13 ms·

Official list of phoned-home info revealed by Microsoft

271 points by frik 10y ago

pawadu 10y ago
I cant comment on the article since I don't have any actual data on the subject (it doesn't seem they do either). But I do have a slightly on-topic question for HN readers using Windows in enterprise: You can run popular Linux distributions off grid and still receive security updates via a local package repository. Can you still do something like this with Windows? Does it require an special Windows 10 version?
- Nux 10y ago
  search for WSUS
- Santosh83 10y ago
  I think you need an Enterprise license to customise the update process. Not even Pro will do, although with that you can turn off the forced updates, which Home users can't.
  - H4CK3RM4N 10y ago
    Last I heard, Pro can only delay updates for 14 days.
- elorant 10y ago
  There is the Enterprise LTSB (Long Term Service Branch) which gives you a stripped down version of the OS with more control on the updating process.
  - douche 10y ago
    It's far away the best distribution, particularly if you're one of those "everything since 7 is a pile of shit" grognards. So much of the cruft is stripped out, and it only gets security updates.
    - russdpale 10y ago
      This is what I use, its amazing but still has the telemetry and all of that. I'm not sure its as stripped down as people think. SME early creators updaters saw one note ads on their ltsb file explorer. I'm going to be switching to Linux this weekend I think.
- throaway23 10y ago
  Why would Microsoft do such a thing? It does not align with locking in and extracting resources at scale from the third world. How else do you prop up a 60billion dollar bill gates? The math does not work any other way. I wouldn't worry too much about data leaks though. Microsft isn't the NSA or the Army where Snowden and Manning type characters sign up for patriotic reason. This is an environment much like wall street where self serving geeks sign up to exploit their intellectual dividend over the rest of society. Which as Alan Greenspan told us - it isn't in their self interest to damage the system. So nothing bad is going to happen especially since everyone else is doing it too.
chj 10y ago
The reason I installed ubuntu on my laptop.
- liareye 10y ago
  For the convenient Amazon button in the dock?
  - mapleoin 10y ago
    They've removed that since 16.04.
    - citrusui 10y ago
      It is still there in 16.04 and above (unity-webapps-common package): http://askubuntu.com/questions/760204/how-to-remove-the-unity-amazon-package-in-16-04 http://askubuntu.com/questions/760204/how-to-remove-the-unit...
      - mapleoin 10y ago
        I believe in that case it was someone upgrading to 16.04 rather than a fresh install. The user configuration would remain unchanged in that case. Here are some other sources: http://www.omgubuntu.co.uk/2016/01/ubuntu-online-search-feature-disabled-16-04 http://www.omgubuntu.co.uk/2016/01/ubuntu-online-search-feat... https://www.howtogeek.com/188589/5-things-you-need-to-know-about-ubuntu-14.04-lts/ https://www.howtogeek.com/188589/5-things-you-need-to-know-a...
        Sylos 10y ago
        He's talking about the Amazon button, not the search box integration. They do still have a referral link glued to the panel by default. But yeah, that's such a non-issue, that I don't understand either why you'd even bring it up, unless you're really trying hard to find something to cling on.
  - veli_joza 10y ago
rl3 10y ago
>Engineers, with permission from Microsoft’s privacy governance team, can obtain users' documents that trigger crashes in applications, so they can work out what's going wrong. The techies can also run diagnostic tools remotely on the computers, again with permission from their overseers. So in other words: engineering access to your personal documents (and computer) is mediated by a group of people who also shouldn't have access in the first place. Got it. When I close my eyes, it's almost like I can vividly picture the crappy NSA PowerPoint slides that must exist, detailing "Windows telemetry exploitation" or some such. At the very least, the information has to be incredibly useful for targeting purposes.
- pjc50 10y ago
  Someone should file a mass copyright infringement suit. Did they really have permission to copy those documents? Charge them on the RIAA scale of thousands of dollars per infringing copy. There's implications for legal discovery here too. Remember the other day when one of the documents in the Uber/Otto case was found on a user's machine? What happens when people start sending in discovery fishing expeditions to get documents from Microsoft?
  - muraiki 10y ago
    Also, think about them obtaining HIPAA protected data...
  - cm2187 10y ago
    Copyright? What about attorney-client privilege or medical secrecy?
  - kranner 10y ago
    Not sure that it's copyright infringement. It is straight-up theft though.
    - cmdrfred 10y ago
      I believe you are correct as I understand it the crime is in the distribution not the possession.
elorant 10y ago
I'd like to know if there are any C# devs who moved to Linux and how is the whole experience.
- androtheos 10y ago
  It's better now with asp.net core and visual studio code both of which run rather well on Debian Linux.
cogs 10y ago
How does this compare with Apple? I haven't seen so many articles about what MacOS slurps, is that because it is better behaved?
- andy_ppp 10y ago
  By default everything is backed up to iCloud right?
  - rubatuga 10y ago
    You don't have to enable icloud
  - mfukar 10y ago
    You have the option of not logging in to iCloud at all.
  - tinus_hn 10y ago
    You can barely backup an iPhone to the free iCloud option. There is no free Mac backup to iCloud. Also imagine the bandwidth requirements, for many people such a backup would run forever without completing.
  - 0x0 10y ago
    It's not the default, you get a prompt during setup/activation where you choose to enable or disable iCloud.
  - matthewmacleod 10y ago
    No.
- rubatuga 10y ago
  Opt out is much easier for Apple products. Did you know you can't disable cortana? On the other hand, upon enabling Siri in macOS, you're presented with a lengthy warning about privacy policy and such. It's obvious which OS values your privacy more
  - 10y ago
rubatuga 10y ago
One Windows 10 version that many people are ignorant of is Windows 10 for education, which is based on the enterprise edition. It has the ability to disable almost all data collecting / advertising features . Cortana doesn't even exist on this version. If you can grab this, and most university or college students should be able to for free, it'll be a big improvement in privacy. Edit: from what I recall, Microsoft stated that advertising didn't have a place in education, or something to that effect
- H4CK3RM4N 10y ago
  What about government employees?
  - thatwebdude 10y ago
    They're using old, barely-supported (Or is 7 even supported at all anymore) versions of Windows that don't phone home.
    - xorblurb 10y ago
