tjosten

Finding my app's website on this made me giggle :)

The landing page looks nice and clean. But even if I wanted to try and use your SaaS, I couldn't responsibly do so: Your privacy policy does not comply to the GDPR, and I cannot find any information about the person or company providing this service.

Also, from your Terms of Service:

>If you have any questions about these Terms of Service, please contact us at [email protected].

This makes it look like you have just been using a pre-made template (or even software?) to launch your SaaS.

Just letting you know; Dropshare is now compatible with Horizon.

Glad to see Dropshare (my app) as an example for data ownership here. :)

While we had our own cloud storage provider for a while, Dropshare was always about "bring your own storage", because I sincerely believe in the importance of "owning your data". The first supported storage provider in the app 10 years ago was SCP over SSH (basically "bring your own server").

Simply put, lack of time maintaining it. It was rather a weekend-hack than a polished product.

Hi there,

Dropshare developer here.

I’d like to quickly clarify that the initial statements are untrue. The Webserver is used as communication bridge between the Share Extension and the app. It only accepts requests with a signature. It cannot delete, share or else manage any uploaded files, and has no code that could potentially cause any harm on your server (e.g. by executing things). It only accepts file urls from your local machine to be uploaded and again, only with a properly signed request.

It is unfair to compare this to the Zoom case since there is no potential vulnerability and other than you explain, there is no danger involved with someone making damage to files on your server or whatsoever.

Best, Timo

P.S.: Of course in case you think you did find indeed a vulnerability I am not aware of, please get in touch via [email protected] according to responsible disclosure.

The link in the footer has just been added and wasn't there when I wrote my comment.

How can a website / service be operated in 2015 without any contact or legal information? How am I supposed to use this for my personal information without being able to read the privacy statements or knowing who's operating the service to what purpose?

Edit: To make the reason for my comment clear, there was no link in the footer like there is now at the time I wrote it.

/sign