Dropbox: Credit is Due

Well, everyone, it looks like Dropbox has listened. They’ve rewritten their TOS in a way that is very sensible, does not use loaded legal terminology that would allow an unscrupulous employee or future company administration to do a little snatch-and-grab with your intellectual property, and is layperson readable. I call this a good result. The outcry from the user community (this was covered a LOT of other places besides just here, most of them with bigger audiences) has been really impressive, and it looks like it made a serious difference in this case.

ZDNet reports this morning on the new TOS. Take some time to read it. It’s a HUGE improvement.

As far as closing thoughts on my part?

Well, first, credit where it’s due, Dropbox listened to their users and seems to be addressing the legitimate concerns. That merits cautious kudos. Something else they did that merits unqualified praise is that they released their TOS changes a full two weeks before they went into effect, which gave everyone who wanted to a chance to pull their files and back out, or to send in feedback, or both. This is a practice that more companies should take notice of and implement. I suspect that the combination of these two actions will serve Dropbox’s reputation well among their users.

Second, the broader principle of caution with online services shouldn’t be forgotten: Know the risks you’re taking with free, cloud-based services, and protect yourself. How do you protect yourself? Keep up to date on the TOS, so you don’t get caught unawares by changes. Encrypt everything you upload. Do not upload intellectual property to services (like Google+ and Facebook, both of which currently have TOS substantially similar to or slightly worse than Dropbox’s earlier proposed revision) that claim the right to re-use, sublicence, create derivative works, adapt, etc. your work (or, worse, the files you merely have a license to use, like your music). A little caution (and encryption) goes a long way.

Third, even with services where you are not the customer, enough people getting pissed off enough can, indeed, make a difference. It’s sort of like the cows all running away from the farm at once–the cows are the product, but if there’s no product, there’s no way to sell it. Your power is diminished in situations where you’re the product rather than the customer, but it’s not totally negligible. Keep up with the blogging!

Fourth, there is a very good reason that Dropbox is popular in the first place: They provide an easy backup solution. Off-site backups are important. Without them, you always risk having your files lost in a fire. Just be careful when shopping for one, and do protect yourself.

Related links:
Everybody Knows Peggy Lee (or should)

Blogging Free Will–Ebook Giveaway

So, Free Will is in prep for release right now, with the typos and other nit-picky details being worked over, layout being done, etc. It’s a big step forward in the Antithesis Progression, and there are a lot of you out there who have been waiting patiently for the series to continue.

Some of you will get a sneak peak. You see, this is a big book. It ate up more pages, and more time, than I expected by an order of magnitude, and I’m eager to see it find a good home on the shelves and in the e-readers of all of you, including those of you who have drifted away in the meantime, intending to come back when the series continued.

To let people know Antithesis is back, we’re going to need publicity. Publicity means you! Some of you out there enjoy blogging, posting opinion pieces and reviews, etc., and you are the ones I need. Starting today, the first hundred of you that email me (either the normal way through the feedback at jdsawyer.net address, or through the web form you can find here) with the subject line “Free Will Ebook” will receive a free, pre-copyedits ebook version of Free Will (and a corrected version once the proofs are done).

In return for receiving this advance review copy, you promise to blog the book when you’ve finished reading it and, once the book is released to the general public in the next week or two, to post a copy or extract of your blog review in two of the following: Amazon, Barnes & Noble, Smashwords, Goodreads, Kobo, Sony ebook store, Kobo, iBookstore. Those of you who feel enthusiastic enough about the book to post the review in all those places will be entered into a drawing. The four prizes in that drawing will be:

Spread the word!
Also, watch this space. There will be more announcements in the coming days about casting calls, a new Death Threats contest, and other goodies.

Google Pulls a Dropbox

Apologies to those who are already tired of this–it’s threatening to become a hobby horse. Looks like with Google+, Google is going where every stupid lawyer has gone before: claiming “a perpetual, irrevocable, worldwide, royalty-free, and non-exclusive license to reproduce, adapt, modify, translate, publish, publicly perform, publicly display and distribute any Content which you submit, post or display on or through, the Services.”

