9 ms·

I'm not supporting the Windows-10 style telemetry (I have it turned off) but I don't think this is about money. Let's take a hypothetical example of where you

I'm not supporting the Windows-10 style telemetry (I have it turned off) but I don't think this is about money. Let's take a hypothetical example of where you assign a given user a random ID, based on something (machine ID). You then track what this user is doing, in general, in the operating system. You can find data points such as what % of users discover/use X feature, how many pin applications to the taskbar, use X app with Y app, have night mode enabled, etc. This allows you to expend resources where they are actually needed, to improve the features that the majority of people would find benefit in. And at the end of the day, none of the above features require knowing anything about WHO that person is. Sure, they can be classified into groups based on how they use the software, such as "business user", "power user", or "gamer" ... but not "John Doe at 123 Main Street, Hollywood, California". This is likely all for product improvement and not for $$$. Why do they subject end-users and not opt-in testers for this? To get real world data at scale.

PurpleBoxDragon 8y ago
>but not "John Doe at 123 Main Street, Hollywood, California". How can you be so sure? Between IP addresses and what wireless networks are available you can get a decently precise location for the majority of users. And this is assuming you don't just capture the address and name when they type it in. Okay, so maybe they aren't using it for evil yet. How many times has a large corporation been able to indefinitely resist the pull of an alternative revenue stream where the majority of the cost has already been paid?
- davidhyde 8y ago
  > How many times has a large corporation been able to indefinitely resist the pull of an alternative revenue stream where the majority of the cost has already been paid? Agreed. They are mining and storing a mineral (our data) that they may enrich and sell (or lose via theft) one day in the future. This is the worrying part. This is a direct violation of GDPR which states that if you don't need the private data for an explicit purpose for the user (not your company) then you are not allowed to keep it.
  - josteink 8y ago
    But it’s not your data they are collecting. They are collecting usage-stats, aggregated data, in a way which deliberately has been decoupled from your identity so they won’t have to face the kind of liability issues you just mentioned. If anything, MS seems like one of the few big actors in IT which “gets” GDPR, and they are using it their advantage in the enterprise market. Of course unwanted telemetry (no matter how anonymized) is going to taint that image somewhat.
    - EvanAnderson 8y ago
      If my actions generate the data then it's my data, decoupled from my identity or not. Without my actions there's no data for them, ergo it's my data. If they'd like to give me some consideration for my data I'd be happy to entertain their offer. (Being granted the right to use the software, in cases where I'm paying for the license, doesn't constitute consideration to me.)
      - josteink 8y ago
        Your comment (action) just caused my aggregated cell-phone data-usage to increment by 200 bytes. Do you own that data? Where do you draw the line?
      - hashhar 8y ago
        Actually you don't. By that logic your order history on Amazon is your data but it is expressly not.
      - LocalH 8y ago
        If there is transparency with regards to the algorithm used, name one good reason why anonymized data is verboten. Not alleging there is such transparency here, just raising the question. It always seems like even anonymous telemetry is considered harmful, and I don't understand why that is from a conceptual standpoint.
        esotericn 8y ago
esotericn 8y ago
This is a common theory of telemetry but ultimately I don't think it makes sense. It's a relatively new addition to the landscape and Windows isn't any better or easier to use than the 2000/XP days - at least in ways which telemetry would influence - the genuine improvements are all obvious wins like display compositing, kernel stability, etc. It also dismisses the point that by including telemetry you've excluded some users, and your automated collection won't be aware of it at all in many cases. Some won't ever use Windows 10 as a main desktop OS because it attempts to spy on them. They won't recommend it to others or develop for it either. Other power users will use it, but will opt out. So your telemetry is now completely biased towards non-power-users. This isn't sour grapes - I wouldn't be using Windows anyway because I'm a free software advocate - I just wonder if they've realised that the incentives line up to effectively ignore some of their "best" users.
- naikrovek 8y ago
  > This is a common theory of telemetry but ultimately I don't think it makes sense. It makes loads of sense, to me. It started with the Customer Experience Improvement Program, WAY back in the Windows 2000 era, if I recall, which you would see an option to enable or disable when you installed a Microsoft SDK. They clearly saw benefit from this information, so they expanded it to include the whole OS. This collects lots of data for them, which helps them understand the usage of their products better, and a nice side benefit is that they can use the knowledge gained by organizing and inspecting this data in their "big data" offerings on Azure and in other places internally. The greatest benefit of Microsoft's telemetry to others is that everyone focuses on MICROSOFT's telemetry, argues about MICROSOFT's telemetry, debates MICROSOFT's telemetry, endlessly, while literally 90% of the rest of the software you use (99.9% if you count software you use that isn't on your computer, like servers, routers, web sites, and so on) collects telemetry, also, even when you think you've turned it off. Nearly every game you have installed on your phone collects FAR more about you than Microsoft has ever dared try to collect, and no one knows or gives a damn because "OMFG MICROSOFT I HATE MICROSOFT I don't care if they collect usage information from me. I truly don't. The entire Internet is trying to make me feel like I should care about usage data that originates from my computer, but I don't. I don't feel like it's my data if it truly is telemetric data about software usage. I would use more free software if more of it were good enough to use. Of course, a lot of free software is GREAT, and I use a lot of that stuff, rather than paid alternatives.
bunderbunder 8y ago
To expand on that last bit - The reason they might want to just collect all data without asking is that there's a chance that making it opt-in could cause bigger bias problems in the data you collect. For example, what if "power users" are significantly more or less likely to opt-in? You could end up with a very distorted view of what features are most popular, or are giving people the most trouble. Not saying that this concern is well-founded (I really don't know), or that this choice makes sense from a business perspective (I'm skeptical). Definitely not saying that this is the ethical choice to make (it isn't). Just trying to shed light on a possible thought process.
