16 ms·

Updates Make Windows 7 and 8 Spy on You Like Windows 10

362 points by Sami_Lehtinen 11y ago

cakeface 11y ago
I've seen a lot of posts about people worrying about personal privacy, as they should be! Right now I'm actually curious about the business implications. Is data going back to Microsoft? Should we be banning Windows for developers, finance, customer support? I'm worried about personally identifiable information (PII) leaking out of our company. Also developers still handle credentials with access to production systems, AWS, sometimes SSL certs. This data cannot be sent out of the network. What is the impact for businesses?
Navarr 11y ago
2016 is the year of desktop linux. For the kind of people who care about this sort of thing. Also puts "Scroogle" into perspective.
- Lendal 11y ago
  1) Internet web sites have always been "lit up with speculation". 2) Microsoft's "spying" has been going on since Windows Vista was released, and speculation has gone along with it. 3) Since the 1990's, next year has always been "the year of desktop Linux."
  - Aoyagi 11y ago
    People keep saying that there was spying going on from XP or Vista, but "spying" isn't a binary state. The amount of intended data-slurping has increased incomparably.
    - yuhong 11y ago
      You can choose between telemetry levels in Win10 though.
  - habitue 11y ago
    I think Navarr is fully aware of the Linux desktop meme. It's clearly tongue-in-cheek
    - Navarr 11y ago
      Yes, thank you. Though honestly the people who really do care about this will see the coming year as year of the Linux desktop. And to me it seems like a lot of HNers care that Windows is sending all this telemetry. (Aren't we the same group that is obsessed with A/B tests and recording analytics on everything a user does on our website?)
      - Moter8 11y ago
        Agree. There seem to be hundreds of analytics services. Use of those is totally correct, obviously. The more specific the merrier.
- thescrewdriver 11y ago
  I doubt there are enough people who care. Google has already proved that seemingly benevolent spying is a highly profitable business model. Most people aren't bothered, or even know, that they are being "Scroogled". Microsoft is just following suite. Sadly it seems to be a sign of things to come.
  - flurpitude 11y ago
    The potential big difference here is that it affects people's work computers, where they do things for organizations that have a strong interest in keeping information from leaking out. Such companies probably were never happy with corporate data passing through Android smartphones, and might have forbidden it. Now they know they can't trust Windows workstations either.
    - yuhong 11y ago
      Win10 enterprise has the no telemetry option for a reason.
      - thescrewdriver 11y ago
        Because every small business uses Win10 enterprise?
        yuhong 11y ago
        Most enterprises that care probably is. And it is possible for small businesses to get, just costs a bit more (including Software Assurance renewal) and it also gets you access to things like LTSB.
        thescrewdriver 11y ago
        Maybe some small businesses don't care, but the people whose data they are handling might not agree with that stance.
    - 11y ago
- cartoonfoxes 11y ago
  I'm inclined to agree, albeit begrudgingly. I am more-or-less happy with the usability of Win 8.1, but I'm not willing to have my machine turned into a permanent outpost of the NSA.
- tacone 11y ago
  It's since 2006 that every year is gonna be the year of linux on the desktop. Except it never happens.
  - danieldk 11y ago
    I guess you haven't witnessed Corel Linux, Wordperfect for Linux or Loki Entertainment. It's been predicted way longer than 2006. Ps. Sorry for the accidental downvote :(.
    - mastahype 11y ago
      Can attest. Used Linux as primary OS for last 2-3 years in college, then got a job doing development on Linux, then worked for a Linux startup in early 2000's (we hired a couple ex Loki employees). Linux on the desktop has been a roller-coaster movement since not long after it's inception, likely around the time KDE and Gnome were released with some level of maturity. There was always the ported desktop managers but I don't think it's had much viability for dominance until OpenOffice came along.
    - Zardoz84 11y ago
      Oh! Someone that remember Corel OS. I have one disc yet somewhere...
      - danieldk 11y ago
        Yeah :). I was mostly using Slackware Linux at the time, but my brother bought a Corel Linux box at the time. If I remember correctly, it came with an inflatable Tux. I also had a separate copy of WordPerfect for Linux for a long time. It still worked fine until I sold it on eBay, thanks to libc5 compatibility in most distributions. Even though I stopped using it at some point, I continued to use the Type 1 fonts that came on the CD.
- nivla 11y ago
  First, the website is down. Second there is always overblown paranoia that runs with every release of Windows. I wish if EFF or atleast ArsTechnica would cover so atleast it will be a proving point for these independent blogs. For all I know is that these updates could be for someone who has already signed up for "Sent diagnostics to Microsoft for product improvement" on their existing Windows. Else it has to be the dumbest spyware that comes with a release note, description and a self describing name. >2016 is the year of desktop linux. I don't care if it is Linux, Apple or Windows. As long as someone can guarantee a certain degree of usability and a common sense of privacy, I wouldn't mind switching. However at this point where even open source is taking a nose dive (eg: "Ubuntu and Amazon Search", "Chrome and proprietary blobs", "Firefox with Hello and Pocket"), I am not sure anymore. If it keeps up this rate, in the future people might look back and see privacy as a silly idea /sad.
jsingleton 11y ago
Site seems overloaded. Here are the KB links from an earlier discussion (https://news.ycombinator.com/item?id=10110316 https://news.ycombinator.com/item?id=10110316). Thanks vetinari. https://support.microsoft.com/en-gb/kb/3068708 https://support.microsoft.com/en-gb/kb/3068708 https://support.microsoft.com/en-gb/kb/3075249 https://support.microsoft.com/en-gb/kb/3075249 https://support.microsoft.com/en-gb/kb/3080149 https://support.microsoft.com/en-gb/kb/3080149 Also found: https://support.microsoft.com/en-gb/kb/2976978 https://support.microsoft.com/en-gb/kb/2976978
- JimmaDaRustla 11y ago
  Some of those look like they'd be used to upgrade to Win10? Compatibility checking, diagnostics, etc. Nothing seems malicious, but you never know.
- 0x0 11y ago
  The list of files modified (to add telemetry hooks?) in kb 3080149 is crazy. NTOSKrnl, NtDll, Lsass, winload.exe etc... Are they really adding spyware/telemetry hooks all the way down to the kernel? What happens next time there's a security patch for the kernel, do we get an ntoskrnl with all these "optional updates" included as well?
  - kstrauser 11y ago
    Pretty much, yes. As I mentioned elsewhere, they enable spying on kids by default if they're logged in through a Microsoft account. If they're going to spy on kids, adults get the same mechanisms installed.
    - acqq 11y ago
      kstrauser refers to: https://news.ycombinator.com/item?id=10111271 https://news.ycombinator.com/item?id=10111271
  - acqq 11y ago
    I remember some months ago where they only claimed fixing something minor (like, something that's not even an executable but some text-based or at least data file) in the patch and the list included also a huge amount of files including cryptwhatever.dll (not the actual name). "Backdoor time" thought I. As little as I checked however, it didn't look like a real smoking gun then. It seems a common practice somehow that since some time their updates aren't "hand picked" but generated by the computer without too much human control or that the programmers don't have time, or simply nobody cares there anymore. I'd be glad if somebody would sensibly explain all that. Including these recent "everything you type will be transferred" and "the list of all your files will be made" claims.
archimedespi 11y ago
Is there any tool like DisableWinTracking for Windows 7?
- mnw21cam 11y ago
  A Linux machine with two ethernet cards acting as a firewall to the internet?
  - simonh 11y ago
    Do we even know how you'd need to configure the firewall to block the specific traffic that's the problem?
    - morganvachon 11y ago
      There's a list of domains that came up in a previous discussion on HN (sorry, I don't recall it right away), and was also trending on pastebin.com, which contained all of the known domains Microsoft was using to report back from the OS. Presumably you could route those to "null" or the equivalent on your router and you'd be good to go. Edit: Here's the pastebin link: http://pastebin.com/RZW74Npk http://pastebin.com/RZW74Npk
      - scott_karana 11y ago
        You could always just do that in Windows' hosts file, too.
        morganvachon 11y ago
        You can, and I'm sure most would. There may come a time, however, when a future Windows update rewrites or works around the hosts file for telemetry. Doing it at the router or external firewall avoids that possibility.
        scott_karana 11y ago
jsingleton 11y ago
Not sure why this is being down-voted. Just trying to be helpful in case people want to avoid these optional updates or uninstall them. Maybe I should just delete the comment?
- leni536 11y ago
  Please don't
  - jsingleton 11y ago
    OK, just didn't want to add to the clutter if it was unhelpful. A load of links without context isn't a great comment. :) BTW these updates all appear to be "Optional" and are part of the Customer Experience Improvement Program (which in my experience is always opt in and you get a notification in the system tray).
    - FilterSweep 11y ago
      They are currently optional - different than "Important Updates" and "Recommended Updates." I checked my windows update panel in Windows 7, mind you, (Start --> Control Panel --> Windows Update), and saw it listed as an optional update. I believe these optional updates, in windows 7 at least, are defaulted to be listed, but not downloaded or installed. I clearly won't be installing these, haha.
- ploxiln 11y ago
  In general I'd say the inclination to delete a comment because it's being down-voted is... not good. Don't try so hard to conform to what appears to be the local public sentiment. (EDIT: or, if it's a threat to delete if you don't get upvotes, also lame)
- dang 11y ago
  That helpful comment got two downvotes and well over a hundred upvotes. This is an extreme example of why HN has a guideline asking people not to comment about being downvoted. Most of the fluctuation is ephemeral, and most comments about it soon become inaccurate. We've detached this subthread from https://news.ycombinator.com/item?id=10110543 https://news.ycombinator.com/item?id=10110543 and marked it off topic.
fataliss 11y ago
Maybe a chance for the Linux gaming scene? Finally a window (see what I just did?) for an other gaming OS? Hail Unix.
deleted 11y ago
[deleted]
bung 11y ago
Been waiting for an article like this but even though it points to two items, KB3075249 and KB3080149, it doesn't seem like "firm" information as there is a huge list of "maybe" items as well as a warning that removing things can mess up your computer. How likely is it that we'll ever have a "firm" finite list?
yuhong 11y ago
FYI, you can't disable telemetry on Win10 unless you have enterprise edition, but you can select levels.