Ugh. I can tell you where my photo gallery WON’T be moving. I’m beginning to think that the phrase “Don’t Be Evil” is one of the more inventive demonstrations of the elastic nature of the English language.

Photofocus has full coverage. Check it out (because I’m frankly too annoyed to go through this all again). For those interested in my extended thoughts on the matter, read this post on the Dropbox mess, this post on how the economics of free online services actually work, and this post on perpetual licenses.

Meanwhile, I’m beginning to think we need a real test case for this kind of bullshit to either rule it out of order and illegal once and for all (in which case we can ignore these kinds of licensing terms), or make it clear that such clauses are enforceable (and under what circumstances) so that we know exactly what to avoid.

EFF? ACLU? Are you listening?

More Dropbox Updates

Dropbox keeps trying. They’ve changed their TOS again–if you’re watching and waiting for them to get their act in order, check the link and see where they’re at now.

Meanwhile, Gigacom has posted an interesting analysis about what the public reaction to Dropbox might mean for the future of online privacy.

Finally, a reader wrote in privately to recommend the iTwin as a potential alternative to Dropbox. From my once-over, it looks to me like i’ll be very useful for a limited subsection of Dropbox users, and fairly idiot-proof, and it certainly does get around the disadvantages of the cloud services. It’s relatively inexpensive, so if you’re looking for an alternative it’s worth checking out.

Dropbox TOS vs. Others TOS

ECtimes posts an excellent analysis of why Dropbox’s TOS situation continues to be a problem for its users–and compares the current (revised several times since Friday) wording to the wording of some other, similar services. Worth a gander.

—addendum—
There are more updates on the Dropbox situation at my new blog post here.

You Are Not the Customer–You Are the Product

My gripe session about Dropbox’s new TOS and my presentation (wherein I all but came out and shouted that it’s stupid to use a free cloud-based backup service) understandably rankled a healthy percentage of the commenters. My fellows in the hacking community, who eat, sleep, and breathe security issues, described my post as a “breathless rant,” an “overreaction,” etc. And what’s more, if my post were written up for LinuxJournal or for an IT rag, they’d be right.

But it wasn’t. It was written with writers, musicians, and other creatives squarely in mind–an audience that, by and large, is not highly conversant with all the ways around lawyers and moronic service providers that we hackers and power users have built up into a reflex. When you tell a writer who only uses a mac (who’s not otherwise a computer geek) that they need to encrypt their backups, they’re likely to look at you like you’re speaking Latin, then shake you off and continue right on doing whatever gets in their way least.

So, in the interest of being part of the solution rather than just part of the agitation camp, I’m now going to get into the things about cloud-based computing that, if you don’t know them, can make the whole enterprise very hazardous. I’ll also suggest a few ways to minimize these hazards and the hazards it can pose–and the benefits it can offer–for writers and other creative non-hacker types who use it.

So, here are some things you need to know about using any cloud-based computing service:

If The Service is Free, You Are Not The Customer

If you’re using a service, it’s natural to assume that you’re the customer and the service provider is the vendor–and there are a lot of companies (like that book about the fronts of peoples heads) that count on the fact that you’ll continue to think that.

Why? Well, if you assume that, you’re going to be inclined to several reflexes–you’ll assume that the vendor will try to treat you well, for example, and you’ll be more likely develop brand loyalty to an insane degree, because we’ve been trained to think that “the customer is always right.”

The trouble is, with these services, you’re not the customer. You (and your data) are the product.

The customers are other parties–in some cases, they’re advertising, demographics, and political firms. In other cases, the free service is a test bed for a commercial product and you’re essentially an unpaid QC person.

If this is sounding negative, it’s not because I don’t approve of the business model–if you understand what you’re getting into I’ve got no problem with such things. The trouble is that the Internet is full of people who think that that nice guy from Nigeria really does need help, and it’s not because they’re stupid, it’s because they don’t have any idea about how the economic situation works on the net. People (like me) who’ve literally been on the Internet since before it was the Internet tend to forget about that.