- bunderbunder 8y ago
  It's also worth mentioning that Microsoft is, to the best of my knowledge, relatively scrupulous about keeping their telemetry data anonymous. Meaning that they're still being way less sketchy about this stuff than your average e-tailer, or mass market retailers like Wal-Mart and Target.
  - r00fus 8y ago
    Do you have a cite for how well they anonymize? Is it as strong a position as Apple (e.g. differential privacy)?
  - olyjohn 8y ago
    Except they are taking things like file names, e-mail headers, recipients, and even in some cases they are taking documents. The recent recommendation from them was as follows: From - https://www.theregister.co.uk/2018/11/16/microsoft_gdpr/ https://www.theregister.co.uk/2018/11/16/microsoft_gdpr/ "...[Microsoft] also recommends simply not using the web-only version of Office 365, or SharePoint Oneline. And it recommends periodically deleting the Active Directory accounts of VIP users and creating new accounts for them so that the diagnostic data associated with those accounts is eventually deleted." Seriously, we should be deleting and recreating accounts in our own fucking domain to keep the data anonymous? Why is that on us? They have you AD account info, and diagnostic data directly tied to it. There's no anonymization going on here at all. They're gathering it recklessly. Also from that link: "Much of what Microsoft collects is diagnostics, the researchers found, and it has seemingly tried to make the system GDPR compliant by storing Office documents on servers based in the EU. But it also collected other data that contained private information and some of that data still ended up on US servers."
inetknght 8y ago
> You can find data points such as what % of users discover/use X feature, how many pin applications to the taskbar, use X app with Y app, have night mode enabled, etc. > This allows you to expend resources where they are actually needed, to improve the features that the majority of people would find benefit in. Let me give you a different idea. Instead of allowing you to expend resources where they are actually needed, it allows you to (often incorrectly) guess what users are trying to do. Product improvement? You're not improving the product at all if you're not directly engaging the user.
wglb 8y ago
Keep in mind that your IP address is part of your PD under the definition of GDPR.
- josteink 8y ago
  A horse oversimplification rendering your comment to be borderline bullshit. Ultimaty, by your interpretation, you can’t do anything privacy-sensitive online because every packet you send over the internet contains (in case you weren’t aware) your IP-address. :shocked_face: That’s how the internet works. And it’s not privacy sensitive unless connected to other data. The GDPR is perfectly reasonable, and obviously has amendments for these kind of things. TLDR: Stop spreading FUD.
  - wglb 8y ago
    This is not simply my interpretation. Here is the GDPR definition itself: https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
    - josteink 8y ago
      And where do you see IP address in that big list of things to consider? And how does the IP address (unlesss coupled with other data) identify you personally (as opposed to your PC or company network)? Hint: it doesn’t. Also: if the IP you send to everyone on the internet is “your” personal, private data, who owns that data when your DHCP lease expires and someone else gets it? See how that doesn’t work? At all? Good good. Yeah that IP address, unless coupled with other data, says nothing about you personally. I thought this much would be blatantly obvious to anyone even remotely competent on a techie site like HN. In short: it doesn’t work that way which you hysterical anti-GDPR fanatics are mindlessly repeating. If so, we’d have to shut down the entire internet and ban all server logs.
BitterAmethyst 8y ago
I don't mind the telemetry, I object to advertisements for Windows Store apps on the lock screen. That is clearly about money.
mbesto 8y ago
> but I don't think this is about money. > to improve the features that the majority of people would find benefit in. > This is likely all for product improvement and not for $$$. Read those sentences again. They are doing it so they can make $$$, whether that means nefariously using your data for advertising/tracking OR improving the product, it 100% translates into making money for them. Improving the product means they continue to sell the product you continually pay for. I think you're missing the overall point - any for-profit entity that tells you it won't infringe your rights, will eventually infringe on your rights. Especially one that takes $110B/yr in revenue. I'd be happy to share countless stories of for-profit entities, especially in tech, that do this.
- infogulch 8y ago
  I think there's a big difference between these two things: > 1: Using customer data to improve your product, to make them happier paying for it, which makes $$$ > 2: Using customer data to sell to someone else or to sell the user's attention, which makes $$$ The extra level of indirection through a product that you deliver to the user that provides value to them makes a huge difference between these two ethically. That said, I will admit that a company can move from 1 to 2 completely seamlessly, without the knowledge of the user. A bean counter, unscrupulous wallstreet exec, or changing priorities may take something that was intended to only ever be 1 and turn it into 2. This risk may be too high for you and that's your call to judge, but I find it hard to fault a company just for trying to improve their product. I do wish more companies took Apple's "differential privacy" approach which allows the data collection technology itself to draw a hard line between 1 and 2 that can't be crossed invisibly.
  - mbesto 8y ago
    > but I find it hard to fault a company just for trying to improve their product Nor do I. So the argument thusly is -> why make the opt-in/out so difficult to manage (e.g. dark patterns)?
birksherty 8y ago
Windows XP did not have this kind of telemetry, yet everyone loved it and things were improved with service packs. I don't agree with this spying. It's the same excuse always. Nowadays everyone suddenly needs tracking for everything, from softwares to TVs and cars.
- tinus_hn 8y ago
  Everybody did not love it, it looked like a toy compared to the ‘rock solid’ Windows 2000. Only when Windows 7 came out everybody suddenly loved Windows XP.
  - Agathos 8y ago
    Windows 7? I thought Windows Vista was the highly successful recruiting tool for the Windows XP Fan Club.
    - tinus_hn 8y ago
      You are right, I must have blocked that subconsciously.
krageon 8y ago
This kind of argument is what companies always say is the reason for telemetry, yet somehow it finds it's way into being sold and abused for spam with distressing frequency. At this point it behooves us to not take information that has repeatedly been proven to be false at face value.

