17 ms·

Microsoft is phoning home the content of PowerPoint slides

734 points by memorable 4y ago

changoplatanero 4y ago
I always assumed they built these features by scraping publicly available powerpoint presentations using their index from Bing.
deafpolygon 4y ago
You did consent to it, in the fine print. Unfortunately.
- tgsovlerkhgsel 4y ago
  Which is why GDPR has the concept of "informed consent", which is a fancy way of saying "consent hidden in the fine print doesn't count".
  - deafpolygon 4y ago
    When installing office, you are told in the fine print to go read: https://privacy.microsoft.com/en-us/privacystatement https://privacy.microsoft.com/en-us/privacystatement ... it counts. The verbiage in there is quite disturbing.
    - reitanqild 4y ago
      It doesn't count anywhere that is protected by GDPR.
      - hulitu 4y ago
        > protected by GDPR This is like the firewall in windows 95: nice but useless.
        real_dogbert 4y ago
        I wish I could disagree with you. GDPR technically does have real teeth, to the extent that one really shouldn't want to raise the ire of an EU Data Protection Authority. Unfortunately, enforcement to date, and the resulting fines, have been lackluster at best. When will people learn that disincentives like fines and such have to actually hurt to be effective in changing the behavior of corporations?
        reitanqild 4y ago
        Many companies have gotten their first fines already. Hundreds of millions of shareholder value down the drain because they blatantly ignored the rules. No, most companies don't get a massive fine in the first round, but I already see enough have gotten then that even Google now allows me to opt out with a single click :-}
  - nonrandomstring 4y ago
    And that the user may not have capacity to consent. That seems the salient issue today with regards to children and social media. Most of the giant social media companies profit from participants who cannot legally enrol.
    - real_dogbert 4y ago
      By "participants who cannot legally enrol," do you mean minors? I'm not tracking what the Venn diagram between those people and those who "may not have the capacity to consent" is.
      - nonrandomstring 4y ago
        EDIT: I was talking about kids. But Dogbert's comment actually deserves a bit more than "try using common sense instead of set theory" :) I tried thinking of classes of adults who lack capacity, other than the mentally unfit, senile or criminally insane. There's a lot of young people who are "deemed to consent" (the passive weasel-words of filthy scoundrels) in higher education. I've written about Turnitin in the Times and the "very dodgy circumstances" in which students are inducted into university and then find themselves coerced into tacit agreement to use tools which massively violate their privacy and other rights. The same applies to Microsoft products where institutions block choice and force students use insecure products that they would refuse if exercising their better judgement.
  - msla 4y ago
    How willing would a government be to prosecute a company its IT infrastructure relies on? Even if you think Microsoft doesn't have kill switches, it still isn't obligated to do business with them.
- mynameisvlad 4y ago
  Not even. It’s an explicit feature that must be separately enabled, and requires Microsoft 365. > The first time you try out Designer, it may ask your permission to get design ideas for you. If you want to use Designer, select Turn on. https://support.microsoft.com/en-us/topic/53c77d7b-dc40-45c2-b684-81415eac0617 https://support.microsoft.com/en-us/topic/53c77d7b-dc40-45c2...
  - CharlesW 4y ago
    Plus there are policies which allow admins to block PowerPoint Designer, as well as all Office 365 "Intelligent Services" (or "Intelligence Services", depending on your POV).
  - deafpolygon 4y ago
    It will ask you to turn on "Connected Experiences".
  - Semaphor 4y ago
    > it may ask your permission I wonder when that is? Because I haven’t used PP yet, and it didn’t ask me. Of course, we use Office 365, and maybe my boss turned it on globally? Does anyone know where the setting is?
    - mynameisvlad 4y ago
      Have you used the Designer feature? That’s what’s being talked about. It should prompt you when you first use it. If you’re on a work account, your admin may have enabled or disabled it already with GPO/MDM.
      - Semaphor 4y ago
        > Have you used the Designer feature? Yes. > If you’re on a work account, your admin may have enabled or disabled it already with GPO/MDM. It has to be a global Office 365 setting, my computer is not in the domain, I’m the only admin for it. That’s why I’m asking where the setting for the permission is, so I can have a look at it (I’m secondary admin for the O365 account) and potentially disable it.