What this all means is that the service provider has a lot less incentive to keep you happy, and a lot more incentive to do things that annoy you while advancing their own interests with regards to serving their primary customer base. These things that annoy you often turn up as rights grabs for your data, sudden changes in Terms of Service, sudden discontinuance of a service you’re relying on–and, when there’s a big public outcry, sometimes a marginal backing off combined with very loud self-flagellating apologies and protestations about how important their customers are to them (which is true–but the customer isn’t you. A fact they usually fail to mention).

In some cases, it can get worse than that. Some companies have (or believe they have) the incentive to use your intellectual property free of charge to make money. Facebook, for example, uses your user pictures in their advertising, and they don’t pay a dime for it. You’re obligated to let them unless you specifically opt-out every time they change their TOS. They’ve also, from time to time, tried to claim copyright or free license to all the text posted on their site (your words) and to all the text linked to from their site (which will never stand up in court).

Which brings me to the court test and the other reason you actually need to read your TOS: A lot of them disallow court cases. In them, you agree to binding arbitration in some po-dunk jurisdiction that doesn’t have robust laws regarding intellectual property or Internet business–a jurisdiction often pre-selected because of its statutory or cultural bias against consumer protection, in favor of enforcing binding arbitration, or of not enforcing claims of individuals against corporations. Get screwed over by a company that does this, and you have two court cases in front of you: first, to get the binding arbitration clause ruled out of order, and second to actually pursue action against the company.

On Putting Things In The Cloud

When you park your car on the street. It’s possible that someone might come along and make off with it. Two things protect people in such situations:
1) They lock their cars (which makes stealing them inconvenient–but not impossible)
2) They have cars that are unremarkable

The same holds true for your data. Most of the time, if you post your work online for free nobody’s going to steal it–frankly, most work isn’t special enough to be worth the bother. Most work is the Yugo of online car theft. And the other kinds of data that some sites collect–the demographic, behavioral, large-scale statistical data for resale to advertisers–isn’t individuated enough to worry many people.

The story changes a bit, though, with things like financial data, or unpublished manuscripts, or raw tracks. Stuff that either has intrinsic value (all financial data does, even if you personally don’t have any money) or statutory value (intellectual property).

Unfortunately, even people who are driving the Internet-equivalent of expensive cars tend not to lock them, unless they’re people who are otherwise interested in hacking and security for its own sake, and this is where you get into trouble.

When you use a cloud-based backup service, you’re gaining some useful things: data portability and off-site fire protection spring to mind. But you’re also putting your data on someone else’s server–you’re trusting your intellectual property to the good graces of an organization whose interests might not align with your own tomorrow, even if they do today–which means that if you want to keep yourself safe, you’re going to have to be checking the service’s user relations blog and TOS pretty regularly–and that’s a headache.

You’re also trusting your data security to a corporation whose security practices you can’t practically audit (and, in the case of a new company, whose practices aren’t well-established enough to have earned them a reputation you can check). The company might respect its users privacy, but if they don’t have their servers secure, then Lulzhack or Anonymous or the Russian Mob or an overzealous high schooler can waltz in and have their pick of what’s there.

VW or Aston Martin, Use A Kill Switch
So, say you need the benefits of a cloud-based data service, what are you going to do? There are a few things that can make the enterprise a not-entirely-foolhardy one:

1) Encrypt your data using the strongest available encryption
This is non-trivial if you’re not in the habit, but it is actually the only way to secure your data against most attacks. GPG, and TrueCrypt are both open-source, community enterprises and are the gold standard in data encryption. PGP has several commercial implementations of the same encryption schemes and algorithms GPG uses, and they have some slick front-ends that make it easier to use. There is a learning curve here, but it’s worth it.

2) Select a data service provider that does not have access to your data
This is the standard of professional practice in the data services industry–your data is stored on a TrueCrypt-style drive to which the hosting company doesn’t hold the keys. They can delete it, but they can’t read it. Since this claim is difficult to verify, though, you should also encrypt the data you upload.

3) Select a data service provider that does not share data
You basically want a company that won’t allow anyone–including the FBI–to access your data without a court order.

