Evidence ledger
31 sources
Checked 15 Oct 2026
Evidence ledger
One row per claim in Where the languages meet: ten years of Dropbox, read from its own repositories: who published it, what grade it carries, when it was written, when the link was last checked, and the quote or figure it rests on. Nothing in the guide is cited from memory, so anything not in this table is not in the guide.
Field guide: Where the languages meet: ten years of Dropbox, read from its own repositories.
Research date 2026-10-15. Every artefact below was retrieved in this session, either by anonymous
git clone --filter=blob:none of the public repository (commit SHAs are from those clones), by
HTTP fetch of the registry endpoint shown, or by fetching the GitHub issue or pull-request page.
Commit-share figures were computed with git log --since/--until --format=%ae and count commits
whose author address contains dropbox; engineers also commit from personal addresses, so every
such share is a floor, never an estimate of the true share.
Corpus boundary. This session's egress policy resolved github.com, raw.githubusercontent.com,
pypi.org, registry.npmjs.org, repo1.maven.org, api.nuget.org / www.nuget.org,
proxy.golang.org and index.crates.io. dropbox.tech, mypy-lang.blogspot.com, usenix.org,
arxiv.org, youtube.com, peps.python.org and every conference host other than GitHub were
unreachable. There is therefore no engineering-blog or paper evidence in this guide, and the three
talks are cited from the slide PDFs the CppCon organisers publish on GitHub, not from video.
| # | Org | Artefact | Tier | Published | Checked | URL | Claim taken from it | Supporting quote or figure |
|---|---|---|---|---|---|---|---|---|
| 1 | Dropbox | dropbox-sdk-java issue #57, "Trust anchor for certification path not found" | postmortem | 2016-06-04 | 2026-10-15 | https://github.com/dropbox/dropbox-sdk-java/issues/57 | A pinned CA file broke Android uploads in SDK 2.0.4 because Android silently dropped certificates while parsing the PEM | Maintainer krieb, 2016-06-06: Android will "silently fail parsing the PEM encoded file, omitting the required certificates to validate the chain"; fix shipped in 2.0.5 on 2016-06-08 |
| 2 | Dropbox | Same issue, maintainer explanation | postmortem | 2016-06-06 | 2026-10-15 | https://github.com/dropbox/dropbox-sdk-java/issues/57 | The bug went unnoticed because only one of two HTTP requestors pinned | The StandardHttpRequestor pins, but the example's OkHttpRequestor "doesn't pin certs like the" standard requestor |
| 3 | Dropbox | dropbox-sdk-python issue #60, "out of date certificate file in SDK?" | postmortem | 2016-04-14 | 2026-10-15 | https://github.com/dropbox/dropbox-sdk-python/issues/60 | Dropbox already had to email app owners in 2016 because SDKs pinned certificates and the servers would switch to a new certificate on 1 August 2016 | Quoted notice: "our logs indicate that you have at least one Dropbox API app"; maintainer: "If you're already using this v2 SDK, no further action is required." |
| 4 | Dropbox | dropbox-sdk-python README at HEAD 1a3c241 | postmortem | 2026 (line revised after 2025-11-05) | 2026-10-15 | https://raw.githubusercontent.com/dropbox/dropbox-sdk-python/1a3c241d367ea0d6cc2d5bdfe4fd2451a60ac39e/README.rst | Every Python SDK older than 12.0.2 stopped working in January 2026 | "Use v12.0.2 or newer of this SDK for compatibility with the Dropbox API servers. Older versions stopped working in January 2026." |
| 5 | Dropbox | Commit 43e5aa6, "Update README.rst with note about server certificate changes (#514)" | source | 2025-11-05 | 2026-10-15 | https://github.com/dropbox/dropbox-sdk-python/commit/43e5aa6d92d47b35e672b2e5f1a517b6f7f73e7f | The warning went into the README two months before the break; the PR was opened 2025-02-06 | Added line: "Make sure you're using v12.0.2 or newer of this SDK by January 2026 for continued compatibility" |
