Dropbox Update

As a user of Dropbox, I received an update in my e-mail (and you probably did, too) attempting to clarify the recent uproar over their Terms of Service (TOS).  I think they've done a pretty good job of stating their terms in more clear language, and further, of explaining why they need the rights they are claiming through your agreement to use the service.  That said, I still stand by my earlier positions in that they DO have access to your data, and you DO need to evaluate what you choose to store on your Dropbox, and whether the risk of abuse of your data is low enough to feel safe storing it with Dropbox.

Here's a bit of the statement Dropbox released on their blog:

Some of you have written us with very understandable concerns about the legal-sounding parts. In particular, our new TOS talks about the licenses we need to run Dropbox. We want to be 100% clear that you own what you put in your Dropbox. We don’t own your stuff. And the license you give us is really limited. It only allows us to provide the service to you. Nothing else.
  

We think it’s really important that you understand the license. It’s about the permissions you give us to run the service, things like creating public links when you ask us to, allowing you to collaborate with colleagues in shared folders, generating web previews or thumbnails of your files, encrypting files, creating backups… the basic things that make Dropbox safe and easy to use. Services like Google Docs and others do the same thing when they get these permissions (see, for example, section 11.1 of Google’s TOS).
 

We wish we didn’t have to use legal terms at all, but copyright law is complicated and if we don’t get these permissions in writing, we might be putting ourselves in a tough spot down the road. Not to bore you with the details, but please take a look at the license term in the TOS. We think it’s fair and strikes the right balance: “This license is solely to enable us to technically administer, display, and operate the Services.”

They have gone to great lengths to state clearly that under normal circumstances they will not access your data, and that data they collect is to better operate the service.  I'm not a lawyer, I don't know how well that would stand up in court if it were part of a lawsuit, but it does look pretty reassuring when reading it as a layman.  They have not clarified how they deal with potential abuse of your data by individual Dropbox employees.  One would assume they have provision in their terms of employment to deal with that, but the likelihood of abuse is highest from disgruntled (ex-)employees who are likely not concerned with remaining employed by Dropbox, and once your data is exposed, there's no stuffing the genie back into the bottle.

So, Dropbox (and really, all cloud computing services) remain a security risk that you need to evaluate for yourself.  A lot of family history data is probably just fine on Dropbox, especially if it's also posted to online trees such as Ancestry.com or MyHeritage.com as well.  Just be careful of data you wish to remain private.

And I'm still not a fan of the Cloud...


This an all other articles on this blog are © copyright 2011 by Daniel G. Dillman

Dropbox, Revisited

It would seem the Dropbox issue is ruffling some feathers out there.  Not just in the genealogy blogging world, but in the tech sector as a whole as well.

Some people are reading the news, and pointedly highlighting the phrase, "...to the extent which we think it necessary for the Service."  to justify the whole thing as being necessary to run Dropbox. 

It's not an exclusion of any kind!  The wording is so vague as to be useless.  WHO gets to decide what is necessary for the service?  Which specific employees of Dropbox have access, and how is that controlled?  Is there a two or more person interaction that needs to take place, to place even a small check on access?  Or can a disgruntled employee with a little time on their hands go fishing?  If the access is possible, then it's also possible for that access to be abused.  How does the company work to prevent such abuse?

I'll agree that Dropbox as a company, and even their employees as individuals, do not have time to randomly rummage through everyone's data all the time.  I've been in IT for well over a decade, and I've had administrative access to all manner of data.  I know from experience that I didn't have time to just dig through the president of the college's e-mail, for example.  But had I wanted, or had reason to do it, I could have. What stopped me was my integrity, and training.  It's simply not something I would do.  But I've seen many news reports of where the integrity of people has failed, and they have snooped when in a similar position.  It happens far too often when an employee feels mistreated or undervalued.   It's one reason why many employers will simply pay an IT worker to stay home after they give two weeks' notice - it's better than letting them maintain access to data and possibly abuse the privilege.

The fact remains your data is out of your direct control, and therefore vulnerable to examination and misuse by the third parties you trusted to hold it safe.  For some data, that's of little importance.  But some data we as genealogists gather can be sensitive, such as family medical issues, the data that we don't publish, especially while those described are still alive.

