19 ms·

Even when told not to, Windows 10 doesn't stop talking to Microsoft

453 points by gregmolnar 11y ago

bsilvereagle 11y ago
> And finally, some traffic seems quite impenetrable. We configured our test virtual machine to use an HTTP and HTTPS proxy (both as a user-level proxy and a system-wide proxy) so that we could more easily monitor its traffic, but Windows 10 seems to make requests to a content delivery network that bypass the proxy. Does this mean a Win10 machine setup to use something like Tor will leak the user's actual IP back to Microsoft? If you're VPN'd, is some traffic still leaking outside of the VPN? From an engineering perspective, how is this happening? Does Microsoft have a second network interface hidden away using hardcoded settings for DNS, etc? On a somewhat related note, if a Win10 app is cert pinning, is there a way to force it to use your cert so you can MITM it?
- zaroth 11y ago
  What they are describing isn't necessarily cert pinning, although it's possible there is also cert pinning. It just means there are hard-coded IP addresses somewhere; either a hard-coded DNS server, or the endpoint itself. Notably, it's still possible to MITM the traffic, just not as easy as if the system respected the proxy settings. You need to spoof the destination IP and try to terminate the TLS with your own trusted cert. If the connection still fails, only then would you know there is a cert pin. I haven't heard if anyone has tried this with the "CDN"-bound traffic, or the persistent bing.com/live.com traffic. If a VPN was being used, I would expect traffic would still be routed through the VPN interface. The HTTP(S) proxy code is higher up the stack than a VPN interface. It does raise a huge red flag though, if you are not fully in control of your own network routing using standard tooling, IMO it's not an appropriate OS for any enterprise environment.
- blackbeard 11y ago
  I've been on Windows 10 for a couple of days now. VPN traffic doesn't leak if the default route is the VPN interface. I tried it and my firewall went silent apart from the tunnel. I have absolutely no fucking idea what it is sending out though. It's always talking to something. I've turned everything off that is documented and use a local account and remove-appxpackage'd everything. Sorry but this release is a write off. My host/vm relation is being inverted to Ubuntu as a host this week rather than a guest. If I don't know what it's doing, how can I trust it?
  - Kenji 11y ago
    Can't you just redirect all that stuff it sends to 127.0.0.1 by editing your hosts file?
    - blackbeard 11y ago
      You can, but we have 450 workstations and about 600 servers. That somewhat multiplies the problems.
      - pc86 11y ago
        > somewhat Yes I can see how that would complicate things a little :)
      - EvanAnderson 11y ago
        If they're using DNS to resolve the name of the "mothership" just put a bogus record (or zone) in your DNS. If they're not using any name resolution protocol and you can isolate the IP addresses they're talking to just blackhole them at your border.
        blackbeard 11y ago
        We're already doing that but it's hard work keeping up with it all.
        a3n 11y ago
        And then Microsoft will fix that, ...
        EvanAnderson 11y ago
        Default deny is the only viable strategy. (It's also completely impractical...)
      - drdaeman 11y ago
        1000+ machines and no way to update a file with a few commands/clicks/whatever-your-configuration-management-system-uses? (Ok, at worst, making a batch file and scheduling its launch.) If so, I suppose you have big issues with your system administration team.
- ised 11y ago
  Change the gateway on the Windows 10 install computer (or "default route" as another commenter calls it) to a computer _you_ control, i.e., a UNIX install, that can do IP forwarding. Turn on IP forwarding. Connect the UNIX install to the internet. Also change your default DNS servers on the Windows 10 install to point to the UNIX install. If you know how, set up DNS on this computer. I recommend using your own cache listening on 127.0.0.x, not a public one. Then monitor traffic being forwarded by the UNIX install. This is not difficult for anyone familiar with UNIX. Plenty of good and bad software to help you. Do people need instructions? If there is interest in blocking this nonsense I for one would be willing to help. There are a lot more Windows users than Apple users so this is fun to watch how the Windows users react to the incessant connections to the mothership, which is par for the course with Apple products. Would love to see the stats on how much cumulative user-purchased bandwidth Apple and Microsoft are usurping in order to track the people who have to pay for it. If you want to block this nonsense, then the easiest way to do it is from another computer acting as a gateway. Trying to block these connections from the computer on which Windows 10 has been installed will probably be an exercise in frustration for most users and they will give up. (Most Apple users do not know or care so they do not try to block.) I am sure that Microsoft is counting on their users acting like Apple users.
  - chopin 11y ago
    If one can master all this, wouldn't it be easier to use a non-Windows box in the first place?
    - wtallis 11y ago
      Of course not. Setting up OpenWRT to do this is a lot less work than migrating your entire workflow to a new operating system.
    - SixSigma 11y ago
      Right when I have finished porting all of my Autodesk products....
  - aluhut 11y ago
    The problem is that it is not an user friendly solution. It will only help those people who do have several OS running or are capable of understanding. The privacy settings that do not work were pretty good hidden already and many are scared away already. This second level is even worse. What we need is a simple tool where you set check boxes to fix it all. That would be a solution for the target audience.
- rsync 11y ago
  Look. Seriously. I don't want to be a brat, but what is the possible overlap between people caring to use Tor (for whatever reason) and people using Windows 10 as the host OS ? You're at the absolute cutting edge of spyware-in-the-home, defective by design, obscured infrastructure that was designed from the ground up to be user hostile in every conceivable dimension. And you're going to run Tor on that. There's a phrase for this and that phrase is "clown college".
  - dmix 11y ago
    Indeed, Microsoft phoning home is on the lower end of your concerns here.
    - deleted 11y ago
      [deleted]
  - lambda 11y ago
    > I don't want to be a brat, but what is the possible overlap between people caring to use Tor (for whatever reason) and people using Windows 10 as the host OS ? Journalists. There are many journalists who need to cover sensitive topics, who are not particularly technically literate. They need to be able to buy a system off the shelf, do some minimal and easy amount of installation of privacy protection, and be reasonably confident that it will work and they will not be outing their sources to whatever particular despot is listing in. Of course, Tails is a better solution for that. But in terms of being able to allow them to do their job as easily as possible, it would be preferable for them to be able to install the Tor browser bundle on their existing OS rather than having to learn an entirely new one (and possibly dual boot in order to run some Windows-only software, and not keep it isolated well enough and thus leak information accidentally). It apparently took a while to teach Glen Greenwald enough of how to use Tor and GPG in order for Snowden to be able to communicate with him. We need to make this process easier, not harder.
    - marcosdumay 11y ago
      Well, looks like they need to get their systems from some seller that is interested on satisfying their needs.
pdkl95 11y ago
From the image of the captured data that is sent when telemetry is "off", a few bits are obviously Windows-style UTF-16. The GUID is obvious, and is that an assert error message? Very strange... prod e5ff4669-311a-0933-dee2-9444eee86460 instrumentation.cpp Instrumentation::StartQosExperience (Utilities::HashMapContains(_qosUXScenarioDataById, scenerioId) == false) Assertfailed: (Utilities::HashMapContains(_qosUXScenarioDataById, scenerioId) == false): Instrumentation is active when we try (it cuts off after "try")
tempodox 11y ago
