Dropbox Syncing Problems

Looking at the /frontview/bin/fvdropbox binary, it uses the curl library to call dropbox.com APIs directly. Maybe there is an atomic timestamp issue, that it thinks the remote files are newer, so it downloads them again each time the service starts. It then uses inotify to find changed files, and upload them.

(r2d2, nothing confidential here. I used the 'strings' command (binutils package), which shows ascii text in binaries.)

# strings /frontview/bin/fvdropbox
DropBox utitlity and sync server
This probram use 'parson' (a light json parser and reader) by Krzysztof Gabls, under MIT license.
See http://kgabis.github.com/parson/ for 'parson'.
  # %s -h                           ... show this help
  # %s [-v 0..3]                    ... start service
  # %s [-v n] [-V] [-d]             ... start service
  # %s [-v n] [-V] -- cmd args...   ... run utility command
    -v n ... verbose. n=0..3.
    -d   ... debug service without started by systemd
    info ... Get user info. (call /account/info API.)
      ... File listing. (call /metadata API.)
    put [-f] local_path remote_path
      ... Upload file. (call /file_put API.) (Up to 150MB)
         -f :  forces update. otherwise update if newer.
    get [-f] remote_path local_path
      ... Download file. (call /files (GET) API.)
         -f :  force download. otherwise download if newer.
    sync [-c cursor] remote_folder local_folder
      ... Download all if newer. Then upload all if newer.
      ... Get file/directory info. (call /metadata API.)
         -l :  with list=true (default: list=false)
    upload [-f] local_path remote_path
      ... Upload file. (call /chunked_upload API.)
      ... Create a folder (call /create_folder API.)
      ... Delte folder or file (call /delete API.)
This program should be started by systemd.

# /frontview/bin/fvdropbox -v 2 -V -d -- info
display_name=my name
quota=24561844224
email=my@email.addr

If you change the "-v 2" to "-v 3", you can see all the debug values. Scary that they don't verify the SSL certificate either, someone could hijack api.dropbox.com via DNS cache poisoning, and get your info. They call HTTPS with plaintext oauth secret key in the URL.

dbox_utils.c:84(debug) [curl]* 	 SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
box_utils.c:84(debug) [curl]< GET /1/account/info?oauth_consumer_key=REDACTED&oauth_token=REDACTED&oauth_signature_method=PLAINTEXT&oauth_signature=REDACTED&oauth_timestamp=REDACTED&oauth_nonce=REDACTED HTTP/1.1

Maybe this 'mode' could be changed to become a one-way push to dropbox, not bi-directional.

# cat /etc/frontview/dropbox/config.xml 
<DropBoxConfiguration xmlns="urn:netgear:nas:readynasd" mode="bidir">
  <ShareId><![CDATA[data/readydrop]]></ShareId>