Dropbox responds to accusations its Mac desktop client hacks OS X security(techcrunch.com)
techcrunch.com
Dropbox responds to accusations its Mac desktop client hacks OS X security
https://techcrunch.com/2016/09/09/dropbox-responds-to-accusations-its-mac-desktop-client-hacks-os-x-security/
48 comments
I'm assuming TechCrunch contacted Mr Newhouse to verify that he wrote that HN response, so he did tell TechCrunch. It would be a bigger journalistic problem if they didn't verify with Mr Newhouse and just took text from some commenter purporting to be Mr Newhouse.
Or that he gave that statement to TechCrunch prior to posting it on HN. It appears there's just a 3 hour time difference between his HN post and the TC story being published.
It still doesn't count as "told TechCrunch".
Would it count if he then repeated the words as well? What are you looking for ?
> What are you looking for ?
Probably for TechCrunch to use a term like "said" instead of involving themselves after the fact.
Probably for TechCrunch to use a term like "said" instead of involving themselves after the fact.
Ben Newhouse will 100% have had to get clearance from Dropbox management for a statement like that. So if that's the line that management has agreed, it's not really surprising that the same statement is given to other outlets too.
So whether this is just the HN comment copy/pasted or if they followed up, I don't care. There are much bigger issues in tech journalism to worry about.
Even more concerning is the actual response.
Basically the comments on the earlier HN thread and then the quotes on the article show their point of view being that what they did isn't a problem, just that they got found out and it paints them in a justifiably negative light.
This is one of the exact reasons why I very much prefer to get apps from the Mac App Store: Sandbox enforced; No setuid; No privilege escalation; No futzing with the OS UI.
Even more concerning is the actual response.
Basically the comments on the earlier HN thread and then the quotes on the article show their point of view being that what they did isn't a problem, just that they got found out and it paints them in a justifiably negative light.
This is one of the exact reasons why I very much prefer to get apps from the Mac App Store: Sandbox enforced; No setuid; No privilege escalation; No futzing with the OS UI.
Tomorrow: TechCrunch responds to accusations of copying from Hacker News and calling it "Mr. X told us"
I actually think Ben just told TC the same as he told us, so no foul play by TC or anything. They're just not reporting anything new at all.
I actually think Ben just told TC the same as he told us, so no foul play by TC or anything. They're just not reporting anything new at all.
"However, the company’s justification for utilizing the Accessibility route to gain root access did little to impress some critics."
That.. no. They use root to gain access to Accessibility!
That.. no. They use root to gain access to Accessibility!
«[...] Dropbox’s Ben Newhouse, from its desktop client team, told TechCrunch.»
He wrote this on HN..
He wrote this on HN..
Not so bad, actually. At least Dropbox has commented on it and is ideally working on making some improvements. Plus, a big tech site has picked up on the story, so a lot more people are aware of it now. And finally, it looks like HN played a role in raising this issue.
Still not an ideal situation, but could have been worse.
Still not an ideal situation, but could have been worse.
Hanlon's razor, gents. Maybe Ben just sent TechCrunch the exact message he posted here.
Please stop with the razors. Someone will get cut.
[deleted]
Sounds like more or less nobody at Dropbox knew how that stuff was getting done either.
Modern-day tech journalism: cut and paste together some quotes from Hacker News comments.
https://news.ycombinator.com/item?id=12464730
https://news.ycombinator.com/item?id=12464730
I'd love to hear what exactly folks consider to be wrong with that.
I've seen this sort of criticism in a few places before, but especially in cases such as this where someone from the company responded and talked of making change, being on top of happenings like this seems like a reasonable thing to do.
It certainly seems better than the old 'ask random people for their opinion' approach of conventional huge media.
I'm struggling to find links to posts about this, but it's not too hard to point to cases, both mentioned online and through my friends, where utterly unqualified opinions were sourced based on journalists using indicators like 'owning a domain name' as proof of a person's authority on a topic.
Edit: at least on HN and social media you can verify the full text of what someone said after the fact and oftentimes even look up their background!
I've seen this sort of criticism in a few places before, but especially in cases such as this where someone from the company responded and talked of making change, being on top of happenings like this seems like a reasonable thing to do.
It certainly seems better than the old 'ask random people for their opinion' approach of conventional huge media.
I'm struggling to find links to posts about this, but it's not too hard to point to cases, both mentioned online and through my friends, where utterly unqualified opinions were sourced based on journalists using indicators like 'owning a domain name' as proof of a person's authority on a topic.
Edit: at least on HN and social media you can verify the full text of what someone said after the fact and oftentimes even look up their background!
Well, as a commenter above points out, Ben didn't "tell TechCrunch", but posted a comment here. It would be far more reasonable to, after seeing a comment by X here addressing important topic Y, the news outlet contacted X about Y, and wrote something about that exchange. Not just copying the comment and making it look as some exchange.
