Comment by bell-cot | Hacker News Reader

Comment by bell-cot | Hacker News Reader

Reminds me of an incident we had with Dropbox a decade ago. They deleted some niche accounting software (custom developed by us) from our Dropbox account, plus their own log files covering those deletions. Then played ignorant.

We learned the lesson, and never again trusted Dropbox, for anything.

(Best guess - a would-be client got pissed when software which they'd never paid for lacked a feature, and told Dropbox a story.)

EDIT: Only executables & related distribution files were on Dropbox, not any source code. We lost nothing...except our trust in Dropbox.

EDIT2: Yes, as several others have kinda pointed out, this incident was a collision between (a) naive human expectations (of high-skill, high-touch, highly-invested customer service for such situations) and (b) the actual business model of any huge / cheap or free / convenient cloud provider of X (plus just "internet reality"). Sadly, I don't see that either (a) or (b) has changed in the past decade.

> plus their own log files covering those deletions

This is the really unreasonable part. Some convoluted internal process that ends up accidentally flagging a file as suspicious and then deleting it is bad enough, but still partially understandable if you're very conservative with assigning blame. But deleting the log files? Either extreme technical incompetence or plain malice.

Our assumption: Log files of everything still existed, but were flagged "Hide & Never Admit To, per $SecretReason".

Hanlon's razor:

At dropbox's scale, guaranteed logfile durability is expensive, and retaining them indefinitely even more so.

They either got auto-deleted or they were never there in the first place.

I agree with Hanlon, but the size for basic audit ability is pretty small. Fileid, action, date, actorID. Maybe a bit more nice to haves. If it’s expensive store it for a couple weeks before archiving to cold storage.

Here’s another Hanlon, it wasn’t Dropbox that deleted the files it was an authorized user, OP or coworker, accidentally who forgot or wouldn’t fess up

Sadly this story could have happened with any big cloud provider.

Ideally there would be more regulation around the ability of big tech companies to shutdown your digital life through a mindless algorithm, with close to zero recourse. Unfortunately I don’t see anything happening unless someone really powerful (say a member of Congress) gets bitten by this.

The solution to this in my mind is self-hosting. Yes, right now that's the exclusive domain of tech nerds, but in theory there's no reason that an open source project can't come along and make this relatively easy for non-techies to set up for themselves (in a similar way to how, say, Squarespace made website creation easy).

I think the real hurdle in adoption would be that most non-techies don't even register their dependence on big cloud providers as a problem yet. But I expect the day is coming. Similar to how Mastodon saw an influx of Twitter users when Musk announced he was intending to buy Twitter.

Filecoin and IPFS?

SyncThing is actually really good. The main issue is integrations. A lot of mobile apps work with Dropbox but not with decent FOSS alternatives.

Syncthing also has untrusted hosts support now: you can sync your files to a host you don't trust, and it keeps them encrypted on the destination.

Very cool. Looks like it's currently marked beta/testing.

The main issue is you can accidentally nuke your own source directory and it's possible to do so in non-obvious ways. This has happened to me a few times (though thankfully had backups elsewhere).

SyncThing comes with a built-in feature to keep the last n versions of files around[1], for added peace of mind.

https://docs.syncthing.net/users/versioning.html

It only works though if you dedicate a separate server for sync.

I don't think it is something that needs legislation.

But it definitely needs more publicity. And if there is something that will bring down "big tech", I think that's it.

"cloud providers" should be treated like something that can fail. We already don't trust hard drives, that's why we have RAID, we don't even trust RAID arrays, that's why we have backups, and we don't trust the place where backups are stored, that's why we have off-site backups. Dropbox (and Microsoft, Google, etc...) is also not to be trusted, just like your hard drive can crash or your servers can catch fire, Dropbox can delete your data. It is not the same mechanism (one is a chemical reaction, the other is a mindless algorithm), but the end result is the same: you lose your data.

But once you take that into account, the value proposition of big cloud providers takes a hit. Often, big companies justify the premium price they ask with reliability. I mean, no one expects companies like Microsoft to go bankrupt anytime soon, and they certainly know about backups and redundancy, but what's the point if all it takes for your data to disappear is an artificial brain fart. Suddenly, the server in your basement doesn't look so bad in comparison, and neither are the smaller companies that actually have people you can talk to.

>> "cloud providers" should be treated like something that can fail. We already don't trust hard drives, that's why we have RAID

"Can fail" is certainly true, just like a hard drive can fail.