- archimedespi 11y ago
  You sort of can, see things like https://github.com/10se1ucgo/DisableWinTracking/ https://github.com/10se1ucgo/DisableWinTracking/.
  - A010 11y ago
    It's easy to blackhole those domains and remove reg keys, but I wonder if M$ will add new ones in later updates.
    - nullsmack 11y ago
      That's okay, they can just use their p2p technology and route their spying through other people's computers.
jimeh 11y ago
Google cache of the article as the site seems down: http://webcache.googleusercontent.com/search?q=cache%3Awww.hakspek.com%2Fsecurity%2Fupdates-make-windows-7-and-8-spy-on-you-like-windows-10%2F&oq=cache%3Awww.hakspek.com%2Fsecurity%2Fupdates-make-windows-7-and-8-spy-on-you-like-windows-10%2F&aqs=chrome..69i57j69i58.1629j0j4&sourceid=chrome&es_sm=91&ie=UTF-8 http://webcache.googleusercontent.com/search?q=cache%3Awww.h...
balabaster 11y ago
.... aaaand Windows Update Automatic Updates is getting disabled.
fiatpandas 11y ago
I have my windows 7 PC set up to automatically install "important" updates. Are these telemetry updates considered "important" or "recommended"?
- marvy 11y ago
  Just check if you already have them installed or not
mintplant 11y ago
Article text, since the site seems to be down: Windows 10 has been launched and already installed on more than 50 million computers worldwide. It is now a known fact that Windows 10 user data is being sent back to Microsoft servers back in Redmond, Washington. Well, now new updates that are being deployed to all Windows 7, 8 and 8.1 machines will turn their computers into a big piece of spyware, just like their predecessor, Windows 10. The updates in question are KB3075249 and KB3080149. if installed, these updates are known to report your data back to Microsoft servers, without user interaction. KB3075249 Microsoft Update adds telemetry points to ‘consent.exe’ in Windows 7, 8 and 8.1, allowing for remote monitoring of everything that happens within the operating system. KB3080149 ensures that all “down-level devices” receive the same updates and treatment as Windows 10 boxes get. As you would guess, forums are lit up with speculation on these updates and more. Below you can find a list of other Windows updates that some users have questioned. Please keep in mind, avoiding some or all of these updates may cause your environment to be unstable and/or unsecure. KB2505438 KB2670838 – Windows 7 Only (corrupts AERO and blurry fonts on some websites) KB2952664 KB2976978 – Windows 8 only KB3021917 KB3035583 KB3075249
- acqq 11y ago
  The links to the Microsoft's KB articles of the two updates: https://support.microsoft.com/en-gb/kb/3080149 https://support.microsoft.com/en-gb/kb/3080149 "This package updates the Diagnostics and Telemetry tracking service to existing devices. This service provides benefits from the latest version of Windows to systems that have not yet upgraded. The update also supports applications that are subscribed to Visual Studio Application Insights." https://support.microsoft.com/en-gb/kb/3075249 https://support.microsoft.com/en-gb/kb/3075249 "This article describes an update that adds telemetry points to consent.exe in Windows 8.1, Windows RT 8.1, Windows Server 2012 R2, Windows 7 Service Pack 1 (SP1), and Windows Server 2008 R2 SP1."
- FilterSweep 11y ago
  Just the name "consent.exe" itself sounds malicious (although it's been around for a while).
  - 11y ago
tinfoilman 11y ago
Brilliant, 2 options I see Never do updates again (which is what I will be doing this evening) and make system perm insecure Or let MS and the NSA rape me for even more data than they already have Go [insert abusive word] yourself Microsoft and to think just last week I got a 3rd windows 7 license because I was planning to stay on 7 long term and not upgrade to 10. Steam hopefully will push linux gaming that i can finally get rid of this crap.
- ionised 11y ago
  If Steam OS becomes a viable desktop gaming OS that plays most, if not all games, I'll drop Windows in a heartbeat.
  - sschueller 11y ago
    Steam is owned by Valve and Valve is a US company. Using steam will not change anything since it is the US laws allowing/requiring companies to comply with the NSA.
    - ionised 11y ago
      The difference being that I want to use Windows only for games without all this other cloud integration crap that comes with it. Steam OS is a Linux-based OS designed primarily for gaming. Any and all cloud-integration will be specifically gaming-focused. Can you not see the difference between that and a general purpose OS like Windows harvesting data everything you do on your system? I won't be using Steam OS to do anything very sensitive like sending or receiving personal e-mails, editing word documents or spreadsheets, or browsing the internet for whatever reason. Unless you consider firing up a shooter or a city-building sim sensitive. The two OS's have very different purposes and use-cases.
    - pjc50 11y ago
      Telemetry is clearly not a legal requirement. It's only data stored on steam servers (including chat logs) which you have to worry about.
    - 11y ago
nly 11y ago
Easiest way to block this for sure is probably going to be harvest a list of hostnames and/or IPs microsoft are using and block them at your border gateway/router. I've recently considered setting up a separate wifi SSID where everything outbound except DNS, and tcp 80/443 is blocked, as well as TLS SNI and plain HTTP logging just so this sort of thing can be monitored.
- kardos 11y ago
  That's a fragile solution at best. One update could change the IP/hosts of the data harvesting servers. Surely the data will be transmitted using TLS or equivalent; HTTP logging won't do you much good unless you can (a) MITM the TLS setup, or (b) extract the keys that the spyware is using.
- JadeNB 11y ago
  It's not what you said, but note that some of the phone-home behaviour is very deep rooted, ignoring proxy settings (http://arstechnica.com/information-technology/2015/08/even-when-told-not-to-windows-10-just-cant-stop-talking-to-microsoft http://arstechnica.com/information-technology/2015/08/even-w...): > We configured our test virtual machine to use an HTTP and HTTPS proxy (both as a user-level proxy and a system-wide proxy) so that we could more easily monitor its traffic, but Windows 10 seems to make requests to a content delivery network that bypass the proxy.
- rasz_pl 11y ago
  Windows internal firewall blocks everything just fine. So far there are no secret allow lists present. Enable 'Deny all outgoing' and start adding your own Egress filtering rules.
rileyteige 11y ago
If I could figure out my wireless card/GPU drivers, I'd swap to Linux in a heartbeat. Plug-n-play drivers is the only reason I'm still on that closed-source OS. Just don't have the patience to hunt down third-party drivers.
- keithpeter 11y ago
  Boot off a live CD (e.g. Ubuntu) and run lspci from a terminal session then post it here. You may find the drivers you need are available in a separate 'restricted' or 'non-free' repository. It is unusual these days on desktop/laptop oriented installs to have to 'hunt down' anything. Very very recent hardware can still be problematic mind you.
- nileshtrivedi 11y ago
  Broadcom and nVidia?
- zurn 11y ago
  Just get the right hardware with good Linux support, it all just works then. You won't find any lasting happiness by digging deeper into the third party drivers swamp. (all-Intel for wifi and graphics is the safest bet)
- tacone 11y ago
  Mainstream hardware is decently supported, if you don't have special claims. Ubuntu live cd/usb?
- yellowapple 11y ago
  > Just don't have the patience to hunt down third-party drivers. For most modern distros, you don't have to hunt down third-party drivers; at most, you might need to enable some first-party or second-party "restricted" repo, at which point you can install the necessary drivers from there. And last I checked, Ubuntu and Linux Mint (among others) provide a "restricted hardware wizard" in the normal settings screen to do precisely this.
dmfdmf 11y ago
When KB3035583 GWX/Win10 Spam came out I removed it and put my updates into manual because I figured it won't be long before MS put out another updated to push Win10. This is much worse, now I find out there are a number of updates that I have to track down and uninstall. Going forward I will always have to lag a month or so behind updates to make sure MS is not installing a key logger on my Win7 computer. I guess my move to Linux is sooner that I thought.
DrNuke 11y ago
This news is another nail in the coffin. The pattern I can see among my peers and my small market is that people are more and more uneasy with using the web for sharing valuable info and data, both on public and private networks. They prefer face-to-face meetings and paper docs. Food for thought and some ground for new startups maybe.
Raed667 11y ago
Every-time Microsoft releases a new Windows (Since XP SP1) I saw quantifiable performance decline with every update I installed. I think Microsoft pushes people to change OSs using this technique.
jahewson 11y ago
This looks like a deliberately misleading and overblown claim to me. Looking at the knowledge base articles, we see that the diagnostics tracking service is enabled only for users who already participate in the customer experience program (a very clear option when setting up Windows for the first time: - KB3080149: "The diagnostics tracking service collects diagnostics about functional issues on Windows systems that participate in the Customer Experience Improvement Program (CEIP)." The second update is short on details, but it's specifically targeting the UAC "Run as Administrator" dialog (which is implemented by consent.exe), presumably to collect information on unsigned applications which request admin privileges. Microsoft should provide further details here for sure, but I see nothing nefarious. One might guess that the information collected here might be the hash of the exe requesting admin privileges. - KB3075249: "This update adds telemetry points to the User Account Control (UAC) feature to collect information on elevations that come from low integrity levels." Compare this with the ridiculous claim in the article that this is "allowing for remote monitoring of everything that happens within the operating system."
- deleted 11y ago
  [deleted]
mosselman 11y ago
So I just started my windows and it seems that I am 'infected' with this anti-privacy stuff. How do I get rid of it? Re-install from the installation disk and disable updates, or can I still remove the updates?
- saint_fiasco 11y ago
  You can remove updates via the control panel.
  - mosselman 11y ago
    But does that really work in this case? It seems as if these new privacy things go pretty deep.
    - saint_fiasco 11y ago
      I'm not sure. I have seen spam that has unsubscribe buttons that actually work, as well as adware that uninstalls properly from the control panel. I hope Windows doesn't do worse than spammers and malware programmers.
      - mosselman 11y ago
        Lol, thanks. I will at least give it a try ;). But before that I am moving all my personal files to my NAS and I will only be using windows for playing a game or 2.
mtgx 11y ago
What an unbelievable lack of respect and a big FU to Microsoft's own customers. At least using Windows 10 is a choice (I think - do they force it on Windows 7 machines?), but to do this to all existing customers - wow, just wow. Behold everyone - this is the "new" Microsoft, worse than it ever was.
- marcosdumay 11y ago
  > I think - do they force it on Windows 7 machines? No, but they keep nagging you every time you turn your computer on.