PurpleBoxDragon 8y ago

>but not "John Doe at 123 Main Street, Hollywood, California". How can you be so sure? Between IP addresses and what wireless networks are available you can get a decently precise location for the majority of users. And this is assuming you don't just capture the address and name when they type it in. Okay, so maybe they aren't using it for evil yet. How many times has a large corporation been able to indefinitely resist the pull of an alternative revenue stream where the majority of the cost has already been paid?

davidhyde 8y ago
> How many times has a large corporation been able to indefinitely resist the pull of an alternative revenue stream where the majority of the cost has already been paid? Agreed. They are mining and storing a mineral (our data) that they may enrich and sell (or lose via theft) one day in the future. This is the worrying part. This is a direct violation of GDPR which states that if you don't need the private data for an explicit purpose for the user (not your company) then you are not allowed to keep it.
- josteink 8y ago
  But it’s not your data they are collecting. They are collecting usage-stats, aggregated data, in a way which deliberately has been decoupled from your identity so they won’t have to face the kind of liability issues you just mentioned. If anything, MS seems like one of the few big actors in IT which “gets” GDPR, and they are using it their advantage in the enterprise market. Of course unwanted telemetry (no matter how anonymized) is going to taint that image somewhat.
  - EvanAnderson 8y ago
    If my actions generate the data then it's my data, decoupled from my identity or not. Without my actions there's no data for them, ergo it's my data. If they'd like to give me some consideration for my data I'd be happy to entertain their offer. (Being granted the right to use the software, in cases where I'm paying for the license, doesn't constitute consideration to me.)
    - josteink 8y ago
      Your comment (action) just caused my aggregated cell-phone data-usage to increment by 200 bytes. Do you own that data? Where do you draw the line?
    - hashhar 8y ago
      Actually you don't. By that logic your order history on Amazon is your data but it is expressly not.
    - LocalH 8y ago
      If there is transparency with regards to the algorithm used, name one good reason why anonymized data is verboten. Not alleging there is such transparency here, just raising the question. It always seems like even anonymous telemetry is considered harmful, and I don't understand why that is from a conceptual standpoint.
      - esotericn 8y ago