4) Select a data service provider with decent lawyers
The shitstorm over last weekend was, on the most charitable reading, caused by bad lawyers. So to be very clear: what you store on a server is no more business to your hosting provider than what you keep in a rental house–and I’m sticking to that unless and until the law says otherwise (which, at the moment, it doesn’t). When you upload to a server, you are granting the implicit right to archive, store, back up (which involves making copies) and display your data to the extent (and only to the extent) required by normal data management operations–these are all technical tasks. You are not implicitly granting the right to create derivative works, to publish, to distribute, or to sublicense the content (and if you’re looking at a service that demands that right because they use a subcontractor to handle their data farms, avoid them.

5) Pay for it
You’re going to be in a much better position if you’re using a paid service, and the paid services are not expensive. You spend more at Starbucks every month, even if you don’t drink coffee. This puts the customer/vendor relationship on the proper footing. Don’t, however, neglect points 1-4 just because you’ve paid.

6) Notice of changes to TOS
Always select a service provider that gives at least a billing-cycle’s worth of notice to changes of their TOS. This is something Dropbox did right, and with all the grousing I’ve been doing about them it’s only fair to give kudos where they’re due.

Blessed Are The Pessimists, for They Have Made Backups

The best solution of all, though, is to do it yourself. There are a number of programs available, such as PogoPlug, which make it easy to set up your own cloud-drive that you can access from anywhere. A lot of NAS appliances also include web servers that let you access your files from anywhere. Get something like this, set it up in a friend’s closet (so you have the “off-site” part of your backups covered–important in case of flood or fire), and you’re miles ahead of using a cloud-based service from a company whose politics and business incentives you have no control over.

Of course, doing this, you are parking your Aston Martin on the street, which means you need both a lock (a good firewall) and a very good kill switch (encrypt everything on that shared drive)–and if you have any sense at all, your cloud drive must be on a dedicated appliance or computer, not on your desktop or laptop machine. Isolating it from the rest of your network protects the rest of your network from the Internet, exposing only your (encrypted, right?) cloud drive on its own well-secured machine (device, spare computer, whatever).

Concluding Thoughts

I got a LOT of comments, and a lot of blog posts, commenting on the panicky, breathless nature of my initial post about the Dropbox debacle by people who figured I ought to “know better.” Those people were all either 1) hackers who already know how to navigate this weird world, or 2) people with a good understanding of cyberlaw but a poor understanding of copyright law. Most of them were very intelligent and the comment stream (and cross-linked posts) are well worth reading–but this post is not for them. The first group are already well-equipped to take care of themselves, because they have the “informed” part of “informed consent” nailed. The second group are intelligent enough that they’ll likely be fine too, though I’m nervous about the folks who take advice from them.

If you’re a creative type, your work is your livelihood. You need to be fully conversant in Copyright law, or you’re gonna get fucked. You also need to be moderately conversant in security–i.e. you need to understand the basic concepts, even if you don’t understand the technical details. And you need to apply both to the way you deal with data you put online.

This is a world of informed consent, and most people on the net are consenting without understanding the paradigm or the implications. For most people, the worst that will happen to them from operating uninformed on the net is a little identity theft. Occasionally, one of them might get implicated in a crime through no fault of their own–annoying and unlikely, but possible. But for creatives who are using the net for business, the ballgame is different–if a creative walks through this world as a naive, he risks a lot more headache and wallet ache. It really is worth the time to get savvy.

If you find this post useful or thought provoking, please consider donating to the tip jar at the top right of this site, or buying a copy of any of the books you’ll find listed in the right sidebar. Writing is how I make my living–I enjoy it and would like to keep it up!

Update on the Dropbox Situation

Dropbox has posted a public explanation for their rapid TOS changes today. As suspected, the email they’ve gotten from concerned users hasn’t gone unnoticed–that’s a good thing.