      7 is quite supported. MS just arbitrarily decided a few weeks ago to don't allow Windows Update if you have a too modern processor, which makes absolutely no sense whatsoever from a technical POV (and which, I guess, will trigger development of tools to fake the ID of an other processor for that purpose, if that's possible), but if you have an "old enough" computer you can continue to use 7 until end of extended support, which is January 14, 2020. This absurd policy decision shows that the Win 10 market share is not as high as they hoped, BTW.
- najati83 10y ago
  Does Windows 10 for Education have the same features as the normal version?
- Pica_soO 10y ago
  Im sure we all only got ourselves to blame for our victim shame. After all, we could have just stayed away from those computers - or installed Linux, which is ridiculous expensive if you price your own time in at minimum wage. Hardware Firewall on a separate machine it is.
us0r 10y ago
Microsoft is absolutely out of control with this shit. I was recently flipping through BI articles and came across this [0]. “Using data from millions of its subscribers … The findings come from people who use Microsoft Word and/or Outlook”. WTF? Sure enough, I opted out of telemetry but that apparently doesn’t include the content of business documents and email. 7 clicks to find that option. I guarantee you 99% of Office 365 users have no idea this is happening. Microsoft customers aren’t getting scroogled, they are getting straight fucked. Not only are they slurping everything imaginable up, but actual people are going through the data and doing stories on business insider. My problem is I actually like their products. I’m cheering for the day the EU (the US won’t do anything so sadly I have to cheer for a foreign government) wakes up and slaps them around. Hopefully it’s hard enough to get them to change their ways. http://www.businessinsider.com/microsoft-data-the-most-confusing-words-in-english-2017-3 http://www.businessinsider.com/microsoft-data-the-most-confu...
- douche 10y ago
  I'm sure Microsoft is mining Office 365 as hard as Google is mining GMail. To believe otherwise seems incredibly naive.
  - veli_joza 10y ago
    I don't think one is better than the other, but it comes down to average user's expectations from cloud software and from desktop software. My last company was very paranoid about security. Things like never leaving your desktop unattended, changing password every 4 weeks, encrypted disks, encrypted emails, forbidding most of cloud services... All the while happily using Windows and Outlook. Also, although Google knows everything about me, they have so far managed to prevent security incidents, leaks and embarrassing deals (apart being forced to provide backdoor to NSA). They seem to know what they are doing security-wise.
  - saiya-jin 10y ago
    with gmail this is expected, it's google which owns adsense. not so much with M$. one is free (paid with targeted ads), the other paid.
itchyjunk 10y ago
Ahh, the "Relevant Ads" button. No matter which way it turns, you still get adds. I am tempted to ask "Is this button broken /s?" but I know it's a feature and not a bug.
itaysk 10y ago
I wonder how this compares to Android while using Google's services and accepting their terms (admittedly I allow everything by default). Is anyone aware of such analysis?
laurencei 10y ago
Is there a place where people have put together a conclusive list/script to remove/turn off as much telemetry as possible? I've seen various lists on reddit, HN etc - but they all seem to have different bits. Perhaps a GitHub Gist that can be crowdsourced to help people ensure they get every single hidden option turned off?
- DavidSJ 10y ago
  Great idea. And it should be generalized to all systems/software: a one-stop shop for steps to take to make your system safe to use.
  - russdpale 10y ago
    The problem is you can't really trust that it is actually turning it off. It could literally just be telling you that while shutting nothing off or shutting down some reporting while still keeping others. There is just no way to know, MS is noe completely untrustworthy in my opinion, and it should be treated as compromised.
- HappyTypist 10y ago
  Honestly, your best bet is to use a mac.
  - izacus 10y ago
    Did you try running Little Snitch lately? There's at least 5-6 daemons that keep contacting Apple and reporting on you on mac as well. And pretty much every 3rd party app uploads behaviour analytics without the ability to turn it off as well.
    - ebbv 10y ago
      1. Apple's telemetry is anonymize and not as invasive. 2. It's one option clearly in the setup and system preferences and easily disabled. Neither of those is true for Windows 10.
    - 10y ago
uranian 10y ago
Most striking for me is not only access to your documents, but also: >events generated by the operating system, and your "inking and typing data." Sounds like a key logger virus, but then built-in the OS? Is this for real?
- inkling 10y ago
  Ostensibly it's for debugging crash dumps. In reality you can bet there will be NSL's and other legal tools used to co-opt this stuff for more noble aims, like defending against terrorism and protecting our children via fishing expeditions and secret gag orders.
  - r3bl 10y ago
    > via fishing expeditions... If you already have access to the things I type and my metadata includes the websites I visit, you don't really need to phish me to get my credentials. If a service also happens to not support 2FA and doesn't have some sort of account activity section, you can effectively have control of me over that service, without me ever doing anything wrong and me not even suspecting a thing.
    - ethbro 10y ago
      Inkling meant fish, as in the legal enforcement sense of using an unrelated charge to obtain a warrant which is then used to fish for evidence of a more serious crime.
- nebabyte 10y ago
  If it is, I applaud their balls if nothing else
- wheelerwj 10y ago
  really? that's the most striking? it wasn't the remote code execution approved by an internal "governance" committee?
- Pigo 10y ago
frik 10y ago
The original title of this post was "The sheer amount of data Windows 10 sends from your PC". Which was shorted from the article title "Put down your coffee and admire the sheer amount of data Windows 10 Creators Update will slurp from your PC" But now he HN title got changed to "Official list of phoned-home info revealed by Microsoft" whih is misleading or let's say down-playing the whole story. The story is more than yesterdays HN story, it shades a not so nice picture about what really happen.
- developer2 10y ago
  The "Official list of phoned-home info revealed by Microsoft" is the subheading from the article, and offers a neutral tone compared to the biased headline of "The sheer amount of data Windows 10 Creators Update will slurp from your PC". While general consensus will likely be that that it is too much data collection, it's more ethical - from a journalism standpoint - to allow each reader to decide that for themselves based on the facts. I find it odd that The Register used a biased headline, while delegating the unbiased phrase to the role of a subheading. I suspect the neutral subheading was provided by the author of the article, while the headline was manufactured by someone whose job it is to drive traffic/views.
