6 ms·

Actually, to me the MS statement is the most illuminating and I'm guessing that Canonical is getting some grumpy calls from Microsoft. This is the last part of

Actually, to me the MS statement is the most illuminating and I'm guessing that Canonical is getting some grumpy calls from Microsoft. This is the last part of the Microsoft statement: "Our terms with our publishers allow them to provide customers with implementation and technical support for their products but restricts them from using contact details for marketing purposes" Canonical then tells us that this person was a Sales Representative, and it is clear from the content that this is a message aimed towards selling. Canonical has broken Microsoft's terms. That said, I can't see where that legal restriction is (e.g. can't see anything like that in https://azure.microsoft.com/en-us/support/legal/marketplace-terms/ https://azure.microsoft.com/en-us/support/legal/marketplace-...).

jacurtis 6y ago
> "On February 10th, a new Canonical Sales Representative contacted one of these developers via LinkedIn, with a poor choice of word. In light of this incident, Canonical will be reviewing its sales training and policies." The part I find the most enlightening (ie: disturbing) is that Canonical's only regret is that the sales rep used "a poor choice of word" and they will train their salespeople better. I assume the "poor choice of word" was when the salesman said, "I saw that you spun up an Ubuntu instance". Was Canonical's biggest regret that the salesmen INFORMED the user that they are monitoring installs and linking them to contact information? Canonical never said "oh the salesperson wasn't supposed to market to you with this information", instead they basically said, the salesman wasn't supposed to TELL YOU that we are monitoring what you install and linking it to personal contact details.
- thom_nic 6y ago
  > the salesman wasn't supposed to TELL YOU that we are monitoring what you install Exactly. The old "I'm sorry I got caught" and not "I'm sorry I did it."
  - reaperducer 6y ago
    We can do better™
    - tohmasu 6y ago
      Legal wishes to remind you that that statement always needs this accompanying statement. The word "better" does not imply a commitment towards customers and/or investors. *The word "do" should not be seen as referring to the taking of any specific course of action which may or may not yield tangible change. *The word "can" does not signify a concrete ability and is not forward-looking. *The word "We" should not be interpreted as Canonical Ltd. nor any of its subsidiaries or affiliated entities.
      - NullPrefix 6y ago
        Reminds of the famous Bill Clinton qoute >It Depends on what the meaning of the word is is https://www.youtube.com/watch?v=j4XT-l-_3y0 https://www.youtube.com/watch?v=j4XT-l-_3y0
        Dylan16807 6y ago
        Except he had a perfectly legitimate point there, as far as I understand, he just utterly botched the explanation. There's a big difference between "is" and "was". Which is what he should have said. There were no semantic games in that particular statement, in stark contrast to some of the other things he said.
        NullPrefix 6y ago
        I'm sorry, but I am not completely aware of the broader context and just shared that soundbite as meme.
        Dylan16807 6y ago
        It's fine and understandable, it's just weird how the meme version is so detached from what the actual problems were.
- raverbashing 6y ago
  Yeah, the only acceptable choice of words in this case would be: none.
- LegitShady 6y ago
  It's all about plausible deniability.
  - qeternity 6y ago
    Or as law enforcement call it: parallel construction. The sales rep was probably expected to reach out claiming some other reason, making it look like the standard LinkedIn spam, but in reality much more targeted.
    - SilasX 6y ago
      Yep, and the purported “retraining” will probably be more like, “use a vaguer or falser pretense to cold-call”.
- brmgb 6y ago
  I like how the vocabulary you use imply there is something highly nefarious happening here whereas it is all fairly standard direct marketing based on an exchange of data clearly highlighted in the TOS. I don't really understand why everyone is up in arms here. In this case, Microsoft is basically a reseller. They told Canonical that they sold one of their product to a customer and Canonical reached out on LinkedIn, a professional social network. It all seems fair game to me. This is not some creepy internet tracking using dubious way to segment people. This is basic direct marketing in a B2B context. It's all pretty tame.
  - FpUser 6y ago
    >"This is basic direct marketing in a B2B context. It's all pretty tame." Well maybe it is ok from that perspective. However my personal reaction as a customer to such sales approach would simple be something in line of GFY to that salesperson.
  - joshuak 6y ago
    Unless you're the kind of person that actually sits and reads the EULA prior to hitting OK every single time, I'd say it makes complete sense people are up in arms. There is a difference between legally defensible and reasonable expectations. It is actually completely unacceptable on what is advertised as a secure platform to engage in targeted marketing AT ALL. If any information about what my company is doing on your platform is shared to other companies, then you are not secure by any definition of the word that I'm aware of. It is not for you to judge what information is valuable or damaging for us.
    - brmgb 6y ago
