Dropbox, Sierra, and iCloud: your data is at risk

Note: this article has been updated as of 1 December 2016: please read my update for the latest situation.

With recent revelations of how it abused an internal database in OS X, we expected Dropbox to have some problems when macOS Sierra blocks that misbehaviour. However, early indications are that Dropbox is not getting on so well with Sierra in other ways, and has a bug which can lose your documents.

The Accessibility issue

As I explained previously, Dropbox software ‘hacks’ the Accessibility database in a very suspicious way, in order to give it access to your Mac. Phil Stokes has confirmed that Sierra blocks this by putting that database within SIP protection.

The latest update to Dropbox now apparently copes with this in its stride, and behaves better: when installing Dropbox, it now asks your permission to obtain Accessibility, which is what it should have done all the way along.

Dropbox and iCloud

If you use iCloud to sync folders which are also used with Dropbox, then you will see spurious error messages and/or confusing sync icons on dropbox. Dropbox describes these and its other Sierra woes here, and blames Apple for the way that it “has implemented iCloud”.

Dropbox’s advised solution is to update to the latest version of the Dropbox software, to move Dropbox back to its default location, rather than in the Desktop or Documents folder, and to disable iCloud notifications. The latter of course disables all notifications from iCloud, not just those concerning its conflicts with Dropbox.

Dropbox insists that, if you do negotiate this maze of spurious errors, glitches, and farts, at the end Dropbox still works fine under Sierra. However, Dropbox “does not currently support a configuration where both iCloud and Dropbox sync the same files.” And it is here – where you might think that you will get the belt and braces of two excellent cloud services to store precious documents – where that added safety could prove disastrous, thanks to a toxic interaction.

The serious bug

Dropbox assures us that “iCloud will not sync or delete Dropbox files if Dropbox is in its default configuration.” The implication is that the user can configure Dropbox in such a way that iCloud will sync or delete Dropbox files, and sure enough this is what is admitted:

However, if all of the following are true for your configuration, then you could potentially lose data on Dropbox:

    • You name your Dropbox folder something other than “Dropbox” (for example “Dropbox 1”), and
    • Your Dropbox folder is saved in a non-default location (the Desktop or Documents folder), and
    • iCloud syncing is on, and
    • iCloud Optimized Storage is enabled.

 

If all four of those are true – something which the latest version of Dropbox will allow, and will not warn you of any danger – then iCloud may replace local copies of files with stubs, with the extension .icloud. If Dropbox is syncing the same files, then it will sync the original file removal and the .icloud representation of the file.

If you think you may have lost any data from this, contact Dropbox support soonest, so they can help you recover it, if possible.

Workaround and fix

This is an extraordinary and serious bug to come to light on the day of Sierra’s release, and demonstrates (yet again) inadequate testing on the part of Dropbox and Apple. Although the circumstances which result in data loss are not common, Dropbox is hugely popular, and a large number of those upgrading to Sierra will be using it.

This bug needs to be fixed within a matter of days, at most.

If you have upgraded to Sierra or intend doing so before Dropbox fixes this problem, then check with great care that your installation does not meet the four criteria above. Simply ensure that your Dropbox is named Dropbox, and that it is saved in the default location. You should then be able to use Sierra’s iCloud features, but noting that there are still other conflicts between Dropbox and iCloud.

You should also perhaps decide whether to use Dropbox or iCloud to sync documents, rather than expecting that using both will be safer: in some circumstances, using both will ironically result in data loss.