6 ms·

PowerShell "sends basic telemetry data to Microsoft [...] about the host running PowerShell, and information about how PowerShell is used" [1]. And since it re

by ptx 5y ago

PowerShell "sends basic telemetry data to Microsoft [...] about the host running PowerShell, and information about how PowerShell is used" [1]. And since it relies on .NET, that also requires its own separate opt-out for its telemetry. There might be other components, now or in the future, that also send data to Microsoft by default and would have to be separately discovered and disabled. [1] https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_telemetry?view=powershell-7.2 https://docs.microsoft.com/en-us/powershell/module/microsoft...

brushfoot 5y ago
To me a telemetry opt-out is a small price to pay for what PowerShell brings to the table, but to each their own. > There might be other components, now or in the future, that also send data to Microsoft Of course. Do your due diligence on whatever you install. No tool should be exempt from that.
- mschuster91 5y ago
  > Do your due diligence on whatever you install. No tool should be exempt from that. That's a ridiculous take. 99% of users don't understand what all that technobabble in a typical EULA means, they will just go for the option they are nudged to (which is why first the courts and now enforcement agencies are stepping up their game against that practice [1]). The way that the GDPR expects stuff to be handled is by getting explicit user consent, the consent must be a reasonably free choice (i.e. deals like "give me your personal data and the app is free, otherwise pay" are banned), and there must not be any exchange of GDPR-protected data without that consent unless technically required to perform the service the user demands. Clearly, a telemetry opt-out is completely against the spirit of the GDPR and I seriously hope for Microsoft to get flattened by the courts for the bullshit they have been pulling for way too long now. What I would actually expect of Microsoft is to follow the Apple way: have one single central place, ideally at setup and later in the System Preferences, where tracking, analytics and other optional crap can be disabled system-wide. [1] https://www.hiddemann.de/allgemein/lg-rostock-bejaht-unterlassungsanspruch-bei-nudging-ueber-cookie-banner/ https://www.hiddemann.de/allgemein/lg-rostock-bejaht-unterla...
  - ElectricalUnion 5y ago
    > What I would actually expect of Microsoft is to follow the Apple way: have one single central place, ideally at setup and later in the System Preferences, where tracking, analytics and other optional crap can be disabled system-wide. This is still GDPR non-compliant, you should have a central place to _opt-in_ tracking, analytics and other optional crap if you so desire.
    - mschuster91 5y ago
      So what? You can opt-in to tracking in the macOS System Preferences, pane "security and data protection", tab "Privacy" at any time you wish should you not have done so during the macOS onboarding process. In Debian, you can opt-in at setup time or any later time with a simple "dpkg-reconfigure popularity-contest" (even though that one isn't fully GDPR-compliant as you can't easily read what exactly is being done from the same screen).
      - ElectricalUnion 5y ago
        > So what? You can opt-in to tracking in the macOS System Preferences, pane "security and data protection", tab "Privacy" at any time you wish should you not have done so during the macOS onboarding process. You cannot opt-in. You can go to `System Preferences > Security & Privacy > Analytics & Improvements` and opt-out, but the default is not opt-in.
