9 ms·
Microsoft stirs suspicions by adding telemetry files to security-only update
- Someone1234 7y agoWe don't know if this is a security update or not. This is an article, about an article, about a blog post, about a random comment. Someone grabbed the update's file change list, spotted files used by the Customer Experience Improvement Program (CEIP) and then said that because those files were updated that this security update "added telemetry." Problem is that those files previously exist on Windows 7 as part of CEIP and may require legitimate updates (inc. security). You still need to opt into the CEIP so that telemetrics are sent to Microsoft, and there's no proof that this update has changed that. I guess what I am saying is: There could be a story here, hypothetically, but this article lacks enough information to say that there is. This could be a legitimately security update to an unpopular part of the Windows 7 OS.
- tinus_hn 7y agoThey’ve pulled these tricks so many times before they are not getting the benefit of the doubt from me.
- TimTheTinker 7y ago> benefit of the doubt OP's point was that ZDNet is stooping a bit low here by journalistic standards. In this case, it appears there's not enough evidence to publish a "question headline" -- much less question whether they deserve some benefit of a doubt. We all know MS and others have engaged in questionable behavior - but at least wait until there's something substantive before publishing.
- fartcannon 7y agoNo, publish now, and let Microsoft's PR machine reveal itself. We could learn so much.
- darkcha0s 7y agoSo you'd rather push fake news, rather than see if the report substantiates.
- phs318u 7y agoAre you referring to Microsoft or ZDnet?
- altmind 7y ago>>We don't know if this is a security update or not. What are you implying, go to the link in the article and find how it is described: https://support.microsoft.com/en-us/help/4507456/windows-7-update-kb4507456 https://support.microsoft.com/en-us/help/4507456/windows-7-u...
- dspillett 7y agoBecause how something is described is always exactly what it is, that's why we are always told to judge books by their covers... That page doesn't state what security matters the update address, nor does the page it links to (directly, maybe the information is there with more digging, but if I'm given a link on the pretext that it shows something I expect it to show that thing without needing to dig). > What are you implying, I'm not the OP, but I think what is being implied is fairly obvious: that the patch exists purely as a way to get the telemetry stuff installed and had no real security addressing content. I very much doubt that is the case though, it is something that would not surprise me from the MS of old but they are at very least more clever these days and would not risk the resulting furory.
- userbinator 7y agoProblem is that those files previously exist on Windows 7 as part of CEIP Were they there from the beginning? If not, which update(s) first added them? I doubt they were, because I clearly remember all the telemetry being in the news starting with Win10 and plenty of people refusing to upgrade to 10 because of it. Even if it's a security update to CEIP, I don't think it should be offered to those who didn't install the original version of it.
- ceph_ 7y agoYou're spreading baseless FUD about the article. They are telemetry files that previously non-security patches have attempted to add on multiple occasions[1]. $ cat 4507456.csv | grep -i telem Appraiser_telemetryrunlist.xml,Not applicable,"71,958",17-May-19,16:16,Not applicable,None,Not applicable Appraiser_telemetryrunlist.xml,Not applicable,"71,958",17-May-19,16:17,Not applicable,None,Not applicable File name,X86_microsoft-windows-a..de-compat-telemetry_31bf3856ad364e35_6.1.7601.24490_none_89e278f970fa1943.manifest,,,,,, File name,X86_microsoft-windows-a..ence-telemetry-sdbs_31bf3856ad364e35_6.1.7601.24490_none_0a5a1cf1c1a22732.manifest,,,,,, File name,Amd64_microsoft-windows-a..de-compat-telemetry_31bf3856ad364e35_6.1.7601.24490_none_e601147d29578a79.manifest,,,,,, File name,Amd64_microsoft-windows-a..ence-telemetry-sdbs_31bf3856ad364e35_6.1.7601.24490_none_6678b87579ff9868.manifest,,,,,, [1]: https://www.computerworld.com/article/3065380/mystery-solved-kb-3150513-is-another-windows-10-update-enabling-patch.html https://www.computerworld.com/article/3065380/mystery-solved...
- VvR-Ox 7y agoJust stop defending this company please, they tried this a lot and look at how much telemetry they managed to get into windows and other products nowadays. I can't listen to this naive way of dealing with these companies anymore. Use it if you want and also use it for your business but don't complain afterwards that someone stole something important etc.