  - logfromblammo 11y ago
    You can turn off the nagging by uninstalling update kb3035583. Then hide the update so it doesn't helpfully install it again for you.
tacone 11y ago
I wonder how any IT corporation of decent size, with internal data policies will be able to live with something this.
leonatan 11y ago
Archived version until the site is up: https://web.archive.org/web/20150824023803/http://www.hakspek.com/security/updates-make-windows-7-and-8-spy-on-you-like-windows-10/ https://web.archive.org/web/20150824023803/http://www.hakspe...
ausjke 11y ago
Happy linux desktop user here, I only need windows for turbotax once a year, so I will worry about this in Feb/Mar, anyone provides a cloud-based tax filing service?
- kingnothing 11y ago
  Turbotax.com
- slayed0 11y ago
  Doesn't turbotax provide just that? I did my taxes with them last year and never left the browser.
- gvb 11y ago
  H&R Block does: http://www.hrblock.com/online-tax-filing/ http://www.hrblock.com/online-tax-filing/ Disclaimer: I have not used their online version so I don't know how well it works. I have been running their Windows version in a VM the last few years because I'm not wild about putting any more of my tax information "in the cloud" than I have to. I would expect TurboTax to support online filing too, but did not see it on a quick search.
  - nacs 11y ago
    > I don't know how well it works I've used H&R Block's online service for filing federal and state taxes for the past few years with no issues.
- cmrx64 11y ago
  The most you need to get turbotax to work online is a user agent spoof.
- specialp 11y ago
  taxact.com is entirely online too. No app required.
- yellowapple 11y ago
  Yeah, TurboTax does. I've done my taxes several times now entirely from Firefox+Linux. TurboTax will nag you about using an unsupported browser/OS combo, but you can just click the link saying "yeah, whatever, I know what I'm doing, sod off and let me do my bloody taxes" and it'll work perfectly fine.
rdudek 11y ago
I have a question that I can't seem to get a straight answer anywhere. If I were to use Win 10 Enterprise edition, could I theoretically disable all the spying and telemetry? It also now seems like we need two computers. One that is open for "spying" so the government looks at my usage and white-lists me as a "good citizen" and another computer that basically is encrypted and hides anything I don't want anyone to know about.
- kardos 11y ago
  Or just one that runs open software...
mizzao 11y ago
People who use their google accounts and Chrome ubiquitously already get spied on by GA at a much bigger scale through all the sites they visit in their browser. Why is it a big uproar when it happens at the OS level? Seems like it's pretty much the same thing. We always have the option of using Linux if we don't like it.
- ihsw 11y ago
  Because the pressure should go in the opposite direction -- they should have to find users that want to be spied on, we shouldn't have to find operating systems that don't spy on us. I wouldn't otherwise have used Windows had I known they'd be shoving their telemetry reporting down my throat.
- Hjugo 11y ago
  Because it is easier to switch a browser then a OS and many just can't switch to linux.
- kardos 11y ago
  Chrome -- as far as we know -- doesn't transmit all of your keystrokes to Google, nor does it transmit the contents or indexes of your local filesystem(s) back to Google.
  - McGlockenshire 11y ago
    You're posting FUD. Those permissions are required in the context of Cortana, so Cortana can work. Keep Cortana off and turn off the services, and nothing gets transmitted. It's literally no worse than the conditions you agree to when using Siri or Ok Google / Google Now.
    - kardos 11y ago
      If you'll allow Wikipedia to define FUD [1], > FUD is generally a strategic attempt to influence perception by disseminating negative and dubious or false information. What part is dubious or false? Do you need me to quote the Win 10 privacy policy? [1] https://en.wikipedia.org/wiki/Fear,_uncertainty_and_doubt https://en.wikipedia.org/wiki/Fear,_uncertainty_and_doubt
hadeharian 11y ago
Windows, now like AOL but better!
kstrauser 11y ago
I submitted a story to Boing Boing (at http://boingboing.net/2015/08/10/windows-10.html http://boingboing.net/2015/08/10/windows-10.html) about the weird experience I had after upgrading my son's laptop from Windows 8.1 to 10. We did this on a Saturday, and Monday morning I had a "family safety report" email from Microsoft detailing which websites he'd visited, which apps he'd used (and for how long), etc. since the upgrade. According to Microsoft's Family Safety FAQ (https://account.microsoft.com/family/faq/ https://account.microsoft.com/family/faq/): > On Windows 10, you’ll need a Microsoft account in order to use Microsoft family whether you’re a part of a family as an adult or a child. When kids are added to a Microsoft family with a Microsoft account, any time they sign in to a Windows 10 device, their settings will be applied and their activity will be reported to the adults in their family. Adults can always turn off activity reporting or remove kids from the Microsoft family at account.microsoft.com/family. By default, unless you log in and explicitly disable it, Windows 10 collects kids' usage activity and uploads it to Microsoft's servers. Presumably the same mechanism is disabled for adults. Presumably. I definitely didn't enable it, and I'm sure my son didn't check any "narc me out to my parents" checkbox. Edit: we already had a family account set up for our Xbox. I suspect that's how Microsoft determined that the emails should go to me.
- IkmoIkmo 11y ago
  Wow that's insane! And I'm glad you're an awesome parent. You should post a anonymised screenshot of that email sometime if you can, this is pretty ridiculous.
  - kstrauser 11y ago
    Ask and ye shall receive: http://imgur.com/eeBtcIw http://imgur.com/eeBtcIw Bear in mind that it's nearly empty because we'd only just recently upgraded to Windows 10, but note that it has an entry for "Latest searches". Wouldn't that be one hell of a way for a kid to come out of the closet to his parents, or for someone to find out their daughter's pregnant? Consider that this data is linked to each kid's email address. When this database is hacked, won't that be an interesting week in all the local schools as everyone learns what their peers are really doing?
toufka 11y ago
Installing spyware via a software update is a huge moral hazard for Microsoft. It incentivizes people to maintain an unpatched operating system.
rbx 11y ago
kb3075249 - "...adds telemetry points..." (https://support.microsoft.com/en-us/kb/3075249 https://support.microsoft.com/en-us/kb/3075249) kb3080149 - "...Telemetry tracking service..." (https://support.microsoft.com/en-us/kb/3080149 https://support.microsoft.com/en-us/kb/3080149) kb3068708 - "...Telemetry tracking service..." (https://support.microsoft.com/en-us/kb/3068708 https://support.microsoft.com/en-us/kb/3068708) kb2976978 - "...performs diagnostics on the Windows systems that participate in the Windows Customer Experience Improvement Program..." (https://support.microsoft.com/en-us/kb/2976978 https://support.microsoft.com/en-us/kb/2976978) kb3021917 - "...Telemetry is sent back to Microsoft..." (https://support.microsoft.com/en-us/kb/3021917 https://support.microsoft.com/en-us/kb/3021917) kb3035583 - "...installs the Get Windows 10 app..." (https://support.microsoft.com/en-us/kb/3035583 https://support.microsoft.com/en-us/kb/3035583) kb2952664 - "...ease the upgrade experience to the latest version of Windows..." (https://support.microsoft.com/en-us/kb/2952664 https://support.microsoft.com/en-us/kb/2952664)
inevitable2 11y ago
Here is a more in-depth analysis of windows 10 and what is sent to MS http://aeronet.cz/news/analyza-windows-10-ve-svem-principu-jde-o-pouhy-terminal-na-sber-informaci-o-uzivateli-jeho-prstech-ocich-a-hlasu/ http://aeronet.cz/news/analyza-windows-10-ve-svem-principu-j... For those who don't speak Czech: -It sends all text you type anywhere (not just into search) every 30 minutes to MS. If you type about a holiday to your blog, next day you'll see holiday ads. -Every 30 minutes it sends your geo-location and network information. -If you type a telephone number into Edge it sends it to MS after 5 minutes. -If you type anywhere in Windows a name of some movie, Windows will start indexing all your media files after a while and will send it to MS after 30 minutes of your inactivity. -After installing W10, it will send about 35MB of data once. -After turning on your webcam for the first time it sends data to microsoft once. -Everything you say is transferred to MS, it works even if you disable and remove and uninstall cortana. Parts of Cortana are needed for the core of the OS to run. -Voice is transferred every 15 min, 80MB of data. -After 15 minutes of your inactivity or when screensaver is on, network activity ramps up and everything else is being sent to MS. -Blocking in hosts doesn't work, IPs are hardcoded into their code and DLLs.
- kardos 11y ago
  Is any of this verified? During a previous posting of this it was largely dismissed as propaganda [1]. If someone has reproduced these findings that would be very interesting. What would be even more interesting would be for someone to intercept the spying data that is being sent back so we know for sure what's being sent. [1] https://news.ycombinator.com/item?id=10053420 https://news.ycombinator.com/item?id=10053420
  - Artemis2 11y ago
    Was about to ask for an alternate source too. Last time this was posted, people pointed out this website was not reliable at all. A nice analysis by a well-known security researcher should exist to confirm that.
    - ewzimm 11y ago
throwaway77632 11y ago
No wonder they intend to no longer describe what's in an update... Only using Windows in a VM still. Just set the network connection host-only. Didn't really need internet there anyway, and given these circumstances, I might as well get rid of it completely. I guess any inclination I had to think Microsoft is on the way up just vanished again. Too bad it also means I'm probably going to throw away my plans of diving into F#. Open source, but still too tied to this company I'd better just give up on.
- kefka 11y ago
  If you want to get into functional programming, check out Haskell or Erlang. Both run well on Linux.
- yellowapple 11y ago
  Last I checked, F# works perfectly fine on non-Windows platforms with Mono.
hfpn 11y ago
Microsoft's got even bigger balls then I thought they had... I hope this is the beginning of the end.
antaviana 11y ago
Curiously, the net effect is that now there is one reason less to skip upgrading to Windows 10!
minthd 11y ago
If that's true - doesn't this expose microsoft legally ? I mean we paid for win 7 under certain terms, and now they're changing them.
- coldpie 11y ago
  One of those terms was that they can change the terms at any time without notice.
  - minthd 11y ago
    :) .Is that even legal ?
    - anonbanker 11y ago
      Consent is cemented 72 hours after a contract has been agreed-upon, unless fraud is involved. In this case, agreement to future contract amendments/changes is consent. Your fault for clicking "Agree". Didn't anyone watch the Human Cent-iPad episode of South Park?
      - minthd 11y ago
        IANAL , but: " Unilateral modifications are not supposed to alter the material or important terms of the original contract. " http://www.faircontracts.org/contract-provisions/unilateral-modification http://www.faircontracts.org/contract-provisions/unilateral-...