| 6 | Dropbox | Initial commit f72f99d of dropbox-sdk-python | source | 2015-06-15 | 2026-10-15 | https://github.com/dropbox/dropbox-sdk-python/commit/f72f99d83dd85d43e3a241137ca4d1ac78d9e5b3 | The pinned CA bundle shipped in the SDK's first commit, beside generated babel_serializers.py |
git ls-tree f72f99d dropbox/: trusted-certs.crt, babel_serializers.py, babel_validators.py, files.py, sharing.py, users.py |
| 7 | Dropbox | dropbox-sdk-python PR #489, "Stop providing a hardcoded CA bundle" | source | 2024-05-09 | 2026-10-15 | https://github.com/dropbox/dropbox-sdk-python/pull/489 | The fix: stop shipping trust material, defer to the platform, keep an opt-in parameter | "The SDK no longer provides a CA bundle to verify SSL connections." and "The ca_certs parameter is still supported, so users can pin with their own CA bundle if they so choose." |
| 8 | Dropbox | dropbox-sdk-java PR #537, "Remove cert pinning from the SDK" | source | 2024-04-29 | 2026-10-15 | https://github.com/dropbox/dropbox-sdk-java/pull/537 | Java removed pinning the same day v7.0.0 was tagged, with no written rationale | Description: "No description provided."; commits "Remove cert pinning from the SDK", "Add back ability to cert pin for standard connections"; tag v7.0.0 966e978a dated 2024-04-29 |
| 9 | Dropbox | dropbox-sdk-java README at HEAD 590eec4 | postmortem | 2026 | 2026-10-15 | https://raw.githubusercontent.com/dropbox/dropbox-sdk-java/590eec45626fb56c660ac6df6bd2e6c923af489c/README.md | Java SDKs older than 7.0.0 stopped working in January 2026, and the README now tells pinners to bring their own pinner | "Use v7.0.0 or newer of this SDK ... Older versions stopped working in January 2026."; "As of version 7.0.0, the SDK no longer provides certificate pinning by default." |
| 10 | Dropbox | dropbox-sdk-dotnet README at HEAD b0f0b18, and NuGet registration for Dropbox.Api | source | 2026; 7.0.0 published 2024-05-22 | 2026-10-15 | https://raw.githubusercontent.com/dropbox/dropbox-sdk-dotnet/b0f0b18160d852b72e0bc7d9223a8f467acdb58e/README.md | .NET carried the same January 2026 cut-off; the fixed release had been available for about nineteen months | "Use v7.0.0 or newer ... Older versions stopped working in January 2026."; NuGet: 7.0.0 published 2024-05-22, 124 versions listed, latest 7.4.0 on 2026-09-23 |
| 11 | Dropbox | PyPI release history for dropbox |
source | 12.0.2 uploaded 2024-06-03 | 2026-10-15 | https://pypi.org/project/dropbox/12.0.2/ | Lead time between the fixed Python release and the break: June 2024 to January 2026 | 12.0.0 2024-05-14, 12.0.2 2024-06-03T16:45:30; 143 releases since 1.1 on 2011-09-29 |
| 12 | Dropbox | Stone docs/evolve_spec.rst (added commit 2582bce) |
adr | 2017-03-02 | 2026-10-15 | https://raw.githubusercontent.com/dropbox/stone/ed81bc453589d4717ca1c46aab94bed6cc9b28ef/docs/evolve_spec.rst | Dropbox wrote down, in 2017, that third-party integrations may never be updated, and codified which spec changes break them | "The owner of the API does not have control over 3rd parties that have integrated their software at some point in the evolution of the interface. These integrations may never be updated making compatibility-awareness critical." |
| 13 | Dropbox | Same document, compatibility rules | adr | 2017-03-02 | 2026-10-15 | https://raw.githubusercontent.com/dropbox/stone/ed81bc453589d4717ca1c46aab94bed6cc9b28ef/docs/evolve_spec.rst | The rules cover fields, unions and routes, not transport or trust | Backwards incompatible: "Removing a struct field", "Adding a new tag to a closed union"; compatible: "Adding a field to a struct that is optional or has a default" |
| 14 | Dropbox | dropbox/stone history |
source | first commit 2014-07-21 | 2026-10-15 | https://github.com/dropbox/stone/commit/93373c4 | The IDL predates API v2 and was first called Babel | 2014-07-21 93373c4 Initial commit.; 2014-08-08 95e06b4 Merge branch 'master' of github.com:dropbox/babelsdk; 27 PyPI releases 2016-06-03 to 2026-09-23 |