- iamnotacrook 7y agoIt's not about "defending a company". That's the wrong way of looking at it. It's about HN not reporting on "..an article, about a blog post, about a random comment..." as if it's facts. Until otherwise demonstrated, this is a non-story. If it turns out to be true, I'll be the first person to say "yeah, same old same old" but no-one's put the work in yet.
- blub 7y agoThe article author tried to contact MS and checked themselves that the files are part of the update. Furthermore, the user Someone1234 has been defending telemetry on HN for years, often ignoring two important facts: * telemetry was invasive and non-transparent, but got toned down because of the backlash. They always refer to the current state and pretend that people are paranoid and exaggerate. * MS used many dark patterns when rolling this out, essentially getting into an arms race with the customers that wanted to disable telemetry.
- VvR-Ox 7y agoThank you very much, now I don't have to answer anymore. Have a good day :)
- dang 7y agoPlease don't cross into personal attack in comments here. I'm sure you can make your substantive points without that. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- craftinator 7y agoI don't have this problem on Linux.
- Causality1 7y agoYou know, I would do quite a lot to get full granular control of Windows Update back. I'd sign and mail a liability waiver. I'd send Microsoft a box of chocolates. I'd take a training course and pass a standardized licensing exam. In the meantime I'm stuck dealing with Windows Update breaking things every week. I've completely given up on ever using my convertible laptop as a tablet again because every day I have to replace the updated broken drivers for the orientation sensor with the good ones from a fresh install of Windows and every night it dutifully installs the broken updated ones and there's not a damned thing I can do about it without disabling Windows Update entirely.
- NegativeLatency 7y agoMight not help your case but I found turning them off and manually updating to work ok. The group policy option has been working for me: https://www.howtogeek.com/224471/how-to-prevent-windows-10-from-automatically-downloading-updates/ https://www.howtogeek.com/224471/how-to-prevent-windows-10-f...
- duxup 7y ago>I'd take a training course and pass a standardized licensing exam I like this idea but it really doesn't protect anyone else if you quit updating and your machine become a less than desirable participant on the internet for the rest of us.
- Causality1 7y agoSo instead I stay on Windows 7 and become a much greater risk.
- duxup 7y agoIt is ultimately your call.
- Silhouette 7y agoIn that case, it seems the root cause of your concerns about other Internet users is that updates for their systems from the OS developer are no longer considered trustworthy. Given that the developer in question has something of a track record now of delivering potentially unwelcome updates, such caution is reasonable. So I think you're aiming at the wrong target here. In any case, the vaccination argument only works if it's defending against a real threat. If there's a genuine security issue here, perhaps it is. On the other hand, if this update really is causing otherwise absent telemetry software to be installed, not installing that telemetry software is hardly a threat to other Internet users.
- reilly3000 7y agoHow on earth is MSFT supposed to maintain comparability for quintillions of iterations of hardware across millions of machines with no data on what works and what doesn't? Unlike FAANG they aren't out there pushing listening devices or trying to build exclusive data sets; they are trying to maintain the stability and security of 78.43% of the world's desktop computers. I don't care for the alarmism here when there are blazing infernos of actual malevolence burning in every direction.
- PhasmaFelis 7y agoThey could start by being honest and open about what data they gather and give users simple, easy-to-access tools to restrict it if they want. (Most modern users won't care, anyway.) If MS has built an OS that cannot be effectively maintained without being sneaky and deceptive about their data gathering, that's their problem. Don't ask me to sympathize with them just because doing things right is hard.
- SquareWheel 7y ago>They could start by being honest and open about what data they gather Are they being dishonest about what they claim to collect? Is there anything deceiving in their privacy policy?
- chopin 7y agoIt's completely unverifiable. For big companies I assume dishonesty until proven otherwise. Give me the keys to read the raw stream and we can talk.
- SquareWheel 7y agoIt doesn't matter that it's unverifiable; that's just how it works. If they're found to be breaking the rules then they earn exorbitant fees, sanctions, and lawsuits. It's like saying that you expect letter carriers to read every letter they deliver because there's no way to prove otherwise. They can get caught doing it, and if they are they're severely punished. That's your insurance. Nothing is perfect, but somehow it still works. You can't always get 100% assurances; that's the nirvana fallacy. If you insist on it you'll just dismantle a system that was otherwise working perfectly fine. Are mail carriers foolproof? No, but they serve a purpose. Are privacy policies foolproof? No, but they serve a purpose.