        anonbanker 11y ago
        Unless you've bilaterally agreed or acquiesced to it, of course. Consent(.exe) is everything. You have 72 hours (10 business days by mail) to undo your consent to the Windows license changes after clicking "Agree". Did you submit your notice in a timely fashion, or did you let the clock run out?
- dmfdmf 11y ago
fsloth 11y ago
If we try to apply the principle of charity - could there be seen any advantages that this telemetry data would provide to the end user? I can't come up with any at least.
- xrstf 11y ago
  If you ever get acused of having illegal images on your PC, you can ask Microsoft to prove that you never had .jpg files in C:\Windows\Fonts.
JustSomeNobody 11y ago
So, does this mean MS has lost all their good will points earned from releasing all the open source code recently?
SwimAway 11y ago
Where are the security researchers? Credible, elaborate, and well-documented articles? Has this not captured their attention or is it a lack of concern?
IkmoIkmo 11y ago
I think it's time that we don't ask of users to protect themselves by reading hundreds of pages of EULAs, and then ostracising themselves from mainstream electronics use (both at home, as well as at work) because they refuse to use software that's loaded with insane levels of spyware (record and transfer all voice and every keystroke). That's a large burden. It's perhaps time this becomes a legal matter rather than purely a user-choice matter. In society we have all kinds of protections for people that make a lot of sense, that take away individual responsibility. For example, even if a person wanted, you're not allowed to become a slave, it's simply not allowed. Even if a person wanted in most of the developed world, you're not allowed to work for less than minimum wage, or in a toxic environment. Similarly even if a person says 'I don't mind if people are misogynistic towards me at work, or discriminatory, I just want this job no matter what because I need the money', that's not allowed, either. Similarly, I think it's time we start to think of legal protections again this level of spyware. We shouldn't put the burden of acceptance on individuals when you'll have millions of people who'd prefer to live in a world where they don't have to use this software at home or at work, but have no choice (particularly at work), and thus accept spyware because the loss of their job works as a blackmailing force, just like in the above examples. That doesn't mean I'm saying there is no legal place for software like this under any conditions. But the notion that it can't be turned off is insane. Even 'on by default' is a step too far, but now Windows is saying whether you use windows 7, 8 or 10, we're spying on you, and you can't turn it off, and if you tamper with our software manually you'll fail because we've hardcoded it. That's not acceptable and my point is, it shouldn't fall upon users to boycott such harmful parts of software they paid for (in the case of Windows 7, half a decade ago). It should fall upon the rule of law to prevent this and allow at least an opt-in, a choice, a choice that isn't 'use any Windows product, or use no Windows product' If OSs were more free like say, the automotive industry, I wouldn't mind as much. Like if Toyota one day decided to record audio in cars, that's one thing. You can switch to more than a dozen top-quality car manufacturers who don't do this, and it wouldn't affect your jobs or anything like that. But we're talking about a desktop/laptop market where <2% of marketshare is Linux and OS X is ~10%, the remainder is virtually all windows and its got hardcoded spyware features.
- SixSigma 11y ago
  My UK govt. is trying the backdoor / ban all encryption and is complicit in our "security services" getting unfettered access to citizen data. As was the previous govt. And all govts before it, and all govts in all countries. Getting them to enact and defend the opposite will take a Herculean effort to make the citizens aware, let alone care. I despair.
SpikedCola 11y ago
Found a useful script on SuperUser that removes KBs as well as hides them in the future. Just need to change the list slightly FOR %%X IN (3075249 3080149 3068708 2976978 3021917 3035583 2952664) DO ... http://superuser.com/questions/922068/how-to-disable-the-get-windows-10-icon-shown-in-the-notification-area-tray/922921#922921 http://superuser.com/questions/922068/how-to-disable-the-get...
aikah 11y ago
That's what happens when a single vendor has more than 95% shares of a market. There is no competition , where the hell people using Windows software are going to run ? I'm really angry at this. What's the difference between this and a spyware / key logger / trojan ? there is none conceptually. I sincerely hope it backfires because it's just insane. If MS wants to collect on my hard drive or log my key strokes , it should ask for my approval first and not hide it behind a license. People are outraged with the AM hack scandal, well nothing guarantees that MS will never be hacked. And when a database like this get hacked , every windows user data will be in the wild. That's just crazy. Is the the "new microsoft" , a lot of HNers like to boast about ? Same as the old one.
superskierpat 11y ago
Well I can see Russia putting alot more money into ReactOs
- yellowapple 11y ago
  Or GNU/Linux, or OpenBSD, or something else privacy-aware. But yes, ReactOS could certainly use some love, from Russia or otherwise. Can't wait for 0.4.0 to come out; should be a nice push toward general usability.
  - superskierpat 11y ago
    I've just finished installing arch linux after nuking my ubuntu/windows install, I've been doing a hell of alot of configuration but I'm pretty happy with I have. More on point, I've been planning to buy a cheap laptop to test more experimental oses, like react and harvey.
    - yellowapple 11y ago
      Hadn't heard of Harvey before. Looks like an interesting take on Plan 9; I'll definitely have to try that one out.
komicsans 11y ago
As far as I know, these updates are optional.
rasz_pl 11y ago
Cant wait for new EU fine, lets hope its orders of magniture more significant this time. Cool 10 Billion Euro should be enough to stop MS from screwing people over.
- Hjugo 11y ago
  Or that they finally fund a project that could replace windows
  - endymi0n 11y ago
    Given their dysmal track record of funding anything remotely successful and other than ivory tower projects, I wouldn't hope too much. https://en.m.wikipedia.org/wiki/Quaero https://en.m.wikipedia.org/wiki/Quaero Or look at Stratosphere/Apache Flink, basically they cloned Spark in much worse for millions of dollars.
  - yellowapple 11y ago
    Something like ReactOS or Longene would be a feasible target for such efforts. Or even just a commitment to GNU/Linux or one of the BSDs.
CamperBob2 11y ago
The lack of public disclosure, commentary, and, yes, outrage surrounding Windows 10's privacy policy is a lot more disturbing than Windows 10 itself.
alimbada 11y ago
There's been a number of revelations about the invasion of privacy prevalent in Windows 10 (and now according to this article/thread 7 and 8 too), but curiously Microsoft have been very silent on the matter which is only making things worse for them as users will naturally take that as a confirmation of the relevant findings. It's also strange to see Microsoft making this move given that this invasion of privacy is probably illegal in many ways in countries that are forward thinking enough to have laws against this type of thing. Maybe they see it as a short term ploy to try and collect as much data as they can before there is a big enough uproar against it and then decide to pull the "feature(s)". They may see it as worth the controversy if they can gather enough data for future products/improvements.
beloch 11y ago
Microsoft has already raised our suspicions by offering Windows 10 upgrades for free. As a result, we're perfectly primed to believe the worst about these updates. Microsoft needs to do something convincing to reassure it's users or Windows 10 will likely become synonymous with "Big Brother" regardless of what's actually going on. To reiterate, we're leaving territory in which it would have been reasonable to "do nothing and hope it all blows over". MS needs to respond quickly or they're going to have another dud release on their hands, in spite of giving it away for free.
vmp 11y ago
I wrote an utility in C# to make it easier to uninstall the offending updates: https://github.com/schumann2k/UpdateAntiSpy https://github.com/schumann2k/UpdateAntiSpy Feedback & pull requests welcome. :)
lewisl9029 11y ago
What exactly is going on with the decision making at Microsoft? With all the backlash that has resulted from the Windows 10 privacy issues, you'd think their next thought wouldn't be "we should piss off our customers with more of the same".
mamon 11y ago
It seems that Microsoft was right when calling Windows 10 "The Last Windows" - after such insolent violation of privacy people will switch to Linux or Mac OS just to avoid it. Microsoft is doomed, let's celebrate! :)
ptx 11y ago
Parents spying on their children's communications seems hard to reconcile with the principles in the UN Convention on the Rights of the Child[1] which most countries are signatories to, in particular articles 13 and 16: "Recognizing that the United Nations has, in the Universal Declaration of Human Rights and in the International Covenants on Human Rights, proclaimed and agreed that everyone is entitled to all the rights and freedoms set forth therein, without distinction of any kind, such as race, colour, sex, language, religion, political or other opinion, national or social origin, property, birth or other status, ... "The child shall have the right to freedom of expression; this right shall include freedom to seek, receive and impart information and ideas of all kinds, regardless of frontiers, either orally, in writing or in print, in the form of art, or through any other media of the child's choice. ... "No child shall be subjected to arbitrary or unlawful interference with his or her privacy, family, or correspondence, nor to unlawful attacks on his or her honour and reputation. "The child has the right to the protection of the law against such interference or attacks." Given that Microsoft is a US company and the US is one of very few countries that hasn't ratified the convention[2], the concept of children having human rights might seem strange and foreign to them, but almost everywhere else, the state is (it seems to me) obligated to protect children from this kind of intrusion. (Maybe the EU could look into forcing them to release a special spyware-free edition...) [1] http://www.ohchr.org/EN/ProfessionalInterest/Pages/CRC.aspx http://www.ohchr.org/EN/ProfessionalInterest/Pages/CRC.aspx [2] http://www.unicef.org/crc/index_30225.html http://www.unicef.org/crc/index_30225.html
miralabs 11y ago
can they be sued for doing this?
tacone 11y ago
I'm with Ubuntu/Gnome3 and it's pretty fine. It took some plugin installing (very easy btw), but it feels pretty good. Time to switch?
mosselman 11y ago
I put this in a file called something.bat and ran it as administrator to uninstall (I hope) most of the KBs. Any feedback would be great: wusa.exe /kb:3075249 /uninstall /norestart wusa.exe /kb:3080149 /uninstall /norestart wusa.exe /kb:3068708 /uninstall /norestart wusa.exe /kb:2976978 /uninstall /norestart wusa.exe /kb:3021917 /uninstall /norestart wusa.exe /kb:3035583 /uninstall /norestart wusa.exe /kb:2952664 /uninstall /norestart

