Interesting. The option /DYNAMICBASE seems to be the default (to support ASLR). Which means they explicitly disabled it. Wonder why? Are they doing something that needed ASLR to be off?
We have an application that builds with a variety of misconfigured options (by modern standards). We fix 'em when we see 'em.
It's a result of upgrading from VC++4, to VC++5, to VC++6, to VS2003, to VS2005, to VS2008. They're set by the project upgrade wizard, for compatibility reasons.
Which is not to say that Dropbox didn't manually set the flag, I'm unsure if /DYNAMICBASE is set or unset for the sake of compatibility.
It's possible they're using an older version of MSVC or an alternative compiler. I don't think /DYNAMICBASE is on by default in VS2005/2008 and it's definitely not on by default in MinGW GCC.