  - brushfoot 5y ago
    > That's a ridiculous take Then it befits a ridiculous state of affairs. It would be great to have the standards you suggest, and it's a shame that we don't. But that doesn't change the fact that we don't, and because we don't, we need to do due diligence on the tools we install.
  - jodrellblank 5y ago
    The GDPR applies to personal data. PowerShell telemetry isn't personal data, so it's not covered by the GDPR. What is reported is documented here: https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_telemetry?view=powershell-7.2 https://docs.microsoft.com/en-us/powershell/module/microsoft... and is "anonymized information about the host running PowerShell, and information about how PowerShell is used". It sucks that it has telemetry, but anonymised information about whether a computer ran 10 .exe or 10 cmdlets pales into insignificance against Windows and Edge and OneDrive slurping up names, addresses, files, moving logins to Microsoft accounts, sending browser history to Microsoft, checking downloads with Microsoft, keeping a history of all programs run in Windows for timeline and trying to send that to Microsoft to sync it between devices, moving OneNote to the cloud, having the start menu search be a Bing web search, defaulting to Cortana being a cloud based voice search, sending pen and ink data to Microsoft, and etc. etc.
sandyarmstrong 5y ago
> And since it relies on .NET, that also requires its own separate opt-out for its telemetry. Building a program with .NET does NOT cause that program to send telemetry to Microsoft. You're thinking of the .NET SDK itself. Using PowerShell does not trigger any use of the .NET SDK. Disclaimer: I work for Microsoft.
- ptx 5y ago
  Ah, yes, my mistake. Although PowerShell sends its own telemetry, the additional telemetry from the .NET platform is only sent when you use the dotnet command [1] and, as a special case, not when you very carefully invoke it only "in the following format: dotnet [path-to-app].dll" and never e.g. "dotnet help". However, presumably PowerShell requires at least the .NET Runtime if not the .NET SDK, doesn't it? The docs [2] suggest running "dotnet --list-runtimes" to "see which versions of the .NET runtime are currently installed", so it sounds like the Runtime also includes the dotnet command. Does running the recommended "dotnet --list-runtimes" command send telemetry, like most of the commands? Or are you saying that the Runtime, unlike the SDK, doesn't include telemetry at all? [1] https://docs.microsoft.com/en-us/dotnet/core/tools/telemetry https://docs.microsoft.com/en-us/dotnet/core/tools/telemetry [2] https://docs.microsoft.com/en-us/dotnet/core/install/how-to-detect-installed-versions https://docs.microsoft.com/en-us/dotnet/core/install/how-to-...
  - sandyarmstrong 5y ago
    > However, presumably PowerShell requires at least the .NET Runtime if not the .NET SDK, doesn't it? Nope, these days .NET programs (like PowerShell) bundle the runtime. But even if they did a lighter distribution that depended on the runtime already being installed, there would be no .NET telemetry sent. > Does running the recommended "dotnet --list-runtimes" command send telemetry, like most of the commands? This is still an SDK command. I don't personally know if this one sends any telemetry. > Or are you saying that the Runtime, unlike the SDK, doesn't include telemetry at all? The runtime does not send telemetry.
    - ptx 5y ago