      > It is actually completely unacceptable on what is advertised as a secure platform to engage in targeted marketing AT ALL. If any information about what my company is doing on your platform is shared to other companies, then you are not secure by any definition of the word that I'm aware of. It is not for you to judge what information is valuable or damaging for us. Security and data sharing have nothing in common. It is perfectly acceptable to share customers list when you are resellers if you clearly state you will do so in the contract. It doesn't become true because you write it in all cap and say it is not for me to judge. If you so value your company information, maybe you should start reading what you sign. Once again, we are not talking about an unreadable EULA for personal software. Azure is a platform geared towards professional. Nothing creepy is happening here. That's Canonical reaching out and giving a potential customer a point of contact if they ever need support. This has nothing to do with broad data collection and spying and is perfectly reasonable. I don't understand why some commenters here find the idea of talking with an actual human being so traumatic.
- floatingatoll 6y ago
  For the record, while in the midst of discovering a possible breach of contract with a company the size of Microsoft, it would be very good form, from a legal perspective, not to risk further jeopardy by openly saying that you've breached your contract. While lawyers are often distasteful to HN readers, they do have immense value in these situations, and they are completely correct to say "do not admit error at this time, not until we've formally analyzed it, post-mortemed it, and resolved our contractual obligations to Microsoft". Yes, y'all may want them to self-flagellate, but I'd rather see them honor their contracts and respect their lawyers first. They already admitted that they behaved inappropriately. The rest is just icing on the cake.
- chmod775 6y ago
  >Canonical never said "oh the salesperson wasn't supposed to market to you with this information" Canonical never said "oh the salesperson shouldn't have had this information". There's only one way they could have used it.
jedberg 6y ago
> That said, I can't see where that legal restriction is It's probably part of the contract between MS and Canonical.
- rkangel 6y ago
  Which is a problem. I'm much happier if that restriction both exists and is enforced. If we can't see that contract, then it's all based on trust, and trusting tech companies with personal information has not gone well so far.
tfehring 6y ago
I guess I don't understand the quote from Microsoft's statement. Canonical provides "implementation and technical support," right? But they're not allowed to use user data from Microsoft to market those services? How else would that data even be useful for Canonical's "implementation and technical support" services?
- rkangel 6y ago
  This is the full quote from MS, provided in The Register article: "Customer privacy and trust is our top priority at Microsoft. We do not sell any information to third-party companies and only share customer information with Azure Marketplace publishers when customers deploy their product, as outlined in our Terms and Conditions. Our terms with our publishers allow them to provide customers with implementation and technical support for their products but restricts them from using contact details for marketing purposes." My interpretation is: Every time you buy or use something from the Marketplace, MS will give your contact details to the Marketplace publisher. That publisher is then restricted in what they can do with the information. They may not use it for Marketing, they may use it to provide technical support.
  - tfehring 6y ago
    Yeah, I agree with your interpretation and that makes sense from Microsoft's perspective. Just one open question that that raises: does a name and employer count as "contact details"? Do Microsoft's terms allow Canonical to reach out to someone on LinkedIn for marketing purposes as long as they don't look them up using the email address Microsoft gives them? And if the answer to that last question is no, what can Canonical do with the data that's actually valuable to them? If I were given access to a database of sales leads that I was explicitly disallowed from contacting, I would actively avoid even accessing the data to avoid any accusation or perception that I violated those terms, just in case I independently got in touch with those same leads through a different channel.
    - rkangel 6y ago
      So I don't know the answers to your questions - but here's one interesting thing - according to GPDR your email address is personal information as you'd expect. However your work email address is not. Companies can do all sorts of harvesting and collection on professional information that they can't on personal.
ballenf 6y ago
Very reminiscent of that Netflix tweet calling out a small group if people for some extraordinary binge watching. “The first rule of the the surveillance economy is don’t talk about the surveillance.”
- Thiez 6y ago
  As I recall their tweet did not indicate that they had direct access to the identity (such as name or address) of those people. I think they mentioned their municipality? Of course they have the raw data, but it's possible the people who sent that tweet just have access to a database that contains only anonymized data.
deleted 6y ago
[deleted]
chrisseaton 6y ago
> but restricts them from using contact details for marketing purposes ... Canonical then tells us that this person was a Sales Representative I don't understand - what's the difference between marketing and sales? Sales is trying to sell you something? But that's also marketing?