Maybe I'm just jaded, but does that really surprise anyone? Most “developments” at MS have been nothing but successive layers of lipstick-on-a-pig. No amount of lipstick can make the pig underneath go away.
- Silhouette 11y ago
  It doesn't surprise me. Moves in this direction were likely as soon as Nadella was chosen to be the new CEO and all but certain as soon as they announced the free upgrade push for Windows 10. It does disappoint me, though. Microsoft was one of the few major players in IT that could realistically have offered an antidote to the always-online, spy-on-everything, everything-is-a-service, subscribe-not-buy, force-updates-you-don't-want madness of recent years. Instead, they seem to be throwing good money after bad in what I'm already expecting to be a repeat of Vista/8 level failure. They have about as much chance of actually out-Googling Google as Mozilla do with Firefox, yet like Mozilla they persist in trying and in doing so alienating the substantial user base who valued their products precisely because they weren't like that.
  - saiya-jin 11y ago
    they clearly don't care about their business customers, since this kind of childish behavior is a strict no-go for most companies with at least slightly decent IT. Fair enough, they actually create big holes in the market that startups can eventually fill in. Albeit it won't be easy (replacing Active directory, Exchange and Office suites), rewards are worth it. With that, Microsoft as desktop and server solution provider is a history. Still not getting why they want to copy Google's revenue stream, when they have solid base in vastly different areas...
    - Silhouette 11y ago
      I'm sure Microsoft care very much about their business customers, which is why this seems such an odd strategic move. As you say, why try to copy a company like Google's business model when they have their own well-established one? I'm half-wondering whether the plan has always been to prioritise the consumer market with Windows 10, and they're taking a reasonable punt on the fact that most businesses won't upgrade for a considerable time anyway, giving them enough opportunity to push out updates that address those businesses' concerns based on the early feedback before it really makes much difference. If that is the case then it's still possible that they have misjudged their market and they'll never fully recover from the negative initial reaction they've been receiving in recent weeks, but the strategy itself would be reasonably logical.
jammycakes 11y ago
In all these discussions about Windows 10 phoning home, there are a couple of things that I haven't yet seen properly discussed. 1. Do the different versions of Windows (Home/Pro/Enterprise/Education) behave differently? If so, how? 2. Do the pro/enterprise versions behave differently when they're connected to a domain? I'd imagine that the answer to at least one of these questions would be "yes." This kind of behaviour would be a deal-breaker in many enterprises.
- electricblue 11y ago
  I'd like to know the difference between free upgrades and Win10 installs with a real product key
  - DrPizza 11y ago
    There's no difference (obviously).
    - ConceptJunkie 11y ago
      There _should_ be no difference, but who knows? Who can be sure? MS probably doesn't even know. I recall reading that there were 6 different versions of the Service Pack update for Office 2000 depending on where you got them from, and they weren't all compatible with each other. Do you think after another decade of Monkey Boy and his winning business strategy of pitting all the departments against each other that they've improved? Nardella actually seems like a grown-up, but he's still a dyed-in-the-wool Microsoft exec.... less stupid certainly, but just as evil. One of the biggest problems with Microsoft is that they are too big and disorganized. They have no vision, and no guiding principle, other than maintaining the lingering shreds of their monopoly. This is obvious from looking at the designed-by-committee, piecemeal UI for Windows, which is getting worse every release and not better. The best you can hope for for any particular feature from release to release is that it's just arbitrarily different and not broken or hidden or completely removed. Windows clearly peaked with XP, but their UI peaked with Windows 2000. The only reason 7 is liked is because they backed off most of the bad things they did with Vista, and the only thing, the _only_ thing I think is better in Windows 8 than any previous version is Task Manager, which is not something I use often. But it is nice. My #1 wish for Windows post-7 is that I could just use the "Classic" theme, but apparently Windows is now too sophisticated to do what it could do 15 years ago. Their UX department has gone totally off the rails or maybe was taken over by wild monkeys. Microsoft used to be _the_ place for good UI design back in the 90s. They were very scientific about it, and their designs were very well-thought out, based on CUA, and an absurd amount of user-testing and most of all, consistent. Not perfect, but they were very good. But as soon as graphics cards could do more than 256 colors and Photoshop was invented, everyone went wild and UI became the lawless, Wild West funhouse it remains today. Except in the past few years, everyone decided that the "flat look" is cool (news flash: it's ugly and hard to make out) and now we have UIs that are as usable and good-looking as Windows 2, but without the consistency. I'd thought Microsoft had run out of sharks to jump with Windows 8, but they keep finding more. But here's the thing. I still like Windows. I just wish I could make Windows look at work like it did when it looked and worked well (I'm not referring to the underlying technology, which is presumably improving all the time, although I still think Windows 8 is absurdly slow compared to 7 and much worse compared to XP... and I have empirical evidence. I do a lot of work in a Windows 2003 VM running on VirtualBox (long story) and it's much faster than the Windows 7 host and doesn't suffer from the, oh gee, everything's going to go "Not Responding" for 30 seconds to 2 minutes for no apparent reason that I see with the apps (at least MS apps) on the host.
elcct 11y ago
Is Microsoft paying for that traffic?
- irixusr 11y ago
  In canada that's a big concern
  - inversionOf 11y ago
    It's a concern anywhere with caps, which increasingly includes much of the US as well. FWIW I'm in Canada and recently my provider (Cogeco) switching my 120Mbps plan to unlimited data per month, which is nice. This actually brings up a great point which is that systems need some sort of bandwidth conservation setting. We recently were traveling and had a couple of laptops and pads with us. Having no data connection at the hotel we were at, I enabled tethering on my smartphone. Last than an hour later I got a warning that they had blown through my 5GB. This wasn't active use, but literally was largely laptops auto downloading patches (they hadn't been turned on in a couple of weeks, backlogging GBs) and browser updates, pads pulling a tonne of updates, etc. It is becoming completely unmanageable.
    - scorpioxy 11y ago
      That's without setting the connection as a metered connection, right? Once i saw that option, I immediately set it because I also use my mobile data connection for access.
    - pdkl95 11y ago
      The problem isn't limited to bandwidth caps and pay-per-byte; bandwidth usage can be a problem anywhere bandwidth is finite. Any heuristic that tries to hide the bandwidth usage based on a single computer can fail when there are other computers using the same network.
  - calvin_ 11y ago
    Maybe in Ontario. It's uncapped out east.
jorgecastillo 11y ago
I am sticking with Windows 7 until I get out of college and after that I am ditching Windows forever.
- gtk40 11y ago
  I too got rid of Windows as soon as I graduated. It's been a nice feeling.
- deleted 11y ago
  [deleted]
- rm_-rf_slash 11y ago
  God forbid Microsoft give 7 the boot for support like they did XP. Windows 7 is standard for workstations at the college administration where I work, and suggestions to switch to 8 are met with laughter across the board. We have trouble enough with China trying to hack us literally thousands of times per day, and there is no reason to trust Windows 10 to be any more secure.
  - Hello71 11y ago
