capi

Members
  • Posts

    70
  • Joined

  • Last visited

  • Days Won

    1

Posts posted by capi

  1. It has been hinted at by the developers that such ability will be coming to the Enterprise/"Business Grade" edition of Sync

     

    Do bear in mind that "reverse engineering" "the software" (a term that BitTorrent Inc's Legal Dept have confirmed also incorporates "the protocol") is against the Terms of Use

     

     

    The Terms of Use might be invalid in some countries regarding an analysis of the protocol.

  2. I recognize that it is always possible to encrypt files yourself before they are accessed by the Sync client (or even Dropbox or any other file sync provider) in order to neutralize any potential backdoor

     

    That wouldn't solve anything, as you are running it (likely) on the same machine as the data, so if you don't trust the software, you should not run it, as it could do much more behind your backs, running on your system.

  3. I can completely understand that the guys at Bittorrent want to get money out of the project, so I see how they came up with the API key. Maybe it would also really help if they published how they want to monetize the app (which I can completely understand, we are all developers ourselves and want to make money from our work).

  4. Can you also elaborate a little bit on how the API key is verified? Is an Internet connection required when starting up? How would I distribute an Application that uses your API, as I suppose I'm not allowed to ship my API key (as it would be visible to the end-user, who could then use it to do something on his own with my key, etc.)

     

    Any input on this would be very appreciated!

  5. How is the API key checked? Does it require a network connection? Or is it "self-contained" for offline use? How is it intended if one wants to ship an application where sync is integrated, is one allowed to distribute one's API key (which would be readable to every user due to the config file) or would every user need to get their own API key?

     

    Thanks for clarifying!

  6. Is there any information on the "Auto Sleep" functionality. Even if turned on and set to wakeup "never", the notification icon stays with "Running". Does this mean it doesn't go to sleep?

     

    The perfect solution for me would be for the notification icon to either disappear or change the icon and text while in "sleep" mode.

  7. And at least the tracker has all my secrets. How can I trust the tracker?

    As stated very often, the tracker has the SHA2(secret):IP:port, not the secret itself. So an attacker would need to brute-force a SHA2-hash in order to get the real secret. That's actually more unlikely than most username/password combos (which most of the time store also the password as hash, hopefully).