The real WTF in that article is the trace of DropBox issuing calls to its API over HTTP instead of HTTPS.