But we'd all be rightfully upset if someone at Western Digital decided to some to our home and proactively delete files from our HDD.

> I don't think it is something that needs legislation

Why not?

Something like this definitely needs legislation.

The whole concept of ToS needs to be overhauled with vast amounts of practice that is currently considered acceptable thrown right in the fucking trash.

The idea that companies can change their ToS on a whim every day and push out walls of text that no one reads and everyone clicks through is insane. Why can't we modify the terms of agreement?

Let's start with that law, all ToS interfaces must include an interface for users to upload their own modifications and companies must have a human interpret them (not some shitty 'ai') and decide to accept them in a reasonable time frame, and if the company chooses to decline them they cannot ban the user from the service for this, the last ToS that they accepted must be the one that their interaction with the customer is conducted under. The entire process must be auditable by other by both sides and a neutral third party.

I'm sick of big companies hiding behind an opaque wall of bullshit, if this was a small town dispute between two individuals this would be transparently settled one way or another and that's exactly how it should be on the internet.

The laws haven't kept up with the times, and they haven't kept up with the creative ways people with money try to fuck over those without.

There is no need to read them. Every single terms of service ever written can be summarized as follows:

> you have no rights

> you promise not to try and exercise any right you think you have

> you will not do anything the company doesn't like

> the company can do anything it wants whether you like it or not

> the company is not responsible for anything ever

> the company makes absolutely no guarantees about anything

> If you ever get it in your silly little head that you do have rights, you agree to binding arbitration with the firm we pay

More simply “to the extent permitted by law, you agree that you waive all your rights and we waive all of our responsibilities.”

+1...but don't expect "$VVVIP bitten by this..." to change anything. Big cloud providers doubtless have Secret VIP Customer Service departments, to avoid that problem.

I've got 776 gigs of pirated TV in my Dropbox. Am I in danger?

in a number of ways yes, depending on the amount of 3rd party attention devoted to the files, in my neck of the woods a 1 terabyte drive is worth ~ 100$

That's very expensive. Where do you live?

somewhat north...

It's cheaper than 1 year of dropbox.

I think Box's KeySafe[1] prevents their ability to see into your files --not entirely sure, but according to their description of it, seems so.

[1]https://blog.box.com/introducing-box-keysafe

Surely a Dropbox upload wasn‘t the only version you had. Couldn‘t you restore easily?

You'd be amazed that folks even today misunderstand it to be a 'backup' instead of a sync service.

It is a backup. Any copy of your data is a backup. It just shouldn't be the only backup (obviously, like any backup.)

A copy of your data that can be easily modified (whether through bugs, malice, or even just you mistakenly deleting a file and Dropbox happily deleting it everywhere for you) is not a backup. It’s definitely way better than nothing, but people relying on Dropbox as the only “backup” will be in for nasty surprises occasionally.

Any backup which is the lone backup isn’t a backup at all.

Yeah: two is one, one is none.

All backups are vulnerable to deletion, loss, or corruption. That’s why you have many. Dropbox is no different.

Dropbox calls it a backup service:

https://www.dropbox.com/backup

The backup you can't trust!

This should be their slogan.

> The backup you can't trust!

In isolation that’s all backups.

True.

Dropbox Backup is not Dropbox the file sync app. See here: https://www.dropbox.com/backup#dropbox-backup-plan

It is included and turned on by default for any of the paid plans: https://www.dropbox.com/plans

In practice it basically just means 30 day recovery for any modifications/deletions.

I used to work there FWIW. Internally it's certainly considered a backup solution for customers.

To be fair, they didn't say it was the only copy they had.

Aren't the files still on the computers that Dropbox synced to?

Deleting files from Dropbox's servers, that's fine, deleting files from my computer that I uploaded to Dropbox, that's bad.

> Aren't the files still on the computers that Dropbox synced to?

Not if “smart sync” is enabled on the folder.

https://help.dropbox.com/installs-integrations/sync-uploads/...

OneDrive recently switched to cloud stored and you have to jump through hoops to make it so you have a local copy of everything.

Files that are stored in iCloud Documents will also not be backed up by Time Machine. Huge mess if you ask me. I therefore don't use iCloud Cloud storage anymore. It's just too complicated to reason about.

Source: https://eclecticlight.co/2022/02/21/can-you-back-up-icloud-d...

Reply on news.ycombinator.com