  - AimHere 10y ago
    > I find it odd that The Register used a biased headline, while delegating the unbiased phrase to the role of a subheading. The only thing odd about that is that The Register has a more neutral tone in it's subheading than normal. The main headline is using the default Register style (and if you go to the Reg's front page, you'll see plenty of tabloid-esque subheadings). I suspect that since this has been the Reg's modus operandi for years, that there's no need for an editor to write headlines by now - the staff writers know what's expected and probably use the house style already. If anything, it's the po-faced subheading that's likely to have been tampered with on an ad-hoc basis.
zwarag 10y ago
Isn't it a bit of a pathetic approach to tackle this topic with: How can we turn off this telemetry craziness. Shouldn't we USE something that just does not scan you're stuff at all. Like Linux or something? Sure it might not be that well round up like Win. But at least it will not penetrate your bum hole by design and will become round up eventually.
- gbrown 10y ago
  Well, I try to for most applications, but I'm actually moving my wife's laptop back to windows. Linux was fine for most things, but when something breaks or doesn't work, I have to fix it - and I don't have the time. Getting hardware like Bluetooth or external touchscreens to work is an absolute nightmare with the state of driver support.
  - jsudhams 10y ago
    Try getting enterprise version, no ads nothing and no phoning back home. If you care add a firewall rule for microsoft.com and other datacollection sites.
  - usernam 10y ago
    It sounds like linux breaks, but you know what happens when "stuff on windows breaks"? Well, it's the same: you'll have to fix it. Ubuntu LTS is really hard to break unless you're constantly screwing around. The same happens on windows. Don't complain about community-supported distros. Buy a commercially supported distribution with long term releases, and you're set.
    - driverdan 10y ago
      Linux still doesn't work well on a lot of laptop hardware.
      - r3bl 10y ago
        What do you mean by "doesn't work well on a lot of laptop hardware"? I'm using Lenovo Yoga 510, not Ubuntu-certified, two-in-one device with a touchscreen and a dedicated graphics card. Sure, there's no such thing as a tablet mode in any of the Linux distributions at the moment, but it works. WiFi works. Touchscreen works. Open source graphics driver works. Battery usage has no noticeable difference compared to Windows. In my three or four years of running Ubuntu-based distributions, I'm yet to find a single laptop where WiFi / sound card / touch screen or any other piece of laptop hardware that doesn't work.
yAnonymous 10y ago
Wouldn't half of that make it illegal to use for government agencies in many countries? They're one config error away from sending classified data to Microsoft.
- AlexeyBrin 10y ago
  Pretty sure they sell a different version to governments like the Enterprise or LTSB versions. That being said, I would prefer to be able to block telemetry on my paid Professional version too.
- vonmoltke 10y ago
  > They're one config error away from sending classified data to Microsoft. No they aren't, because classified data is only handled on isolated networks.
  - nebabyte 10y ago
    "It won't phone home, just make sure to keep it offline or it might phone home"?
  - wheelerwj 10y ago
    lol, obviously that's not even remotely (get it?) accurate. classified data should only be handled on isolated networks.
    - vonmoltke 10y ago
      Handling classified data on an unapproved network is both illegal and a serious security violation in every environment I have worked in. If you have that going on, Windows phoning home is the least of your worries.
  - douche 10y ago
    If only that were true... we could have been saved so much tedious wrangling and wikileaking.
Sir_Cmpwn 10y ago
If you are one of these engineers that just meets a spec and ships it without a moral compass, then I sincerely hope I never work with you.
- yorwba 10y ago
  How does a moral compass help the engineer whose spec says "If DEBUG_SEND_CRASH_INPUT is defined at build time, send the content of all files opened by the crashing process to the telemetry server."? How are they supposed to know that the flag will be enabled in the release build, causing their code to exfiltrate user documents to Microsoft? I believe this is what nebabyte means by > A moral compass can't work without a magnetic field of context.
  - Sir_Cmpwn 10y ago
    That makes sense. The only thing for it is to start the uproar now, then, and hopefully it'll be pulled in the near future.
  - nebabyte 10y ago
    Exactly. It's not like it's even going to be 'a devil in the details' kind of thing; once the mechanisms are built, they could be used securely or maliciously depending on any number of factors such as presets. The engineer isn't necessarily going to get a play-by-play of the big picture - just what they need to know to get their part built - so expecting some moral stand against the final product they probably weren't part of the meeting on sounds absurd.
    - pdkl95 10y ago
      Unless you are working in a fully compartmentalized organization (e.g. the NSA), engineering doesn't happen entirely in isolation. I agree that the complexity of computers can obscure what any piece of the whole will eventually responsible for, but engineers should still be considering the ethical implications that are visible, especially the global nature of the project itself. Regarding "telemetry" specifically, it should be obvious that designing something that automatically exfiltrates random data is a potentially serious security issue. It shouldn't be transmitting anything without explicit permission. It is irresponsible to assume that a preset represents intent and the informed consent of the user. Even when permission has been given, care should be taken to limit collection to only what is needed and log entries about what was sent should be created. Yes, even on debug builds. > The engineer isn't necessarily going to get a play-by-play of the big picture Maybe you should ask for that before taking the job. You don't need to know every detail, but it's negligent to work on a project without at least some understanding of what the big picture goals are. -- My point is that you do know some things about the projects you are working on. You need to consider not only what your designs do, but also how it may be used, which may not be what you originally intended. You no longer have the luxury of pretending engineering work is entirely isolated from political and social consequences. Those consequences will vary greatly in magnitude and are probably good in many situations, but it's irresponsible to ignore them entirely. The entire concept of "disruptive" startups relies on the existence of those consequences and how strongly they impact society. I encourage everyone to watch this[1] talk from 30c3 (or read the transcript[2]), which discusses this topic. [1] https://media.ccc.de/v/30C3_-_5491_-_en_-_saal_1_-_201312272300_-_no_neutral_ground_in_a_burning_world_-_quinn_norton_-_eleanor_saitta https://media.ccc.de/v/30C3_-_5491_-_en_-_saal_1_-_201312272... [2] http://opentranscripts.org/transcript/no-neutral-ground-burning-world/ http://opentranscripts.org/transcript/no-neutral-ground-burn...