I've never been a fan of Cloud Computing.  It's not Dropbox, specifically, it's that segment of IT  as a   whole that I have issues with.  Data security was one of the things I was educated about, and  trained to deal with, ever since I started in the field.  The whole concept of Cloud Computing, especially Cloud Storage like Dropbox, flies in the face of all of that.    This is just a particular example that highlights why we need to be extremely careful of what we put out there, and how it is controlled and accessed, and by whom.

I'm betting this isn't over...



This an all other articles on this blog are © copyright 2011 by Daniel G. Dillman

Dropbox Warning!

We all know and love Dropbox, the web-based service that lets us share files between our computers using 'Cloud' technology, right?  Just drop your files in the Dropbox folder, and you can access them from any other Dropbox connected computer.  Great concept!

Here's the problem: By using a 'Cloud' service, you essentially allow someone else to hold your data for you, and you are subject to their whims as to what they can do with it.  Previously, Dropbox had a pretty decent statement of how they would hold your data.  It was all supposed to be totally private, not even Dropbox employees could get at it.  Until the US Government demanded some data that Dropbox was holding.  And then it turns out that Dropbox employees could indeed access data if it was necessary, such as to comply with a court order.  Or if some bored, disgruntled employee decided they wanted to snoop.

Now it's worse.  Dropbox just changed their Terms of Service (TOS), and there's some worrisome language in there that essentially assigns full copyright to all of your data to Dropbox: 

'By submitting your stuff to the Services, you grant us (and those we work with to provide the Services) worldwide, non-exclusive, royalty-free, sublicenseable rights to use, copy, distribute, prepare derivative works (such as translations or format conversions) of, perform, or publicly display that stuff to the extent we think it necessary for the Service.'

Oh, and sublicenseable, meaning they can let anyone else use your data as well.   Is that what you signed up for?  Is that okay with you? 

This is one of my biggest problems with 'Cloud Computing'.  It's like handing someone your wallet, and trusting them to just hold it, not let anyone else access it, and not access it themselves.  The pressure is just too great for them to just snoop a little, or give in to demands from others to get access for various reasons.  This has always been my problem with Cloud Computing, but the market was all gung ho with a new buzzword, a new (not really) concept, and a huge marketing push to drive customers.  What providers like about Cloud Computing is that it's portable.  They can build new data centers anywhere it's cheap to do so.  Cost of doing business in Hong Kong getting too high?  Let's move the datacenter to Thailand.  Somewhere that labor and rent is cheap.

Dropbox is very convenient.  But is it worth giving away your data?


This and all other articles on this blog are © copyright 2011 by Daniel G. Dillman

Cloud Genealogy

We hear a lot about "Cloud" computing or services these days.  What does that mean? 

     Cloud computing refers to applications or data storage that is not local to us - meaning it is somewhere out on the Internet.  Why is this called "Cloud" computing?  Well, technical people know that for decades, in network diagrams, computers have been represented by icons, and networks by lines connecting the computer icons.  This works well for documenting a building's computer network, but when you start diagramming many buildings or even the entire Internet, the connections get to be too complicated to diagram exactly. 

     In the case of the Internet itself, it gets more complicated in that the infrastructure of the Internet is designed to be flexible in the exact network paths data can take to get from you to your destination and back.  This makes the Internet very robust as a delivery mechanism, in that it can (and is specifically designed to) route around a damaged or very slow section by using an alternate route, transparently.  It makes diagramming very difficult, as paths can change rapidly, even many times per second.  So, to represent that uncertain path, network diagrams have traditionally used a cloud-like symbol to signify the Internet.

Cloud network diagram.  Source: Wikipedia

     So, Cloud computing or storage refers to applications or storage that resides "in the cloud" out on the Internet.  Why would we want to do that?  Well, "cloud" providers are able to set up large datacenters to host all of this, which allows them to offer services at very low cost due to economies of scale.  Also, cloud storage is off-site, which is an appealing thing for backing up data in that if your location gets hit with a large-scale disaster such as a hurricane or earthquake, your data is still safe in a remote datacenter location, able to be restored.  Also, these services have staff who can maintain your server or data storage, freeing you from the responsibility of doing so.