| 15 | Dropbox | dropbox/dropbox-api-spec commit 3c363a5, "Update API specification (#138)" |
source | 2026-10-09 | 2026-10-15 | https://github.com/dropbox/dropbox-api-spec/commit/3c363a594dafbe0f4646e73352b62a4767540d25 | The spec is a set of .stone files updated by a bot; 39 commits in 2026 |
Author dropbox-spec-updater[bot]; first commit 452a598 on 2015-06-19 "Initial commit of specs."; files files.stone, sharing.stone, auth.stone, ... |
| 16 | Dropbox | dropbox-sdk-python commit 1a3c241 "Automated Spec Update (#613)" and .gitmodules |
source | 2026-10-09 | 2026-10-15 | https://github.com/dropbox/dropbox-sdk-python/commit/1a3c241d367ea0d6cc2d5bdfe4fd2451a60ac39e | SDKs consume the spec as a git submodule and are regenerated by bot; five of the six SDKs carry a bot commit dated 2026-10-09 | .gitmodules: url = https://github.com/dropbox/dropbox-api-spec.git; bot commits on 2026-10-09 in Python, Java, JS, .NET and Obj-C; Swift on 2026-07-29 |
| 17 | CppCon / Dropbox | "From the Dropbox Trenches", Steven Kabbes and Tony Grue, CppCon 2014 slides | talk | 2014-09 | 2026-10-15 | https://raw.githubusercontent.com/CppCon/CppCon2014/master/Presentations/From%20The%20Dropbox%20Trenches/From%20the%20Dropbox%20Trenches%20-%20Steven%20Kabbes%20and%20Tony%20Grue%20-%20CppCon%202014.pdf | Why Dropbox chose a shared C++ core: two tiny teams shipping the same logic months apart | "Camera Uploads ... Shipped 4 months apart ... People constrained, ~3 engineers"; "1 function impl: besides the call site and the implementation, you need to add code in 5 places!!!" |
| 18 | CppCon / Dropbox | Same slides, Android results | talk | 2014-09 | 2026-10-15 | https://raw.githubusercontent.com/CppCon/CppCon2014/master/Presentations/From%20The%20Dropbox%20Trenches/From%20the%20Dropbox%20Trenches%20-%20Steven%20Kabbes%20and%20Tony%20Grue%20-%20CppCon%202014.pdf | The measured wins were memory and GC, on 2014 Android | "~500k objects: 500 MS GC!"; "30k photos, ~10 objects each in C++ 300k objects disappear from the GC's view!" |
| 19 | CppCon / Dropbox | "Practical Cross-Platform Mobile C++ Development at Dropbox", Alex Allain and Andrew Twyman, CppCon 2014 slides | talk | 2014-09 | 2026-10-15 | https://raw.githubusercontent.com/CppCon/CppCon2014/master/Presentations/Practical%20Cross-Platform%20Mobile%20C%2B%2B%20Development%20at%20Dropbox/Practical%20Cross-Platform%20Mobile%20C%2B%2B%20Development%20at%20Dropbox%20-%20Alex%20Allain%20-%20CppCon%202014.pdf | The bridge was named as the hard part from day one | "Principles of your language bridge: Keep it thin; Hard to get right; Filled with boilerplate - hides real logic ... You can auto-generate this"; "General: inconsistent debugging"; "Our goal: zero cost for cross-platform dev" |
| 20 | CppCon / Dropbox | "Bridging Languages Cross-Platform", Andrew Twyman and Jacob Potter, CppCon 2015 slides | talk | 2015-09 | 2026-10-15 | https://raw.githubusercontent.com/CppCon/CppCon2015/master/Presentations/Bridging%20Languages%20Cross-Platform/Bridging%20Languages%20Cross-Platform%20-%20Andrew%20Twyman%20and%20Jacob%20Potter%20-%20CppCon%202015.pdf | Djinni deliberately bridged in-process, not over a serialised protocol | "Djinni's Principles: ... Method calls pass control between languages. Not serialized RPC"; one interface yields "(4 files) JNI bridging" and "(4 files) Objective-C++ bridging" |
| 21 | Dropbox | djinni README maintenance note, commit dfb9982 | source | 2019-04-11 | 2026-10-15 | https://github.com/dropbox/djinni/commit/dfb9982af22f8077f7acf9b97b6dcc30ba0d9e2e | Dropbox stopped maintaining the in-process bridge in April 2019 | "This repo is stable but no longer maintained by Dropbox." |
| 22 | Dropbox | djinni commit history, by author address | source | 2014-09-08 to 2020-03-25 | 2026-10-15 | https://github.com/dropbox/djinni | Dropbox-addressed commits collapsed two years before the notice | 2015: 93 of 229; 2016: 41 of 133; 2017: 4 of 39; 2018: 5 of 24; 2019: 3 of 11 |