Am I now recommending them? Hell no. Assuming the best of intentions, I think they are in error about the kind of license they need to run a data archive service. And, again, assuming the best of intentions, the sorts of rights they’re claiming to run their service are very easily abused–and the folks that run Dropbox today, no matter how honorable they are, will not be running the place forever. Young companies frequently have rapid changes of administration, and in my opinion it’s foolish to put that kind of trust in the goodwill of even the most ethical of service providers. For a more lengthy explanation why, see my post on The Third Cousins Rule.

There is also the underlying problem with free cloud-based data services, which I mentioned briefly in one of the comments on the previous post, but which I should do a full blog post on. Think I’ll schedule that one for next week.

— —
By the way, for the benefit of those who have privately posted flames on the earlier comment thread (which didn’t make it through moderation due to using false email addresses) asking whether I’ve read a TOS, I recommend you check out this thread on Reddit, in which TOS from similar services by Microsoft Skydrive and SpiderOak are quoted–and they’re FAR more reasonable and intelligent than today’s Dropbox drivel:

The Reddit discussion

And I gotta say, as a company, if Microsoft has less intrusive TOS than you do, you’re doing something wrong. Kudos also to SpiderOak for blind-encrypting their stuff, so they can’t even get to it if they wanted to. There are a couple examples of how cloud-based data services should be done. I can’t believe I’m going to say this, but kudos to Microsoft!

Thanks everyone for spreading the word to those affected by all this!

—-Addendum—-
I’ve posted a follow-up with recommendations on how to decide if, and what, back up service will suit your needs, and how to protect yourself from getting screwed by one. You can find that post here.

—Second Addendum—
There are more updates on the Dropbox situation at my new blog post here.

Put it in the Cloud? Are You Nuts?

Note:
The situation in the following post has been resolved for now. Dropbox has taken everyone’s outrage seriously, and has fixed the problem. More information here. I am leaving this post and the follow-ups up because it contains a good deal of information on how to protect yourself and your intellectual property when working in the cloud.

As of Sat, July 2 2011, Dropbox has joined Facebook and who-knows-how-many-other ass-backward companies in declaring eminent domain on their user’s data. That’s right, boys and girls, if you’re using Dropbox for storing your manuscripts, photographs, creative works, etc., you should know that their revised TOS says that:

you grant us (and those we work with to provide the Services) worldwide, non-exclusive, royalty-free, sublicenseable rights to use, copy, distribute, prepare derivative works (such as translations or format conversions) of, perform, or publicly display that stuff to the extent we think it necessary for the Service.

In other words, they own your stuff.
Not that this would stand up for a minute in court–but do you want to be a test case?
Continue reading ‘Put it in the Cloud? Are You Nuts?’

Self-Sustaining and WCW *FINALLY* on Nook

Much apologies for the delays, but B&N’s backlog seems to have caught up with itself finally.

As a result, both of the new short stories are now available on the Nook. You can find Self-Sustaining here, and We Create Worlds here.

Now, back to getting Free Will squared away…

New Fiction: Self-Sustaining

Theo is a monk–or as near to it as makes no difference–but don’t worry about it if he invites you to dinner. You won’t be left with bread and water. Although he may deny himself the pleasures of the flesh, he is generous with his hospitality–and his money.

Tonight, he hosts dinner with his chief researcher who’s just made one of the biggest applied biology breakthroughs in history; the culmination of a lifelong dream, and a grand occasion for the greatest hospitality he’s ever shown.

Being a kindly soul, it has never occurred to Theo that there can be too much of a good thing. His guest, however, may have ideas of his own…

Now available for your Kindle, Nook, and all other readers.

—Story Sample Below the Cut—
Continue reading ‘New Fiction: Self-Sustaining’

Released: We Create Worlds

Rick is a scurrilous, irascible scoundrel, with a heart of gold—not because he’s warm and fuzzy underneath, but because his heart is totally devoted to money. His favorite goldmine is his shop, where he vends virtual reality and manufactured novels. He keeps his customers happy, and he always knows the right party to hit to find a pliable college girl with more cocaine than sense. Life is good. But life has a way of doing unexpected things, and the world has a way of changing around the most adaptable people.