362 points by Sami_Lehtinen 11y ago

I've seen a lot of posts about people worrying about personal privacy, as they should be! Right now I'm actually curious about the business implications. Is data going back to Microsoft? Should we be banning Windows for developers, finance, customer support? I'm worried about personally identifiable information (PII) leaking out of our company. Also developers still handle credentials with access to production systems, AWS, sometimes SSL certs. This data cannot be sent out of the network. What is the impact for businesses?

Navarr 11y ago

2016 is the year of desktop linux. For the kind of people who care about this sort of thing. Also puts "Scroogle" into perspective.

Lendal 11y ago
1) Internet web sites have always been "lit up with speculation". 2) Microsoft's "spying" has been going on since Windows Vista was released, and speculation has gone along with it. 3) Since the 1990's, next year has always been "the year of desktop Linux."
- Aoyagi 11y ago
  People keep saying that there was spying going on from XP or Vista, but "spying" isn't a binary state. The amount of intended data-slurping has increased incomparably.
  - yuhong 11y ago
    You can choose between telemetry levels in Win10 though.
- habitue 11y ago
  I think Navarr is fully aware of the Linux desktop meme. It's clearly tongue-in-cheek
  - Navarr 11y ago
    Yes, thank you. Though honestly the people who really do care about this will see the coming year as year of the Linux desktop. And to me it seems like a lot of HNers care that Windows is sending all this telemetry. (Aren't we the same group that is obsessed with A/B tests and recording analytics on everything a user does on our website?)
    - Moter8 11y ago
      Agree. There seem to be hundreds of analytics services. Use of those is totally correct, obviously. The more specific the merrier.
thescrewdriver 11y ago
I doubt there are enough people who care. Google has already proved that seemingly benevolent spying is a highly profitable business model. Most people aren't bothered, or even know, that they are being "Scroogled". Microsoft is just following suite. Sadly it seems to be a sign of things to come.
- flurpitude 11y ago
  The potential big difference here is that it affects people's work computers, where they do things for organizations that have a strong interest in keeping information from leaking out. Such companies probably were never happy with corporate data passing through Android smartphones, and might have forbidden it. Now they know they can't trust Windows workstations either.
  - yuhong 11y ago
    Win10 enterprise has the no telemetry option for a reason.
    - thescrewdriver 11y ago
      Because every small business uses Win10 enterprise?
      - yuhong 11y ago
        Most enterprises that care probably is. And it is possible for small businesses to get, just costs a bit more (including Software Assurance renewal) and it also gets you access to things like LTSB.
        thescrewdriver 11y ago
        Maybe some small businesses don't care, but the people whose data they are handling might not agree with that stance.
  - 11y ago
cartoonfoxes 11y ago
I'm inclined to agree, albeit begrudgingly. I am more-or-less happy with the usability of Win 8.1, but I'm not willing to have my machine turned into a permanent outpost of the NSA.
tacone 11y ago
It's since 2006 that every year is gonna be the year of linux on the desktop. Except it never happens.
- danieldk 11y ago
  I guess you haven't witnessed Corel Linux, Wordperfect for Linux or Loki Entertainment. It's been predicted way longer than 2006. Ps. Sorry for the accidental downvote :(.
  - mastahype 11y ago
    Can attest. Used Linux as primary OS for last 2-3 years in college, then got a job doing development on Linux, then worked for a Linux startup in early 2000's (we hired a couple ex Loki employees). Linux on the desktop has been a roller-coaster movement since not long after it's inception, likely around the time KDE and Gnome were released with some level of maturity. There was always the ported desktop managers but I don't think it's had much viability for dominance until OpenOffice came along.
  - Zardoz84 11y ago
    Oh! Someone that remember Corel OS. I have one disc yet somewhere...
    - danieldk 11y ago
      Yeah :). I was mostly using Slackware Linux at the time, but my brother bought a Corel Linux box at the time. If I remember correctly, it came with an inflatable Tux. I also had a separate copy of WordPerfect for Linux for a long time. It still worked fine until I sold it on eBay, thanks to libc5 compatibility in most distributions. Even though I stopped using it at some point, I continued to use the Type 1 fonts that came on the CD.
nivla 11y ago
First, the website is down. Second there is always overblown paranoia that runs with every release of Windows. I wish if EFF or atleast ArsTechnica would cover so atleast it will be a proving point for these independent blogs. For all I know is that these updates could be for someone who has already signed up for "Sent diagnostics to Microsoft for product improvement" on their existing Windows. Else it has to be the dumbest spyware that comes with a release note, description and a self describing name. >2016 is the year of desktop linux. I don't care if it is Linux, Apple or Windows. As long as someone can guarantee a certain degree of usability and a common sense of privacy, I wouldn't mind switching. However at this point where even open source is taking a nose dive (eg: "Ubuntu and Amazon Search", "Chrome and proprietary blobs", "Firefox with Hello and Pocket"), I am not sure anymore. If it keeps up this rate, in the future people might look back and see privacy as a silly idea /sad.

jsingleton 11y ago

Site seems overloaded. Here are the KB links from an earlier discussion (https://news.ycombinator.com/item?id=10110316 https://news.ycombinator.com/item?id=10110316). Thanks vetinari. https://support.microsoft.com/en-gb/kb/3068708 https://support.microsoft.com/en-gb/kb/3068708 https://support.microsoft.com/en-gb/kb/3075249 https://support.microsoft.com/en-gb/kb/3075249 https://support.microsoft.com/en-gb/kb/3080149 https://support.microsoft.com/en-gb/kb/3080149 Also found: https://support.microsoft.com/en-gb/kb/2976978 https://support.microsoft.com/en-gb/kb/2976978

JimmaDaRustla 11y ago
Some of those look like they'd be used to upgrade to Win10? Compatibility checking, diagnostics, etc. Nothing seems malicious, but you never know.
0x0 11y ago
The list of files modified (to add telemetry hooks?) in kb 3080149 is crazy. NTOSKrnl, NtDll, Lsass, winload.exe etc... Are they really adding spyware/telemetry hooks all the way down to the kernel? What happens next time there's a security patch for the kernel, do we get an ntoskrnl with all these "optional updates" included as well?
- kstrauser 11y ago
  Pretty much, yes. As I mentioned elsewhere, they enable spying on kids by default if they're logged in through a Microsoft account. If they're going to spy on kids, adults get the same mechanisms installed.
  - acqq 11y ago
    kstrauser refers to: https://news.ycombinator.com/item?id=10111271 https://news.ycombinator.com/item?id=10111271
- acqq 11y ago
  I remember some months ago where they only claimed fixing something minor (like, something that's not even an executable but some text-based or at least data file) in the patch and the list included also a huge amount of files including cryptwhatever.dll (not the actual name). "Backdoor time" thought I. As little as I checked however, it didn't look like a real smoking gun then. It seems a common practice somehow that since some time their updates aren't "hand picked" but generated by the computer without too much human control or that the programmers don't have time, or simply nobody cares there anymore. I'd be glad if somebody would sensibly explain all that. Including these recent "everything you type will be transferred" and "the list of all your files will be made" claims.

archimedespi 11y ago

Is there any tool like DisableWinTracking for Windows 7?

mnw21cam 11y ago
A Linux machine with two ethernet cards acting as a firewall to the internet?
- simonh 11y ago
  Do we even know how you'd need to configure the firewall to block the specific traffic that's the problem?
  - morganvachon 11y ago
    There's a list of domains that came up in a previous discussion on HN (sorry, I don't recall it right away), and was also trending on pastebin.com, which contained all of the known domains Microsoft was using to report back from the OS. Presumably you could route those to "null" or the equivalent on your router and you'd be good to go. Edit: Here's the pastebin link: http://pastebin.com/RZW74Npk http://pastebin.com/RZW74Npk
    - scott_karana 11y ago
      You could always just do that in Windows' hosts file, too.
      - morganvachon 11y ago
        You can, and I'm sure most would. There may come a time, however, when a future Windows update rewrites or works around the hosts file for telemetry. Doing it at the router or external firewall avoids that possibility.
        scott_karana 11y ago

jsingleton 11y ago

Not sure why this is being down-voted. Just trying to be helpful in case people want to avoid these optional updates or uninstall them. Maybe I should just delete the comment?

leni536 11y ago
Please don't
- jsingleton 11y ago
  OK, just didn't want to add to the clutter if it was unhelpful. A load of links without context isn't a great comment. :) BTW these updates all appear to be "Optional" and are part of the Customer Experience Improvement Program (which in my experience is always opt in and you get a notification in the system tray).
  - FilterSweep 11y ago
    They are currently optional - different than "Important Updates" and "Recommended Updates." I checked my windows update panel in Windows 7, mind you, (Start --> Control Panel --> Windows Update), and saw it listed as an optional update. I believe these optional updates, in windows 7 at least, are defaulted to be listed, but not downloaded or installed. I clearly won't be installing these, haha.
ploxiln 11y ago
In general I'd say the inclination to delete a comment because it's being down-voted is... not good. Don't try so hard to conform to what appears to be the local public sentiment. (EDIT: or, if it's a threat to delete if you don't get upvotes, also lame)
dang 11y ago
That helpful comment got two downvotes and well over a hundred upvotes. This is an extreme example of why HN has a guideline asking people not to comment about being downvoted. Most of the fluctuation is ephemeral, and most comments about it soon become inaccurate. We've detached this subthread from https://news.ycombinator.com/item?id=10110543 https://news.ycombinator.com/item?id=10110543 and marked it off topic.

fataliss 11y ago

Maybe a chance for the Linux gaming scene? Finally a window (see what I just did?) for an other gaming OS? Hail Unix.

deleted 11y ago

[deleted]

bung 11y ago

Been waiting for an article like this but even though it points to two items, KB3075249 and KB3080149, it doesn't seem like "firm" information as there is a huge list of "maybe" items as well as a warning that removing things can mess up your computer. How likely is it that we'll ever have a "firm" finite list?

yuhong 11y ago

FYI, you can't disable telemetry on Win10 unless you have enterprise edition, but you can select levels.