    > We have trouble enough with China trying to hack us literally thousands of times per day you mean you did "tail -f /var/log/secure". > God forbid Microsoft give 7 the boot for support like they did XP. god forbid Microsoft try to deprecate OSs after nearly 13 years. note that in 2001, the newest Linux kernel available was in the 2.4 series, with many people still using 2.2.
    - Silhouette 11y ago
      god forbid Microsoft try to deprecate OSs after nearly 13 years. You seem to have invented a decade. Windows 8 RTM was just over 3 years ago. Also, while I have some sympathy with both the idea that software isn't perfect and the idea that Microsoft need a viable business model, I don't think it's unreasonable to expect a product like Windows 7 to come with essential support for a significant period of time, perhaps based on the expected working lifetime of devices where the software is normally installed. It's true that we don't know how to make perfect software yet, but it's also still the case that those security and bug fixes are only necessary because the product as originally provided was defective. If you're making as much money from a product as Microsoft do from Windows, and if defects in your product cause harm on the scale that bugs in Windows do, I think it's fair to expect you to make good your mistakes for a reasonable period as well. It also seems to me that Microsoft could do very well from stating a reasonable period of guaranteed support with the purchase but then offering reasonably-priced ongoing support afterwards so it have a real revenue stream to fund long-term maintenance if it turns out that devices running Windows 7 are in use for a long time. This also conveniently removes the incentive to ship successive products that are seen to be worse than what people had before.
PythonicAlpha 11y ago
You agreed to the privacy terms, so you are at the mercy of whatsoever Microsoft implemented. Windows 10 even could totally ignore your settings. I say this, not because I think that this is OK, but to reflect, that even the change of the settings do not save you from the harm, that was done from the privacy terms! Why downvoted? When you disagree, than give arguments, not gutless clicks!
- thescrewdriver 11y ago
  Very few people will read the privacy terms. Just because they have a document people clicked 'agree' below without reading doesn't mean that MS should not be held to account for what Windows 10 is leaking. For many users not using Windows isn't an option.
  - tomswartz07 11y ago
    The other thing to note is that they've changed the terms during an automatic update. The terms that they changed had several opt-out (as opposed to off-by-default opt-in) features that are mentioned in OP's article.
    - drdaeman 11y ago
      So, Microsoft did unethical but legal move. That's almost exactly what he said - Legally, user is at MS' mercy, ethically that's not OK.
  - PythonicAlpha 11y ago
    With such an argumentation, you could just trash any terms. As long as they are not against any law, they are valid, as long as they do not contain something that is totally unexpected (for example that you must pay Microsoft additional fees above the normal price). I also think, that Microsoft should be held accountable -- but it starts with those terms! I think, many people just rushed into Windows 10, because it was free. But free, seldom means free in deed. A clever trick of Microsoft to trick people into this. As long the privacy terms are not effectively changed and the OS stops to send coded data to servers, this OS can not be trusted.
cautious_int 11y ago
Windows 10 seems to transmit information to the server even when OneDrive is disabled and logins are using a local account that isn't connected to a Microsoft Account. Well there you go. If you ever wondered whether this is happening only on the Microsoft Account(tm).
thescrewdriver 11y ago
Until recently Microsoft had taken a far more reasonable approach to privacy than say Google. Anyone remember the MS "gmail man" ads mocking the way Google inspects your email when MS doesn't? It seems that MS under Nadella has taken a decidedly Google-like turn away from privacy with Windows 10. MS seems as hell-bent as Google and Facebook to collect as much data about you as possible, even if it is for seemingly innocuous purposes.
- inversionOf 11y ago
  "Anyone remember the MS "gmail man" ads mocking the way Google inspects your email when MS doesn't?" Did anyone actually fall for that? Intelligent systems need information to function, and when the intelligence is personalized, it needs personal information. One of the reasons Google has succeeded is because of that personal information, providing services that have enough context that they are three quarters of the way to my destination before I've even started. It is enormously jarring how over the top Microsoft went with Windows 10, with insane defaults and little justification, but this is the manifestation of the whole "cloud like" platform. Increasingly we expect a world where a device is just a terminal into a platform, and we can jump to different devices and form factors and the world is almost the same. That is what Microsoft is trying for, clumsily.
  - jevgeni 11y ago
    How is Google scanning massively one's emails a requirement for "intelligent systems" and is OK, but Microsoft sending telemetry data is "over the top"?
    - inversionOf 11y ago
      While I hardly think you're asking with any sincerity, sharing every keystroke, local system search, application activity, wifi passwords, and so on is over the top. Making that the default, instead of a value-add that you pitch, was profoundly poorly considered.
      - 11y ago
fumar 11y ago
I'm not savvy enough to discern whether OSX os iOS does this. Does anyone know if iDevices also ping back to Apple?
- jshelly 11y ago
  Little snitch indicates OSX does, but I'm not savvy enough to discern in what capacity or the content
  - chmaynard 11y ago
    As I understand it, Little Snitch is a process-level network firewall that uses a kernel extension to monitor and report all outgoing traffic. I have used it for about a week on a Mac running OS X 10.11, and I'm seeing lots of undocumented traffic from apps and daemons signed by Apple. By undocumented, I mean that the built-in docs in Little Snitch can't explain what the sender is doing.
- jeromegv 11y ago
  OSX only does for Spotlight & Safari search, but you can disable it (and it actually disables it). Details here: https://fix-macosx.com https://fix-macosx.com
jcadam 11y ago
Wow. I use Linux and BSD on my own machines, but the rest of the family is on Windows 10. This sort of thing makes me seriously think about trying to get the wife and kids to consider switching :/
- scuba7183 11y ago
  I had the Win10 preview on a spare laptop that I just use for Netflix and Pandora, and was planning on just upgrading it to full 10..... until all this came out. Wiped it and installed Xubuntu. I did like Windows 10 though, but then they kinda ruined it
ultramancool 11y ago
Hah, I mentioned this a few days ago. Glad to see someone picked it up and ran it. https://news.ycombinator.com/item?id=10037753 https://news.ycombinator.com/item?id=10037753
enqk 11y ago
This highlights what we really lost when consumer operating systems started replacing enterprise-grade operating systems. I would have never imagined this kind of things happening on something like Solaris or Irix, which were the base operating systems of many workstations. At some point when Linux became popular it suggested that the regular consumer would benefit from the robustness, focus, reliability of an entreprise grade OS. Not so.. That large companies accept this state of affair is extremely surprising. That we accept that our electricity and communication bills are being diverted to serve the interest of an operating system's creator.. that sounds crazy. It's like letting the creator of your fridge eat your food and drive your car.
- t0mbstone 11y ago
  Would you let the creator of your fridge eat some of your food, if they gave you the fridge for free?
  - GhotiFish 11y ago
    If I put a lock on the fridge they gave me, should I be taken to jail?
  - mjcohen 11y ago
    Maybe, from the stuff in the back that is way past its use-by date.
  - enqk 11y ago
    Well I would let them maybe eat some food once or twice but they certainly would not have the key to my appartment
  - pmelendez 11y ago