esotericn 8y ago

This is a common theory of telemetry but ultimately I don't think it makes sense. It's a relatively new addition to the landscape and Windows isn't any better or easier to use than the 2000/XP days - at least in ways which telemetry would influence - the genuine improvements are all obvious wins like display compositing, kernel stability, etc. It also dismisses the point that by including telemetry you've excluded some users, and your automated collection won't be aware of it at all in many cases. Some won't ever use Windows 10 as a main desktop OS because it attempts to spy on them. They won't recommend it to others or develop for it either. Other power users will use it, but will opt out. So your telemetry is now completely biased towards non-power-users. This isn't sour grapes - I wouldn't be using Windows anyway because I'm a free software advocate - I just wonder if they've realised that the incentives line up to effectively ignore some of their "best" users.

naikrovek 8y ago
> This is a common theory of telemetry but ultimately I don't think it makes sense. It makes loads of sense, to me. It started with the Customer Experience Improvement Program, WAY back in the Windows 2000 era, if I recall, which you would see an option to enable or disable when you installed a Microsoft SDK. They clearly saw benefit from this information, so they expanded it to include the whole OS. This collects lots of data for them, which helps them understand the usage of their products better, and a nice side benefit is that they can use the knowledge gained by organizing and inspecting this data in their "big data" offerings on Azure and in other places internally. The greatest benefit of Microsoft's telemetry to others is that everyone focuses on MICROSOFT's telemetry, argues about MICROSOFT's telemetry, debates MICROSOFT's telemetry, endlessly, while literally 90% of the rest of the software you use (99.9% if you count software you use that isn't on your computer, like servers, routers, web sites, and so on) collects telemetry, also, even when you think you've turned it off. Nearly every game you have installed on your phone collects FAR more about you than Microsoft has ever dared try to collect, and no one knows or gives a damn because "OMFG MICROSOFT I HATE MICROSOFT I don't care if they collect usage information from me. I truly don't. The entire Internet is trying to make me feel like I should care about usage data that originates from my computer, but I don't. I don't feel like it's my data if it truly is telemetric data about software usage. I would use more free software if more of it were good enough to use. Of course, a lot of free software is GREAT, and I use a lot of that stuff, rather than paid alternatives.

bunderbunder 8y ago

To expand on that last bit - The reason they might want to just collect all data without asking is that there's a chance that making it opt-in could cause bigger bias problems in the data you collect. For example, what if "power users" are significantly more or less likely to opt-in? You could end up with a very distorted view of what features are most popular, or are giving people the most trouble. Not saying that this concern is well-founded (I really don't know), or that this choice makes sense from a business perspective (I'm skeptical). Definitely not saying that this is the ethical choice to make (it isn't). Just trying to shed light on a possible thought process.

bunderbunder 8y ago
It's also worth mentioning that Microsoft is, to the best of my knowledge, relatively scrupulous about keeping their telemetry data anonymous. Meaning that they're still being way less sketchy about this stuff than your average e-tailer, or mass market retailers like Wal-Mart and Target.
- r00fus 8y ago
  Do you have a cite for how well they anonymize? Is it as strong a position as Apple (e.g. differential privacy)?
- olyjohn 8y ago
  Except they are taking things like file names, e-mail headers, recipients, and even in some cases they are taking documents. The recent recommendation from them was as follows: From - https://www.theregister.co.uk/2018/11/16/microsoft_gdpr/ https://www.theregister.co.uk/2018/11/16/microsoft_gdpr/ "...[Microsoft] also recommends simply not using the web-only version of Office 365, or SharePoint Oneline. And it recommends periodically deleting the Active Directory accounts of VIP users and creating new accounts for them so that the diagnostic data associated with those accounts is eventually deleted." Seriously, we should be deleting and recreating accounts in our own fucking domain to keep the data anonymous? Why is that on us? They have you AD account info, and diagnostic data directly tied to it. There's no anonymization going on here at all. They're gathering it recklessly. Also from that link: "Much of what Microsoft collects is diagnostics, the researchers found, and it has seemingly tried to make the system GDPR compliant by storing Office documents on servers based in the EU. But it also collected other data that contained private information and some of that data still ended up on US servers."

