5 ms·

> So is a Google Search. Which is implicitly understood by the nature of its outputs. Furthermore Google Search is localized to an application (if we aren't ta

> So is a Google Search. Which is implicitly understood by the nature of its outputs. Furthermore Google Search is localized to an application (if we aren't talking about Android phones, which is another world of bad) and isn't ever present in the OS if you didn't make extra effort to disable it. The issue dissolves to informed consent. You'll have hard time convincing me my less technically inclined relatives provided informed consent to collection of data when Windows 10 was forced on them which I had to disable after it ran for weeks.

KirinDave 10y ago
> Which is implicitly understood by the nature of its outputs. Furthermore Google Search is localized to an application (if we aren't talking about Android phones, which is another world of bad) and isn't ever present in the OS if you didn't make extra effort to disable it. chokes Firefox and Chrome are getting a hell of a pass if you're going to say web browsing is "confined to an application." > You'll have hard time convincing me my less technically inclined relatives provided informed consent to collection of data when Windows 10 was forced on them which I had to disable after it ran for weeks. While there is no doubt that the Win10 migration could have been handled better, it's difficult to actually image a better path for MS to take. As you've intimated, your "less technically inclined relatives" are difficult to inform in order to give informed consent w.r.t. the issues at play with the upgrade to Win10. What's more, the telemetry collected is of the most benign type that Apple, Google, Microsoft, and nearly all 3rd party apps have actually been collecting (enabled via TOS agreements and practicality) for the better part of a decade now. Said usage telemetry is essentially required to provide software at the scale, quality, and cost that the market demands.
- ta_donk_gt 10y ago
  > What's more, the telemetry collected is of the most benign type that Apple, Google, Microsoft, and nearly all 3rd party apps have actually been collecting Do you have any links on what telemetry data is actually collected and sent? I would genuinely appreciate it. This is has held me back from what is otherwise a pretty solid OS upgrade. All I've seen has either directly indicated or indirectly insinuated that every key stroke (not just Cortana search, but every keystroke entered while using Windows 10) is collected and sent with the telemetry data. Being encrypted traffic, and data that can be sent at any time, not necessarily when keys are being pressed, there is no way to inspect and verify. The closest I have seen to rebuttals of this are either people with no knowledge or connection saying "oh, come on, they would never do that", or Microsoft saying essentially "we cannot allow telemetry to be turned off anymore because the more advanced users that we need data from would turn it off". I don't think there is a way to prove what is actually sent, unfortunately, but it would be nice to at least hear Microsoft say "we firmly believe in the privacy of our users and would never dream of being anywhere near that invasive".
  - daxorid 10y ago
    Really wish someone could definitively answer you. I have yet to see any analysis that could define hard boundaries on where keylogging occurs.
  - KirinDave 10y ago
    Ars peeked awhile ago. http://arstechnica.com/information-technology/2015/08/even-when-told-not-to-windows-10-just-cant-stop-talking-to-microsoft/ http://arstechnica.com/information-technology/2015/08/even-w... I've talked to 3 professional security researchers about it, and all seem unconcerned.
- PhasmaFelis 10y ago
  > While there is no doubt that the Win10 migration could have been handled better, it's difficult to actually image a better path for MS to take. No it's not! "Don't use deceptive language, don't force updates on users who didn't request them or specifically declined them, never reboot a running computer without explicit permission for any reason short of a total system freeze." > Said usage telemetry is essentially required to provide software at the scale, quality, and cost that the market demands. Then why are they being deceptive about it? If it's completely benign and only works for the good of the user, why do we keep hearing about new telemetry that people weren't aware of or thought they'd already disabled?