pleasecalllater 10y ago
Cool, so I will have backup data in NSA, and Microsoft. Do you think it's possible to recover my data from their servers easily? Looks like 'my data' will soon be something strange, and suspicious.
- akerro 10y ago
  Some people tried it already and court rejected their cases.
  - pleasecalllater 10y ago
    Heh, usually when I get a stupid enough idea, it turns out that someone had that before :)
vadansky 10y ago
If you absolutely have to use Windows (like me) is it possible to block all the telemetry at the router level, maybe somekind of hardware firewall? Do we have a list of IPs to blacklist?
- AlexeyBrin 10y ago
  You can try, but to be frank you can never be sure. The only 100% way to stop telemetry is to work disconnected from the Internet. A slightly safer version of Windows is Enterprise LTSB but I don't think you can legally buy it as an individual.
  - zebrafish 10y ago
    You can't buy that for a home computer. It's only licensed for PLCs and other manufacturing or enterprise critical computers. edit*: and it's extraordinarily expensive
  - thoughtpalette 10y ago
    I just added the above linked endpoints to my hosts file. Not sure how well that'll work.
    - falcolas 10y ago
      Reports from earlier indicate that they don't use the hosts file (or purportedly even DNS) for OS processes like telemetry and update. You'd have to do it at a higher level.
    - MikusR 10y ago
      You have to block using firewall. As hosts file is being bypassed. Plenty of malware modify hosts file.
      - thoughtpalette 10y ago
        Ahhh, it seems I should've read the entire comment thread. Thanks to both of you for the notification!
Clownshoesms 10y ago
Privacy journey. It'll take a while to purge that tripe. Makes me feel sick thinking of the corporate weasel on the end of the post.
Steeeve 10y ago
The article doesn't have a full list, it has a set of examples. The technet pages linked in the article don't have a full set of information either. I have the distinct impression that regardless of settings, some data gets sent. I also have the distinct impression that the data will be for sale - the usefulness of a good portion of the data is questionable and some would only be useful for application developers. What the list does have enough of ... is enough information for adversarial parties to want to target it. It's not that hard to stop using windows. More people should.
AdmiralAsshat 10y ago
Useful utility I remember from a few years ago: https://www.safer-networking.org/spybot-anti-beacon/ https://www.safer-networking.org/spybot-anti-beacon/ I mostly used it to block the Windows 7 telemetry that they backported. I don't know how up-to-date they're keeping it, though. I fear Microsoft is adding more hooks faster than Spybot can block them.
- Clownshoesms 10y ago
  It's infuriating that I'm still paranoid about what my paid for Win 7 OS sends out, despite hiding updates and trying to keep on top of it. Then again, with IME etc, who siphons more? We've gone wildly wrong somewhere that this is the norm. Wildly wrong.
darrmit 10y ago
For those thinking Enterprise and/or Education may be better, it's only better if you're using it in an environment where privacy settings are enforced via Group Policy or some other method. Standalone (like I'm running it) is really not much better than Pro unless you go through and manually intervene. For example, the default telemetry level is "Enhanced": "The Enhanced level gathers data about how Windows and apps are used and how they perform. This level also includes data from both the Basic and Security levels. This level helps to improve the user experience with the operating system and apps. Data from this level can be abstracted into patterns and trends that can help Microsoft determine future improvements. This is the default level for Windows 10 Enterprise and Windows 10 Education editions, and the minimum level needed to quickly identify and address Windows, Windows Server, and System Center quality issues." [1] On a fresh install of Windows 10 Enterprise I still have to manually disable updates by disabling/setting permissions on scheduled tasks for updates and I'm still prompted for things like "Use OneDrive!". Cortana is also enabled by default. [1] https://technet.microsoft.com/en-us/itpro/windows/configure/configure-windows-telemetry-in-your-organization https://technet.microsoft.com/en-us/itpro/windows/configure/...
- LinuxFreedom 10y ago
  It is a real problem for the industry that people are clinging to that embarrassing anti-thesis of an operating system, no matter what is published about it, they still try to find a way to sell some kind of their religious fake believe that it is possible to trick MS in their own house. It is also very alarming that people from "tech communities" like this one are "defending" their use of an inferior fake operating system instead of just simply shutting up and being ashamed of their technical ignorance. But I hope most of these "it is anyway a great thing" posts are just pro marketing guys, I personally have not met one respectable tech person that would burn its name to propagate that MS anti-os. If your school or educational institute still depends on that failed OS, please help them to understand the importance of Free Software, thanks!
  - AlexeyBrin 10y ago
    > It is also very alarming that people from "tech communities" like this one are "defending" their use of an inferior fake operating system instead of just simply shutting up and being ashamed of their technical ignorance. But I hope most of these "it is anyway a great thing" posts are just pro marketing guys, I personally have not met one respectable tech person that would burn its name to propagate that MS anti-os. Being condescending about Windows pro users will for sure boost the adoption of your preferred OS and raise awareness about the FSF ideals. You'll have a better chance if you change your tone and use ethical reasons for using alternative operating systems. From a technical point of view Linux is not better or worse than Windows or macOS. Take this from someone that uses all three of them for work.
retox 10y ago
Some troubling sounding ones; - All the physical memory used by Windows at the point of the crash - URL for a specific two second chunk of content if there is an error - Image & video resolution, video length, file sizes types and encoding - URLs (which may include search terms) - Ink strokes written, text before and after the ink insertion point, recognized text entered - Time and result of each connection attempt (WiFi) - Mobile Equipment ID (IMEI) and Mobile Country Code (MCCO) - Whether the user clicked or hovered on UI controls or hotspots