    That analogy doesn't hold up... if any it would be if you'd let the creator of the fridge to see which food are you putting in so it can tell Amazon and offering you similar items. And then you would decide if you take advantage of that or if you would not use it because of fear that the fridge would be sharing more than just the items you bought.
otis_inf 11y ago
In the post-Snowden era, USA tech corporations, like Microsoft, felt the downturn on trust from non-USA companies and citizens in their online offerings. With Microsoft betting more and more on their cloud services, I find it strange (or maybe it isn't strange, but let's be naive for a minute here) that Microsoft goes against this and actually gives people _more_ reasons to not trust them than less. As if they're thinking we all don't give a shit. But if we all didn't, why the downturn in trust in USA tech corporations post-Snowden? I can't help but think that this is either massively naive from their part (people/companies won't care, they will buy our stuff and services regardless) or very short-sighted (as it will hurt their cloud services offerings in the long run, the more they hammer down the trust from their own users in MS' wares.)
- sliverstorm 11y ago
  Or maybe when nobody trusts you anyway, that ship has sailed? :)
w8rbt 11y ago
Windows 10 reminds me of a saying an old co-worker of mine used a lot, "Vendors lie... packets don't."
jellicle 11y ago
I have a really hard time understanding how "enterprises" are going to upgrade to Windows 10. An operating system that is sending random internal data to random places on the internet seems to violate both a wide selection of national laws related to data privacy, and many corporate policies relating to trade secrets, privacy, internal operations and so on. Microsoft must have thought of this. What's their plan for continuing to sell to these customers?
bhouston 11y ago
Given that it is proven that the NSA spied on European companies for economic reasons, this isn't a good idea. Now the NSA can just tap into Microsoft, either covertly or through court order, and spy on the whole world. Details of economic spying -- may not be the best article but the easiest to find: http://www.hurriyetdailynews.com/nsa-spied-on-french-economy-ministers-top-companies-reports-.aspx?pageID=238&nID=84733&NewsCatID=351 http://www.hurriyetdailynews.com/nsa-spied-on-french-economy...
- likeclockwork 11y ago
  Embrace, Extend, Eavesdrop.
mjcohen 11y ago
I got a refurbished HP Stream 11 for $120 (Groupon) and spent 3 hours upgrading to Windows 10. I then installed Chrome and LibreOffice. It works fine, but, with all these privacy invasions, I see no reason to use it. My Acer C720 Chromebook (upgraded to a 128GB SSD) with Crouton and Ubuntu 14.04 is much more useful to me.
- gluelogic 11y ago
  This is totally off topic, but, if you don't mind sharing, what SSD did you get? I have the same Chromebook running Arch, but it has been idling since I got something else. I really want to upgrade it and start using it again.
cryptophreak 11y ago
Of course this is true. Companies make money by spying on their customers. Did we really imagine that flipping the “Stop making money” preference was going to work?
- oxide 11y ago
  well...yes. I fully expect when I opt out of something, anything, that it isn't still doing what I just thought I opted out of. that's probably my fault for being so naive.
datainplace 11y ago
Stupid question, but my Mom lives in a really rural area. Pays quite a bit for internet and is charged by the MB. Can we ask Microsoft to pay for their bandwidth usage? Since upgrading to Windows 10 she's been hit with $200 in overages.
- hebdo 11y ago
  This seems to be one of the real costs of upgrading to the latest version of Windows. In this case your mom has to pay the bills, but in general I'm curious how long will it take for ISPs to launch a solid campaign against Microsoft, like they did with Netflix.
  - technojunkie 11y ago
    How is this a real cost, is there an estimate of how many bytes are sent and received and at what interval? If it was anywhere in the thousands of megabytes regularly, maybe that's the real cost but that's just an assumption.
    - hebdo 11y ago
      Not quite sure what is your point here. The amount of megabytes transferred each month does not have to be any particular fixed number to become a burden for the user, or the ISP. We can see that at least in one case (and probably many more) such a cost can exceed $200. All of this without user's consent. Microsoft, please get your stuff together. Hire some privacy aware people.
- ikeboy 11y ago
  Did she set the connection as "metered"? I know some things stop then. The $200 is likely from the automatic updates, which were pretty big. How much extra in MB was it?
  - noja 11y ago
    It's likely from the automatic _sharing_ of automatic updates.
yellowapple 11y ago
It's hard to know without inspecting the exact data involved, but I feel like this is dangerously close to a HIPAA or HITECH breach, and I know of several hospitals who are strongly on the Microsoft bandwagon and are considering Windows 10. The "send search data to an internet endpoint even if it's patently obvious that the search is for local resources" reeks strongly of Ubuntu's Amazon Shopping Lens. Did Mark Shuttleworth switch gears from Canonical to Microsoft when I wasn't looking?
- dragonwriter 11y ago
  > It's hard to know without inspecting the exact data involved, but I feel like this is dangerously close to a HIPAA or HITECH breach Perhaps pedantic, but that's redundant; HITECH doesn't define breaches separately from HIPAA, it establishes standards for when HIPAA data is "unsecured" and reporting requirements, etc., related to HIPAA breaches.
  - yellowapple 11y ago
    I'm aware; my point was that there are HITECH implications as well that would be very hard to address with Windows 10 if my suspicions are correct; it would be hard to meet the breach reporting and notification requirements when the operating system may very well be actively siphoning PII even when supposedly configured to do otherwise. The only safe option is to assume that any patient data that exists on a Windows 10 system is unsecured unless that system is entirely disconnected from any kind of network or until Windows 10 is significantly more transparent about what it's doing behind users' backs. Of course, this is speculation right now, and perhaps my concerns are unfounded, but I can already imagine some old doctor typing "J. Random Hacker biopsy" into that Start Menu search field in the hopes of finding some document and inadvertently sending the fact that J. Random Hacker had a biopsy to Microsoft and potentially some advertising partners (depending on the nature of such transmissions).
godgod 11y ago
The NSA is loving this. Microsoft 10 is their new operating system.
mark_l_watson 11y ago
I was downvoted and criticised a few days ago for defending Microsoft on Windows 10. I am starting to change my opinion after looking into the issue more. I watched a recent Richard Stallman talk on youtube and went through the process of making the tightest privacy settings I could on my iPad, Windows 10 laptop, and Android phone. (I left my Mac and Linux laptops as is since I just use those for development.) I think that Microsoft looked at the Google Now user experience on Android phones and decided to emulate that type of AI assistent in Windows. Google collects all sorts of user context information and Microsoft decided to do the same. This is a guess but the difference may be that (some) people are willing to have less privacy on their smartphones but care more about privacy on their computers.
- dragonwriter 11y ago
  > I think that Microsoft looked at the Google Now user experience on Android phones and decided to emulate that type of AI assistent in Windows. I don't mind that (Cortana). I do mind that when Cortana and its supporting options are explicitly disabled, Win 10 apparently still won't stop chattering back with HQ constantly. Not only for privacy reasons either; it seems (though I'm not certain of the relationship) to have a substantial, though intermittent rather than constant, impact on performance.
  - mark_l_watson 11y ago
    I agree.
tdkl 11y ago
Funny, nowadays there seem to be more firewall rules needed for outbound traffic then inbound on Windows. In the old days we had a name for that - spyware.
- PythonicAlpha 11y ago
  The name today is "cloud" ;)

