[vetinari]

I always wondered, why do small companies use Dropbox at all?

A 1 TB NAS in RAID-1 by Synology or QNAP will cost you about 400 EUR (including VAT). That's about 9% of what the author of the article paid for some 700 GB in Dropbox. It will do everything that Dropbox does, except you can use standard protocols (SMB, AFS, WebDAV, whatever) and the data will not leave your company.

[gvb]

> and the data will not leave your company.

That is a two-edged sword. The data is also inaccessible outside of your company. There are ways to make it accessible outside the company (VPN, WebDAV over https), but they tend to be complex, fragile, and sometimes unworkable (see next).

> standard protocols (SMB, AFS, WebDAV, whatever)

Support for the standard file sharing protocols (SMB, NFS, I presume AFS, and WebDAV) sucks or doesn't exist on mobile devices.

[vetinari]

Well, every single NAS box offers VPN solution that can be enabled by few clicks (usually OpenVPN).

Also, most NAS vendors provide mobile applications, so you can access the data. They realize, that the standard protocols on mobile devices are lacking.

Anyway, to pay someone to get you such a NAS and configure everything for you is still a fraction of cost, that you would pay for cloud providers.

[smacktoward]

But then you have to worry about keeping that VPN access secure. There's been cases where that's been a problem, like the ransomware attacks on Synology NAS boxes (see http://www.anandtech.com/show/8337/synology-advises-users-of...).

> to pay someone to get you such a NAS and configure everything for you is still a fraction of cost, that you would pay for cloud providers.

Dropbox for Business costs what, $75/month for 5 users? That's less than you'd pay for an hour of a competent person's time.

I'm not a huge fan of Dropbox for several of the reasons that have already been mentioned above (I use SpiderOak myself), but on these specific points they definitely beat the roll-your-own approach.

[vetinari]

That ransomware attacks were on Synology boxes that had their web console exposed to the web. Nothing to worry about when using VPN.

[slantyyz]

>> Nothing to worry about when using VPN.

If you are a services/consulting company and do client work on-site, you often have to sign an agreement from the IT department that prevents you from using a VPN on the client's network. In those cases, your remote workers need web access to files.

[vetinari]

Well, that didn't happen to us.

We have access either to completely separated guest network, where we have to use VPN to both our network and customer network, or access via Citrix or Remote Desktop, where to exchange the files we have to use the built-in file share facility.

[stalcottsmith]

Synology offers mobile apps to access the shares.

[dagw]

It will do everything that Dropbox does

Only after a whole lot of hacking and you'll probably end up having to slap a real server in front of your NAS.

[vetinari]

What would the real server run?

I haven't found anything, that Dropbox does that the NAS doesn't. Maybe there is some marginal function, I don't know. But is that hypothetical marginal function worth the 900% price premium (per year) plus reduced privacy?

[dagw]

How do you do offline syncing and sharing of folders with people outside of your network? Having to manage a bunch of VPN accounts for outside users seems like a major pain and getting them all set up with OpenVPN seems like an even bigger pain.

[vetinari]

We are using IPSEC VPN for external access. It works with standard clients in Windows, OSX, Linux, Android, iOS, whatever.

It allows not only access to files on NAS, but also to webapps on another box and remote desktop on yet another box.

Though I'm thinking about how to configure haproxy to allow Remote Desktop Gateway and https on the single IP, that we have.

[dagw]

Having to manage VPN accounts for everybody I want to share a folder with sounds like a huge pain. Especially if I have to go ask the VPN admin each time. And I'm still curious how you do offline access and syncing to local disk.

[vetinari]

There is no offline access or syncing.

The data is available over gigabit link. It is local, after all. No need to sync to hide the latency.

And after all, there is more data on NAS, that the drive on my notebook can handle. No need to have it all locally.

[moey]

On windows, one can use this:

http://windows.microsoft.com/en-us/windows/working-with-netw...

[zurn]

A NAS box is going to get hacked (X), have backups neglected/misconfigured/misdelegated and then have data accidentally deleted or experience disk crashes, etc. You can improve your chances by investing time and energy on taking good care of it, but even then you can still get bitten.

(X) devices from both vendors you mentioned are pretty frequent victims

[vetinari]

Only devices with services exposed to Internet were hacked. Devices inside LAN, with external access provided by VPN, were not hacked.

This applies to any service or device that you run. NAS is no exception. Your printer could be hacked, if you exposed it to the Net.

Data can be accidentaly deleted anywhere, cloud providers or your own storage. You must make backups anyway.

[zurn]

No, that's 90s thinking. Current methods don't require the boxes/services to be directly internet-addressable.

An exception is when you have a completely isolated LAN that's not serving internet-connected computers. But that's pretty spartan.

[vetinari]

The infections needed to have access to web console (in Synology case, that's port 5000).

Unless you are targeted, that's very difficult to achieve even in slightly secured networks (i.e. every possible toggle in settings is not ON).

When you are targeted, it does not matter, whether you use Synology or Dropbox, the approach is tailored to your situation.

[zurn]

For just one technique, read up on DNS rebinding attacks vs home "routers". Same works against NAS devices.

These devices are so common that it is cost effective to do against a bunch of device+vuln combos in a mass drive-by fashion (served by compromised or shady ad networks or any of the other 100 methods that get you to follow a bad link).

Or there's going to be another taiwanese device or PC compromised on your LAN and it'll automatically portscan & metasploit all your network in 5 minutes.

Also don't think getting "targeted" means you have to be James Bond-special. It can mean someone found a prominent blog they'd like to inject their rogue ads on. Or you pissed someone off online and they got some script kiddies to spend 10 minutes to ruin your day and get their laughs (or $20 in bitcoin).

Dropbox's security guys will detect these after they get used a few times (before they get to you), unlike your taiwanese NAS vendor who will only do something half-assed 2 weeks after it hits the news. Or nothing when it doesn't hit the news, as often happens.

All in all the mindset that you have "LAN" or "intranet" that's a significant security perimeter is outdated even if you're nobody. Don't make a network that's "hard and crunchy on the outside, soft and chewy on the inside".

[vetinari]

Well, it the rebind attacks depends on multiple weak points. Our DNS cache does not allow for external DNS servers to return IP addresses from our internal range. But I guess not everyone's router does that.

But your point is valid.

[slantyyz]

>> I always wondered, why do small companies use Dropbox at all?

For smaller companies who don't want to manage infrastructure, the short answer is time.

* Setting up the NAS.

* Servicing the NAS when a drive fails.

* Setting up a backup for the NAS.

* Supporting people for connections to NAS