  - KirinDave 10y ago
    > "Don't use deceptive language, don't force updates on users who didn't request them or specifically declined them, never reboot a running computer without explicit permission for any reason short of a total system freeze." See, even these are not so cut and dry. Sure, "Deceptive" is a thing we want to avoid. But if a user is deceived by what others called clear language, was your language deceptive? I had no real issues understanding, "They want to give me an upgrade. If I click that, I'll get the upgrade." > don't force updates on users who didn't request them or specifically declined them, never reboot a running computer without explicit permission for any reason short of a total system freeze. We can argue about specifics all day, but if a user isn't going to reboot their computer periodically for critical security updates then doing it for them is a public service and it should be done. We're still very busy as a society pretending that computers aren't a public utility, but in fact they are and they have very real consequences for their use. > Then why are they being deceptive about it? See, this is what I don't get. Where are they being "deceptive" about telemetry? They don't act like it's a secret. They talk about it in public. > why do we keep hearing about new telemetry that people weren't aware of or thought they'd already disabled? Good question! This is not a new story. Go read the article carefully! This is all basically clickbaiting off an original very popular clickbait that said the EULA technically could be read to allow keylogging in some situations here: http://www.theinquirer.net/inquirer/news/2373838/microsofts-windows-10-preview-has-permission-to-watch-your-every-move http://www.theinquirer.net/inquirer/news/2373838/microsofts-... (btw, it can't, there's US and EU law at play that protects consumers). No seriously. That's what started this all. An insinuation that a tech preview might have telemetry. And so we continue to roll over this calling Cortana a "keylogger". They printed a followup which basically said, "No, they didn't use a keylogger" and gave it a surreal headline: http://www.theinquirer.net/inquirer/news/2421234/microsoft-plays-down-playing-fast-and-loose-with-windows-10-privacy http://www.theinquirer.net/inquirer/news/2421234/microsoft-p... From a technical and not-total-uninformed-bs perspective, it all comes back to, "Cortana's typeahead search mixes desktop search items with Bing search results, which are sent key-by-key for latency reasons, which is a trace of keystrokes" coupled with, "Cortana uses cloud computation for "hey cortana" voice analysis (not the wakeup cue, the the part after). And in Microsoft's defense, no one minded when Google did this, after Apple did it, after Firefox did it.
- RaleyField 10y ago
  > chokes Firefox and Chrome are getting a hell of a pass if you're going to say web browsing is "confined to an application." Well browsing in Firefox is confined to Firefox, not sure what you want to say. The fact that Firefox isn't perfect in every way shouldn't mean that Windows should go 100 mph evil with its telemetry. > is of the most benign type that Apple, Google If it's not straight keylogger still doesn't mean it's anywhere near acceptable. And it's fallacious to think whatever Apple and Google does on their platforms should have any bearing when judging what Microsoft does on its. There's been pattern of derailment whenever Windows is mention and it should stop. > and nearly all 3rd party apps have actually been collecting (enabled via TOS agreements and practicality) Lack of _informed_ consent and the fact that telemetry as part of OS is ever present (and not segregated to third party software) is what makes the difference. Flaws in third party applications are still reproachable, but they aren't the subject of discussion here and hopefully they are replaceable and not installed and turned on by default.
  - KirinDave 10y ago
    > Well browsing in Firefox is confined to Firefox, not sure what you want to say. The fact that Firefox isn't perfect in every way shouldn't mean that Windows should go 100 mph evil with its telemetry. Browsers are an incredibly sensitive and important part of people's day-to-day use of computers. In terms of time spent, most people overwhelmingly spend their time there, and even do work of other types via that system. > If it's not straight keylogger still doesn't mean it's anywhere near acceptable Indeed! But we can't even have a conversation about what the "is" in fact is! We're using incredibly incendiary and obviously incorrect language to avoid even the pretext of a rational examination of the data. I was just downmodded to -2 for posting a link to Ars's examination of the telemetry via local proxy and a discussion about what it looks like at the byte level. People are that uninterested in actually understanding the technical details here. Can you name a specific aspect of the telemetry that you don't like that you can't turn off in SP1? If so, please let me know. I am happy to gather data to consider escalating concerns both as part of my professional responsibility and as part of my connections to many smart and placed people at MS. > Lack of _informed_ consent and the fact that telemetry as part of OS is ever present (and not segregated to third party software) is what makes the difference. OSX, iOS, Android, and Ubuntu all contain core telemetry. They have similar EULAs to Windows for the customer facing product. Heck, this entire conversation got kicked off from the article I linked over the more exclusive opt-in for Insider program builds! The clause isn't as strong in the public EULA, last time I checked (IANAL, so please feel free to correct me if you're better informed there). I am all for a rational, calm, informed discussion about the pros and cons of telemetry. I wrestle with the "right" thing to do daily as part of the products I help build, design and ship. I very much want to have that conversation, but shady authors looking for cheap ways to buy relevance are writing clickbait to obfuscate the real discussion to make incrementally more dollars via impressions. If you're looking for deceit, the handful of authors cashing in on this meme are not a bad place to start.