453 points by gregmolnar 11y ago

> And finally, some traffic seems quite impenetrable. We configured our test virtual machine to use an HTTP and HTTPS proxy (both as a user-level proxy and a system-wide proxy) so that we could more easily monitor its traffic, but Windows 10 seems to make requests to a content delivery network that bypass the proxy. Does this mean a Win10 machine setup to use something like Tor will leak the user's actual IP back to Microsoft? If you're VPN'd, is some traffic still leaking outside of the VPN? From an engineering perspective, how is this happening? Does Microsoft have a second network interface hidden away using hardcoded settings for DNS, etc? On a somewhat related note, if a Win10 app is cert pinning, is there a way to force it to use your cert so you can MITM it?

zaroth 11y ago
What they are describing isn't necessarily cert pinning, although it's possible there is also cert pinning. It just means there are hard-coded IP addresses somewhere; either a hard-coded DNS server, or the endpoint itself. Notably, it's still possible to MITM the traffic, just not as easy as if the system respected the proxy settings. You need to spoof the destination IP and try to terminate the TLS with your own trusted cert. If the connection still fails, only then would you know there is a cert pin. I haven't heard if anyone has tried this with the "CDN"-bound traffic, or the persistent bing.com/live.com traffic. If a VPN was being used, I would expect traffic would still be routed through the VPN interface. The HTTP(S) proxy code is higher up the stack than a VPN interface. It does raise a huge red flag though, if you are not fully in control of your own network routing using standard tooling, IMO it's not an appropriate OS for any enterprise environment.
blackbeard 11y ago
I've been on Windows 10 for a couple of days now. VPN traffic doesn't leak if the default route is the VPN interface. I tried it and my firewall went silent apart from the tunnel. I have absolutely no fucking idea what it is sending out though. It's always talking to something. I've turned everything off that is documented and use a local account and remove-appxpackage'd everything. Sorry but this release is a write off. My host/vm relation is being inverted to Ubuntu as a host this week rather than a guest. If I don't know what it's doing, how can I trust it?
- Kenji 11y ago
  Can't you just redirect all that stuff it sends to 127.0.0.1 by editing your hosts file?
  - blackbeard 11y ago
    You can, but we have 450 workstations and about 600 servers. That somewhat multiplies the problems.
    - pc86 11y ago
      > somewhat Yes I can see how that would complicate things a little :)
    - EvanAnderson 11y ago
      If they're using DNS to resolve the name of the "mothership" just put a bogus record (or zone) in your DNS. If they're not using any name resolution protocol and you can isolate the IP addresses they're talking to just blackhole them at your border.
      - blackbeard 11y ago
        We're already doing that but it's hard work keeping up with it all.
        a3n 11y ago
        And then Microsoft will fix that, ...
        EvanAnderson 11y ago
        Default deny is the only viable strategy. (It's also completely impractical...)
    - drdaeman 11y ago
      1000+ machines and no way to update a file with a few commands/clicks/whatever-your-configuration-management-system-uses? (Ok, at worst, making a batch file and scheduling its launch.) If so, I suppose you have big issues with your system administration team.
ised 11y ago
Change the gateway on the Windows 10 install computer (or "default route" as another commenter calls it) to a computer _you_ control, i.e., a UNIX install, that can do IP forwarding. Turn on IP forwarding. Connect the UNIX install to the internet. Also change your default DNS servers on the Windows 10 install to point to the UNIX install. If you know how, set up DNS on this computer. I recommend using your own cache listening on 127.0.0.x, not a public one. Then monitor traffic being forwarded by the UNIX install. This is not difficult for anyone familiar with UNIX. Plenty of good and bad software to help you. Do people need instructions? If there is interest in blocking this nonsense I for one would be willing to help. There are a lot more Windows users than Apple users so this is fun to watch how the Windows users react to the incessant connections to the mothership, which is par for the course with Apple products. Would love to see the stats on how much cumulative user-purchased bandwidth Apple and Microsoft are usurping in order to track the people who have to pay for it. If you want to block this nonsense, then the easiest way to do it is from another computer acting as a gateway. Trying to block these connections from the computer on which Windows 10 has been installed will probably be an exercise in frustration for most users and they will give up. (Most Apple users do not know or care so they do not try to block.) I am sure that Microsoft is counting on their users acting like Apple users.
- chopin 11y ago
  If one can master all this, wouldn't it be easier to use a non-Windows box in the first place?
  - wtallis 11y ago
    Of course not. Setting up OpenWRT to do this is a lot less work than migrating your entire workflow to a new operating system.
  - SixSigma 11y ago
    Right when I have finished porting all of my Autodesk products....
- aluhut 11y ago
  The problem is that it is not an user friendly solution. It will only help those people who do have several OS running or are capable of understanding. The privacy settings that do not work were pretty good hidden already and many are scared away already. This second level is even worse. What we need is a simple tool where you set check boxes to fix it all. That would be a solution for the target audience.
rsync 11y ago
Look. Seriously. I don't want to be a brat, but what is the possible overlap between people caring to use Tor (for whatever reason) and people using Windows 10 as the host OS ? You're at the absolute cutting edge of spyware-in-the-home, defective by design, obscured infrastructure that was designed from the ground up to be user hostile in every conceivable dimension. And you're going to run Tor on that. There's a phrase for this and that phrase is "clown college".
- dmix 11y ago
  Indeed, Microsoft phoning home is on the lower end of your concerns here.
  - deleted 11y ago
    [deleted]
- lambda 11y ago
  > I don't want to be a brat, but what is the possible overlap between people caring to use Tor (for whatever reason) and people using Windows 10 as the host OS ? Journalists. There are many journalists who need to cover sensitive topics, who are not particularly technically literate. They need to be able to buy a system off the shelf, do some minimal and easy amount of installation of privacy protection, and be reasonably confident that it will work and they will not be outing their sources to whatever particular despot is listing in. Of course, Tails is a better solution for that. But in terms of being able to allow them to do their job as easily as possible, it would be preferable for them to be able to install the Tor browser bundle on their existing OS rather than having to learn an entirely new one (and possibly dual boot in order to run some Windows-only software, and not keep it isolated well enough and thus leak information accidentally). It apparently took a while to teach Glen Greenwald enough of how to use Tor and GPG in order for Snowden to be able to communicate with him. We need to make this process easier, not harder.
  - marcosdumay 11y ago
    Well, looks like they need to get their systems from some seller that is interested on satisfying their needs.

pdkl95 11y ago

From the image of the captured data that is sent when telemetry is "off", a few bits are obviously Windows-style UTF-16. The GUID is obvious, and is that an assert error message? Very strange... prod e5ff4669-311a-0933-dee2-9444eee86460 instrumentation.cpp Instrumentation::StartQosExperience (Utilities::HashMapContains(_qosUXScenarioDataById, scenerioId) == false) Assertfailed: (Utilities::HashMapContains(_qosUXScenarioDataById, scenerioId) == false): Instrumentation is active when we try (it cuts off after "try")

tempodox 11y ago

Maybe I'm just jaded, but does that really surprise anyone? Most “developments” at MS have been nothing but successive layers of lipstick-on-a-pig. No amount of lipstick can make the pig underneath go away.