jacurtis 6y ago

> "On February 10th, a new Canonical Sales Representative contacted one of these developers via LinkedIn, with a poor choice of word. In light of this incident, Canonical will be reviewing its sales training and policies." The part I find the most enlightening (ie: disturbing) is that Canonical's only regret is that the sales rep used "a poor choice of word" and they will train their salespeople better. I assume the "poor choice of word" was when the salesman said, "I saw that you spun up an Ubuntu instance". Was Canonical's biggest regret that the salesmen INFORMED the user that they are monitoring installs and linking them to contact information? Canonical never said "oh the salesperson wasn't supposed to market to you with this information", instead they basically said, the salesman wasn't supposed to TELL YOU that we are monitoring what you install and linking it to personal contact details.

thom_nic 6y ago
> the salesman wasn't supposed to TELL YOU that we are monitoring what you install Exactly. The old "I'm sorry I got caught" and not "I'm sorry I did it."
- reaperducer 6y ago
  We can do better™
  - tohmasu 6y ago
    Legal wishes to remind you that that statement always needs this accompanying statement. The word "better" does not imply a commitment towards customers and/or investors. *The word "do" should not be seen as referring to the taking of any specific course of action which may or may not yield tangible change. *The word "can" does not signify a concrete ability and is not forward-looking. *The word "We" should not be interpreted as Canonical Ltd. nor any of its subsidiaries or affiliated entities.
    - NullPrefix 6y ago
      Reminds of the famous Bill Clinton qoute >It Depends on what the meaning of the word is is https://www.youtube.com/watch?v=j4XT-l-_3y0 https://www.youtube.com/watch?v=j4XT-l-_3y0
      - Dylan16807 6y ago
        Except he had a perfectly legitimate point there, as far as I understand, he just utterly botched the explanation. There's a big difference between "is" and "was". Which is what he should have said. There were no semantic games in that particular statement, in stark contrast to some of the other things he said.
        NullPrefix 6y ago
        I'm sorry, but I am not completely aware of the broader context and just shared that soundbite as meme.
        Dylan16807 6y ago
        It's fine and understandable, it's just weird how the meme version is so detached from what the actual problems were.
raverbashing 6y ago
Yeah, the only acceptable choice of words in this case would be: none.
LegitShady 6y ago
It's all about plausible deniability.
- qeternity 6y ago
  Or as law enforcement call it: parallel construction. The sales rep was probably expected to reach out claiming some other reason, making it look like the standard LinkedIn spam, but in reality much more targeted.
  - SilasX 6y ago
    Yep, and the purported “retraining” will probably be more like, “use a vaguer or falser pretense to cold-call”.
brmgb 6y ago
I like how the vocabulary you use imply there is something highly nefarious happening here whereas it is all fairly standard direct marketing based on an exchange of data clearly highlighted in the TOS. I don't really understand why everyone is up in arms here. In this case, Microsoft is basically a reseller. They told Canonical that they sold one of their product to a customer and Canonical reached out on LinkedIn, a professional social network. It all seems fair game to me. This is not some creepy internet tracking using dubious way to segment people. This is basic direct marketing in a B2B context. It's all pretty tame.
- FpUser 6y ago
  >"This is basic direct marketing in a B2B context. It's all pretty tame." Well maybe it is ok from that perspective. However my personal reaction as a customer to such sales approach would simple be something in line of GFY to that salesperson.
- joshuak 6y ago
  Unless you're the kind of person that actually sits and reads the EULA prior to hitting OK every single time, I'd say it makes complete sense people are up in arms. There is a difference between legally defensible and reasonable expectations. It is actually completely unacceptable on what is advertised as a secure platform to engage in targeted marketing AT ALL. If any information about what my company is doing on your platform is shared to other companies, then you are not secure by any definition of the word that I'm aware of. It is not for you to judge what information is valuable or damaging for us.
  - brmgb 6y ago
    > It is actually completely unacceptable on what is advertised as a secure platform to engage in targeted marketing AT ALL. If any information about what my company is doing on your platform is shared to other companies, then you are not secure by any definition of the word that I'm aware of. It is not for you to judge what information is valuable or damaging for us. Security and data sharing have nothing in common. It is perfectly acceptable to share customers list when you are resellers if you clearly state you will do so in the contract. It doesn't become true because you write it in all cap and say it is not for me to judge. If you so value your company information, maybe you should start reading what you sign. Once again, we are not talking about an unreadable EULA for personal software. Azure is a platform geared towards professional. Nothing creepy is happening here. That's Canonical reaching out and giving a potential customer a point of contact if they ever need support. This has nothing to do with broad data collection and spying and is perfectly reasonable. I don't understand why some commenters here find the idea of talking with an actual human being so traumatic.
floatingatoll 6y ago
For the record, while in the midst of discovering a possible breach of contract with a company the size of Microsoft, it would be very good form, from a legal perspective, not to risk further jeopardy by openly saying that you've breached your contract. While lawyers are often distasteful to HN readers, they do have immense value in these situations, and they are completely correct to say "do not admit error at this time, not until we've formally analyzed it, post-mortemed it, and resolved our contractual obligations to Microsoft". Yes, y'all may want them to self-flagellate, but I'd rather see them honor their contracts and respect their lawyers first. They already admitted that they behaved inappropriately. The rest is just icing on the cake.
chmod775 6y ago
>Canonical never said "oh the salesperson wasn't supposed to market to you with this information" Canonical never said "oh the salesperson shouldn't have had this information". There's only one way they could have used it.