- nmeagent 4y ago
  If I have one hope for the future, it's that 'accepting' click-through corporate EULAs containing unconscionable terms that few read will no longer be considered consent.
cm42 4y ago
"Informed Consent is just a theory. Besides [other app] already spies on you so who cares? Whaddareya doing in PowerPoint that's so sekret?"
- Izmaki 4y ago
  "I have nothing to hide so why should I care?" is the worst, misinformed argument in the history of mankind.
- mtgx 4y ago
  I know it's sarcasm, but you don't have to have "big secrets" in order to want privacy. Everyone knows what you're doing in the restroom, doesn't mean you're ok to going to a see-through public restroom.
- Ninn 4y ago
  In our companies slides we have tons of confidential slides containing info that could be misused for insider trading by MS engineers?
  - lotsofpulp 4y ago
    It would not be insider trading if done by people outside your company. Edit: Nvm, I think I am wrong. https://www.investopedia.com/articles/investing/092616/how-insider-trading-prevented-corporations.asp https://www.investopedia.com/articles/investing/092616/how-i... >Another way that insider trading can occur is if non-company employees—such as those from government regulators or accounting firms, law firms, or brokerages—gain material nonpublic information from their clients and use that information for their personal gain.
    - deafpolygon 4y ago
      "Our AI is technically not an employee."
- NayamAmarshe 4y ago
  To that, I always reply with "I have nothing to hide but much to give".
beckingz 4y ago
I look forward to the day when PowerPoint is banned due to enterprise security concerns.
- bnt 4y ago
  How about Grammarly? Or G-suite? They have access to most of the companies out there. I find it terrifying people use Grammarly and it has access to every piece of confidential word written.
  - ttrrooppeerr 4y ago
    Grammarly and Hola VPN are the two browser extensions that any IT Admin should be ban straight away in corporate machines.
    - formerly_proven 4y ago
      You guys allow users to install browser extensions?
  - Someone1234 4y ago
    Grammarly should absolutely be banned. Their privacy policy is horrible. I'd suggest companies look into LanguageTool's "On-Premise" commercial offering or run the Java-based server themselves (with N-Grams). Is it as good as Grammarly? Nope, but it is "90%" as good and significantly more private.
  - real_dogbert 4y ago
    G-Suite is a super interesting case in that you literally cannot use the product without handing over your data to Google. It certainly seems like companies would hate that, particularly those with data protection obligations. Google does theoretically require a Business Associate Agreement (BAA) if your use case is subject to HIPAA and you intend to store or transmit PHI using their services, but I don't know how they detect or enforce that. [1] --- [1]: https://support.google.com/a/answer/3407054?hl=en https://support.google.com/a/answer/3407054?hl=en
dhruvdh 4y ago
PowerPoint has a feature where it uses machine learning to suggest layout and design changes for your content. This feature most likely can be turned off, but of course it needs some data on what's on your slide to suggest changes. I hope this submission is flagged and removed. Just because you don't like Microsoft doesn't mean such misrepresentation is okay.
- pjc50 4y ago
  So you agree that Microsoft sends the content of your Powerpoint slides (and, by extension, all DoD powerpoint slides, since they're notorious users of the application) to Microsoft?
  - dislikedtom2 4y ago
    It's implied that he does not agree since he claims that the claim is misrepresentation.
  - horsawlarway 4y ago
    > and, by extension, all DoD powerpoint slides, since they're notorious users of the application This is a pretty huge exaggeration here. Closed rooms exists and are used when appropriate. And just because something is enabled in the consumer version by default does not imply it's enabled and available in enterprise settings. Last time I dug through the office GPO templates - basically every phone home feature was easily disabled on an org level if desired. Further - what do you think something like Google Slides is doing with your data? It's ALL stored on Google's servers by default.