271 points by frik 10y ago

I cant comment on the article since I don't have any actual data on the subject (it doesn't seem they do either). But I do have a slightly on-topic question for HN readers using Windows in enterprise: You can run popular Linux distributions off grid and still receive security updates via a local package repository. Can you still do something like this with Windows? Does it require an special Windows 10 version?

Nux 10y ago
search for WSUS
Santosh83 10y ago
I think you need an Enterprise license to customise the update process. Not even Pro will do, although with that you can turn off the forced updates, which Home users can't.
- H4CK3RM4N 10y ago
  Last I heard, Pro can only delay updates for 14 days.
elorant 10y ago
There is the Enterprise LTSB (Long Term Service Branch) which gives you a stripped down version of the OS with more control on the updating process.
- douche 10y ago
  It's far away the best distribution, particularly if you're one of those "everything since 7 is a pile of shit" grognards. So much of the cruft is stripped out, and it only gets security updates.
  - russdpale 10y ago
    This is what I use, its amazing but still has the telemetry and all of that. I'm not sure its as stripped down as people think. SME early creators updaters saw one note ads on their ltsb file explorer. I'm going to be switching to Linux this weekend I think.
throaway23 10y ago
Why would Microsoft do such a thing? It does not align with locking in and extracting resources at scale from the third world. How else do you prop up a 60billion dollar bill gates? The math does not work any other way. I wouldn't worry too much about data leaks though. Microsft isn't the NSA or the Army where Snowden and Manning type characters sign up for patriotic reason. This is an environment much like wall street where self serving geeks sign up to exploit their intellectual dividend over the rest of society. Which as Alan Greenspan told us - it isn't in their self interest to damage the system. So nothing bad is going to happen especially since everyone else is doing it too.

chj 10y ago

The reason I installed ubuntu on my laptop.

liareye 10y ago
For the convenient Amazon button in the dock?
- mapleoin 10y ago
  They've removed that since 16.04.
  - citrusui 10y ago
    It is still there in 16.04 and above (unity-webapps-common package): http://askubuntu.com/questions/760204/how-to-remove-the-unity-amazon-package-in-16-04 http://askubuntu.com/questions/760204/how-to-remove-the-unit...
    - mapleoin 10y ago
      I believe in that case it was someone upgrading to 16.04 rather than a fresh install. The user configuration would remain unchanged in that case. Here are some other sources: http://www.omgubuntu.co.uk/2016/01/ubuntu-online-search-feature-disabled-16-04 http://www.omgubuntu.co.uk/2016/01/ubuntu-online-search-feat... https://www.howtogeek.com/188589/5-things-you-need-to-know-about-ubuntu-14.04-lts/ https://www.howtogeek.com/188589/5-things-you-need-to-know-a...
      - Sylos 10y ago
        He's talking about the Amazon button, not the search box integration. They do still have a referral link glued to the panel by default. But yeah, that's such a non-issue, that I don't understand either why you'd even bring it up, unless you're really trying hard to find something to cling on.
- veli_joza 10y ago

rl3 10y ago

>Engineers, with permission from Microsoft’s privacy governance team, can obtain users' documents that trigger crashes in applications, so they can work out what's going wrong. The techies can also run diagnostic tools remotely on the computers, again with permission from their overseers. So in other words: engineering access to your personal documents (and computer) is mediated by a group of people who also shouldn't have access in the first place. Got it. When I close my eyes, it's almost like I can vividly picture the crappy NSA PowerPoint slides that must exist, detailing "Windows telemetry exploitation" or some such. At the very least, the information has to be incredibly useful for targeting purposes.

pjc50 10y ago
Someone should file a mass copyright infringement suit. Did they really have permission to copy those documents? Charge them on the RIAA scale of thousands of dollars per infringing copy. There's implications for legal discovery here too. Remember the other day when one of the documents in the Uber/Otto case was found on a user's machine? What happens when people start sending in discovery fishing expeditions to get documents from Microsoft?
- muraiki 10y ago
  Also, think about them obtaining HIPAA protected data...
- cm2187 10y ago
  Copyright? What about attorney-client privilege or medical secrecy?
- kranner 10y ago
  Not sure that it's copyright infringement. It is straight-up theft though.
  - cmdrfred 10y ago
    I believe you are correct as I understand it the crime is in the distribution not the possession.

elorant 10y ago

I'd like to know if there are any C# devs who moved to Linux and how is the whole experience.

androtheos 10y ago
It's better now with asp.net core and visual studio code both of which run rather well on Debian Linux.

cogs 10y ago

How does this compare with Apple? I haven't seen so many articles about what MacOS slurps, is that because it is better behaved?

andy_ppp 10y ago
By default everything is backed up to iCloud right?
- rubatuga 10y ago
  You don't have to enable icloud
- mfukar 10y ago
  You have the option of not logging in to iCloud at all.
- tinus_hn 10y ago
  You can barely backup an iPhone to the free iCloud option. There is no free Mac backup to iCloud. Also imagine the bandwidth requirements, for many people such a backup would run forever without completing.
- 0x0 10y ago
  It's not the default, you get a prompt during setup/activation where you choose to enable or disable iCloud.
- matthewmacleod 10y ago
  No.
rubatuga 10y ago
Opt out is much easier for Apple products. Did you know you can't disable cortana? On the other hand, upon enabling Siri in macOS, you're presented with a lengthy warning about privacy policy and such. It's obvious which OS values your privacy more
- 10y ago

rubatuga 10y ago

One Windows 10 version that many people are ignorant of is Windows 10 for education, which is based on the enterprise edition. It has the ability to disable almost all data collecting / advertising features . Cortana doesn't even exist on this version. If you can grab this, and most university or college students should be able to for free, it'll be a big improvement in privacy. Edit: from what I recall, Microsoft stated that advertising didn't have a place in education, or something to that effect

