4 ms·

I guess I don't understand the quote from Microsoft's statement. Canonical provides "implementation and technical support," right? But they're not allowed to us

I guess I don't understand the quote from Microsoft's statement. Canonical provides "implementation and technical support," right? But they're not allowed to use user data from Microsoft to market those services? How else would that data even be useful for Canonical's "implementation and technical support" services?

rkangel 6y ago
This is the full quote from MS, provided in The Register article: "Customer privacy and trust is our top priority at Microsoft. We do not sell any information to third-party companies and only share customer information with Azure Marketplace publishers when customers deploy their product, as outlined in our Terms and Conditions. Our terms with our publishers allow them to provide customers with implementation and technical support for their products but restricts them from using contact details for marketing purposes." My interpretation is: Every time you buy or use something from the Marketplace, MS will give your contact details to the Marketplace publisher. That publisher is then restricted in what they can do with the information. They may not use it for Marketing, they may use it to provide technical support.
- tfehring 6y ago
  Yeah, I agree with your interpretation and that makes sense from Microsoft's perspective. Just one open question that that raises: does a name and employer count as "contact details"? Do Microsoft's terms allow Canonical to reach out to someone on LinkedIn for marketing purposes as long as they don't look them up using the email address Microsoft gives them? And if the answer to that last question is no, what can Canonical do with the data that's actually valuable to them? If I were given access to a database of sales leads that I was explicitly disallowed from contacting, I would actively avoid even accessing the data to avoid any accusation or perception that I violated those terms, just in case I independently got in touch with those same leads through a different channel.
  - rkangel 6y ago
    So I don't know the answers to your questions - but here's one interesting thing - according to GPDR your email address is personal information as you'd expect. However your work email address is not. Companies can do all sorts of harvesting and collection on professional information that they can't on personal.
    - iamacyborg 6y ago
      This is not strictly true. Sales@example.com would not be considered personal data, bob.smith@company.com would be
  - nickflood 6y ago
    If they discover a huge security problem with the distribution you installed, they can contact you and help you upgrade to a non-vulnerable version? This like like what "technical support" is supposed to mean
- sorokod 6y ago
  How more reasonable it would have been for Microsoft to provide the publishers details to consumers instead of the other way around. Interesting that this is not so.
  - lotsofpulp 6y ago
    Microsoft can earn more money this way (selling data for sales purposes), so their behavior meets my expectations.
    - sorokod 6y ago
      Mine too, it is hilarious that they present this gratuitous data sharing as "this is normal/we are the victims as much as you are"
    - deleted 6y ago
      [deleted]
    - moron4hire 6y ago
      But they aren't selling the data
      - sorokod 6y ago
        On the off chance you are not being sarcastic, do you think that Canonical got the data for free?
        Hawxy 6y ago
        Yes? Its pretty evident that when you publish a marketplace app, the details of those that installed it are automatically stored for use by the vendor. All of the statements above align with this, unless you're insinuating that Microsoft are liars.
- pbhjpbhj 6y ago
  This sounds like plausible deniability to me. "We sell your details to companies whose products you're using - which would be really useful marketing information; but they say they don't use it for that, so we did what we need to."? Microsoft being lily-white (/s) would ensure they had GDPR-like positive consent from customers that they could pass on those customers info to specific third parties... The idea that companies keep some sort of information wall between their support and marketing departments is pretty ridiculous. MS have to be fully aware of this, surely. So, the story is Canonical taking part in the same crap as the more overtly crap companies, and just this one agent not being clever enough to keep their leads under wraps. GDPR obliges companies to provide information on all this parties PII has been passed to. Given cookie lists (or UBlock blocked files) are hundreds of companies long I'm surprised we're not getting reports of who is buying up all this info.
pc86 6y ago
By waiting for someone to reach out for "implementation and technical support," at which point Canonical already has the data they need to investigate deeper? Not that that's even great, because 99% of the people who spin up a service will never contact Canonical and shouldn't have their info shared.
- tfehring 6y ago
  Yeah, I thought about that possibility, but I'm skeptical because the usefulness of Canonical getting that data directly from Microsoft seems really minimal. Whatever data Microsoft is collecting from its clients (I'd think it's at most metadata about base images, instance types, and maybe number of instances and usage patterns) should be trivial for those clients to provide to Canonical, if needed, if and when they initiate a support contract.
dragonwriter 6y ago
> But they're not allowed to use user data from Microsoft to market those services? How else would that data even be useful for Canonical's "implementation and technical support" services? The data on who was doing what would be useful for providing implementation and technical support to people who has already contracted with Canonical for those services, both for providing the service and, depending on price structure, possibly for billing.
- saghm 6y ago
  > The data on who was doing what would be useful for providing implementation and technical support to people who has already contracted with Canonical for those services So then why should everyone else who doesn't have any contact with Canonical have their data forwarded to them too? This should be opt-in rather then opt-out, let alone always happening with no way to opt out
RobLach 6y ago
"Ubuntu Server on Azure best practices guide.pdf"
elygre 6y ago
“Ouch. Big bug. Let’s contact the users who installed it from the azure marketplace. Good thing we got their names when they installed it!”