KirinDave 10y ago

> Which is implicitly understood by the nature of its outputs. Furthermore Google Search is localized to an application (if we aren't talking about Android phones, which is another world of bad) and isn't ever present in the OS if you didn't make extra effort to disable it. chokes Firefox and Chrome are getting a hell of a pass if you're going to say web browsing is "confined to an application." > You'll have hard time convincing me my less technically inclined relatives provided informed consent to collection of data when Windows 10 was forced on them which I had to disable after it ran for weeks. While there is no doubt that the Win10 migration could have been handled better, it's difficult to actually image a better path for MS to take. As you've intimated, your "less technically inclined relatives" are difficult to inform in order to give informed consent w.r.t. the issues at play with the upgrade to Win10. What's more, the telemetry collected is of the most benign type that Apple, Google, Microsoft, and nearly all 3rd party apps have actually been collecting (enabled via TOS agreements and practicality) for the better part of a decade now. Said usage telemetry is essentially required to provide software at the scale, quality, and cost that the market demands.

ta_donk_gt 10y ago
> What's more, the telemetry collected is of the most benign type that Apple, Google, Microsoft, and nearly all 3rd party apps have actually been collecting Do you have any links on what telemetry data is actually collected and sent? I would genuinely appreciate it. This is has held me back from what is otherwise a pretty solid OS upgrade. All I've seen has either directly indicated or indirectly insinuated that every key stroke (not just Cortana search, but every keystroke entered while using Windows 10) is collected and sent with the telemetry data. Being encrypted traffic, and data that can be sent at any time, not necessarily when keys are being pressed, there is no way to inspect and verify. The closest I have seen to rebuttals of this are either people with no knowledge or connection saying "oh, come on, they would never do that", or Microsoft saying essentially "we cannot allow telemetry to be turned off anymore because the more advanced users that we need data from would turn it off". I don't think there is a way to prove what is actually sent, unfortunately, but it would be nice to at least hear Microsoft say "we firmly believe in the privacy of our users and would never dream of being anywhere near that invasive".
- daxorid 10y ago
  Really wish someone could definitively answer you. I have yet to see any analysis that could define hard boundaries on where keylogging occurs.
- KirinDave 10y ago
  Ars peeked awhile ago. http://arstechnica.com/information-technology/2015/08/even-when-told-not-to-windows-10-just-cant-stop-talking-to-microsoft/ http://arstechnica.com/information-technology/2015/08/even-w... I've talked to 3 professional security researchers about it, and all seem unconcerned.
PhasmaFelis 10y ago
> While there is no doubt that the Win10 migration could have been handled better, it's difficult to actually image a better path for MS to take. No it's not! "Don't use deceptive language, don't force updates on users who didn't request them or specifically declined them, never reboot a running computer without explicit permission for any reason short of a total system freeze." > Said usage telemetry is essentially required to provide software at the scale, quality, and cost that the market demands. Then why are they being deceptive about it? If it's completely benign and only works for the good of the user, why do we keep hearing about new telemetry that people weren't aware of or thought they'd already disabled?