H4CK3RM4N 10y ago
What about government employees?
- thatwebdude 10y ago
  They're using old, barely-supported (Or is 7 even supported at all anymore) versions of Windows that don't phone home.
  - xorblurb 10y ago
    7 is quite supported. MS just arbitrarily decided a few weeks ago to don't allow Windows Update if you have a too modern processor, which makes absolutely no sense whatsoever from a technical POV (and which, I guess, will trigger development of tools to fake the ID of an other processor for that purpose, if that's possible), but if you have an "old enough" computer you can continue to use 7 until end of extended support, which is January 14, 2020. This absurd policy decision shows that the Win 10 market share is not as high as they hoped, BTW.
najati83 10y ago
Does Windows 10 for Education have the same features as the normal version?
Pica_soO 10y ago
Im sure we all only got ourselves to blame for our victim shame. After all, we could have just stayed away from those computers - or installed Linux, which is ridiculous expensive if you price your own time in at minimum wage. Hardware Firewall on a separate machine it is.

us0r 10y ago

Microsoft is absolutely out of control with this shit. I was recently flipping through BI articles and came across this [0]. “Using data from millions of its subscribers … The findings come from people who use Microsoft Word and/or Outlook”. WTF? Sure enough, I opted out of telemetry but that apparently doesn’t include the content of business documents and email. 7 clicks to find that option. I guarantee you 99% of Office 365 users have no idea this is happening. Microsoft customers aren’t getting scroogled, they are getting straight fucked. Not only are they slurping everything imaginable up, but actual people are going through the data and doing stories on business insider. My problem is I actually like their products. I’m cheering for the day the EU (the US won’t do anything so sadly I have to cheer for a foreign government) wakes up and slaps them around. Hopefully it’s hard enough to get them to change their ways. http://www.businessinsider.com/microsoft-data-the-most-confusing-words-in-english-2017-3 http://www.businessinsider.com/microsoft-data-the-most-confu...

douche 10y ago
I'm sure Microsoft is mining Office 365 as hard as Google is mining GMail. To believe otherwise seems incredibly naive.
- veli_joza 10y ago
  I don't think one is better than the other, but it comes down to average user's expectations from cloud software and from desktop software. My last company was very paranoid about security. Things like never leaving your desktop unattended, changing password every 4 weeks, encrypted disks, encrypted emails, forbidding most of cloud services... All the while happily using Windows and Outlook. Also, although Google knows everything about me, they have so far managed to prevent security incidents, leaks and embarrassing deals (apart being forced to provide backdoor to NSA). They seem to know what they are doing security-wise.
- saiya-jin 10y ago
  with gmail this is expected, it's google which owns adsense. not so much with M$. one is free (paid with targeted ads), the other paid.

itchyjunk 10y ago

Ahh, the "Relevant Ads" button. No matter which way it turns, you still get adds. I am tempted to ask "Is this button broken /s?" but I know it's a feature and not a bug.

itaysk 10y ago

I wonder how this compares to Android while using Google's services and accepting their terms (admittedly I allow everything by default). Is anyone aware of such analysis?

laurencei 10y ago

Is there a place where people have put together a conclusive list/script to remove/turn off as much telemetry as possible? I've seen various lists on reddit, HN etc - but they all seem to have different bits. Perhaps a GitHub Gist that can be crowdsourced to help people ensure they get every single hidden option turned off?

DavidSJ 10y ago
Great idea. And it should be generalized to all systems/software: a one-stop shop for steps to take to make your system safe to use.
- russdpale 10y ago
  The problem is you can't really trust that it is actually turning it off. It could literally just be telling you that while shutting nothing off or shutting down some reporting while still keeping others. There is just no way to know, MS is noe completely untrustworthy in my opinion, and it should be treated as compromised.
HappyTypist 10y ago
Honestly, your best bet is to use a mac.
- izacus 10y ago
  Did you try running Little Snitch lately? There's at least 5-6 daemons that keep contacting Apple and reporting on you on mac as well. And pretty much every 3rd party app uploads behaviour analytics without the ability to turn it off as well.
  - ebbv 10y ago
    1. Apple's telemetry is anonymize and not as invasive. 2. It's one option clearly in the setup and system preferences and easily disabled. Neither of those is true for Windows 10.
  - 10y ago

uranian 10y ago

Most striking for me is not only access to your documents, but also: >events generated by the operating system, and your "inking and typing data." Sounds like a key logger virus, but then built-in the OS? Is this for real?

inkling 10y ago
Ostensibly it's for debugging crash dumps. In reality you can bet there will be NSL's and other legal tools used to co-opt this stuff for more noble aims, like defending against terrorism and protecting our children via fishing expeditions and secret gag orders.
- r3bl 10y ago
  > via fishing expeditions... If you already have access to the things I type and my metadata includes the websites I visit, you don't really need to phish me to get my credentials. If a service also happens to not support 2FA and doesn't have some sort of account activity section, you can effectively have control of me over that service, without me ever doing anything wrong and me not even suspecting a thing.
  - ethbro 10y ago
    Inkling meant fish, as in the legal enforcement sense of using an unrelated charge to obtain a warrant which is then used to fish for evidence of a more serious crime.
nebabyte 10y ago
If it is, I applaud their balls if nothing else
wheelerwj 10y ago
really? that's the most striking? it wasn't the remote code execution approved by an internal "governance" committee?
Pigo 10y ago

frik 10y ago

The original title of this post was "The sheer amount of data Windows 10 sends from your PC". Which was shorted from the article title "Put down your coffee and admire the sheer amount of data Windows 10 Creators Update will slurp from your PC" But now he HN title got changed to "Official list of phoned-home info revealed by Microsoft" whih is misleading or let's say down-playing the whole story. The story is more than yesterdays HN story, it shades a not so nice picture about what really happen.