- dilawar 7y agoIf no one is paying you, is there still any good reason to use Windows?
- rlv-dan 7y agoIt's what many (most?) people are used to and comfortable using. And that's a big part in decision making for humans. (Provided they even know of the alternatives.)
- burrows 7y agoWindows is terrible.
- kungtotte 7y agoGaming is still better on Windows. It's improved greatly with Steam's work on Proton, at a guess I'd say at least 75% of my library is now playable with no extra work from my side. On Windows it's still 100% though.
- fartcannon 7y agoIt's not 100% anymore. In fact, WINE supports packages that Windows no longer can.
- kungtotte 7y agoWindows programs in general, or games available on Steam? Because I'm talking about the latter. As far as I know there are no games on Steam that won't run under Windows any more.
- waddlesworth 7y agoI tried gaming on Linux awhile back, my biggest problem was how spotty the nVidia drivers are. I realise nVidia is mostly to blame here, but it's definitely still a problem that's preventing me from ever really being able to game on Linux (Ubuntu.) With a goal of 1440p@144hz, and someone who appreciates visual fidelity, I own an RTX 2080 Ti, and there's just far too much of a performance penalty for linux gaming.
- mirimir 7y agoThe last time I helped my wife with a Windows 10 install, I was utterly grossed out. I've always been suspicious about snooping and covert logging, and spent years playing the game about blocking it all, but Windows 10 is crazy invasive. I mean, by default, it wants to send every keystroke back to Microsoft servers! For "diagnostic purposes", I guess. And every URL that you visit. That's arguably worse than Google. Which is saying a lot.
- pilif 7y ago> I mean, by default, it wants to send every keystroke back to Microsoft servers do you have any proof to substantiate this statement? I don’t believe for a second that Microsoft is getting away with an OS-wide keylogger
- tallanvor 7y agoOf course he doesn't, because it's obviously untrue. Newer versions of Windows 10 gives you the option to save all diagnostic data and view it, so that you can actually see what they send back.
- eps 7y agoGot a link for the instructions on how to do this?
- tallanvor 7y agoHere: https://www.thewindowsclub.com/diagnostic-data-viewer-windows-10 https://www.thewindowsclub.com/diagnostic-data-viewer-window... Or here: https://www.onmsft.com/how-to/how-to-see-the-diagnostic-data-windows-10-is-sending-to-microsoft https://www.onmsft.com/how-to/how-to-see-the-diagnostic-data... Quite a few sites have listed how to do this.
- mirimir 7y agoIt's true that I can't, because that was years ago. But I do remember what I read. And some searching will find others who say the same. All of the angst about Windows 10 spying did force Microsoft to be more transparent. At one point, they were facing legal action from France and Brazil, and very likely other countries.
- bprasanna 7y agoNot sure what happened lately, Microsoft is having a stint of bad news as well! They must always remember that the faith now is hard earned through lots of good decisions and generosity.
- devoply 7y agowolf in sheep's clothing, the "new" microsoft.
- sverige 7y agoSince I have very clear memories of the first time MS did something like this, it kills me that no one publishes articles with quite the same degree of alarm about the massive amounts of telemetry that Google, Facebook, Amazon, et al. have successfully deployed. I mean, I don't like MS, but they're kind of like the annoying acquaintance who always pushes their latest MLM scheme while we all live in a neighborhood full of gangster thugs.
- LifeLiverTransp 7y agoAh, thats the microsoft we all knew and love to hate. Google peeps at you every waking hour, but at least pretends to be clueless. Facebook is what waits at the end of a dark alley, you choose to walk down. But microsoft, microsoft is someone a home depot walking up from behind "So you need that tool for work?" and after that its darkness and pain. Still amazing though how much windows could decay and they still got away with it. Year of the linux desktop, as if this company did not held the UI-Knowledge and legacy software of half the planet hostage.
- infiniteseeker 7y agoYawn. That would only be a problem if you choose to run Micro$oft software. And it is in your hands to fix the problem by going with Linux etc. (key word is choose...i realise it is imposed on many, specially in the enterprise world).