archimedespi 11y ago
You sort of can, see things like https://github.com/10se1ucgo/DisableWinTracking/ https://github.com/10se1ucgo/DisableWinTracking/.
- A010 11y ago
  It's easy to blackhole those domains and remove reg keys, but I wonder if M$ will add new ones in later updates.
  - nullsmack 11y ago
    That's okay, they can just use their p2p technology and route their spying through other people's computers.

jimeh 11y ago

Google cache of the article as the site seems down: http://webcache.googleusercontent.com/search?q=cache%3Awww.hakspek.com%2Fsecurity%2Fupdates-make-windows-7-and-8-spy-on-you-like-windows-10%2F&oq=cache%3Awww.hakspek.com%2Fsecurity%2Fupdates-make-windows-7-and-8-spy-on-you-like-windows-10%2F&aqs=chrome..69i57j69i58.1629j0j4&sourceid=chrome&es_sm=91&ie=UTF-8 http://webcache.googleusercontent.com/search?q=cache%3Awww.h...

balabaster 11y ago

.... aaaand Windows Update Automatic Updates is getting disabled.

fiatpandas 11y ago

I have my windows 7 PC set up to automatically install "important" updates. Are these telemetry updates considered "important" or "recommended"?

marvy 11y ago
Just check if you already have them installed or not

mintplant 11y ago

Article text, since the site seems to be down: Windows 10 has been launched and already installed on more than 50 million computers worldwide. It is now a known fact that Windows 10 user data is being sent back to Microsoft servers back in Redmond, Washington. Well, now new updates that are being deployed to all Windows 7, 8 and 8.1 machines will turn their computers into a big piece of spyware, just like their predecessor, Windows 10. The updates in question are KB3075249 and KB3080149. if installed, these updates are known to report your data back to Microsoft servers, without user interaction. KB3075249 Microsoft Update adds telemetry points to ‘consent.exe’ in Windows 7, 8 and 8.1, allowing for remote monitoring of everything that happens within the operating system. KB3080149 ensures that all “down-level devices” receive the same updates and treatment as Windows 10 boxes get. As you would guess, forums are lit up with speculation on these updates and more. Below you can find a list of other Windows updates that some users have questioned. Please keep in mind, avoiding some or all of these updates may cause your environment to be unstable and/or unsecure. KB2505438 KB2670838 – Windows 7 Only (corrupts AERO and blurry fonts on some websites) KB2952664 KB2976978 – Windows 8 only KB3021917 KB3035583 KB3075249

acqq 11y ago
The links to the Microsoft's KB articles of the two updates: https://support.microsoft.com/en-gb/kb/3080149 https://support.microsoft.com/en-gb/kb/3080149 "This package updates the Diagnostics and Telemetry tracking service to existing devices. This service provides benefits from the latest version of Windows to systems that have not yet upgraded. The update also supports applications that are subscribed to Visual Studio Application Insights." https://support.microsoft.com/en-gb/kb/3075249 https://support.microsoft.com/en-gb/kb/3075249 "This article describes an update that adds telemetry points to consent.exe in Windows 8.1, Windows RT 8.1, Windows Server 2012 R2, Windows 7 Service Pack 1 (SP1), and Windows Server 2008 R2 SP1."
FilterSweep 11y ago
Just the name "consent.exe" itself sounds malicious (although it's been around for a while).
- 11y ago

tinfoilman 11y ago

Brilliant, 2 options I see Never do updates again (which is what I will be doing this evening) and make system perm insecure Or let MS and the NSA rape me for even more data than they already have Go [insert abusive word] yourself Microsoft and to think just last week I got a 3rd windows 7 license because I was planning to stay on 7 long term and not upgrade to 10. Steam hopefully will push linux gaming that i can finally get rid of this crap.

ionised 11y ago
If Steam OS becomes a viable desktop gaming OS that plays most, if not all games, I'll drop Windows in a heartbeat.
- sschueller 11y ago
  Steam is owned by Valve and Valve is a US company. Using steam will not change anything since it is the US laws allowing/requiring companies to comply with the NSA.
  - ionised 11y ago
    The difference being that I want to use Windows only for games without all this other cloud integration crap that comes with it. Steam OS is a Linux-based OS designed primarily for gaming. Any and all cloud-integration will be specifically gaming-focused. Can you not see the difference between that and a general purpose OS like Windows harvesting data everything you do on your system? I won't be using Steam OS to do anything very sensitive like sending or receiving personal e-mails, editing word documents or spreadsheets, or browsing the internet for whatever reason. Unless you consider firing up a shooter or a city-building sim sensitive. The two OS's have very different purposes and use-cases.
  - pjc50 11y ago
    Telemetry is clearly not a legal requirement. It's only data stored on steam servers (including chat logs) which you have to worry about.
  - 11y ago

nly 11y ago

Easiest way to block this for sure is probably going to be harvest a list of hostnames and/or IPs microsoft are using and block them at your border gateway/router. I've recently considered setting up a separate wifi SSID where everything outbound except DNS, and tcp 80/443 is blocked, as well as TLS SNI and plain HTTP logging just so this sort of thing can be monitored.

kardos 11y ago
That's a fragile solution at best. One update could change the IP/hosts of the data harvesting servers. Surely the data will be transmitted using TLS or equivalent; HTTP logging won't do you much good unless you can (a) MITM the TLS setup, or (b) extract the keys that the spyware is using.
JadeNB 11y ago
It's not what you said, but note that some of the phone-home behaviour is very deep rooted, ignoring proxy settings (http://arstechnica.com/information-technology/2015/08/even-when-told-not-to-windows-10-just-cant-stop-talking-to-microsoft http://arstechnica.com/information-technology/2015/08/even-w...): > We configured our test virtual machine to use an HTTP and HTTPS proxy (both as a user-level proxy and a system-wide proxy) so that we could more easily monitor its traffic, but Windows 10 seems to make requests to a content delivery network that bypass the proxy.
rasz_pl 11y ago
Windows internal firewall blocks everything just fine. So far there are no secret allow lists present. Enable 'Deny all outgoing' and start adding your own Egress filtering rules.

rileyteige 11y ago

If I could figure out my wireless card/GPU drivers, I'd swap to Linux in a heartbeat. Plug-n-play drivers is the only reason I'm still on that closed-source OS. Just don't have the patience to hunt down third-party drivers.

keithpeter 11y ago
Boot off a live CD (e.g. Ubuntu) and run lspci from a terminal session then post it here. You may find the drivers you need are available in a separate 'restricted' or 'non-free' repository. It is unusual these days on desktop/laptop oriented installs to have to 'hunt down' anything. Very very recent hardware can still be problematic mind you.
nileshtrivedi 11y ago
Broadcom and nVidia?
zurn 11y ago
Just get the right hardware with good Linux support, it all just works then. You won't find any lasting happiness by digging deeper into the third party drivers swamp. (all-Intel for wifi and graphics is the safest bet)
tacone 11y ago
Mainstream hardware is decently supported, if you don't have special claims. Ubuntu live cd/usb?
yellowapple 11y ago
> Just don't have the patience to hunt down third-party drivers. For most modern distros, you don't have to hunt down third-party drivers; at most, you might need to enable some first-party or second-party "restricted" repo, at which point you can install the necessary drivers from there. And last I checked, Ubuntu and Linux Mint (among others) provide a "restricted hardware wizard" in the normal settings screen to do precisely this.

dmfdmf 11y ago

When KB3035583 GWX/Win10 Spam came out I removed it and put my updates into manual because I figured it won't be long before MS put out another updated to push Win10. This is much worse, now I find out there are a number of updates that I have to track down and uninstall. Going forward I will always have to lag a month or so behind updates to make sure MS is not installing a key logger on my Win7 computer. I guess my move to Linux is sooner that I thought.

DrNuke 11y ago

This news is another nail in the coffin. The pattern I can see among my peers and my small market is that people are more and more uneasy with using the web for sharing valuable info and data, both on public and private networks. They prefer face-to-face meetings and paper docs. Food for thought and some ground for new startups maybe.

Raed667 11y ago

Every-time Microsoft releases a new Windows (Since XP SP1) I saw quantifiable performance decline with every update I installed. I think Microsoft pushes people to change OSs using this technique.

jahewson 11y ago

This looks like a deliberately misleading and overblown claim to me. Looking at the knowledge base articles, we see that the diagnostics tracking service is enabled only for users who already participate in the customer experience program (a very clear option when setting up Windows for the first time: - KB3080149: "The diagnostics tracking service collects diagnostics about functional issues on Windows systems that participate in the Customer Experience Improvement Program (CEIP)." The second update is short on details, but it's specifically targeting the UAC "Run as Administrator" dialog (which is implemented by consent.exe), presumably to collect information on unsigned applications which request admin privileges. Microsoft should provide further details here for sure, but I see nothing nefarious. One might guess that the information collected here might be the hash of the exe requesting admin privileges. - KB3075249: "This update adds telemetry points to the User Account Control (UAC) feature to collect information on elevations that come from low integrity levels." Compare this with the ridiculous claim in the article that this is "allowing for remote monitoring of everything that happens within the operating system."

deleted 11y ago
[deleted]

mosselman 11y ago

So I just started my windows and it seems that I am 'infected' with this anti-privacy stuff. How do I get rid of it? Re-install from the installation disk and disable updates, or can I still remove the updates?

saint_fiasco 11y ago
You can remove updates via the control panel.
- mosselman 11y ago
  But does that really work in this case? It seems as if these new privacy things go pretty deep.
  - saint_fiasco 11y ago
    I'm not sure. I have seen spam that has unsubscribe buttons that actually work, as well as adware that uninstalls properly from the control panel. I hope Windows doesn't do worse than spammers and malware programmers.
    - mosselman 11y ago
      Lol, thanks. I will at least give it a try ;). But before that I am moving all my personal files to my NAS and I will only be using windows for playing a game or 2.

mtgx 11y ago

What an unbelievable lack of respect and a big FU to Microsoft's own customers. At least using Windows 10 is a choice (I think - do they force it on Windows 7 machines?), but to do this to all existing customers - wow, just wow. Behold everyone - this is the "new" Microsoft, worse than it ever was.