- NikolaNovak 4y ago
  Right; when I saw title I assumed Designer was going to be the context. I've also observed that Designer only works when I'm online, so I figured out that it uses external servers to generate suggestions. I suppose it could/should be more obvious/explicit on the Designer pane itself, something like "This is an online feature that uses Microsoft's servers to generate recommendations", or a more user-friendly language. Note however that the article is light on details; does it send a full content of slides? Some hash of text and images? A non-identifiable abstraction of layers involved? This could be done well or poorly. (I don't think the submission should be flagged FWIW, but I agree that it's not of good enough quality to deserve great ranking; but that's of course subjective:)
ttrrooppeerr 4y ago
> Did we consent to this? I did. I guess the author didn't read the T&Cs.
- soganess 4y ago
  Chief Justice(of the United States) John Roberts suggested that he doesn't read them. Trying to call people out for not doing so or not understanding the technological reason why data is sent doesn't seem productive.
sheerun 4y ago
The next era will be of Offline Apps because of stuff like this
- NayamAmarshe 4y ago
  FOSS and offline-first is the future.
  - cassianoleal 4y ago
    2023 is the year of Linux on the desktop?
    - trelane 4y ago
      It was quite some time ago. You didn't get the memo?
      - yjftsjthsd-h 4y ago
        "The future is already here – it's just not evenly distributed."
    - snapcaster 4y ago
      Yes, along with Beowulf clusters to run our infrastructure
    - bodge5000 4y ago
      Joking aside I think we are getting close, Photon did a lot to bridge with Windows in terms of gaming, GUI is often times at least on par with Windows/MacOS, if not better (obviously thats subjective), and reliability/performance has already been there for a while. That being said, I still think theres more work to do, and arguably the hardest work is ahead.
      - _chu1 4y ago
        Linux is on par with Windows kind of but not really. It's a little ghetto For example, desktop environments are just wonky and buggy most the time, random games don't work, WINE is the worst piece of software on the planet, drivers suck, other random weird issues.
Someone1234 4y ago
This is a one paragraph claim that doesn't provide resources to show that their claim has basis. It could very well be entirely accurate, but there's no information contained here to know one way or the other. For example there have been numerous claims made previously that link ANY network traffic to a supposed invasion of privacy, but once you delve into the underlying traffic it isn't nearly as nefarious as it initially seemed. This article is telling you to "open up the network monitor of your choice" but network traffic and CONTENT are apples Vs. oranges, and yet we're meant to draw conclusions from that? We're meant to know Microsoft are taking your slide's content whole-hog? Isn't that yet to be determined?
- sammy2255 4y ago
  I was expecting at LEAST some screenshots lol
  - throwaw20221107 4y ago
    Yes. OP's post doesn't present any evidence that those packets being sent actually contain your personal data. Show us some data from an actual packet or GTFO. That being said, I don't doubt that they do :)
- jeroenhd 4y ago
  Powerpoint indicates that message content is being used for design proposals in the consent prompt. The Microsoft website says it "analyses your data": https://learn.microsoft.com/en-us/deployoffice/privacy/connected-experiences https://learn.microsoft.com/en-us/deployoffice/privacy/conne...
- nosmokewhereiam 4y ago
  Can Wireshark render this in PCAP? Would it just be encoded and Wireshark could decode it out of the box?
RajT88 4y ago
This doesn't bother me too much (but it would if I worked at a different company - I'd have concerns over company secrets). It's the browsing history which is by default sent to GOOG/MSFT which bugs me. On by default, and I'd swear I've seen it get reset on Chrome. Chrome: Settings > Sync and Google Services > Make searches and browsing better Edge: Settings > Privacy, Search and services > Personalize your web experience
semi-extrinsic 4y ago
I've raised this point repeatedly in different orgs. It's met with some combination of indifference and lack of understanding and not-my-responsibility-ism, but I'm sure that this will eventually blow up hard in some company's face - like 9-digit settlement for breach of contract, or worse things like breach of export control laws. Enterprise data security on the "MS Office level" at this point is like driving 60 mph on a road with no lane dividers. You just pray that you never meet a drunk driver or someone texting in oncoming traffic who suddenly swerves into your lane. You pray that none of your employees click the wrong button and bankrupt the company.