Silhouette 11y ago
It doesn't surprise me. Moves in this direction were likely as soon as Nadella was chosen to be the new CEO and all but certain as soon as they announced the free upgrade push for Windows 10. It does disappoint me, though. Microsoft was one of the few major players in IT that could realistically have offered an antidote to the always-online, spy-on-everything, everything-is-a-service, subscribe-not-buy, force-updates-you-don't-want madness of recent years. Instead, they seem to be throwing good money after bad in what I'm already expecting to be a repeat of Vista/8 level failure. They have about as much chance of actually out-Googling Google as Mozilla do with Firefox, yet like Mozilla they persist in trying and in doing so alienating the substantial user base who valued their products precisely because they weren't like that.
- saiya-jin 11y ago
  they clearly don't care about their business customers, since this kind of childish behavior is a strict no-go for most companies with at least slightly decent IT. Fair enough, they actually create big holes in the market that startups can eventually fill in. Albeit it won't be easy (replacing Active directory, Exchange and Office suites), rewards are worth it. With that, Microsoft as desktop and server solution provider is a history. Still not getting why they want to copy Google's revenue stream, when they have solid base in vastly different areas...
  - Silhouette 11y ago
    I'm sure Microsoft care very much about their business customers, which is why this seems such an odd strategic move. As you say, why try to copy a company like Google's business model when they have their own well-established one? I'm half-wondering whether the plan has always been to prioritise the consumer market with Windows 10, and they're taking a reasonable punt on the fact that most businesses won't upgrade for a considerable time anyway, giving them enough opportunity to push out updates that address those businesses' concerns based on the early feedback before it really makes much difference. If that is the case then it's still possible that they have misjudged their market and they'll never fully recover from the negative initial reaction they've been receiving in recent weeks, but the strategy itself would be reasonably logical.

jammycakes 11y ago

In all these discussions about Windows 10 phoning home, there are a couple of things that I haven't yet seen properly discussed. 1. Do the different versions of Windows (Home/Pro/Enterprise/Education) behave differently? If so, how? 2. Do the pro/enterprise versions behave differently when they're connected to a domain? I'd imagine that the answer to at least one of these questions would be "yes." This kind of behaviour would be a deal-breaker in many enterprises.

electricblue 11y ago
I'd like to know the difference between free upgrades and Win10 installs with a real product key
- DrPizza 11y ago
  There's no difference (obviously).
  - ConceptJunkie 11y ago
    There _should_ be no difference, but who knows? Who can be sure? MS probably doesn't even know. I recall reading that there were 6 different versions of the Service Pack update for Office 2000 depending on where you got them from, and they weren't all compatible with each other. Do you think after another decade of Monkey Boy and his winning business strategy of pitting all the departments against each other that they've improved? Nardella actually seems like a grown-up, but he's still a dyed-in-the-wool Microsoft exec.... less stupid certainly, but just as evil. One of the biggest problems with Microsoft is that they are too big and disorganized. They have no vision, and no guiding principle, other than maintaining the lingering shreds of their monopoly. This is obvious from looking at the designed-by-committee, piecemeal UI for Windows, which is getting worse every release and not better. The best you can hope for for any particular feature from release to release is that it's just arbitrarily different and not broken or hidden or completely removed. Windows clearly peaked with XP, but their UI peaked with Windows 2000. The only reason 7 is liked is because they backed off most of the bad things they did with Vista, and the only thing, the _only_ thing I think is better in Windows 8 than any previous version is Task Manager, which is not something I use often. But it is nice. My #1 wish for Windows post-7 is that I could just use the "Classic" theme, but apparently Windows is now too sophisticated to do what it could do 15 years ago. Their UX department has gone totally off the rails or maybe was taken over by wild monkeys. Microsoft used to be _the_ place for good UI design back in the 90s. They were very scientific about it, and their designs were very well-thought out, based on CUA, and an absurd amount of user-testing and most of all, consistent. Not perfect, but they were very good. But as soon as graphics cards could do more than 256 colors and Photoshop was invented, everyone went wild and UI became the lawless, Wild West funhouse it remains today. Except in the past few years, everyone decided that the "flat look" is cool (news flash: it's ugly and hard to make out) and now we have UIs that are as usable and good-looking as Windows 2, but without the consistency. I'd thought Microsoft had run out of sharks to jump with Windows 8, but they keep finding more. But here's the thing. I still like Windows. I just wish I could make Windows look at work like it did when it looked and worked well (I'm not referring to the underlying technology, which is presumably improving all the time, although I still think Windows 8 is absurdly slow compared to 7 and much worse compared to XP... and I have empirical evidence. I do a lot of work in a Windows 2003 VM running on VirtualBox (long story) and it's much faster than the Windows 7 host and doesn't suffer from the, oh gee, everything's going to go "Not Responding" for 30 seconds to 2 minutes for no apparent reason that I see with the apps (at least MS apps) on the host.

elcct 11y ago

Is Microsoft paying for that traffic?

irixusr 11y ago
In canada that's a big concern
- inversionOf 11y ago
  It's a concern anywhere with caps, which increasingly includes much of the US as well. FWIW I'm in Canada and recently my provider (Cogeco) switching my 120Mbps plan to unlimited data per month, which is nice. This actually brings up a great point which is that systems need some sort of bandwidth conservation setting. We recently were traveling and had a couple of laptops and pads with us. Having no data connection at the hotel we were at, I enabled tethering on my smartphone. Last than an hour later I got a warning that they had blown through my 5GB. This wasn't active use, but literally was largely laptops auto downloading patches (they hadn't been turned on in a couple of weeks, backlogging GBs) and browser updates, pads pulling a tonne of updates, etc. It is becoming completely unmanageable.
  - scorpioxy 11y ago
    That's without setting the connection as a metered connection, right? Once i saw that option, I immediately set it because I also use my mobile data connection for access.
  - pdkl95 11y ago
    The problem isn't limited to bandwidth caps and pay-per-byte; bandwidth usage can be a problem anywhere bandwidth is finite. Any heuristic that tries to hide the bandwidth usage based on a single computer can fail when there are other computers using the same network.
- calvin_ 11y ago
  Maybe in Ontario. It's uncapped out east.

jorgecastillo 11y ago

I am sticking with Windows 7 until I get out of college and after that I am ditching Windows forever.

