How I replaced Dropbox

Updated April 2 at bottom.

My main beef with Dropbox is that it’s not secure, not adequately encrypted, and there’s been a little too much indication that Dropbox is spying on user data.

Ever since I decided to lock down my cyber-life, I had Dropbox in my sights. It was going to be a pain to replace it, I thought, so it took a while before I got around to doing so. I finally did do so today.

The longest step of this process was deciding what I wanted to do. At first, I thought I’d set up my own lightweight cloud server using my desktop, which would sync files on all my devices, something like NextCloud. A great bonus is that this makes it particularly easy to sync things like your address book and passwords. This doesn’t seem like a bad idea and is now my fallback. But I ultimately decided to pass because (a) setup might end up being very bothersome, (b) it might eat up desktop resources, and (c) I’d have to keep my computer on all the time, which seems suboptimal.

All of the problems with installing my own NextCloud—bothersome setup, resources constraints, and always-on system—are taken care of by getting my own server or, less ambitiously, what is called a NAS, or Network-Attached Storage system. I spent several hours yesterday researching all about NASes, and came close to getting either a QNAP or a Synology NAS, because they’re so frickin’ cool. I mean, jeez, it’s actually a fully-functioning standalone web server with a zillion apps (especially Synology), and sure, you can use it to sync your files. But the more I thought about it, the more I thought, “This is a lot of work (and yet another giant attack surface for hackers), when all I really want is a Dropbox replacement.” If I were just hacking and exploring, I would have gotten a NAS in a heartbeat, they’re so cool. But I have other things to do, so…

I also semi-seriously considered getting a zero-knowledge encryption system, like SpiderOak. The premise seems solid: your files are all saved in the cloud, but 100% encrypted, and the key needed to decrypt them is only on your machine (or in your head). SpiderOak (and many other similar services) cannot scan your files because it lacks the keys to read them. I guess my experience with being hacked and seriously disaffected with storing data in the cloud generally turned me off even to this. If I don’t have to trust a company (as I do if, e.g., I want to use a VPN), then I’d prefer not to.

So, how do you get cloud functionality without the cloud? With syncing apps. These use different technologies to sync your devices directly with each other, through the Internet, but not stored on the Internet, and without any one of them acting as a server to the others (so they’re all peers of each other in your little device network). It turns out that there are several options available here, and I came close to going with Syncthing because it’s open source (and therefore, more trustworthy) but…no iPhone app. But the next best thing is Resilio Sync, which is also based on (the UPDATE: closed-source) Bittorrent Sync. Now, the fact that it uses Tor doesn’t mean your data is stored in the dark web. It simply makes use of the Tor network, which is perfectly legal and legit, that is required for accessing the dark web (something I’ve never even tried to do, by the way). The beauty of the system is that in transit through cyberspace, your data is end-to-end encrypted through a decentralized network. It’s hard to get more secure, or that’s my understanding.

Resilio Sync is pretty easy to install if you’re not using Linux. It was a bit of a pain (they could work harder on the setup, I mean really, guys) but still doable, if like me you’re reasonably adept with vague Linux instructions. It didn’t take longer than an hour to completely set up and test (my son did it in half the time), and then I started moving folders over, one by one, from Dropbox to my new Sync folder. This was quite satisfying, not unlike that satisfying feeling of changing my account email addresses from gmail.com to sanger.io. And because Resilio updates via your LAN directly from device to device, it syncs much faster than Dropbox. Like Linux, the slightly geekier alternative turns out to be just better, all the way around.

I got the $100 one-time deal so my family could all use it. Since this is roughly what I’ve been paying to Dropbox yearly for the last decade or whatever it’s been, I was very happy to pay this.

How does it work? Well, once it’s set up, it’s just like Dropbox. Create a new file in your work folder? It’s practically instantly synced to any other devices that are on, as soon as you save it. (Of course, it does have to be on, in order to sync. And your phone won’t sync the file and folder contents; it will only sync the index, and then, as with the Dropbox mobile app, you can download the item one-by-one.)

There is one very small change this might require to your routine. Since your files aren’t in the cloud but only on other machines, before you leave one machine with files on it you might want to access elsewhere, you’ll want to make sure either (a) that machine will stay on while you’re away from it, or (b) you’ve synced before you leave while they’re in close proximity (the LAN connection will make syncing faster, too).

Love it so far. Buh-bye Dropbox! Any regrets so far? Not really. While LAN syncing for me is significantly faster than Dropbox, it uses only 10% of my available LAN bandwidth, and I wasn’t able to get it to go faster; I’m not sure what’s up with that. I tried to fix it but didn’t dare do too much, since it involved a lot of fiddly changes to settings that, it seems, need to be undone. Your mileage may vary.

Also, they didn’t make Linux GUI other than a browser-based one, which is OK; it works well enough. They didn’t even bother to create a tray icon, but they do have an API, so my 12-year-old son made one for them and I’m already using it. (Want the code, Resilio? I can set that up.)

Of course, if you haven’t taken the Linux plunge, Resilio Sync is probably going to be a lot more usable for you—not that, at the end of the day, it isn’t extremely usable for Linux users, too. And, as I’ve indicated, there are many, many other options available to you if you want to ditch Dropbox. You should consider them for yourself.


April 2 update:

I’ve been using Resilio Sync for the last two weeks, and my son and I have a few concerns. The first is one we knew about going in: it’s not a cloud solution. Syncing works only if both devices are on. This means syncing isn’t exactly “set it and forget it.” You have to pay attention to whether something is syncing, and if you forget…you won’t be synced. After using Dropbox for years, this turns out to be quite annoying.