developer2 10y ago
The "Official list of phoned-home info revealed by Microsoft" is the subheading from the article, and offers a neutral tone compared to the biased headline of "The sheer amount of data Windows 10 Creators Update will slurp from your PC". While general consensus will likely be that that it is too much data collection, it's more ethical - from a journalism standpoint - to allow each reader to decide that for themselves based on the facts. I find it odd that The Register used a biased headline, while delegating the unbiased phrase to the role of a subheading. I suspect the neutral subheading was provided by the author of the article, while the headline was manufactured by someone whose job it is to drive traffic/views.
- AimHere 10y ago
  > I find it odd that The Register used a biased headline, while delegating the unbiased phrase to the role of a subheading. The only thing odd about that is that The Register has a more neutral tone in it's subheading than normal. The main headline is using the default Register style (and if you go to the Reg's front page, you'll see plenty of tabloid-esque subheadings). I suspect that since this has been the Reg's modus operandi for years, that there's no need for an editor to write headlines by now - the staff writers know what's expected and probably use the house style already. If anything, it's the po-faced subheading that's likely to have been tampered with on an ad-hoc basis.

zwarag 10y ago

Isn't it a bit of a pathetic approach to tackle this topic with: How can we turn off this telemetry craziness. Shouldn't we USE something that just does not scan you're stuff at all. Like Linux or something? Sure it might not be that well round up like Win. But at least it will not penetrate your bum hole by design and will become round up eventually.

gbrown 10y ago
Well, I try to for most applications, but I'm actually moving my wife's laptop back to windows. Linux was fine for most things, but when something breaks or doesn't work, I have to fix it - and I don't have the time. Getting hardware like Bluetooth or external touchscreens to work is an absolute nightmare with the state of driver support.
- jsudhams 10y ago
  Try getting enterprise version, no ads nothing and no phoning back home. If you care add a firewall rule for microsoft.com and other datacollection sites.
- usernam 10y ago
  It sounds like linux breaks, but you know what happens when "stuff on windows breaks"? Well, it's the same: you'll have to fix it. Ubuntu LTS is really hard to break unless you're constantly screwing around. The same happens on windows. Don't complain about community-supported distros. Buy a commercially supported distribution with long term releases, and you're set.
  - driverdan 10y ago
    Linux still doesn't work well on a lot of laptop hardware.
    - r3bl 10y ago
      What do you mean by "doesn't work well on a lot of laptop hardware"? I'm using Lenovo Yoga 510, not Ubuntu-certified, two-in-one device with a touchscreen and a dedicated graphics card. Sure, there's no such thing as a tablet mode in any of the Linux distributions at the moment, but it works. WiFi works. Touchscreen works. Open source graphics driver works. Battery usage has no noticeable difference compared to Windows. In my three or four years of running Ubuntu-based distributions, I'm yet to find a single laptop where WiFi / sound card / touch screen or any other piece of laptop hardware that doesn't work.

yAnonymous 10y ago

Wouldn't half of that make it illegal to use for government agencies in many countries? They're one config error away from sending classified data to Microsoft.

AlexeyBrin 10y ago
Pretty sure they sell a different version to governments like the Enterprise or LTSB versions. That being said, I would prefer to be able to block telemetry on my paid Professional version too.
vonmoltke 10y ago
> They're one config error away from sending classified data to Microsoft. No they aren't, because classified data is only handled on isolated networks.
- nebabyte 10y ago
  "It won't phone home, just make sure to keep it offline or it might phone home"?
- wheelerwj 10y ago
  lol, obviously that's not even remotely (get it?) accurate. classified data should only be handled on isolated networks.
  - vonmoltke 10y ago
    Handling classified data on an unapproved network is both illegal and a serious security violation in every environment I have worked in. If you have that going on, Windows phoning home is the least of your worries.
- douche 10y ago
  If only that were true... we could have been saved so much tedious wrangling and wikileaking.

Sir_Cmpwn 10y ago

If you are one of these engineers that just meets a spec and ships it without a moral compass, then I sincerely hope I never work with you.

yorwba 10y ago
How does a moral compass help the engineer whose spec says "If DEBUG_SEND_CRASH_INPUT is defined at build time, send the content of all files opened by the crashing process to the telemetry server."? How are they supposed to know that the flag will be enabled in the release build, causing their code to exfiltrate user documents to Microsoft? I believe this is what nebabyte means by > A moral compass can't work without a magnetic field of context.
- Sir_Cmpwn 10y ago
  That makes sense. The only thing for it is to start the uproar now, then, and hopefully it'll be pulled in the near future.
- nebabyte 10y ago
  Exactly. It's not like it's even going to be 'a devil in the details' kind of thing; once the mechanisms are built, they could be used securely or maliciously depending on any number of factors such as presets. The engineer isn't necessarily going to get a play-by-play of the big picture - just what they need to know to get their part built - so expecting some moral stand against the final product they probably weren't part of the meeting on sounds absurd.
  - pdkl95 10y ago
    Unless you are working in a fully compartmentalized organization (e.g. the NSA), engineering doesn't happen entirely in isolation. I agree that the complexity of computers can obscure what any piece of the whole will eventually responsible for, but engineers should still be considering the ethical implications that are visible, especially the global nature of the project itself. Regarding "telemetry" specifically, it should be obvious that designing something that automatically exfiltrates random data is a potentially serious security issue. It shouldn't be transmitting anything without explicit permission. It is irresponsible to assume that a preset represents intent and the informed consent of the user. Even when permission has been given, care should be taken to limit collection to only what is needed and log entries about what was sent should be created. Yes, even on debug builds. > The engineer isn't necessarily going to get a play-by-play of the big picture Maybe you should ask for that before taking the job. You don't need to know every detail, but it's negligent to work on a project without at least some understanding of what the big picture goals are. -- My point is that you do know some things about the projects you are working on. You need to consider not only what your designs do, but also how it may be used, which may not be what you originally intended. You no longer have the luxury of pretending engineering work is entirely isolated from political and social consequences. Those consequences will vary greatly in magnitude and are probably good in many situations, but it's irresponsible to ignore them entirely. The entire concept of "disruptive" startups relies on the existence of those consequences and how strongly they impact society. I encourage everyone to watch this[1] talk from 30c3 (or read the transcript[2]), which discusses this topic. [1] https://media.ccc.de/v/30C3_-_5491_-_en_-_saal_1_-_201312272300_-_no_neutral_ground_in_a_burning_world_-_quinn_norton_-_eleanor_saitta https://media.ccc.de/v/30C3_-_5491_-_en_-_saal_1_-_201312272... [2] http://opentranscripts.org/transcript/no-neutral-ground-burning-world/ http://opentranscripts.org/transcript/no-neutral-ground-burn...