gtk40 11y ago
I too got rid of Windows as soon as I graduated. It's been a nice feeling.
deleted 11y ago
[deleted]
rm_-rf_slash 11y ago
God forbid Microsoft give 7 the boot for support like they did XP. Windows 7 is standard for workstations at the college administration where I work, and suggestions to switch to 8 are met with laughter across the board. We have trouble enough with China trying to hack us literally thousands of times per day, and there is no reason to trust Windows 10 to be any more secure.
- Hello71 11y ago
  > We have trouble enough with China trying to hack us literally thousands of times per day you mean you did "tail -f /var/log/secure". > God forbid Microsoft give 7 the boot for support like they did XP. god forbid Microsoft try to deprecate OSs after nearly 13 years. note that in 2001, the newest Linux kernel available was in the 2.4 series, with many people still using 2.2.
  - Silhouette 11y ago
    god forbid Microsoft try to deprecate OSs after nearly 13 years. You seem to have invented a decade. Windows 8 RTM was just over 3 years ago. Also, while I have some sympathy with both the idea that software isn't perfect and the idea that Microsoft need a viable business model, I don't think it's unreasonable to expect a product like Windows 7 to come with essential support for a significant period of time, perhaps based on the expected working lifetime of devices where the software is normally installed. It's true that we don't know how to make perfect software yet, but it's also still the case that those security and bug fixes are only necessary because the product as originally provided was defective. If you're making as much money from a product as Microsoft do from Windows, and if defects in your product cause harm on the scale that bugs in Windows do, I think it's fair to expect you to make good your mistakes for a reasonable period as well. It also seems to me that Microsoft could do very well from stating a reasonable period of guaranteed support with the purchase but then offering reasonably-priced ongoing support afterwards so it have a real revenue stream to fund long-term maintenance if it turns out that devices running Windows 7 are in use for a long time. This also conveniently removes the incentive to ship successive products that are seen to be worse than what people had before.

PythonicAlpha 11y ago

You agreed to the privacy terms, so you are at the mercy of whatsoever Microsoft implemented. Windows 10 even could totally ignore your settings. I say this, not because I think that this is OK, but to reflect, that even the change of the settings do not save you from the harm, that was done from the privacy terms! Why downvoted? When you disagree, than give arguments, not gutless clicks!

thescrewdriver 11y ago
Very few people will read the privacy terms. Just because they have a document people clicked 'agree' below without reading doesn't mean that MS should not be held to account for what Windows 10 is leaking. For many users not using Windows isn't an option.
- tomswartz07 11y ago
  The other thing to note is that they've changed the terms during an automatic update. The terms that they changed had several opt-out (as opposed to off-by-default opt-in) features that are mentioned in OP's article.
  - drdaeman 11y ago
    So, Microsoft did unethical but legal move. That's almost exactly what he said - Legally, user is at MS' mercy, ethically that's not OK.
- PythonicAlpha 11y ago
  With such an argumentation, you could just trash any terms. As long as they are not against any law, they are valid, as long as they do not contain something that is totally unexpected (for example that you must pay Microsoft additional fees above the normal price). I also think, that Microsoft should be held accountable -- but it starts with those terms! I think, many people just rushed into Windows 10, because it was free. But free, seldom means free in deed. A clever trick of Microsoft to trick people into this. As long the privacy terms are not effectively changed and the OS stops to send coded data to servers, this OS can not be trusted.

cautious_int 11y ago

Windows 10 seems to transmit information to the server even when OneDrive is disabled and logins are using a local account that isn't connected to a Microsoft Account. Well there you go. If you ever wondered whether this is happening only on the Microsoft Account(tm).

thescrewdriver 11y ago

Until recently Microsoft had taken a far more reasonable approach to privacy than say Google. Anyone remember the MS "gmail man" ads mocking the way Google inspects your email when MS doesn't? It seems that MS under Nadella has taken a decidedly Google-like turn away from privacy with Windows 10. MS seems as hell-bent as Google and Facebook to collect as much data about you as possible, even if it is for seemingly innocuous purposes.

inversionOf 11y ago
"Anyone remember the MS "gmail man" ads mocking the way Google inspects your email when MS doesn't?" Did anyone actually fall for that? Intelligent systems need information to function, and when the intelligence is personalized, it needs personal information. One of the reasons Google has succeeded is because of that personal information, providing services that have enough context that they are three quarters of the way to my destination before I've even started. It is enormously jarring how over the top Microsoft went with Windows 10, with insane defaults and little justification, but this is the manifestation of the whole "cloud like" platform. Increasingly we expect a world where a device is just a terminal into a platform, and we can jump to different devices and form factors and the world is almost the same. That is what Microsoft is trying for, clumsily.
- jevgeni 11y ago
  How is Google scanning massively one's emails a requirement for "intelligent systems" and is OK, but Microsoft sending telemetry data is "over the top"?
  - inversionOf 11y ago
    While I hardly think you're asking with any sincerity, sharing every keystroke, local system search, application activity, wifi passwords, and so on is over the top. Making that the default, instead of a value-add that you pitch, was profoundly poorly considered.
    - 11y ago

fumar 11y ago

I'm not savvy enough to discern whether OSX os iOS does this. Does anyone know if iDevices also ping back to Apple?

jshelly 11y ago
Little snitch indicates OSX does, but I'm not savvy enough to discern in what capacity or the content
- chmaynard 11y ago
  As I understand it, Little Snitch is a process-level network firewall that uses a kernel extension to monitor and report all outgoing traffic. I have used it for about a week on a Mac running OS X 10.11, and I'm seeing lots of undocumented traffic from apps and daemons signed by Apple. By undocumented, I mean that the built-in docs in Little Snitch can't explain what the sender is doing.
jeromegv 11y ago
OSX only does for Spotlight & Safari search, but you can disable it (and it actually disables it). Details here: https://fix-macosx.com https://fix-macosx.com

jcadam 11y ago

Wow. I use Linux and BSD on my own machines, but the rest of the family is on Windows 10. This sort of thing makes me seriously think about trying to get the wife and kids to consider switching :/

scuba7183 11y ago
I had the Win10 preview on a spare laptop that I just use for Netflix and Pandora, and was planning on just upgrading it to full 10..... until all this came out. Wiped it and installed Xubuntu. I did like Windows 10 though, but then they kinda ruined it

ultramancool 11y ago

Hah, I mentioned this a few days ago. Glad to see someone picked it up and ran it. https://news.ycombinator.com/item?id=10037753 https://news.ycombinator.com/item?id=10037753

enqk 11y ago

This highlights what we really lost when consumer operating systems started replacing enterprise-grade operating systems. I would have never imagined this kind of things happening on something like Solaris or Irix, which were the base operating systems of many workstations. At some point when Linux became popular it suggested that the regular consumer would benefit from the robustness, focus, reliability of an entreprise grade OS. Not so.. That large companies accept this state of affair is extremely surprising. That we accept that our electricity and communication bills are being diverted to serve the interest of an operating system's creator.. that sounds crazy. It's like letting the creator of your fridge eat your food and drive your car.

t0mbstone 11y ago
Would you let the creator of your fridge eat some of your food, if they gave you the fridge for free?
- GhotiFish 11y ago
  If I put a lock on the fridge they gave me, should I be taken to jail?
- mjcohen 11y ago
  Maybe, from the stuff in the back that is way past its use-by date.
- enqk 11y ago
  Well I would let them maybe eat some food once or twice but they certainly would not have the key to my appartment
- pmelendez 11y ago
  That analogy doesn't hold up... if any it would be if you'd let the creator of the fridge to see which food are you putting in so it can tell Amazon and offering you similar items. And then you would decide if you take advantage of that or if you would not use it because of fear that the fridge would be sharing more than just the items you bought.

