The landing page looks nice and clean. But even if I wanted to try and use your SaaS, I couldn't responsibly do so: Your privacy policy does not comply to the GDPR, and I cannot find any information about the person or company providing this service.
Also, from your Terms of Service:
>If you have any questions about these Terms of Service, please contact us at [email protected].
This makes it look like you have just been using a pre-made template (or even software?) to launch your SaaS.
Glad to see Dropshare (my app) as an example for data ownership here. :)
While we had our own cloud storage provider for a while, Dropshare was always about "bring your own storage", because I sincerely believe in the importance of "owning your data". The first supported storage provider in the app 10 years ago was SCP over SSH (basically "bring your own server").
Funny you ask, me and other people built something like this a few years (actually 7 years…) ago. It never really got past a few hundred initial users, thus has been shut down meanwhile.
I’d like to quickly clarify that the initial statements are untrue. The Webserver is used as communication bridge between the Share Extension and the app. It only accepts requests with a signature. It cannot delete, share or else manage any uploaded files, and has no code that could potentially cause any harm on your server (e.g. by executing things). It only accepts file urls from your local machine to be uploaded and again, only with a properly signed request.
It is unfair to compare this to the Zoom case since there is no potential vulnerability and other than you explain, there is no danger involved with someone making damage to files on your server or whatsoever.
Best,
Timo
P.S.: Of course in case you think you did find indeed a vulnerability I am not aware of, please get in touch via [email protected] according to responsible disclosure.
How can a website / service be operated in 2015 without any contact or legal information? How am I supposed to use this for my personal information without being able to read the privacy statements or knowing who's operating the service to what purpose?
Edit: To make the reason for my comment clear, there was no link in the footer like there is now at the time I wrote it.
- Automatic Updates
Publish updates to your app or game instantly in just 3 clicks.
However, I wasn't able to find any documentation about that feature, same for Crash Reporting. I've written an email, but by any chance you know anything about this?