6 ms·

This is an impossible problem. If they underdeclare, they invite a lawsuit. If they overdeclare, they get accused of malfeasance they aren't even doing. If the

This is an impossible problem. If they underdeclare, they invite a lawsuit. If they overdeclare, they get accused of malfeasance they aren't even doing. If they open the whole business to transparency, they become victims of commerical espionage and expose their users' data to invasion.

rrobukef 6y ago
How often have you seen the words: "Including but not limited to ..."? This is not an impossible problem.
TeMPOraL 6y ago
How about just providing a link to an actual payload (with example data)? And within the installed application, providing the ability to review all the data that was recorded and set?
- bradford 6y ago
  Windows lets you view the data that is being gathered on your machine, this would include the package manager: https://docs.microsoft.com/en-us/windows/privacy/diagnostic-data-viewer-overview https://docs.microsoft.com/en-us/windows/privacy/diagnostic-... MS adheres to GDPR export/delete requirements. Failure to adhere risks litigation so it's not something that MS is just going to willy-nilly flaunt. It's frustrating reading a lot of comments that are of the form "Why doesn't MS just do XYZ?" from individuals who don't seem to know that MS is already doing that. [disclaimer, MS employee]
  - TeMPOraL 6y ago
    Thanks. I guess this is just Cunningham's law in action. https://meta.m.wikimedia.org/wiki/Cunningham%27s_Law https://meta.m.wikimedia.org/wiki/Cunningham%27s_Law
  - ptx 6y ago
    Why doesn't MS just stop forcibly collecting data from my machine? Is it just that I don't know that they're already stopping?
    - bradford 6y ago
      The parent comment that I replied to was asking about transparency and I tried my best to answer. > Why doesn't MS just stop forcibly collecting data from my machine? Updates. At the minimum data collection level for client SKU (set via user settings), MS asserts that only data needed to keep the machine running and secure is collected (i.e, updates). They really do try hard to honor this assert, although I understand I'm not going to be able to entirely eliminate skepticism. You can argue that you should be allowed to disable telemetry for updates, but I think that's a different conversation. MS didn't want Windows reputation to suffer due to undeployed fixes (this was a big problem prior to win8), and they took a hard line on the updates. Enterprise SKUs have a zero exhaust option (no telemetry), but alas, it's not free.
      - TeMPOraL 6y ago
        > MS asserts that only data needed to keep the machine running and secure is collected (i.e, updates) I think this phrase is going to be a contentious point anyway. Microsoft doesn't need any telemetry to "keep the machine running" - as trivially evidenced by me pulling out the Ethernet plug, disconnecting the wireless adapter, and booting up Windows 10. The OS will run just fine. As for keeping it secure, it depends on how much you stretch the word "secure". I can't see any reason why telemetry would be needed to deliver updates (Windows could just download the list of available updates and request the ones it needs). You could argue telemetry is needed for malware detection and mitigation, but that can be stretched to justify everything up to and including uploading snapshots of your hard drive. I'm guessing "needed to keep the machine secure" is how we've arrived at the rather absurd situation in which Windows Defender is automatically uploading executables it finds on the machine, to have them tested on Microsoft servers - which has been demonstrated to be a neat vector for exfiltrating data from secure corporate networks: the malware can just encode the data it collected into an executable and write it out to the file system, at which point it gets picked up by Defender and uploaded to Microsoft (which corporate firewall will most likely allow), where upon execution it connects to the attacker's server and delivers collected data.
tjoff 6y ago
It is not hard to specify what you are collecting. If that is such a big task maybe not doing it in the first place is the reasonable thing to do.

rrobukef 6y ago

How often have you seen the words: "Including but not limited to ..."? This is not an impossible problem.

TeMPOraL 6y ago

How about just providing a link to an actual payload (with example data)? And within the installed application, providing the ability to review all the data that was recorded and set?

bradford 6y ago
Windows lets you view the data that is being gathered on your machine, this would include the package manager: https://docs.microsoft.com/en-us/windows/privacy/diagnostic-data-viewer-overview https://docs.microsoft.com/en-us/windows/privacy/diagnostic-... MS adheres to GDPR export/delete requirements. Failure to adhere risks litigation so it's not something that MS is just going to willy-nilly flaunt. It's frustrating reading a lot of comments that are of the form "Why doesn't MS just do XYZ?" from individuals who don't seem to know that MS is already doing that. [disclaimer, MS employee]
- TeMPOraL 6y ago
  Thanks. I guess this is just Cunningham's law in action. https://meta.m.wikimedia.org/wiki/Cunningham%27s_Law https://meta.m.wikimedia.org/wiki/Cunningham%27s_Law
- ptx 6y ago
  Why doesn't MS just stop forcibly collecting data from my machine? Is it just that I don't know that they're already stopping?
  - bradford 6y ago
    The parent comment that I replied to was asking about transparency and I tried my best to answer. > Why doesn't MS just stop forcibly collecting data from my machine? Updates. At the minimum data collection level for client SKU (set via user settings), MS asserts that only data needed to keep the machine running and secure is collected (i.e, updates). They really do try hard to honor this assert, although I understand I'm not going to be able to entirely eliminate skepticism. You can argue that you should be allowed to disable telemetry for updates, but I think that's a different conversation. MS didn't want Windows reputation to suffer due to undeployed fixes (this was a big problem prior to win8), and they took a hard line on the updates. Enterprise SKUs have a zero exhaust option (no telemetry), but alas, it's not free.
    - TeMPOraL 6y ago
      > MS asserts that only data needed to keep the machine running and secure is collected (i.e, updates) I think this phrase is going to be a contentious point anyway. Microsoft doesn't need any telemetry to "keep the machine running" - as trivially evidenced by me pulling out the Ethernet plug, disconnecting the wireless adapter, and booting up Windows 10. The OS will run just fine. As for keeping it secure, it depends on how much you stretch the word "secure". I can't see any reason why telemetry would be needed to deliver updates (Windows could just download the list of available updates and request the ones it needs). You could argue telemetry is needed for malware detection and mitigation, but that can be stretched to justify everything up to and including uploading snapshots of your hard drive. I'm guessing "needed to keep the machine secure" is how we've arrived at the rather absurd situation in which Windows Defender is automatically uploading executables it finds on the machine, to have them tested on Microsoft servers - which has been demonstrated to be a neat vector for exfiltrating data from secure corporate networks: the malware can just encode the data it collected into an executable and write it out to the file system, at which point it gets picked up by Defender and uploaded to Microsoft (which corporate firewall will most likely allow), where upon execution it connects to the attacker's server and delivers collected data.

tjoff 6y ago

It is not hard to specify what you are collecting. If that is such a big task maybe not doing it in the first place is the reasonable thing to do.