by ptx 5y ago

brushfoot 5y ago

To me a telemetry opt-out is a small price to pay for what PowerShell brings to the table, but to each their own. > There might be other components, now or in the future, that also send data to Microsoft Of course. Do your due diligence on whatever you install. No tool should be exempt from that.

mschuster91 5y ago
> Do your due diligence on whatever you install. No tool should be exempt from that. That's a ridiculous take. 99% of users don't understand what all that technobabble in a typical EULA means, they will just go for the option they are nudged to (which is why first the courts and now enforcement agencies are stepping up their game against that practice [1]). The way that the GDPR expects stuff to be handled is by getting explicit user consent, the consent must be a reasonably free choice (i.e. deals like "give me your personal data and the app is free, otherwise pay" are banned), and there must not be any exchange of GDPR-protected data without that consent unless technically required to perform the service the user demands. Clearly, a telemetry opt-out is completely against the spirit of the GDPR and I seriously hope for Microsoft to get flattened by the courts for the bullshit they have been pulling for way too long now. What I would actually expect of Microsoft is to follow the Apple way: have one single central place, ideally at setup and later in the System Preferences, where tracking, analytics and other optional crap can be disabled system-wide. [1] https://www.hiddemann.de/allgemein/lg-rostock-bejaht-unterlassungsanspruch-bei-nudging-ueber-cookie-banner/ https://www.hiddemann.de/allgemein/lg-rostock-bejaht-unterla...
- ElectricalUnion 5y ago
  > What I would actually expect of Microsoft is to follow the Apple way: have one single central place, ideally at setup and later in the System Preferences, where tracking, analytics and other optional crap can be disabled system-wide. This is still GDPR non-compliant, you should have a central place to _opt-in_ tracking, analytics and other optional crap if you so desire.
  - mschuster91 5y ago
    So what? You can opt-in to tracking in the macOS System Preferences, pane "security and data protection", tab "Privacy" at any time you wish should you not have done so during the macOS onboarding process. In Debian, you can opt-in at setup time or any later time with a simple "dpkg-reconfigure popularity-contest" (even though that one isn't fully GDPR-compliant as you can't easily read what exactly is being done from the same screen).
    - ElectricalUnion 5y ago
      > So what? You can opt-in to tracking in the macOS System Preferences, pane "security and data protection", tab "Privacy" at any time you wish should you not have done so during the macOS onboarding process. You cannot opt-in. You can go to `System Preferences > Security & Privacy > Analytics & Improvements` and opt-out, but the default is not opt-in.
- brushfoot 5y ago
  > That's a ridiculous take Then it befits a ridiculous state of affairs. It would be great to have the standards you suggest, and it's a shame that we don't. But that doesn't change the fact that we don't, and because we don't, we need to do due diligence on the tools we install.
- jodrellblank 5y ago
  The GDPR applies to personal data. PowerShell telemetry isn't personal data, so it's not covered by the GDPR. What is reported is documented here: https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_telemetry?view=powershell-7.2 https://docs.microsoft.com/en-us/powershell/module/microsoft... and is "anonymized information about the host running PowerShell, and information about how PowerShell is used". It sucks that it has telemetry, but anonymised information about whether a computer ran 10 .exe or 10 cmdlets pales into insignificance against Windows and Edge and OneDrive slurping up names, addresses, files, moving logins to Microsoft accounts, sending browser history to Microsoft, checking downloads with Microsoft, keeping a history of all programs run in Windows for timeline and trying to send that to Microsoft to sync it between devices, moving OneNote to the cloud, having the start menu search be a Bing web search, defaulting to Cortana being a cloud based voice search, sending pen and ink data to Microsoft, and etc. etc.

sandyarmstrong 5y ago

> And since it relies on .NET, that also requires its own separate opt-out for its telemetry. Building a program with .NET does NOT cause that program to send telemetry to Microsoft. You're thinking of the .NET SDK itself. Using PowerShell does not trigger any use of the .NET SDK. Disclaimer: I work for Microsoft.

ptx 5y ago
Ah, yes, my mistake. Although PowerShell sends its own telemetry, the additional telemetry from the .NET platform is only sent when you use the dotnet command [1] and, as a special case, not when you very carefully invoke it only "in the following format: dotnet [path-to-app].dll" and never e.g. "dotnet help". However, presumably PowerShell requires at least the .NET Runtime if not the .NET SDK, doesn't it? The docs [2] suggest running "dotnet --list-runtimes" to "see which versions of the .NET runtime are currently installed", so it sounds like the Runtime also includes the dotnet command. Does running the recommended "dotnet --list-runtimes" command send telemetry, like most of the commands? Or are you saying that the Runtime, unlike the SDK, doesn't include telemetry at all? [1] https://docs.microsoft.com/en-us/dotnet/core/tools/telemetry https://docs.microsoft.com/en-us/dotnet/core/tools/telemetry [2] https://docs.microsoft.com/en-us/dotnet/core/install/how-to-detect-installed-versions https://docs.microsoft.com/en-us/dotnet/core/install/how-to-...
- sandyarmstrong 5y ago
  > However, presumably PowerShell requires at least the .NET Runtime if not the .NET SDK, doesn't it? Nope, these days .NET programs (like PowerShell) bundle the runtime. But even if they did a lighter distribution that depended on the runtime already being installed, there would be no .NET telemetry sent. > Does running the recommended "dotnet --list-runtimes" command send telemetry, like most of the commands? This is still an SDK command. I don't personally know if this one sends any telemetry. > Or are you saying that the Runtime, unlike the SDK, doesn't include telemetry at all? The runtime does not send telemetry.
  - ptx 5y ago