rkangel 6y ago

This is the full quote from MS, provided in The Register article: "Customer privacy and trust is our top priority at Microsoft. We do not sell any information to third-party companies and only share customer information with Azure Marketplace publishers when customers deploy their product, as outlined in our Terms and Conditions. Our terms with our publishers allow them to provide customers with implementation and technical support for their products but restricts them from using contact details for marketing purposes." My interpretation is: Every time you buy or use something from the Marketplace, MS will give your contact details to the Marketplace publisher. That publisher is then restricted in what they can do with the information. They may not use it for Marketing, they may use it to provide technical support.

tfehring 6y ago
Yeah, I agree with your interpretation and that makes sense from Microsoft's perspective. Just one open question that that raises: does a name and employer count as "contact details"? Do Microsoft's terms allow Canonical to reach out to someone on LinkedIn for marketing purposes as long as they don't look them up using the email address Microsoft gives them? And if the answer to that last question is no, what can Canonical do with the data that's actually valuable to them? If I were given access to a database of sales leads that I was explicitly disallowed from contacting, I would actively avoid even accessing the data to avoid any accusation or perception that I violated those terms, just in case I independently got in touch with those same leads through a different channel.
- rkangel 6y ago
  So I don't know the answers to your questions - but here's one interesting thing - according to GPDR your email address is personal information as you'd expect. However your work email address is not. Companies can do all sorts of harvesting and collection on professional information that they can't on personal.
  - iamacyborg 6y ago
    This is not strictly true. Sales@example.com would not be considered personal data, bob.smith@company.com would be
- nickflood 6y ago
  If they discover a huge security problem with the distribution you installed, they can contact you and help you upgrade to a non-vulnerable version? This like like what "technical support" is supposed to mean
sorokod 6y ago
How more reasonable it would have been for Microsoft to provide the publishers details to consumers instead of the other way around. Interesting that this is not so.
- lotsofpulp 6y ago
  Microsoft can earn more money this way (selling data for sales purposes), so their behavior meets my expectations.
  - sorokod 6y ago
    Mine too, it is hilarious that they present this gratuitous data sharing as "this is normal/we are the victims as much as you are"
  - deleted 6y ago
    [deleted]
  - moron4hire 6y ago
    But they aren't selling the data
    - sorokod 6y ago
      On the off chance you are not being sarcastic, do you think that Canonical got the data for free?
      - Hawxy 6y ago
        Yes? Its pretty evident that when you publish a marketplace app, the details of those that installed it are automatically stored for use by the vendor. All of the statements above align with this, unless you're insinuating that Microsoft are liars.
pbhjpbhj 6y ago
This sounds like plausible deniability to me. "We sell your details to companies whose products you're using - which would be really useful marketing information; but they say they don't use it for that, so we did what we need to."? Microsoft being lily-white (/s) would ensure they had GDPR-like positive consent from customers that they could pass on those customers info to specific third parties... The idea that companies keep some sort of information wall between their support and marketing departments is pretty ridiculous. MS have to be fully aware of this, surely. So, the story is Canonical taking part in the same crap as the more overtly crap companies, and just this one agent not being clever enough to keep their leads under wraps. GDPR obliges companies to provide information on all this parties PII has been passed to. Given cookie lists (or UBlock blocked files) are hundreds of companies long I'm surprised we're not getting reports of who is buying up all this info.

pc86 6y ago

By waiting for someone to reach out for "implementation and technical support," at which point Canonical already has the data they need to investigate deeper? Not that that's even great, because 99% of the people who spin up a service will never contact Canonical and shouldn't have their info shared.

tfehring 6y ago
Yeah, I thought about that possibility, but I'm skeptical because the usefulness of Canonical getting that data directly from Microsoft seems really minimal. Whatever data Microsoft is collecting from its clients (I'd think it's at most metadata about base images, instance types, and maybe number of instances and usage patterns) should be trivial for those clients to provide to Canonical, if needed, if and when they initiate a support contract.

dragonwriter 6y ago

> But they're not allowed to use user data from Microsoft to market those services? How else would that data even be useful for Canonical's "implementation and technical support" services? The data on who was doing what would be useful for providing implementation and technical support to people who has already contracted with Canonical for those services, both for providing the service and, depending on price structure, possibly for billing.

saghm 6y ago
> The data on who was doing what would be useful for providing implementation and technical support to people who has already contracted with Canonical for those services So then why should everyone else who doesn't have any contact with Canonical have their data forwarded to them too? This should be opt-in rather then opt-out, let alone always happening with no way to opt out

RobLach 6y ago

"Ubuntu Server on Azure best practices guide.pdf"

elygre 6y ago

“Ouch. Big bug. Let’s contact the users who installed it from the azure marketplace. Good thing we got their names when they installed it!”