inetknght 8y ago

> You can find data points such as what % of users discover/use X feature, how many pin applications to the taskbar, use X app with Y app, have night mode enabled, etc. > This allows you to expend resources where they are actually needed, to improve the features that the majority of people would find benefit in. Let me give you a different idea. Instead of allowing you to expend resources where they are actually needed, it allows you to (often incorrectly) guess what users are trying to do. Product improvement? You're not improving the product at all if you're not directly engaging the user.

wglb 8y ago

Keep in mind that your IP address is part of your PD under the definition of GDPR.

josteink 8y ago
A horse oversimplification rendering your comment to be borderline bullshit. Ultimaty, by your interpretation, you can’t do anything privacy-sensitive online because every packet you send over the internet contains (in case you weren’t aware) your IP-address. :shocked_face: That’s how the internet works. And it’s not privacy sensitive unless connected to other data. The GDPR is perfectly reasonable, and obviously has amendments for these kind of things. TLDR: Stop spreading FUD.
- wglb 8y ago
  This is not simply my interpretation. Here is the GDPR definition itself: https://gdpr-info.eu/art-4-gdpr/ https://gdpr-info.eu/art-4-gdpr/ ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;
  - josteink 8y ago
    And where do you see IP address in that big list of things to consider? And how does the IP address (unlesss coupled with other data) identify you personally (as opposed to your PC or company network)? Hint: it doesn’t. Also: if the IP you send to everyone on the internet is “your” personal, private data, who owns that data when your DHCP lease expires and someone else gets it? See how that doesn’t work? At all? Good good. Yeah that IP address, unless coupled with other data, says nothing about you personally. I thought this much would be blatantly obvious to anyone even remotely competent on a techie site like HN. In short: it doesn’t work that way which you hysterical anti-GDPR fanatics are mindlessly repeating. If so, we’d have to shut down the entire internet and ban all server logs.

BitterAmethyst 8y ago

I don't mind the telemetry, I object to advertisements for Windows Store apps on the lock screen. That is clearly about money.

mbesto 8y ago

> but I don't think this is about money. > to improve the features that the majority of people would find benefit in. > This is likely all for product improvement and not for $$$. Read those sentences again. They are doing it so they can make $$$, whether that means nefariously using your data for advertising/tracking OR improving the product, it 100% translates into making money for them. Improving the product means they continue to sell the product you continually pay for. I think you're missing the overall point - any for-profit entity that tells you it won't infringe your rights, will eventually infringe on your rights. Especially one that takes $110B/yr in revenue. I'd be happy to share countless stories of for-profit entities, especially in tech, that do this.

infogulch 8y ago
I think there's a big difference between these two things: > 1: Using customer data to improve your product, to make them happier paying for it, which makes $$$ > 2: Using customer data to sell to someone else or to sell the user's attention, which makes $$$ The extra level of indirection through a product that you deliver to the user that provides value to them makes a huge difference between these two ethically. That said, I will admit that a company can move from 1 to 2 completely seamlessly, without the knowledge of the user. A bean counter, unscrupulous wallstreet exec, or changing priorities may take something that was intended to only ever be 1 and turn it into 2. This risk may be too high for you and that's your call to judge, but I find it hard to fault a company just for trying to improve their product. I do wish more companies took Apple's "differential privacy" approach which allows the data collection technology itself to draw a hard line between 1 and 2 that can't be crossed invisibly.
- mbesto 8y ago
  > but I find it hard to fault a company just for trying to improve their product Nor do I. So the argument thusly is -> why make the opt-in/out so difficult to manage (e.g. dark patterns)?

birksherty 8y ago

Windows XP did not have this kind of telemetry, yet everyone loved it and things were improved with service packs. I don't agree with this spying. It's the same excuse always. Nowadays everyone suddenly needs tracking for everything, from softwares to TVs and cars.

tinus_hn 8y ago
Everybody did not love it, it looked like a toy compared to the ‘rock solid’ Windows 2000. Only when Windows 7 came out everybody suddenly loved Windows XP.
- Agathos 8y ago
  Windows 7? I thought Windows Vista was the highly successful recruiting tool for the Windows XP Fan Club.
  - tinus_hn 8y ago
    You are right, I must have blocked that subconsciously.

krageon 8y ago

This kind of argument is what companies always say is the reason for telemetry, yet somehow it finds it's way into being sold and abused for spam with distressing frequency. At this point it behooves us to not take information that has repeatedly been proven to be false at face value.