     Okay, so this Cloud stuff sounds pretty good!  Why doesn't everyone do this?  Well, last week's Blogger outage is one example.  If you hosted your blog on your own server at your house or office, you would never have known there was a problem blogging.  If you own a Sony Playstation game console, you're probably aware that the Playstation Network has been down for nearly a month!  Just because something is hosted in a datacenter does not mean it's immune to failure.  Most have many redundancies built-in to try to minimize down-time, but nothing is foolproof, right?  Major power outages have been known to take datacenters offline.  Communications lines have been cut, both intentionally and unintentionally.  Human error has also caused major problems as well. 

     Okay, so cloud services have issues, too.  But right now, "Cloud Computing" is a hot buzzword in the IT industry.  All of the consultants are pushing everyone to put their data and hosting in the cloud.  In fact, they often encourage businesses to outsource their IT needs to the cloud.  It's so much cheaper to host a company's IT needs in the cloud than to hire a staff of IT guys to build and maintain your own, they say.  And they might be right, except that what happens when the cloud fails?  Your business goes right along with it, and you have no way to operate until the cloud is back online.  If you host your own servers on-site, you at least have access to immediately work on repairing or replacing the failed equipment.  At the very least, you probably need a minimal IT staff on-site to maintain the local network infrastructure and computers.  Cloud computing services don't deal with the equipment on your premises.  In the cloud, you have to trust that the hosting provider will be diligent in getting you back online ASAP.  Since their contracts usually specify some level of service guarantee, they usually try pretty hard to keep you online, or get you back up quickly, as their reputation and business live or die by that ability to keep you working.

     There's another downside to Cloud Computing: bandwidth.  If your storage is all out in the cloud, there has to be a way to get the data to and from that storage.  That's your Internet connection.  Is it fast enough to handle the load?  Does your Internet Service Provider place a cap on the amount of data you can send and receive in a month?  With the ever-increasing size of our data files these days, this is an important consideration.  If your data is local, it's not an issue as your network is much faster than the Internet, and you have no imposed limit on how much you can use it. 

     Are these downsides enough to rule out cloud storage?  For some, it might be.  For the average blogger?  Not really.  Even many businesses find these negatives are more than offset by lowered costs of operation, or ability to get hosting by someone with the knowledge and staff to properly maintain it.  It tends to work better for small businesses that can't afford an IT staff with the variety of knowledge needed in today's business world.  Large corporations will tend to maintain their own network servers and storage in-house, as they prefer the immediacy of having the data on-site and have the staff to dedicate to keeping it running.  Whether a cloud model works for your situation or not will depend on many factors which you will have to weigh carefully before committing to one method or the other, or even a combination.  Just consider carefully, and don't be pushed into the cloud because some sales guy said it was all the rage and the perfect solution, because as recent events have shown, Cloud Computing isn't perfect!

Friday Fun

We genealogy buffs tend to be a wordy bunch, and that is nowhere more apparent than on genealogy blogs such as this one.  Blogs give us a forum where we can show off our finds, discuss tools and tips, ponder deeper issues of family and history, etc.  Some of us go on at great length in... okay, I'll get to the point of this post.

We typically use a lot of words.  But what if we were constrained in length?  For instance, Twitter imposes a 140 character limit per tweet, similar to texting.  How would you discuss genealogy in such a limited space?  Strangely enough, it was a tweet (a Twitter message) from @MyHeritage (Twitter user names are preceded by the "@" symbol) that made me aware of the fun little web gadget I'm bringing you today.  You may have seen blogs that include a 'Labels' listing.  This blog does, down on the right side.  It lists the labels we bloggers add to our entries to try to make them searchable, and to give some quick idea of the content of the article.  Blogger's Labels widget is fairly primitive in that it doesn't give much option for the format of the output.  A website called Wordle has take the concept much further.  Wordle lets you point at any blog or website and it will generate a 'label cloud' from the words it finds, varying the size of the words by frequency of use, and making interesting shapes of the output.  It also uses a variety of fonts and colors to spice it up further.  Even better, you can manually tweak a number of settings and it will rework the label cloud for you until you have something you like.  As of just prior to this post, my cloud looks something like this:

I encourage you to try Wordle and see what it makes of your favorite blog.  Now that I've written all of that, I'm getting little bells in my head that this may also have been covered by Thomas McEntee over at Geneabloggers.  This is probably the case, as I've found his blog to be very helpful and influential in getting my own blog off the ground.  You should probably go read his, too! 

Have a great weekend!