| 23 | Dropbox | lepton issue #158, "Lepton denial-of-service with specially crafted JPEG files" | postmortem | 2022-11-18 | 2026-10-15 | https://github.com/dropbox/lepton/issues/158 | A crafted JPEG produced a file whose round-trip verification looped forever; reported by Tenable | "This issue was originally reported by Tenable."; the conversion back to JPEG "causes an infinite loop"; sensitive code in encode_eobrun in jpgcoder.cc; repository archived 2023-02-14 |
| 24 | Dropbox | lepton README deprecation notice, commits 05bdcf1 and f34c7f4 | source | 2022-11-18, revised 2023-02-13 | 2026-10-15 | https://raw.githubusercontent.com/dropbox/lepton/f34c7f42d2e0d688239cb880648dc152713c4eae/README.md | Dropbox archived the public C++ codec rather than fix it, while saying internal use was unaffected | "we no longer have sufficient resources to adequately support this project ... While we did ensure that the reported vulnerabilities don't affect our internal use of Lepton, we unfortunately don't have the capacity to properly fix these"; "losslessly compressing JPEGs by an average of 22%" |
| 25 | Microsoft | microsoft/lepton_jpeg_rust README | source | checked at HEAD 2026-10-15 | 2026-10-15 | https://github.com/microsoft/lepton_jpeg_rust | The successor is a Rust port whose stated motive is safety | "a port of the C++ Lepton JPEG compression tool that was released by DropBox"; "the advantage of all the safety features that Rust has to offer"; cites "an exhaustive security check on the C++ code" |
| 26 | Dropbox | pb-jelly README | source | checked at HEAD 0ad4009 | 2026-10-15 | https://raw.githubusercontent.com/dropbox/pb-jelly/0ad40093768bbdb9108a63bbda2c3a4b79c8795a/README.md | Rust has carried Dropbox's storage bytes since 2016 and its sync engine since | "initially written in 2016 to satisfy the need of shuffling large amount of bytes in Dropbox's Storage System (Magic Pocket)"; "used in several parts of Dropbox, including our Sync Engine" |
| 27 | Dropbox | rust-brotli history and crates.io index | source | 2016-04-16 to 2026-08-25 | 2026-10-15 | https://index.crates.io/br/ot/brotli | The Rust codec outlived Dropbox's involvement and is maintained by named individuals | 2018: 170 of 387 commits Dropbox-addressed; 2024: 0 of 153 (top authors Yuri Astrakhan 84, Daniel Reiter Horn 34); latest crate version 9.0.0 |
| 28 | Python | PEP 484, "Type Hints" | adr | created 2014-09-29 | 2026-10-15 | https://raw.githubusercontent.com/python/peps/main/peps/pep-0484.rst | Gradual typing became a language standard modelled on mypy | Author line includes "Jukka Lehtosalo"; "The proposal is strongly inspired by mypy"; "This latter feature is taken from the idea of gradual typing." |
| 29 | Python | python/mypy commit history by author address | source | 2013 to 2026 | 2026-10-15 | https://github.com/python/mypy | Dropbox funded mypy heavily, then stepped back to zero without the project dying | Dropbox-addressed commits: 2015: 321 of 1,442; 2016: 297 of 976; 2017: 59 of 805; 2025: 0 of 862; 2026 to date: 0 of 796 |
| 30 | Python | mypyc README (mypyc/mypyc at 4dcb006) | source | 2021-03-07 | 2026-10-15 | https://raw.githubusercontent.com/mypyc/mypyc/4dcb0062a4c94f771bc09f37d7f74dfa00c513ab/README.md | The type annotations were turned into a compiler and used on the type checker itself | "The mypy project has been using mypyc to compile mypy since 2019, giving it a 4x performance boost over regular Python." |
| 31 | Python | PyPI mypy 0.700 files | source | 2019-04-03 | 2026-10-15 | https://pypi.org/project/mypy/0.700/ | First compiled (CPython-ABI) mypy wheels | First cp35-cp35m wheel in 0.700, uploaded 2019-04-03; release 2.4.0 ships 50 compiled wheels of 52 files |
| 32 | SQLAlchemy | SQLAlchemy 2.0 docs, orm/extensions/mypy.rst |
