Hacker News Reader

Comment by gcv | Hacker News Reader

Suppose I'm on a team with Alice, and I share a folder with her. Bob is not on our team. Alice can share one of my folders with Bob without my consent. This is a problem (consider dealing with temporary employees, contractors, and so on).

In addition, some teams really need separation of knowledge. Perhaps I have some financial or contract files which most of my employees should not read, but I want to share them with my accountant and my lawyer. This feature reeks of "enterpriseyness", so I understand that Dropbox probably doesn't want to deal with it, but it is valuable to small businesses as well.

View on HN

And if you were using paper Alice could photocopy the document and hand it Bob. The answer to this problem is Alice needs to know who this information can and cannot be shared with. If she isn't capable of that these permissions won't help anyways.

There is a difference between the effort of photocopying individual documents and sending them along one by one, and getting them automatically synced to my competitors.

Just because an employee can copy out all files does not make it acceptable for software to re-share out confidential data without so much as sending a notification to the owner. There's no such thing as perfect security, but raising the bar and making malicious behavior more difficult is not a bad thing, especially when it improves the UX.

Dropbox is in the business of enabling stuff, not disabling malicious behaviour (or making it more difficult or whatever).

Specifically, if someone has malicious intent, software is not likely to stop them.

You can't solve people problems with software is a often used mantra.

If Alice wants to, she can always copy the file out of the team's dropbox folder and email it to Bob.

… or copy it to her personal Dropbox, then share that folder with Bob. It would probably be superfast because of Dropbox’s deduplication.

It's not as simple as that.

Sure, she can do that if all she wants to do is copy it once.

But what if the folder's contents are frequently being changed and she wants to keep Bob abreast of them? If files in it are being changed, and new ones are added?

Then she has to make the effort to track changes and repeatedly email them to Bob.

It's a matter of the amount of friction involved, and there can be a big difference in friction between being able to share-by-copy things and just giving access to the folder.

Does this mean Bob would be able to alter documents you never explicitly shared with him?

Yes, Bob has full access. Dropbox does not support read-only sharing.

The nightmare scenario is: (1) Alice re-shares my folder with Bob, and I don't know about it. (2) I don't have the "preserve modifications infinitely" option turned on in my Dropbox account. (3) Bob starts to make malicious changes to my files. (4) I discover this more than 30 days later, which means I can't recover the original files.

Reply on news.ycombinator.com