- real_dogbert 4y ago
  Yeah, I'm surprised every healthcare related business doesn't either ban PowerPoint or block this "feature" somehow. HIPAA is a hell of a drug.
  - colechristensen 4y ago
    HIPAA is tame compared to export control and classified information handling. Single occurrences can get you 7 or 8 digit fines and prison sentences.
  - reaperducer 4y ago
    I'm surprised every healthcare related business doesn't either ban PowerPoint or block this "feature" somehow. I work in healthcare, and the legal department bars me from using Google Analytics for HIPAA reasons. Meanwhile, IT made Chrome the only browser the employees are allowed to use on every Windows machine in the org.
    - happythebob 4y ago
      Did you read the article? I find your jaded sense of cynicism to be different than critical thought. I don't see any proof in the article posted about its claims. It's just very easy to get jaded, cynical people to support the right headlines on social media. Hacker News, be better.
bitwize 4y ago
Microsoft Office is, in general, straight up spyware now. It reports usage statistics back to your boss. Marietta can now see exactly how long YT's mom took to read that toilet paper memo, and make disciplinary decisions accordingly.
someweirdperson 4y ago
With all data stored on a sharepoint or onedrive, and powerpoint running in a browser... where's the news?
Waterluvian 4y ago
Obtaining user data should be a horrifying prospect for companies. They should obsessively work for alternative ways to not need it for their goals. And when they need it, to be ridiculously careful about it. (you could substitute "user data" for "application state" here) But it's not because there aren't sufficient consequences. Memory leaks don't properly crash the company as they should.
- danuker 4y ago
  > Memory leaks I suspect you mean data leaks, in the context of your comment. But memory leaks should be a thing of the past also - they hint at the quality of the underlying code.
- Nevermark 4y ago
  > Memory leaks don't properly crash the company as they should. Typically, companies just worry about about liability leaks. Which they take seriously enough to dedicate a lot of lawyer time to plugging redundantly with innocuously vague disclosure wording, terms of service wording, difficult to find and inconvenient to use opt-out tools, etc.
Mo3 4y ago
I wonder what the NSA or any other of these three-letter agencies think about that, I can remember much of the leaked information consisting of Powerpoint slides.
- newsclues 4y ago
  They probably have access to the data feed.
- yjftsjthsd-h 4y ago
  It sounds (from other comments in this thread) like there's an org-level way to disable it, so they probably just use that to force it off.
- deleted 4y ago
  [deleted]
SanjayMehta 4y ago
I don't even allow browser search suggestions; this is beyond the pale.
deleted 4y ago
[deleted]
NotYourLawyer 4y ago
Why doesn’t this article include the packet capture or whatever data he has that shows exactly what’s being sent?
- Arnavion 4y ago
  Because that would be more effort than posting clickbait.
- Beltalowda 4y ago
  One possible reason is that the actual data that's being sent is a lot less nefarious than is being implied. I've seen people vehemently argue that merely checking if a new version is available amounts to horrible invasive unethical tracking. You might want to turn that off for the truly paranoid situations, and that's fair, but it's of course completely different than "sends all your data". I don't have a Windows machine and I certainly don't have PowerPoint, so I can't actually check anything myself. But I see a lot of confirmation biasing going on in this thread, and I bet most people didn't check anything either. All I can give this article is a shrug.
  - mixmastamyk 4y ago
    Many folks are aware MS has been all-in on telemetry for perhaps a decade now. They pioneered activation two decades ago. Explicitly in the TOS. Producing more evidence is left as an exercise at this point. Edit: no more posts allowed for me. Reply below: That’s exactly what telemetry is, today. Grammarly built a whole business on this. Copilot, etc. Refusing to believe that times have changed because you’ve not been paying attention, is not a compelling argument.