marcosdumay 11y ago
> I think - do they force it on Windows 7 machines? No, but they keep nagging you every time you turn your computer on.
- logfromblammo 11y ago
  You can turn off the nagging by uninstalling update kb3035583. Then hide the update so it doesn't helpfully install it again for you.

tacone 11y ago

I wonder how any IT corporation of decent size, with internal data policies will be able to live with something this.

leonatan 11y ago

Archived version until the site is up: https://web.archive.org/web/20150824023803/http://www.hakspek.com/security/updates-make-windows-7-and-8-spy-on-you-like-windows-10/ https://web.archive.org/web/20150824023803/http://www.hakspe...

ausjke 11y ago

Happy linux desktop user here, I only need windows for turbotax once a year, so I will worry about this in Feb/Mar, anyone provides a cloud-based tax filing service?

kingnothing 11y ago
Turbotax.com
slayed0 11y ago
Doesn't turbotax provide just that? I did my taxes with them last year and never left the browser.
gvb 11y ago
H&R Block does: http://www.hrblock.com/online-tax-filing/ http://www.hrblock.com/online-tax-filing/ Disclaimer: I have not used their online version so I don't know how well it works. I have been running their Windows version in a VM the last few years because I'm not wild about putting any more of my tax information "in the cloud" than I have to. I would expect TurboTax to support online filing too, but did not see it on a quick search.
- nacs 11y ago
  > I don't know how well it works I've used H&R Block's online service for filing federal and state taxes for the past few years with no issues.
cmrx64 11y ago
The most you need to get turbotax to work online is a user agent spoof.
specialp 11y ago
taxact.com is entirely online too. No app required.
yellowapple 11y ago
Yeah, TurboTax does. I've done my taxes several times now entirely from Firefox+Linux. TurboTax will nag you about using an unsupported browser/OS combo, but you can just click the link saying "yeah, whatever, I know what I'm doing, sod off and let me do my bloody taxes" and it'll work perfectly fine.

rdudek 11y ago

I have a question that I can't seem to get a straight answer anywhere. If I were to use Win 10 Enterprise edition, could I theoretically disable all the spying and telemetry? It also now seems like we need two computers. One that is open for "spying" so the government looks at my usage and white-lists me as a "good citizen" and another computer that basically is encrypted and hides anything I don't want anyone to know about.

kardos 11y ago
Or just one that runs open software...

mizzao 11y ago

People who use their google accounts and Chrome ubiquitously already get spied on by GA at a much bigger scale through all the sites they visit in their browser. Why is it a big uproar when it happens at the OS level? Seems like it's pretty much the same thing. We always have the option of using Linux if we don't like it.

ihsw 11y ago
Because the pressure should go in the opposite direction -- they should have to find users that want to be spied on, we shouldn't have to find operating systems that don't spy on us. I wouldn't otherwise have used Windows had I known they'd be shoving their telemetry reporting down my throat.
Hjugo 11y ago
Because it is easier to switch a browser then a OS and many just can't switch to linux.
kardos 11y ago
Chrome -- as far as we know -- doesn't transmit all of your keystrokes to Google, nor does it transmit the contents or indexes of your local filesystem(s) back to Google.
- McGlockenshire 11y ago
  You're posting FUD. Those permissions are required in the context of Cortana, so Cortana can work. Keep Cortana off and turn off the services, and nothing gets transmitted. It's literally no worse than the conditions you agree to when using Siri or Ok Google / Google Now.
  - kardos 11y ago
    If you'll allow Wikipedia to define FUD [1], > FUD is generally a strategic attempt to influence perception by disseminating negative and dubious or false information. What part is dubious or false? Do you need me to quote the Win 10 privacy policy? [1] https://en.wikipedia.org/wiki/Fear,_uncertainty_and_doubt https://en.wikipedia.org/wiki/Fear,_uncertainty_and_doubt

hadeharian 11y ago

Windows, now like AOL but better!

kstrauser 11y ago

I submitted a story to Boing Boing (at http://boingboing.net/2015/08/10/windows-10.html http://boingboing.net/2015/08/10/windows-10.html) about the weird experience I had after upgrading my son's laptop from Windows 8.1 to 10. We did this on a Saturday, and Monday morning I had a "family safety report" email from Microsoft detailing which websites he'd visited, which apps he'd used (and for how long), etc. since the upgrade. According to Microsoft's Family Safety FAQ (https://account.microsoft.com/family/faq/ https://account.microsoft.com/family/faq/): > On Windows 10, you’ll need a Microsoft account in order to use Microsoft family whether you’re a part of a family as an adult or a child. When kids are added to a Microsoft family with a Microsoft account, any time they sign in to a Windows 10 device, their settings will be applied and their activity will be reported to the adults in their family. Adults can always turn off activity reporting or remove kids from the Microsoft family at account.microsoft.com/family. By default, unless you log in and explicitly disable it, Windows 10 collects kids' usage activity and uploads it to Microsoft's servers. Presumably the same mechanism is disabled for adults. Presumably. I definitely didn't enable it, and I'm sure my son didn't check any "narc me out to my parents" checkbox. Edit: we already had a family account set up for our Xbox. I suspect that's how Microsoft determined that the emails should go to me.

IkmoIkmo 11y ago
Wow that's insane! And I'm glad you're an awesome parent. You should post a anonymised screenshot of that email sometime if you can, this is pretty ridiculous.
- kstrauser 11y ago
  Ask and ye shall receive: http://imgur.com/eeBtcIw http://imgur.com/eeBtcIw Bear in mind that it's nearly empty because we'd only just recently upgraded to Windows 10, but note that it has an entry for "Latest searches". Wouldn't that be one hell of a way for a kid to come out of the closet to his parents, or for someone to find out their daughter's pregnant? Consider that this data is linked to each kid's email address. When this database is hacked, won't that be an interesting week in all the local schools as everyone learns what their peers are really doing?

toufka 11y ago

Installing spyware via a software update is a huge moral hazard for Microsoft. It incentivizes people to maintain an unpatched operating system.

rbx 11y ago

kb3075249 - "...adds telemetry points..." (https://support.microsoft.com/en-us/kb/3075249 https://support.microsoft.com/en-us/kb/3075249) kb3080149 - "...Telemetry tracking service..." (https://support.microsoft.com/en-us/kb/3080149 https://support.microsoft.com/en-us/kb/3080149) kb3068708 - "...Telemetry tracking service..." (https://support.microsoft.com/en-us/kb/3068708 https://support.microsoft.com/en-us/kb/3068708) kb2976978 - "...performs diagnostics on the Windows systems that participate in the Windows Customer Experience Improvement Program..." (https://support.microsoft.com/en-us/kb/2976978 https://support.microsoft.com/en-us/kb/2976978) kb3021917 - "...Telemetry is sent back to Microsoft..." (https://support.microsoft.com/en-us/kb/3021917 https://support.microsoft.com/en-us/kb/3021917) kb3035583 - "...installs the Get Windows 10 app..." (https://support.microsoft.com/en-us/kb/3035583 https://support.microsoft.com/en-us/kb/3035583) kb2952664 - "...ease the upgrade experience to the latest version of Windows..." (https://support.microsoft.com/en-us/kb/2952664 https://support.microsoft.com/en-us/kb/2952664)

inevitable2 11y ago

Here is a more in-depth analysis of windows 10 and what is sent to MS http://aeronet.cz/news/analyza-windows-10-ve-svem-principu-jde-o-pouhy-terminal-na-sber-informaci-o-uzivateli-jeho-prstech-ocich-a-hlasu/ http://aeronet.cz/news/analyza-windows-10-ve-svem-principu-j... For those who don't speak Czech: -It sends all text you type anywhere (not just into search) every 30 minutes to MS. If you type about a holiday to your blog, next day you'll see holiday ads. -Every 30 minutes it sends your geo-location and network information. -If you type a telephone number into Edge it sends it to MS after 5 minutes. -If you type anywhere in Windows a name of some movie, Windows will start indexing all your media files after a while and will send it to MS after 30 minutes of your inactivity. -After installing W10, it will send about 35MB of data once. -After turning on your webcam for the first time it sends data to microsoft once. -Everything you say is transferred to MS, it works even if you disable and remove and uninstall cortana. Parts of Cortana are needed for the core of the OS to run. -Voice is transferred every 15 min, 80MB of data. -After 15 minutes of your inactivity or when screensaver is on, network activity ramps up and everything else is being sent to MS. -Blocking in hosts doesn't work, IPs are hardcoded into their code and DLLs.

kardos 11y ago
Is any of this verified? During a previous posting of this it was largely dismissed as propaganda [1]. If someone has reproduced these findings that would be very interesting. What would be even more interesting would be for someone to intercept the spying data that is being sent back so we know for sure what's being sent. [1] https://news.ycombinator.com/item?id=10053420 https://news.ycombinator.com/item?id=10053420
- Artemis2 11y ago
  Was about to ask for an alternate source too. Last time this was posted, people pointed out this website was not reliable at all. A nice analysis by a well-known security researcher should exist to confirm that.
  - ewzimm 11y ago

throwaway77632 11y ago

No wonder they intend to no longer describe what's in an update... Only using Windows in a VM still. Just set the network connection host-only. Didn't really need internet there anyway, and given these circumstances, I might as well get rid of it completely. I guess any inclination I had to think Microsoft is on the way up just vanished again. Too bad it also means I'm probably going to throw away my plans of diving into F#. Open source, but still too tied to this company I'd better just give up on.

kefka 11y ago
If you want to get into functional programming, check out Haskell or Erlang. Both run well on Linux.
yellowapple 11y ago
Last I checked, F# works perfectly fine on non-Windows platforms with Mono.

hfpn 11y ago

Microsoft's got even bigger balls then I thought they had... I hope this is the beginning of the end.

antaviana 11y ago

Curiously, the net effect is that now there is one reason less to skip upgrading to Windows 10!

minthd 11y ago

If that's true - doesn't this expose microsoft legally ? I mean we paid for win 7 under certain terms, and now they're changing them.

coldpie 11y ago
One of those terms was that they can change the terms at any time without notice.
- minthd 11y ago
  :) .Is that even legal ?
  - anonbanker 11y ago
    Consent is cemented 72 hours after a contract has been agreed-upon, unless fraud is involved. In this case, agreement to future contract amendments/changes is consent. Your fault for clicking "Agree". Didn't anyone watch the Human Cent-iPad episode of South Park?
    - minthd 11y ago
      IANAL , but: " Unilateral modifications are not supposed to alter the material or important terms of the original contract. " http://www.faircontracts.org/contract-provisions/unilateral-modification http://www.faircontracts.org/contract-provisions/unilateral-...
      - anonbanker 11y ago
        Unless you've bilaterally agreed or acquiesced to it, of course. Consent(.exe) is everything. You have 72 hours (10 business days by mail) to undo your consent to the Windows license changes after clicking "Agree". Did you submit your notice in a timely fashion, or did you let the clock run out?
dmfdmf 11y ago

fsloth 11y ago

If we try to apply the principle of charity - could there be seen any advantages that this telemetry data would provide to the end user? I can't come up with any at least.

xrstf 11y ago
If you ever get acused of having illegal images on your PC, you can ask Microsoft to prove that you never had .jpg files in C:\Windows\Fonts.

