3 ms·

FYI: these are in-ecosystem ads (so they all come from MS). The messaging is quite similar what they already do with notifications elsewhere in the system ("Edg

FYI: these are in-ecosystem ads (so they all come from MS). The messaging is quite similar what they already do with notifications elsewhere in the system ("Edge is faster than Chrome"). It's still manipulative bullshit, but it's not the gaping security hole that it sounds like it 'ought to be. Even so... this type of behavior is what made me drop Windows over 5 years ago now.

Sohcahtoa82 5y ago
> these are in-ecosystem ads (so they all come from MS). For now. I think it's incredibly naive to believe it would stay that way. Or maybe I'm just cynical. EDIT: Considering the fact that the Start menu displays ads for 3rd party software, nah, I think it's naive to assume the ads in Explorer would always come from MS.
- notamy 5y ago
  Right? Imagine what happens when a program hijacks it to inject malvertising or smth similarly nefarious...
kemotep 5y ago
In the past Microsoft has had issues with subdomain takeovers[0], resulting in spam being distributed by their own domains. Without strict guarantees and control over the way this content is delivered to end user systems, how can we know that a similar type of attack could not happen? This time in a potentially administrative level file explorer? [0]: https://www.zdnet.com/article/microsoft-has-a-subdomain-hijacking-problem/ https://www.zdnet.com/article/microsoft-has-a-subdomain-hija...
- gruez 5y ago
  >Without strict guarantees and control over the way this content is delivered to end user systems, how can we know that a similar type of attack could not happen? This time in a potentially administrative level file explorer? Sounds like you're not really against ads, but any sort of stuff that can change runtime behavior (eg. feature flagging) or retrieves content dynamically.
  - kemotep 5y ago
    I would say that I am not pro-advertisements but I understand things need to be paid for. Software worth using is worth paying for. But I would prefer to pay in currency and not time and attention. Additionally, a paid Operating System pushing additional premium features on increasingly more and more pixels is a little egregious. My file browser should be boring and not contain surprises.
- chaorace 5y ago
  I don't believe it has yet been established if these ads are downloaded on-demand. If the messaging is instead shipped via Windows Update, I don't think that would create any additional attack surfaces.

Sohcahtoa82 5y ago

> these are in-ecosystem ads (so they all come from MS). For now. I think it's incredibly naive to believe it would stay that way. Or maybe I'm just cynical. EDIT: Considering the fact that the Start menu displays ads for 3rd party software, nah, I think it's naive to assume the ads in Explorer would always come from MS.

notamy 5y ago
Right? Imagine what happens when a program hijacks it to inject malvertising or smth similarly nefarious...

kemotep 5y ago

In the past Microsoft has had issues with subdomain takeovers[0], resulting in spam being distributed by their own domains. Without strict guarantees and control over the way this content is delivered to end user systems, how can we know that a similar type of attack could not happen? This time in a potentially administrative level file explorer? [0]: https://www.zdnet.com/article/microsoft-has-a-subdomain-hijacking-problem/ https://www.zdnet.com/article/microsoft-has-a-subdomain-hija...

gruez 5y ago
>Without strict guarantees and control over the way this content is delivered to end user systems, how can we know that a similar type of attack could not happen? This time in a potentially administrative level file explorer? Sounds like you're not really against ads, but any sort of stuff that can change runtime behavior (eg. feature flagging) or retrieves content dynamically.
- kemotep 5y ago
  I would say that I am not pro-advertisements but I understand things need to be paid for. Software worth using is worth paying for. But I would prefer to pay in currency and not time and attention. Additionally, a paid Operating System pushing additional premium features on increasingly more and more pixels is a little egregious. My file browser should be boring and not contain surprises.
chaorace 5y ago
I don't believe it has yet been established if these ads are downloaded on-demand. If the messaging is instead shipped via Windows Update, I don't think that would create any additional attack surfaces.