otis_inf 11y ago

In the post-Snowden era, USA tech corporations, like Microsoft, felt the downturn on trust from non-USA companies and citizens in their online offerings. With Microsoft betting more and more on their cloud services, I find it strange (or maybe it isn't strange, but let's be naive for a minute here) that Microsoft goes against this and actually gives people _more_ reasons to not trust them than less. As if they're thinking we all don't give a shit. But if we all didn't, why the downturn in trust in USA tech corporations post-Snowden? I can't help but think that this is either massively naive from their part (people/companies won't care, they will buy our stuff and services regardless) or very short-sighted (as it will hurt their cloud services offerings in the long run, the more they hammer down the trust from their own users in MS' wares.)

sliverstorm 11y ago
Or maybe when nobody trusts you anyway, that ship has sailed? :)

w8rbt 11y ago

Windows 10 reminds me of a saying an old co-worker of mine used a lot, "Vendors lie... packets don't."

jellicle 11y ago

I have a really hard time understanding how "enterprises" are going to upgrade to Windows 10. An operating system that is sending random internal data to random places on the internet seems to violate both a wide selection of national laws related to data privacy, and many corporate policies relating to trade secrets, privacy, internal operations and so on. Microsoft must have thought of this. What's their plan for continuing to sell to these customers?

bhouston 11y ago

Given that it is proven that the NSA spied on European companies for economic reasons, this isn't a good idea. Now the NSA can just tap into Microsoft, either covertly or through court order, and spy on the whole world. Details of economic spying -- may not be the best article but the easiest to find: http://www.hurriyetdailynews.com/nsa-spied-on-french-economy-ministers-top-companies-reports-.aspx?pageID=238&nID=84733&NewsCatID=351 http://www.hurriyetdailynews.com/nsa-spied-on-french-economy...

likeclockwork 11y ago
Embrace, Extend, Eavesdrop.

mjcohen 11y ago

I got a refurbished HP Stream 11 for $120 (Groupon) and spent 3 hours upgrading to Windows 10. I then installed Chrome and LibreOffice. It works fine, but, with all these privacy invasions, I see no reason to use it. My Acer C720 Chromebook (upgraded to a 128GB SSD) with Crouton and Ubuntu 14.04 is much more useful to me.

gluelogic 11y ago
This is totally off topic, but, if you don't mind sharing, what SSD did you get? I have the same Chromebook running Arch, but it has been idling since I got something else. I really want to upgrade it and start using it again.

cryptophreak 11y ago

Of course this is true. Companies make money by spying on their customers. Did we really imagine that flipping the “Stop making money” preference was going to work?

oxide 11y ago
well...yes. I fully expect when I opt out of something, anything, that it isn't still doing what I just thought I opted out of. that's probably my fault for being so naive.

datainplace 11y ago

Stupid question, but my Mom lives in a really rural area. Pays quite a bit for internet and is charged by the MB. Can we ask Microsoft to pay for their bandwidth usage? Since upgrading to Windows 10 she's been hit with $200 in overages.

hebdo 11y ago
This seems to be one of the real costs of upgrading to the latest version of Windows. In this case your mom has to pay the bills, but in general I'm curious how long will it take for ISPs to launch a solid campaign against Microsoft, like they did with Netflix.
- technojunkie 11y ago
  How is this a real cost, is there an estimate of how many bytes are sent and received and at what interval? If it was anywhere in the thousands of megabytes regularly, maybe that's the real cost but that's just an assumption.
  - hebdo 11y ago
    Not quite sure what is your point here. The amount of megabytes transferred each month does not have to be any particular fixed number to become a burden for the user, or the ISP. We can see that at least in one case (and probably many more) such a cost can exceed $200. All of this without user's consent. Microsoft, please get your stuff together. Hire some privacy aware people.
ikeboy 11y ago
Did she set the connection as "metered"? I know some things stop then. The $200 is likely from the automatic updates, which were pretty big. How much extra in MB was it?
- noja 11y ago
  It's likely from the automatic _sharing_ of automatic updates.

yellowapple 11y ago

It's hard to know without inspecting the exact data involved, but I feel like this is dangerously close to a HIPAA or HITECH breach, and I know of several hospitals who are strongly on the Microsoft bandwagon and are considering Windows 10. The "send search data to an internet endpoint even if it's patently obvious that the search is for local resources" reeks strongly of Ubuntu's Amazon Shopping Lens. Did Mark Shuttleworth switch gears from Canonical to Microsoft when I wasn't looking?

dragonwriter 11y ago
> It's hard to know without inspecting the exact data involved, but I feel like this is dangerously close to a HIPAA or HITECH breach Perhaps pedantic, but that's redundant; HITECH doesn't define breaches separately from HIPAA, it establishes standards for when HIPAA data is "unsecured" and reporting requirements, etc., related to HIPAA breaches.
- yellowapple 11y ago
  I'm aware; my point was that there are HITECH implications as well that would be very hard to address with Windows 10 if my suspicions are correct; it would be hard to meet the breach reporting and notification requirements when the operating system may very well be actively siphoning PII even when supposedly configured to do otherwise. The only safe option is to assume that any patient data that exists on a Windows 10 system is unsecured unless that system is entirely disconnected from any kind of network or until Windows 10 is significantly more transparent about what it's doing behind users' backs. Of course, this is speculation right now, and perhaps my concerns are unfounded, but I can already imagine some old doctor typing "J. Random Hacker biopsy" into that Start Menu search field in the hopes of finding some document and inadvertently sending the fact that J. Random Hacker had a biopsy to Microsoft and potentially some advertising partners (depending on the nature of such transmissions).

godgod 11y ago

The NSA is loving this. Microsoft 10 is their new operating system.

mark_l_watson 11y ago

I was downvoted and criticised a few days ago for defending Microsoft on Windows 10. I am starting to change my opinion after looking into the issue more. I watched a recent Richard Stallman talk on youtube and went through the process of making the tightest privacy settings I could on my iPad, Windows 10 laptop, and Android phone. (I left my Mac and Linux laptops as is since I just use those for development.) I think that Microsoft looked at the Google Now user experience on Android phones and decided to emulate that type of AI assistent in Windows. Google collects all sorts of user context information and Microsoft decided to do the same. This is a guess but the difference may be that (some) people are willing to have less privacy on their smartphones but care more about privacy on their computers.

dragonwriter 11y ago
> I think that Microsoft looked at the Google Now user experience on Android phones and decided to emulate that type of AI assistent in Windows. I don't mind that (Cortana). I do mind that when Cortana and its supporting options are explicitly disabled, Win 10 apparently still won't stop chattering back with HQ constantly. Not only for privacy reasons either; it seems (though I'm not certain of the relationship) to have a substantial, though intermittent rather than constant, impact on performance.
- mark_l_watson 11y ago
  I agree.

tdkl 11y ago

Funny, nowadays there seem to be more firewall rules needed for outbound traffic then inbound on Windows. In the old days we had a name for that - spyware.

PythonicAlpha 11y ago
The name today is "cloud" ;)