    - Beltalowda 4y ago
      "Telemetry" is not "sending the contents of your documents" (or at least, not necessarily so). This comment kind of demonstrates my point about the complete lack of nuance in these conversations. And to reply to your reply: > That’s exactly what telemetry is The common understanding of telemetry is sending metadata about how people are using software. That is, things like "this button was clicked", "this feature was used", etc. That is my understanding of the word anyway. Either way, this is a bit of a boring semantic discussion; my point is just that there is nuance to these things, and that this article doesn't really tell us anything concrete beyond "the network is used". Well, okay ... but for what, exactly? Because that does matter.
user3939382 4y ago
What I want is Little Snitch on steroids built into the OS where every process, including all native ones, including UI apps, are blocked from network connectivity by default, and the user gets an easy monitor of outgoing traffic with TLS/SSL inspection built in (you'd need some OS API to enable that). Kind of like granular oauth permissions, apps should have to declare which outgoing they have, a description/why, and allow inspection of the actual traffic. What Adobe CC, Google Chrome, MS Office, and macOS/Windows itself do with this background network connectivity is completely out of control and abusive to the user. They get away with it because the vast majority of users are non-technical and don't realize it's happening. I've profiled and decrypted the background traffic on a stock Android install and the volume was also appalling. Getting macOS to 0 background traffic involved blackholing large Apple IP blocks at the router, whereas some of their processes use random IPs from these ranges and don't use DNS. Just as the general public doesn't have the awareness or ability to fight for their privacy rights I doubt any of this will ever be remedied.
- Kim_Bruning 4y ago
  We could go to our EU representatives and ask for them to make it mandatory. Though I suspect it'll go down the same way as the GDPR, at least at first. (Lessons have already been learned of course)
  - account42 4y ago
    We really just need a clarification/ruling that ANY telemetry is not essential to providing a service and thus requires informed consent before it can be collected and consent cannote be required to use the service. And then enforcement against all these applications. I don't think adding technical layers to block these data leaks is going to work long term.
- 3pt14159 4y ago
  > with TLS/SSL inspection built in (you'd need some OS API to enable that). I'm not sure of that. Provided you can add a cert to your OS, you should be able to get away with a piece of protocol downgrade network gear that you can then pipe to a different (ideally, offline other than UDP receive) computer for analysis. You'd need to disable HSTS, but other than that I think it should be the solution you're looking for. Oh, and for good measure, ethernet cable instead of wifi.
teekert 4y ago
I guess since we all use MS mostly for business purposes we don't care so much about privacy. It's something our managers sign off on, in the name of security, features and really nice value for money. But oh boy, do they know a lot about us and our businesses. I mean, my office apps have "LinkedIn services" on by default [0], so they are linking all the things to all the things. [0]: https://support.microsoft.com/en-us/office/linkedin-in-microsoft-apps-and-services-6d7c5b09-d525-424a-9c18-8081ee7a67e8 https://support.microsoft.com/en-us/office/linkedin-in-micro...
roody15 4y ago
The future of personal computing is really dark these days. I just attended an apple event for education and government. The amount of data tracking and the standardization/normalization of this behavior is dystopian. What happened to computers being just fun and a source of exploration and freedom? Microsoft, Gooogle, Apple all constantly push their cloud based accounts … where everything is tracked.
- eastbound 4y ago
  On the other hand, Atlassian’s stock lost 66% of its value, and it could be because investors notice that converting people to the Cloud is not currently working. Atlassian should have better bet on their Server solutions, but they really really wanted to be a cloud operator. “For strategic reasons.” Maybe for governmental reasons, who knows.
  - jsty 4y ago
    > it could be because investors notice that converting people to the Cloud is not currently working Given the barn storming financial performance of other cloud operators and Atlassian's impressive record in (un)reliability, I think investors are quite aware that converting people to the cloud is going swimmingly most places that aren't Atlassian.
  - Mountain_Skies 4y ago
    It's a contentious issue in AppSec where most vendors want you to upload source code to their cloud for anything other than the most basic of scans. There are SLAs for how long the vendors can retain the source code they scan, but many clients are not aware of how much of these scans are performed manually behind the scenes by humans and how few of the vendors have their compliance audited. The possibility of a vendor failing to properly secure your source code is risky enough on its own, but it being accompanied by detailed reports of the security vulnerabilities in the code should cause some hair to stand on end.