Step into Rick’s parlor. Don’t mind the bell on the door or the old fashioned cash register. Buy a manufactured novel, fresh from the computer—a first edition. Sit in the easy chair or lay out on the sofa. Strap on a helmet and a skinsuit and take a swim on Europa. He can be trusted. Really. It says so on the door. In ten foot high letters, right above the shop front, he tells you exactly what they do:

“We Create Worlds”

And they do it on the cheap.

You can find the story at Amazon and Smashwords.

—Story Sample Below the Cut—
Continue reading ‘Released: We Create Worlds’

Released: Train Time

Have you ever seen that well-dressed man at the airport, or the station, who stands patiently by as if he has all the time in the world? Have you wondered who he was waiting for, and how long he’d stay? Have you ever been that man, stuck in the hours between delay and disappointment, with no way to know if the person you’re waiting for will show? Let fancy take you to the mountains of Northern Italy at the dawn of the 22nd century for the story of a woman and a train–and of a walking stick and the man who owns it, as he waits for Train Time.

You can find the story at Amazon, Barnes & Noble, and Smashwords. Below, you can find a sample.

Enjoy!

—Story Sample Below The Cut—
Continue reading ‘Released: Train Time’

The Fonthead (An Epic, of sorts)

Even if I’m lucky enough to be in that generation that gets to live past a hundred and twenty, I doubt I will ever reconcile myself to fonts. I love fonts–I’ve been doing graphic design now for the better part of a decade. Titles, book covers, book layouts, pamphlets, movie posters–you can’t get away from fonts for defining the look and feel of something with words on it.

So, fonts are cool.

Except…

Well, fonts are weird. I laid out a cover for a short story earlier this week, and this particular story needed a different font-ish approach than I normally take with the covers for my short stories. Finding the right font involved typing the relevant text at the appropriate sizes, and then cycling through my font database.

Let me tell you, if you want to have a transcendental experience, there’s not a lot you could do that would be more effective than testing fonts.
Continue reading ‘The Fonthead (An Epic, of sorts)’

Fans Making A Difference

Most people why buy a book or pick it up from the library just want to read it–that’s an excellent thing! Sometimes, though, us authors get email from fans who, for whatever reason, what to know what extra they can do. If you’re in that camp, this is for you. If that doesn’t describe you, you’re gonna be bored or annoyed by much of what follows

Let’s say you’ve found an author you love with a series you adore (and, let’s face it, who hasn’t?). If you’ve been a reader long enough, you’ve experienced the frustration of an orphaned series–where the publisher just drops things mid story, and the next book is never written. You might even have gotten very annoyed with the author for it, and confronted them at a convention or a signing, only to be told it’s out of their hands.

Unfortunate though it might be, the truth is that the success of a series lies in your hands. You may be just one of thousands of readers, but it only takes a handful out of every thousand readers to make a huge difference in how a book does on the open market.

Seanan McGuire a.k.a. Mira Grant and Gail Carriger have both recently chimed in recently on how you can help an author out, and it caused a bit of a shitstorm on twitter–I suspect that storm is a by-product of the interesting times we live in in publishing.
Continue reading ‘Fans Making A Difference’

Who’s an Outlier, Again?

A funny thing happens during times of great industrial upheaval: Everyone wants a piece of the new deal, but nobody wants to take what they perceive to be a risk. Most established players retrench, hold on to what’s familiar, and try to shout down anyone with a contravening opinion. It’s human nature to get defensive when one perceives a threat to one’s view of the universe.

In the midst of the upheaval in the publishing industry, I’m seeing this a lot. As agents are conning their clients into unethical business arrangements (and kudos to Peter Cox and Kristen Nelson for going on record about the danger this represents to writers), editors with excellent reputations are getting kicked off writing forums for providing data on the change, publishers are defrauding their authors and engaging in massive rights grabs, breaking the rules can earn you some pretty serious grief from other writers who are following the rules and hoping they’ll get reputation points for it.

Trouble is, this isn’t first grade. There are no gold stars for following the rules. And a lot of people are breaking the rules.
And they’re winning.
Continue reading ‘Who’s an Outlier, Again?’