This, in turn, means I have to worry more about losing files. I can back up files on my main machine, which is always a great idea (of course), but if I haven’t synced because two machines haven’t been on at the same time (or because I need to reboot Sync, which is also an annoyance), then I might still lose laptop files because I only back up my desktop.

Backing up is all the more important because it is possible to inadvertently delete a bunch of files from one machine…leading them to be deleted everywhere. That would be a disaster. It’s like automatically deleting all your backups. Of course, the stuff might be rescuable in Trash, but do you really want to rely on Trash as a fallback solution?

To pour salt in the wound, if I really want peace of mind, I have to make sure the the backup program is fantastic. I can’t rely on Resilio Sync as a backup program. And the default Ubuntu backup program kind of sucks (which is surprising to me). This isn’t a count against Resilio, but it does make switching, if I’m going to switch, more urgent.

So it’s back to the drawing board. A zero-knowledge encryption cloud solution is sounding better now, but there are two sticking points for me: (a) I don’t want to have to trust an external vendor if I don’t have to, and (b) I’m not confident that I know what’s going on well enough to be able to say that my data is truly secure and private.

Last time, I came very close to getting a NAS, but I didn’t. I’m now 90% sure I will get a NAS after all.

The reason I didn’t get a NAS the first time is that it sounded like just too much trouble to set it up and maintain it, not to mention having another attack surface to lock down. But the more I think about it, the more I think it might be worth it.

After all, another rather huge advantage of a NAS is that I don’t have to rely on any cloud service I don’t control myself, at least for my personal purposes, for a range of purposes we now use different cloud services for. That means I can maintain my own synced contacts, passwords, bookmarks, etc., as well as supporting collaborative documents (a la Google Docs) I want to work on with others (such as a Declaration of Digital Independence). I might still have to rely on Google Docs (or something like it) for work, but at least my private life would be more locked down.

Any one of the latter advantages certainly wouldn’t be enough to justify getting a NAS. But taken together, and combined with an always-on Dropbox alternative that I can “set and forget,” it’s looking better and better.

Stay tuned. I’m not done yet.

Another installment in my series on how I’m locking down my cyber-life.


by

Posted

in

,

Comments

Please do dive in (politely). I want your reactions!

8 responses to “How I replaced Dropbox”

  1. What an elegantly minimalist and simple approach to a problem that cloud services have been over-complicating. Turns out Syncthing does have an Android app, so I will definitely be checking that out. Anything that makes better use of the hardware we already own is a good idea. I do run NextCloud, but it has potential to be so much more than cloud storage. I personally won’t be satisfied until everything I do is running on hardware I own, in house, from e-mail on up. You are correct that a computer needs to be left on 24/7, but consider that, for our blogs and e-mail, some computer somewhere is on 24/7 anyway. If that computer is a Raspberry Pi for your personal e-mail, blog, and decentralized social media, the 96 watt-hours it consumes in a day would be a small price to pay for the digital freedom and autonomy, and your idea of syncing may make cloud storage unnecessary, and therefore making a Raspberry Pi server a more viable idea.

    Thanks again for another eye-opening post!

  2. Thanks for the feedback, Paul!

    So far, so good with Resilio Sync. My son had trouble losing data but because that’s because he was trying to be a little too clever.

    I do think it’ll be especially important to do daily syncs/backups to a hard drive, something I haven’t been doing because I’ve been depending on Dropbox for not losing my data.

  3. So what, if anything, is there with Resilio Sync to protect against an accidental file deletion being propagated and deleting all copies of a file?

    1. Um…daily backups, like we used to do (and some of us still do)? Yeah, I don’t think it works by itself and not in tandem with a backup plan. I could be wrong but when I was checking it out, I didn’t see any sort of file recovery feature of the sort that, e.g., Dropbox has.

  4. Mike

    I’m also looking for a dropbox clone.

    I am seriously considering OwnCloud as the software package, except that I am worried about just what you commented on – it’s lack of a file recovery feature….

    I need multiple dropboxes with a different set of users for each.

    I have a 5-drive RAID-5 USB Drobo available, and plan on using it with a Raspberry Pi,
    with a solar panel setup to charge a huge battery (enough for a week of overcast days).

    Think that will handle it?

    1. Can’t tell you whether OwnCloud has software with similar functionality to Dropbox, but probably. I’d have to look it up myself. My worry would be theft, fire, or other disaster. For this I do backup into a zero-knowledge encryption service. My only worry is that it’s not open source and so I have to trust them that it really is zero-knowledge. Good luck!

  5. Robert

    There are some NAS on the market that allow you to install Resilio Sync (I have Netgear NAS). My NAS is always on so that’s what I backup to.

  6. SHG

    My solution to the same problem (a long-time Dropbox subscriber with all the same concerns):

    I installed Syncthing on every computer in the house, and in Syncthing preferences I told Syncthing to synchronise my iCloud Drive folder. So whenever I change anything inside my house, Syncthing replicates that change on every other machine over the LAN; iCloud Drive puts a copy in the cloud protected by the encryption and 2FA of my Apple account.

    For the amount of data I’ve got this setup requires a paid iCloud Drive account, but it’s not even half of what I was paying for Dropbox. And I trust Apple more than I trust Dropbox.

Leave a Reply

Your email address will not be published. Required fields are marked *