    - q-big 4y ago
      > It's a contentious issue in AppSec where most vendors want you to upload source code to their cloud for anything other than the most basic of scans. Write the source code in some Assembler language (or even binary code ;-) ). Or use some obscure programming language that the vendor cannot scan, thus having a reason not to upload it.
TheRealDunkirk 4y ago
Is there any way to tell if your company has opted in? Mine makes a huge show of classifying Office documents and barking about the policies of what can be shown to outside people. It would be hilarious to find out that they've done this, and are letting Microsoft slurp up all the stuff that would get us fired if we sent it to an outside email address.
- g_p 4y ago
  I believe this is covered by the "Optional Connected Experiences" option. On Mac, this is accessible via the App's main menu > Preferences > Privacy. Looks like these instrucitons should help you check: https://learn.microsoft.com/en-us/deployoffice/privacy/optional-connected-experiences https://learn.microsoft.com/en-us/deployoffice/privacy/optio...
- pavon 4y ago
  When I click "Design Ideas" (rightmost icon in Home ribbon), I get a prompt that says "This experience is unavailable. Your organization's admin has turned off the service required to use this experience." This is despite both the Privacy -> "Turn on Optional connected experiences" and "Automatically show me design ideas" options being modifiable by me (and give the same results whether enabled or not), so I guess the Group Policy options are more fine grained.
  - TheRealDunkirk 4y ago
    In options (under General), I see there's a tick box for the feature, and it is checked. I have a button that says "Designer," and it seems to work. Nice! Next time someone in IT tells me something as moronic as "all web application authentication code must be written in C," or that "SAML authentication happens by adding a key to the HTTP header," -- both of which have actually happened -- I'll have a nice redirection to share.
danuker 4y ago
LibreOffice FTW. https://libreoffice.org/ https://libreoffice.org/ It may be glitchy in some areas, but I've been using it since graduating high school, and I can do whatever I want with it.
- acomjean 4y ago
  If you deal with csv (or their tab separated cousins..) libre office sheets (spreadsheet) is really great. I'm on linux desktop now and this lets me read and write MS office files and works quite well.
  - danuker 4y ago
    TSV is my favorite also. Quote all you want, no need to unescape in whatever program you interop with.
- deleted 4y ago
  [deleted]
- squarefoot 4y ago
  This. I've installed Linux+LO for years to a lot of people (also a couple times when it was in the earlier StarOffice incarnation, can't recall if under Windows or OS/2, certainly not Linux), being extremely clear on one thing: "this is not Microsoft Office, it's not as powerful as Microsoft Office and you may find some incompatibilities here and there (that was true especially during the old times), but the features 99% of users need are all here. Keep it for a while, and if it doesn't work for you, I'll install your Microsoft Office back for free and you lose nothing". It was a success almost everywhere, but it's extremely important for "normal" users to be comfortable with the different tool; remember that we value privacy, Open Source, etc. they don't. If something that they don't perceive as important requires a change in their workflow, they'll refuse that, so I don't even talk them about different file formats and just set it up to read/write in MS Office formats from scratch.
  - q-big 4y ago
    > but the features 99% of users need are all here. I cannot believe this, in particular for the comparison Excel vs. LibreOfice Calc: the latter is used insanely actively in the finance and insurance industries, thus any proper user sampling should bias towards these industries. On the other hand: users in these industries know Excel really well and use very advanced features of it.
deleted 4y ago
[deleted]
didip 4y ago
Can you imagine, receiving all powerpoint content from your competitors (the rest of FAANG) in real time?