It /was/ an exchange, between the folks the article mentions it was between.
Completely agree with the sibling commenter and you about 'told TechCrunch'.
Yours and the sibling comments most-all refer to this point, so just replying once to that - yes certainly misrepresentation is bad, but copy/pasting comments together from Hacker News need not be, as the grandparent poster suggested. Dismissing it as 'modern journalism' with the snide comment in the grandparent post was just lazy.
Completely agree with the sibling commenter and you about 'told TechCrunch'.
Yours and the sibling comments most-all refer to this point, so just replying once to that - yes certainly misrepresentation is bad, but copy/pasting comments together from Hacker News need not be, as the grandparent poster suggested. Dismissing it as 'modern journalism' with the snide comment in the grandparent post was just lazy.
I'd love to hear what exactly folks consider to be wrong with that.
Ben Newhouse's answer left quite a few questions open. How about poking him or Dropbox a bit more? For instance, competing products (OneDrive, Resilio Sync, etc.) provide similar functionality without placing SUID 'backdoors'. Given that OneDrive's client is distributed via the app store, I'd guess that it even uses OS X sandboxing.
What about asking a security expert (or perhaps Apple) to comment?
A good journalist doesn't just literally relay information, but provides context/interpretation.
(Of course, it's in TC's right to do this, but it doesn't add much to the conversation.)
Ben Newhouse's answer left quite a few questions open. How about poking him or Dropbox a bit more? For instance, competing products (OneDrive, Resilio Sync, etc.) provide similar functionality without placing SUID 'backdoors'. Given that OneDrive's client is distributed via the app store, I'd guess that it even uses OS X sandboxing.
What about asking a security expert (or perhaps Apple) to comment?
A good journalist doesn't just literally relay information, but provides context/interpretation.
(Of course, it's in TC's right to do this, but it doesn't add much to the conversation.)
All valid points, although perhaps it's more in their interest to publish soon/rapidly/without dedicating much effort to every post that they put out?
What you're describing may be in line with what we expect from conventional journalists, but media put out starting at once a day is a different medium with different constraints, is it not? Don't the even faster media forms (intra-day news on TV, radio) have more people on board to help make that process happen quickly?
What you're describing may be in line with what we expect from conventional journalists, but media put out starting at once a day is a different medium with different constraints, is it not? Don't the even faster media forms (intra-day news on TV, radio) have more people on board to help make that process happen quickly?
I thought that Tech Crunch was "social blog"? So of course there won't be any real journalists there.
Not much wrong at all with quoting a comment or twitter (maybe it's lazy).
Misrepresenting those quotes as a direct discussion? Horrible, because it is misrepresentation.
It seems pretty likely that TechCrunch reached out and confirmed the comments though, so that wouldn't be a misrepresentation.
Misrepresenting those quotes as a direct discussion? Horrible, because it is misrepresentation.
It seems pretty likely that TechCrunch reached out and confirmed the comments though, so that wouldn't be a misrepresentation.
> Edit: at least on HN and social media you can verify the full text of what someone said after the fact
Anyone else seeing humour in putting this statement in an edit that was not in the original post?
Anyone else seeing humour in putting this statement in an edit that was not in the original post?
Haha quite. :) Was going to comment on that but left it out.
Nonetheless the internet is still dramatically better at preserving originals [1] than exchanges between journalists and individuals. Aren't journalists notorious for misrepresenting what people say in those exchanges? Whether there's any accuracy to that or not we can't tell, because of that lack of permanence in many such cases (modulo voice recorders).
[1]: See for example the various deleted Tweet archives.
Nonetheless the internet is still dramatically better at preserving originals [1] than exchanges between journalists and individuals. Aren't journalists notorious for misrepresenting what people say in those exchanges? Whether there's any accuracy to that or not we can't tell, because of that lack of permanence in many such cases (modulo voice recorders).
[1]: See for example the various deleted Tweet archives.
The haphazard stringing of comments leaves a pretty mixed-up message about what the actual issue is. There's no coherent overview of what is going on by TechCrunch. The traditional "ask random people" part comes after the explanatory segment, which makes it much less of a problem.
Admittedly it's the fourth paragraph, but this is an overview:
> ... while allegations that Dropbox was creating a spoof dialogue box to phish users’ passwords proved to be incorrect, critics continued to slate its implementation of an official OS X security dialogue box that they said appeared designed to mislead users into handing over their admin passwords in order to grant Dropbox root access to the system via the Mac’s Accessibility permissions list.
It's an awful overview, for sure, but it is present.