jedberg 6y ago

> That said, I can't see where that legal restriction is It's probably part of the contract between MS and Canonical.

rkangel 6y ago
Which is a problem. I'm much happier if that restriction both exists and is enforced. If we can't see that contract, then it's all based on trust, and trusting tech companies with personal information has not gone well so far.

tfehring 6y ago

I guess I don't understand the quote from Microsoft's statement. Canonical provides "implementation and technical support," right? But they're not allowed to use user data from Microsoft to market those services? How else would that data even be useful for Canonical's "implementation and technical support" services?

rkangel 6y ago
This is the full quote from MS, provided in The Register article: "Customer privacy and trust is our top priority at Microsoft. We do not sell any information to third-party companies and only share customer information with Azure Marketplace publishers when customers deploy their product, as outlined in our Terms and Conditions. Our terms with our publishers allow them to provide customers with implementation and technical support for their products but restricts them from using contact details for marketing purposes." My interpretation is: Every time you buy or use something from the Marketplace, MS will give your contact details to the Marketplace publisher. That publisher is then restricted in what they can do with the information. They may not use it for Marketing, they may use it to provide technical support.
- tfehring 6y ago
  Yeah, I agree with your interpretation and that makes sense from Microsoft's perspective. Just one open question that that raises: does a name and employer count as "contact details"? Do Microsoft's terms allow Canonical to reach out to someone on LinkedIn for marketing purposes as long as they don't look them up using the email address Microsoft gives them? And if the answer to that last question is no, what can Canonical do with the data that's actually valuable to them? If I were given access to a database of sales leads that I was explicitly disallowed from contacting, I would actively avoid even accessing the data to avoid any accusation or perception that I violated those terms, just in case I independently got in touch with those same leads through a different channel.
  - rkangel 6y ago
    So I don't know the answers to your questions - but here's one interesting thing - according to GPDR your email address is personal information as you'd expect. However your work email address is not. Companies can do all sorts of harvesting and collection on professional information that they can't on personal.

ballenf 6y ago

Very reminiscent of that Netflix tweet calling out a small group if people for some extraordinary binge watching. “The first rule of the the surveillance economy is don’t talk about the surveillance.”

Thiez 6y ago
As I recall their tweet did not indicate that they had direct access to the identity (such as name or address) of those people. I think they mentioned their municipality? Of course they have the raw data, but it's possible the people who sent that tweet just have access to a database that contains only anonymized data.

deleted 6y ago

[deleted]

chrisseaton 6y ago

> but restricts them from using contact details for marketing purposes ... Canonical then tells us that this person was a Sales Representative I don't understand - what's the difference between marketing and sales? Sales is trying to sell you something? But that's also marketing?