adr | updated July 2024 | 2026-10-15 | https://raw.githubusercontent.com/sqlalchemy/sqlalchemy/rel_2_0/doc/build/orm/extensions/mypy.rst | A type-checker plugin could not survive the checker's release cadence; native typing replaced it | "This plugin cannot be maintained across constantly changing releases of mypy and its stability going forward CANNOT be guaranteed."; "supported only up until mypy 1.10.1" |
| 33 | Dropbox | sqlalchemy-stubs (repository and PyPI) | source | last release 2021-01-12; last commit 2022-11-14 | 2026-10-15 | https://pypi.org/project/sqlalchemy-stubs/ | Dropbox's own stubs-plus-plugin for SQLAlchemy stopped when the library typed itself | README: "type stubs and a mypy plugin ... SQLAlchemy uses some Python 'magic' that makes having precise types for some code patterns problematic"; last release 0.4 on 2021-01-12 |
| 34 | Dropbox | pyannotate (repository and PyPI) | source | last release 2019-09-16 | 2026-10-15 | https://pypi.org/project/pyannotate/ | The annotation-inference tool was built to be finished with | README: "Insert annotations into your source code based on call arguments and return types observed at runtime."; last release 1.2.0 on 2019-09-16; last commit 2021-10-12 |
| 35 | Dropbox | mypy-protobuf history and PyPI | source | 2017-12-11 to 2026-09-18 | 2026-10-15 | https://pypi.org/project/mypy-protobuf/ | The schema-to-types generator survived its sponsor, maintained by the same person from a personal address | Last nipunn@dropbox.com commit 2021-06-24; nipunn1313@gmail.com commits through 2024-11-21; Dropbox-addressed commits 2022 onward: 0; 46 PyPI releases, latest 5.1.0 on 2026-04-28 |
| 36 | Dropbox | dbx_build_tools README | source | 2019-12-11 to 2023-08-16 | 2026-10-15 | https://raw.githubusercontent.com/dropbox/dbx_build_tools/ee7d614c85217adb061162ed0e5fd852d893b939/README.md | Dropbox built hermetic Python on Bazel; the public copy was written almost entirely by Dropbox and stopped in 2023 | "The build rules support hermetic Python binaries ... Python binaries include a Python interpreter built with Bazel."; Dropbox-addressed commits 2020: 326 of 330; last commit 2023-08-16 |
| 37 | Dropbox | AffectedModuleDetector README, commit 5a10fe5 | source | 2026-06-16 | 2026-10-15 | https://raw.githubusercontent.com/dropbox/AffectedModuleDetector/5a10fe54fe934b2e4b1a7132bb0c2e3c4c36b21b/README.md | Build tooling for the native Android app was handed to another company in 2026 | "Dropbox has archived this repository and is no longer maintaining Affected Module Detector. The project is now actively maintained by Flo Health" |
| 38 | Dropbox | merou README deprecation | source | last commit 2023-04-18 | 2026-10-15 | https://raw.githubusercontent.com/dropbox/merou/a4dae2a016ced01399e491964e0d7516113670a8/README.rst | The in-house group and permission service was deprecated | "The Merou/Grouper project has been deprecated ... the Dropbox team will no longer contribute to this repository." |
| 39 | Dropbox | godropbox on the Go module proxy | source | latest pseudo-version 2023-06-23 | 2026-10-15 | https://proxy.golang.org/github.com/dropbox/godropbox/@latest | The 2014 Go service library's last published version is from 2023, with no deprecation notice | {"Version":"v0.0.0-20230623171840-436d2007a9fd","Time":"2023-06-23T17:18:40Z"}; Dropbox-addressed commits 2014: 255 of 318 |
| 40 | Dropbox | Maven Central metadata for dropbox-core-sdk |
source | lastUpdated 2026-07-15 | 2026-10-15 | https://repo1.maven.org/maven2/com/dropbox/core/dropbox-core-sdk/maven-metadata.xml | The generated Java SDK keeps shipping | <latest>8.0.2</latest>, <lastUpdated>20260715201721</lastUpdated> |
| 41 | Dropbox | npm registry document for dropbox |
source | modified 2026-09-23 | 2026-10-15 | https://registry.npmjs.org/dropbox | The JavaScript SDK has shipped 155 versions | 155 versions; created 2011-05-01; latest 10.47.0 |