Similarly, the 'ask random people' part in the article /does/ come after the explanatory segment. It's just that the explanatory segment quotes HN comments /from the company being talked about/ and isn't very good. ;)
> ... while allegations that Dropbox was creating a spoof dialogue box to phish users’ passwords proved to be incorrect, critics continued to slate its implementation of an official OS X security dialogue box that they said appeared designed to mislead users into handing over their admin passwords in order to grant Dropbox root access to the system via the Mac’s Accessibility permissions list.
It's an awful overview, for sure, but it is present.
Similarly, the 'ask random people' part in the article /does/ come after the explanatory segment. It's just that the explanatory segment quotes HN comments /from the company being talked about/ and isn't very good. ;)
it's highly misleading to quote someone saying "told TechCrunch" rather that citing actual context for the quote. Misattributing like this implies a stronger and more deliberate relationship between the information source and journalist than actually existed.
>Modern-day tech journalism: cut and paste together some quotes from Hacker News comments.
What people seem to be oblivious to is that "modern day journalism" also brings in much much less than "old day journalism" did -- and it's the masses who cause this, since they don't seem to particularly care to pay for content of higher quality, and ad revenue is not that big to compensate.
So don't expect competent fact-checking departments (if they exist at all), journalists paid to follow a story for weeks or even days, and other such niceties in 2016.
The same goes for people who invariantly ask online outlets "don't you have editors" etc for typos and such.
Don't these people know that even traditional media like newspapers have been dropping most of their editors and proof-checkers? Tons of online media often have none at all, or just one or a couple to handle tons of posts per day.
What people seem to be oblivious to is that "modern day journalism" also brings in much much less than "old day journalism" did -- and it's the masses who cause this, since they don't seem to particularly care to pay for content of higher quality, and ad revenue is not that big to compensate.
So don't expect competent fact-checking departments (if they exist at all), journalists paid to follow a story for weeks or even days, and other such niceties in 2016.
The same goes for people who invariantly ask online outlets "don't you have editors" etc for typos and such.
Don't these people know that even traditional media like newspapers have been dropping most of their editors and proof-checkers? Tons of online media often have none at all, or just one or a couple to handle tons of posts per day.
Why is it always an external failure rather than an internal one whenever a media outlet of some kind screws up?
We can't follow the most basic of journalism standards? Can't afford it, sorry.
We told an outright lie? We couldn't hire fact checkers, sorry.
Our front page is covered in low-quality clickbait trash? Nobody wants to pay for news, sorry.
This kind of blameshifting comes off very familiar to anyone who's heard large movie/music companies blaming their marketing/promotion/quality failures on piracy.
We can't follow the most basic of journalism standards? Can't afford it, sorry.
We told an outright lie? We couldn't hire fact checkers, sorry.
Our front page is covered in low-quality clickbait trash? Nobody wants to pay for news, sorry.
This kind of blameshifting comes off very familiar to anyone who's heard large movie/music companies blaming their marketing/promotion/quality failures on piracy.
>Why is it always an external failure rather than an internal one whenever a media outlet of some kind screws up?
I don't believe that is the case, and the question is not pertinent to (or alluded by) what I wrote so I am not qualified to answer it.
I merely pointed some historical developments behind less good news coverage.
That doesn't absolve anyone of their responsibility -- neither the journalist that puts his name under a bad article, nor the people who are not willing to pay and award good content, but nevertheless complaint for its lack, as if the deserve it by birthright.
In other words: you get what you paid for (and the corollary: you only have a right to complain for what you paid for).
I don't believe that is the case, and the question is not pertinent to (or alluded by) what I wrote so I am not qualified to answer it.
I merely pointed some historical developments behind less good news coverage.
That doesn't absolve anyone of their responsibility -- neither the journalist that puts his name under a bad article, nor the people who are not willing to pay and award good content, but nevertheless complaint for its lack, as if the deserve it by birthright.
In other words: you get what you paid for (and the corollary: you only have a right to complain for what you paid for).
Unfortunately you did it in such a way as to excuse a failure to meet the most basic of the basic expectations as a financial problem, when it's really an ethical problem. As if we have no right to expect someone who calls himself a journalist to hew to standards.
>As if we have no right to expect someone who calls himself a journalist to hew to standards.
We can call them out for not adhering to the standards of the profession, but unless those online mediums make enough to get actual talent (and editors, copy editors, proof readers, fact checkers, etc.) we should not have a realistic expectation of even basic quality from them.
We can call them out for not adhering to the standards of the profession, but unless those online mediums make enough to get actual talent (and editors, copy editors, proof readers, fact checkers, etc.) we should not have a realistic expectation of even basic quality from them.
It's not just tech journalism. I think I've seen the New York Times spin an article whose summary is "Somebody tweeted something".
And yet, here it is on the front page.
TechCrunch, FYI: quoting an HN comment doesn't really count as "told TechCrunch".