- KirinDave 10y ago
  > "Don't use deceptive language, don't force updates on users who didn't request them or specifically declined them, never reboot a running computer without explicit permission for any reason short of a total system freeze." See, even these are not so cut and dry. Sure, "Deceptive" is a thing we want to avoid. But if a user is deceived by what others called clear language, was your language deceptive? I had no real issues understanding, "They want to give me an upgrade. If I click that, I'll get the upgrade." > don't force updates on users who didn't request them or specifically declined them, never reboot a running computer without explicit permission for any reason short of a total system freeze. We can argue about specifics all day, but if a user isn't going to reboot their computer periodically for critical security updates then doing it for them is a public service and it should be done. We're still very busy as a society pretending that computers aren't a public utility, but in fact they are and they have very real consequences for their use. > Then why are they being deceptive about it? See, this is what I don't get. Where are they being "deceptive" about telemetry? They don't act like it's a secret. They talk about it in public. > why do we keep hearing about new telemetry that people weren't aware of or thought they'd already disabled? Good question! This is not a new story. Go read the article carefully! This is all basically clickbaiting off an original very popular clickbait that said the EULA technically could be read to allow keylogging in some situations here: http://www.theinquirer.net/inquirer/news/2373838/microsofts-windows-10-preview-has-permission-to-watch-your-every-move http://www.theinquirer.net/inquirer/news/2373838/microsofts-... (btw, it can't, there's US and EU law at play that protects consumers). No seriously. That's what started this all. An insinuation that a tech preview might have telemetry. And so we continue to roll over this calling Cortana a "keylogger". They printed a followup which basically said, "No, they didn't use a keylogger" and gave it a surreal headline: http://www.theinquirer.net/inquirer/news/2421234/microsoft-plays-down-playing-fast-and-loose-with-windows-10-privacy http://www.theinquirer.net/inquirer/news/2421234/microsoft-p... From a technical and not-total-uninformed-bs perspective, it all comes back to, "Cortana's typeahead search mixes desktop search items with Bing search results, which are sent key-by-key for latency reasons, which is a trace of keystrokes" coupled with, "Cortana uses cloud computation for "hey cortana" voice analysis (not the wakeup cue, the the part after). And in Microsoft's defense, no one minded when Google did this, after Apple did it, after Firefox did it.
RaleyField 10y ago
> chokes Firefox and Chrome are getting a hell of a pass if you're going to say web browsing is "confined to an application." Well browsing in Firefox is confined to Firefox, not sure what you want to say. The fact that Firefox isn't perfect in every way shouldn't mean that Windows should go 100 mph evil with its telemetry. > is of the most benign type that Apple, Google If it's not straight keylogger still doesn't mean it's anywhere near acceptable. And it's fallacious to think whatever Apple and Google does on their platforms should have any bearing when judging what Microsoft does on its. There's been pattern of derailment whenever Windows is mention and it should stop. > and nearly all 3rd party apps have actually been collecting (enabled via TOS agreements and practicality) Lack of _informed_ consent and the fact that telemetry as part of OS is ever present (and not segregated to third party software) is what makes the difference. Flaws in third party applications are still reproachable, but they aren't the subject of discussion here and hopefully they are replaceable and not installed and turned on by default.
- KirinDave 10y ago
  > Well browsing in Firefox is confined to Firefox, not sure what you want to say. The fact that Firefox isn't perfect in every way shouldn't mean that Windows should go 100 mph evil with its telemetry. Browsers are an incredibly sensitive and important part of people's day-to-day use of computers. In terms of time spent, most people overwhelmingly spend their time there, and even do work of other types via that system. > If it's not straight keylogger still doesn't mean it's anywhere near acceptable Indeed! But we can't even have a conversation about what the "is" in fact is! We're using incredibly incendiary and obviously incorrect language to avoid even the pretext of a rational examination of the data. I was just downmodded to -2 for posting a link to Ars's examination of the telemetry via local proxy and a discussion about what it looks like at the byte level. People are that uninterested in actually understanding the technical details here. Can you name a specific aspect of the telemetry that you don't like that you can't turn off in SP1? If so, please let me know. I am happy to gather data to consider escalating concerns both as part of my professional responsibility and as part of my connections to many smart and placed people at MS. > Lack of _informed_ consent and the fact that telemetry as part of OS is ever present (and not segregated to third party software) is what makes the difference. OSX, iOS, Android, and Ubuntu all contain core telemetry. They have similar EULAs to Windows for the customer facing product. Heck, this entire conversation got kicked off from the article I linked over the more exclusive opt-in for Insider program builds! The clause isn't as strong in the public EULA, last time I checked (IANAL, so please feel free to correct me if you're better informed there). I am all for a rational, calm, informed discussion about the pros and cons of telemetry. I wrestle with the "right" thing to do daily as part of the products I help build, design and ship. I very much want to have that conversation, but shady authors looking for cheap ways to buy relevance are writing clickbait to obfuscate the real discussion to make incrementally more dollars via impressions. If you're looking for deceit, the handful of authors cashing in on this meme are not a bad place to start.