Box's company blog covers product launches, acquisitions, funding, and enterprise cloud storage and security features.
HN links it for Box announcements such as encryption key management, and commenters question whether the key still sits in plaintext on Box's servers.
> Also, speeding up the initial load times for internal users often does little to increase profits.
I used to be on the Performance team at Box. Our charter was to get the files page to load in under 1s for the median domestic (US) user.
Box is largely sold to CTOs, not the people using it. The folks demoing/testing/evaluating are almost always on fast computers with fast internet. That didn't negate our goal, though, for a few reasons:
1. It turns out that lots of business users fly on airplanes. If you have to store/send a file and the app loads too slowly, you'll just use Dropbox or GDrive, or the OneDrive that Microsoft threw into your Office365 contract for free instead. And when _that_ loads instead, you'll remember it come contract negotiation time.
2. If all of the people who are supposed to use the app hate it, they'll actively avoid using it. If they have no choice, they'll complain and make sure decision makers are well-aware of how bad it sucks. That does eventually trickle up. With Box, folks would switch to email or flash drives, which makes security/compliance orgs salty, which introduces new, stricter limitations on your USB ports and email, which pisses off the execs paying for Box. Bad business software—contrary to popular belief—does eventually get phased out, just not on a short timescale.
3. Geography does matter. One project to bring the files page on Box from ~3s to ~2.3s ended up improving EU load times by multiple seconds in some cases.…
BOX.COM | Sr. Software Engineer, Full Stack, Box Notes | HQ -
Redwood City | Full-Time | ONSITE
Box Notes is a collaborative business note-taking tool that makes it easy for our 54 million+ users to create and collaborate on content in real-time. Our mission is to build the world’s best business collaborative note-taking product.
We have some interesting and exciting challenges that we need help with which include scaling our backend infrastructure to support complex realtime features on Box Notes. Examples include rethinking high availability of the system, moving to containerized backend components and working on reliability of the system as we work fanatically to grow our user base.
Example Projects: Box Notes team recently launched a whole new way of collaborating with your team by launching Inbox, Differences, Presence and Templates. https://blog.box.com/blog/box-notes-inbox-presence-differences/ Exciting part is that these features were innovations from past Hackathons from the engineers on the team!
Who you are:
* You are experienced in Node.js, Javascript, React
* You have 3-5+ Years of relevant work experience
* You are passionate about solving hard problems using data-driven solutions
* You act like an owner and strive to do work you're proud of, both technically and in your team interactions
* You are able to inspire other people to work with you, and you enjoy mentoring and coaching junior engineers
* And more importantly you like to be in a fun…
Box has always promoted this notion that you can make applications/addons/extensions that use Box as a backing datastore [1]. This was quite obviously a play at the B2B line-of-business market, which could conceivably develop cloud-hosted apps [2] that operate on data that employees upload into Box.
This is to the detriment of those who sell traditional desktop-based line-of-business apps, including potentially Microsoft Office.
Box could -- for a while now -- open Google Docs documents [3][4] and the like. I guess now it works the other direction, where Google Docs works on files that are sitting in Box?
Google Drive, as funny as it sounds, is actually in a different market: they're the catch-all storage space for Google stuff, while at the same time marketed at nothing in particular. Meanwhile Box aggressively goes after the 'medium business' market. From this odd partnership, a realistic competitor to Microsoft and other office-y application makers may result.
[1] http://readwrite.com/2013/06/06/box-pay-developers-based-on-app-usage/
[2] https://app.box.com/services/browse/57
[3] https://blog.box.com/blog/how-to-use-google-docs-in-box/
[4] https://blog.box.com/blog/box-and-google-docs-accelerating-the-cloud-workforce/
My guess: Porting their kernel extension to ARM is not that trivial.
They were one of the first who offered these 0-byte placeholders, and they rely on a kernel driver, which is only available on both Windows and macOS (but not Linux).
OneDrive [0] and Box [1] are moving away from their implementations and switching to Apple's File Provider API. Their motive might be less development effort, and the official API might be good enough. Still, I wonder whether the deprecation of 3rd party kernel extensions might also be a reason to switch to such a "thin client".
Interestingly, Apple did something similar on Windows [2]: They are now using Microsoft's OneDrive implementation for their iCloud file sync client.
Now I am wondering what Dropbox will do. Is maintaining their kernel extension still feasible on macOS?
[0] https://techcommunity.microsoft.com/t5/microsoft-onedrive-blog/microsoft-works-to-ensure-a-great-onedrive-experience-on-apple/ba-p/2400803
[1] https://blog.box.com/get-more-secure-seamless-box-drive-experience-across-macs
[2] https://blogs.windows.com/windowsexperience/2019/06/11/apples-all-new-icloud-for-windows-app-now-available-in-the-microsoft-store
Box | Staff Software Engineer | Full-time | Redwood City, CA | ONSITE | https://boards.greenhouse.io/boxinc/jobs/191237#
Our Mission: make Box developers as effective as possible to develop, ship and manage their services. What used to take six months to launch a service is now less than a week
As a Staff Software Engineer, you will have the opportunity to build Box's Platform as a Service (PaaS) layer. Our team owns scheduling, service authentication and authorization, service discovery, load balancing, monitoring, and more. We are working with modern containerization technologies like Docker and Kubernetes to build the next generation of our infrastructure to support all services in our datacenters and other clouds.
How Box Runs Containers in Production with Kubernetes by Sam Ghods, Box - https://youtu.be/QIDrdZlEQdw?list=PLj6h78yzYM2PqgIGU1Qmi8nY7dqn9PCr4
Kubernetes at Box: Microservices at Maximum Velocity - https://blog.box.com/blog/kubernetes-box-microservices-maximum-velocity
Apply at: https://boards.greenhouse.io/boxinc/jobs/191237#
Seems like it will protect data-at-rest really well. Unfortunately there's still the issue of the file/Box Key existing[0] in plaintext on Box's servers. You're trusting them to keep those servers secure against intrustion, and not to retain copies of the plaintext file/Box Key.
If you use this feature and someone seizes all your existing data from Box then they'll still need to use your Customer Keys and your HSMs to decrypt it. Fantastic. If, however, they compromise the servers and start stealing the Box Keys as they are generated then they'll have be able to decrypt the data encrypted with those Box Keys. Not so fantastic. It's a trade-off which may be worth it in some cases, but it's a trade-off nonetheless.
I wish reporters who write about this stuff would challenge the security model more than just asking Box PR if the service is secure.
[0] In memory, during encryption/decryption. https://blog.box.com/2015/02/breaking-the-last-barrier-to-cloud-adoption-with-box-enterprise-key-management/