pleasecalllater 10y ago

Cool, so I will have backup data in NSA, and Microsoft. Do you think it's possible to recover my data from their servers easily? Looks like 'my data' will soon be something strange, and suspicious.

akerro 10y ago
Some people tried it already and court rejected their cases.
- pleasecalllater 10y ago
  Heh, usually when I get a stupid enough idea, it turns out that someone had that before :)

vadansky 10y ago

If you absolutely have to use Windows (like me) is it possible to block all the telemetry at the router level, maybe somekind of hardware firewall? Do we have a list of IPs to blacklist?

AlexeyBrin 10y ago
You can try, but to be frank you can never be sure. The only 100% way to stop telemetry is to work disconnected from the Internet. A slightly safer version of Windows is Enterprise LTSB but I don't think you can legally buy it as an individual.
- zebrafish 10y ago
  You can't buy that for a home computer. It's only licensed for PLCs and other manufacturing or enterprise critical computers. edit*: and it's extraordinarily expensive
- thoughtpalette 10y ago
  I just added the above linked endpoints to my hosts file. Not sure how well that'll work.
  - falcolas 10y ago
    Reports from earlier indicate that they don't use the hosts file (or purportedly even DNS) for OS processes like telemetry and update. You'd have to do it at a higher level.
  - MikusR 10y ago
    You have to block using firewall. As hosts file is being bypassed. Plenty of malware modify hosts file.
    - thoughtpalette 10y ago
      Ahhh, it seems I should've read the entire comment thread. Thanks to both of you for the notification!

Clownshoesms 10y ago

Privacy journey. It'll take a while to purge that tripe. Makes me feel sick thinking of the corporate weasel on the end of the post.

Steeeve 10y ago

The article doesn't have a full list, it has a set of examples. The technet pages linked in the article don't have a full set of information either. I have the distinct impression that regardless of settings, some data gets sent. I also have the distinct impression that the data will be for sale - the usefulness of a good portion of the data is questionable and some would only be useful for application developers. What the list does have enough of ... is enough information for adversarial parties to want to target it. It's not that hard to stop using windows. More people should.

AdmiralAsshat 10y ago

Useful utility I remember from a few years ago: https://www.safer-networking.org/spybot-anti-beacon/ https://www.safer-networking.org/spybot-anti-beacon/ I mostly used it to block the Windows 7 telemetry that they backported. I don't know how up-to-date they're keeping it, though. I fear Microsoft is adding more hooks faster than Spybot can block them.

Clownshoesms 10y ago
It's infuriating that I'm still paranoid about what my paid for Win 7 OS sends out, despite hiding updates and trying to keep on top of it. Then again, with IME etc, who siphons more? We've gone wildly wrong somewhere that this is the norm. Wildly wrong.

darrmit 10y ago

For those thinking Enterprise and/or Education may be better, it's only better if you're using it in an environment where privacy settings are enforced via Group Policy or some other method. Standalone (like I'm running it) is really not much better than Pro unless you go through and manually intervene. For example, the default telemetry level is "Enhanced": "The Enhanced level gathers data about how Windows and apps are used and how they perform. This level also includes data from both the Basic and Security levels. This level helps to improve the user experience with the operating system and apps. Data from this level can be abstracted into patterns and trends that can help Microsoft determine future improvements. This is the default level for Windows 10 Enterprise and Windows 10 Education editions, and the minimum level needed to quickly identify and address Windows, Windows Server, and System Center quality issues." [1] On a fresh install of Windows 10 Enterprise I still have to manually disable updates by disabling/setting permissions on scheduled tasks for updates and I'm still prompted for things like "Use OneDrive!". Cortana is also enabled by default. [1] https://technet.microsoft.com/en-us/itpro/windows/configure/configure-windows-telemetry-in-your-organization https://technet.microsoft.com/en-us/itpro/windows/configure/...

LinuxFreedom 10y ago
It is a real problem for the industry that people are clinging to that embarrassing anti-thesis of an operating system, no matter what is published about it, they still try to find a way to sell some kind of their religious fake believe that it is possible to trick MS in their own house. It is also very alarming that people from "tech communities" like this one are "defending" their use of an inferior fake operating system instead of just simply shutting up and being ashamed of their technical ignorance. But I hope most of these "it is anyway a great thing" posts are just pro marketing guys, I personally have not met one respectable tech person that would burn its name to propagate that MS anti-os. If your school or educational institute still depends on that failed OS, please help them to understand the importance of Free Software, thanks!
- AlexeyBrin 10y ago
  > It is also very alarming that people from "tech communities" like this one are "defending" their use of an inferior fake operating system instead of just simply shutting up and being ashamed of their technical ignorance. But I hope most of these "it is anyway a great thing" posts are just pro marketing guys, I personally have not met one respectable tech person that would burn its name to propagate that MS anti-os. Being condescending about Windows pro users will for sure boost the adoption of your preferred OS and raise awareness about the FSF ideals. You'll have a better chance if you change your tone and use ethical reasons for using alternative operating systems. From a technical point of view Linux is not better or worse than Windows or macOS. Take this from someone that uses all three of them for work.

retox 10y ago

Some troubling sounding ones; - All the physical memory used by Windows at the point of the crash - URL for a specific two second chunk of content if there is an error - Image & video resolution, video length, file sizes types and encoding - URLs (which may include search terms) - Ink strokes written, text before and after the ink insertion point, recognized text entered - Time and result of each connection attempt (WiFi) - Mobile Equipment ID (IMEI) and Mobile Country Code (MCCO) - Whether the user clicked or hovered on UI controls or hotspots