JustSomeNobody 11y ago

So, does this mean MS has lost all their good will points earned from releasing all the open source code recently?

SwimAway 11y ago

Where are the security researchers? Credible, elaborate, and well-documented articles? Has this not captured their attention or is it a lack of concern?

IkmoIkmo 11y ago

I think it's time that we don't ask of users to protect themselves by reading hundreds of pages of EULAs, and then ostracising themselves from mainstream electronics use (both at home, as well as at work) because they refuse to use software that's loaded with insane levels of spyware (record and transfer all voice and every keystroke). That's a large burden. It's perhaps time this becomes a legal matter rather than purely a user-choice matter. In society we have all kinds of protections for people that make a lot of sense, that take away individual responsibility. For example, even if a person wanted, you're not allowed to become a slave, it's simply not allowed. Even if a person wanted in most of the developed world, you're not allowed to work for less than minimum wage, or in a toxic environment. Similarly even if a person says 'I don't mind if people are misogynistic towards me at work, or discriminatory, I just want this job no matter what because I need the money', that's not allowed, either. Similarly, I think it's time we start to think of legal protections again this level of spyware. We shouldn't put the burden of acceptance on individuals when you'll have millions of people who'd prefer to live in a world where they don't have to use this software at home or at work, but have no choice (particularly at work), and thus accept spyware because the loss of their job works as a blackmailing force, just like in the above examples. That doesn't mean I'm saying there is no legal place for software like this under any conditions. But the notion that it can't be turned off is insane. Even 'on by default' is a step too far, but now Windows is saying whether you use windows 7, 8 or 10, we're spying on you, and you can't turn it off, and if you tamper with our software manually you'll fail because we've hardcoded it. That's not acceptable and my point is, it shouldn't fall upon users to boycott such harmful parts of software they paid for (in the case of Windows 7, half a decade ago). It should fall upon the rule of law to prevent this and allow at least an opt-in, a choice, a choice that isn't 'use any Windows product, or use no Windows product' If OSs were more free like say, the automotive industry, I wouldn't mind as much. Like if Toyota one day decided to record audio in cars, that's one thing. You can switch to more than a dozen top-quality car manufacturers who don't do this, and it wouldn't affect your jobs or anything like that. But we're talking about a desktop/laptop market where <2% of marketshare is Linux and OS X is ~10%, the remainder is virtually all windows and its got hardcoded spyware features.

SixSigma 11y ago
My UK govt. is trying the backdoor / ban all encryption and is complicit in our "security services" getting unfettered access to citizen data. As was the previous govt. And all govts before it, and all govts in all countries. Getting them to enact and defend the opposite will take a Herculean effort to make the citizens aware, let alone care. I despair.

SpikedCola 11y ago

Found a useful script on SuperUser that removes KBs as well as hides them in the future. Just need to change the list slightly FOR %%X IN (3075249 3080149 3068708 2976978 3021917 3035583 2952664) DO ... http://superuser.com/questions/922068/how-to-disable-the-get-windows-10-icon-shown-in-the-notification-area-tray/922921#922921 http://superuser.com/questions/922068/how-to-disable-the-get...

aikah 11y ago

That's what happens when a single vendor has more than 95% shares of a market. There is no competition , where the hell people using Windows software are going to run ? I'm really angry at this. What's the difference between this and a spyware / key logger / trojan ? there is none conceptually. I sincerely hope it backfires because it's just insane. If MS wants to collect on my hard drive or log my key strokes , it should ask for my approval first and not hide it behind a license. People are outraged with the AM hack scandal, well nothing guarantees that MS will never be hacked. And when a database like this get hacked , every windows user data will be in the wild. That's just crazy. Is the the "new microsoft" , a lot of HNers like to boast about ? Same as the old one.

superskierpat 11y ago

Well I can see Russia putting alot more money into ReactOs

yellowapple 11y ago
Or GNU/Linux, or OpenBSD, or something else privacy-aware. But yes, ReactOS could certainly use some love, from Russia or otherwise. Can't wait for 0.4.0 to come out; should be a nice push toward general usability.
- superskierpat 11y ago
  I've just finished installing arch linux after nuking my ubuntu/windows install, I've been doing a hell of alot of configuration but I'm pretty happy with I have. More on point, I've been planning to buy a cheap laptop to test more experimental oses, like react and harvey.
  - yellowapple 11y ago
    Hadn't heard of Harvey before. Looks like an interesting take on Plan 9; I'll definitely have to try that one out.

komicsans 11y ago

As far as I know, these updates are optional.

rasz_pl 11y ago

Cant wait for new EU fine, lets hope its orders of magniture more significant this time. Cool 10 Billion Euro should be enough to stop MS from screwing people over.

Hjugo 11y ago
Or that they finally fund a project that could replace windows
- endymi0n 11y ago
  Given their dysmal track record of funding anything remotely successful and other than ivory tower projects, I wouldn't hope too much. https://en.m.wikipedia.org/wiki/Quaero https://en.m.wikipedia.org/wiki/Quaero Or look at Stratosphere/Apache Flink, basically they cloned Spark in much worse for millions of dollars.
- yellowapple 11y ago
  Something like ReactOS or Longene would be a feasible target for such efforts. Or even just a commitment to GNU/Linux or one of the BSDs.

CamperBob2 11y ago

The lack of public disclosure, commentary, and, yes, outrage surrounding Windows 10's privacy policy is a lot more disturbing than Windows 10 itself.

alimbada 11y ago

There's been a number of revelations about the invasion of privacy prevalent in Windows 10 (and now according to this article/thread 7 and 8 too), but curiously Microsoft have been very silent on the matter which is only making things worse for them as users will naturally take that as a confirmation of the relevant findings. It's also strange to see Microsoft making this move given that this invasion of privacy is probably illegal in many ways in countries that are forward thinking enough to have laws against this type of thing. Maybe they see it as a short term ploy to try and collect as much data as they can before there is a big enough uproar against it and then decide to pull the "feature(s)". They may see it as worth the controversy if they can gather enough data for future products/improvements.

beloch 11y ago

Microsoft has already raised our suspicions by offering Windows 10 upgrades for free. As a result, we're perfectly primed to believe the worst about these updates. Microsoft needs to do something convincing to reassure it's users or Windows 10 will likely become synonymous with "Big Brother" regardless of what's actually going on. To reiterate, we're leaving territory in which it would have been reasonable to "do nothing and hope it all blows over". MS needs to respond quickly or they're going to have another dud release on their hands, in spite of giving it away for free.

vmp 11y ago

I wrote an utility in C# to make it easier to uninstall the offending updates: https://github.com/schumann2k/UpdateAntiSpy https://github.com/schumann2k/UpdateAntiSpy Feedback & pull requests welcome. :)

lewisl9029 11y ago

What exactly is going on with the decision making at Microsoft? With all the backlash that has resulted from the Windows 10 privacy issues, you'd think their next thought wouldn't be "we should piss off our customers with more of the same".

mamon 11y ago

It seems that Microsoft was right when calling Windows 10 "The Last Windows" - after such insolent violation of privacy people will switch to Linux or Mac OS just to avoid it. Microsoft is doomed, let's celebrate! :)

ptx 11y ago

Parents spying on their children's communications seems hard to reconcile with the principles in the UN Convention on the Rights of the Child[1] which most countries are signatories to, in particular articles 13 and 16: "Recognizing that the United Nations has, in the Universal Declaration of Human Rights and in the International Covenants on Human Rights, proclaimed and agreed that everyone is entitled to all the rights and freedoms set forth therein, without distinction of any kind, such as race, colour, sex, language, religion, political or other opinion, national or social origin, property, birth or other status, ... "The child shall have the right to freedom of expression; this right shall include freedom to seek, receive and impart information and ideas of all kinds, regardless of frontiers, either orally, in writing or in print, in the form of art, or through any other media of the child's choice. ... "No child shall be subjected to arbitrary or unlawful interference with his or her privacy, family, or correspondence, nor to unlawful attacks on his or her honour and reputation. "The child has the right to the protection of the law against such interference or attacks." Given that Microsoft is a US company and the US is one of very few countries that hasn't ratified the convention[2], the concept of children having human rights might seem strange and foreign to them, but almost everywhere else, the state is (it seems to me) obligated to protect children from this kind of intrusion. (Maybe the EU could look into forcing them to release a special spyware-free edition...) [1] http://www.ohchr.org/EN/ProfessionalInterest/Pages/CRC.aspx http://www.ohchr.org/EN/ProfessionalInterest/Pages/CRC.aspx [2] http://www.unicef.org/crc/index_30225.html http://www.unicef.org/crc/index_30225.html

miralabs 11y ago

can they be sued for doing this?

tacone 11y ago

I'm with Ubuntu/Gnome3 and it's pretty fine. It took some plugin installing (very easy btw), but it feels pretty good. Time to switch?

mosselman 11y ago

I put this in a file called something.bat and ran it as administrator to uninstall (I hope) most of the KBs. Any feedback would be great: wusa.exe /kb:3075249 /uninstall /norestart wusa.exe /kb:3080149 /uninstall /norestart wusa.exe /kb:3068708 /uninstall /norestart wusa.exe /kb:2976978 /uninstall /norestart wusa.exe /kb:3021917 /uninstall /norestart wusa.exe /kb:3035583 /uninstall /norestart wusa.exe /kb:2952664 /uninstall /norestart