- kolbe 4y ago
  I can't imagine powerpoint is a useful application to any org that hires mildly talented designers
  - thfuran 4y ago
    Big presentations at conferences may involve designers but there are surely many internal meetings at many levels that have a lot of PowerPoint and no designers.
jklinger410 4y ago
"We use MS products for our business because it provides enterprise level security"
- reaperducer 4y ago
  About ten years ago, I worked at a company where we were prohibited from using any Microsoft products at all — in the name of security. When I tell Windows-centric tech people that these days, they can't wrap their brains around it. There is no institutional memory of Microsoft's dumpster fire days.
msla 4y ago
And governments think Microsoft doesn't spy on them, that it's impossible to hide communications.
underscore_ku 4y ago
use Linux... it's free and doesn't spy on you
kolbe 4y ago
If I were ever in a position to tell investment banks what to do, I would demand every pitch of theirs happen in a jupyter notebook.
deleted 4y ago
[deleted]
bastardoperator 4y ago
Meanwhile half the slide decks I see are built on Google. You can't even get to the slides without phoning home.
klyrs 4y ago
Well that's cool, it's just like Copilot but for confidential and proprietary information! I wonder if I can get a sneak peek into my competitor's quarterly reports using this suggestion feature...
MasterYoda 4y ago
I use "simplewall" [1], a firewall to windows. What I like about it is you get a popup window every time a new program want to send data out, then you could block or accept it or temporary accept it. It's crazy how many programs that wants to talk to the internet constantly. [1] https://www.henrypp.org/product/simplewall https://www.henrypp.org/product/simplewall
DerekBickerton 4y ago
On Windows there is Glasswire[0] for blocking applications that phone home. Just find the offending process and block it. It's not a perfect solution though as Windows 10/11 has hundreds of things that phone home and blocking them has unintended side effects (things crash randomly if they can't talk to the Internet). [0] https://www.glasswire.com/ https://www.glasswire.com/
heikkilevanto 4y ago
So, what is the best way to game the system? Make many offensive Power Point presentations or silly layouts and hope the system starts to recommend them to others?
Terretta 4y ago
> Did we consent to this? Yes, explicitly, and not in 60 pages of legalese, in a dialog box.
dustedcodes 4y ago
Microsoft and Google have OneDrive and Google Drive where most slide decks are stored anyway so in some ways this is barely newsworthy, on the other hand I guess if someone purposefully selected Office instead of Google slides for their presentations and thought using an offline app which doesn't save the files to their OneDrive would keep them secret might get surprised by this feature.
- moffkalast 4y ago
  Well with Google Slides you know they'll be storing your data quite obviously right off the bat. The problem isn't so much the storing as the lying.
shmerl 4y ago
LibreOffice is an option.
adamsmith143 4y ago
This seems kind of shocking, is MS really hoarding the trade secrets of like every Fortune 500 company on their servers?
squokko 4y ago
Oh, the humanity! When you CLICK THE SLIDE DESIGNER button it sends your slides to a Slide Designer service? What hath God wrought?
dagmx 4y ago
This post is dubious at best. It makes a “do your own research claim” without sharing anything concrete. Yet, this plays into people’s own confirmation biases so it’s already being taken verbatim by people here.
- mixmastamyk 4y ago
  https://news.ycombinator.com/item?id=31727293 https://news.ycombinator.com/item?id=31727293
  - Springtime 4y ago
    I'd too be interested in further analysis (eg: ruling out false alarms, such as some update check) so that I can say to others with more certainty that something is of potential concern, rather than it being shot down later if someone does a more rigorous analysis. Just because one could say a company has done controversial things before doesn't mean there's no benefit in verifying claims.
    - mixmastamyk 4y ago
      It’s in their TOS and stated as a feature. https://news.ycombinator.com/item?id=33509159 https://news.ycombinator.com/item?id=33509159 There’s an expression, paraphrased as “when someone tells you who they are, believe them.”
      - Springtime 4y ago
        I mean, it's fine if one is personally satisfied with not explicitly having evidence of the specific alleged data collection here, but speaking from experience when the time comes and people inevitably prod further for sources and only hand-wavy arguments can be produced I've found it's not the strongest/most compelling result for motivating a potential change of behavior. Anyone here could believe this is occurring and it wouldn't likely surprise them but actually knowing concretely can have the effect of changing things. Consider the difference between people assuming various things about the NSA pre-Snowden vs post leaks and how it affected change (or at the least a better basis for it).
jeroenhd 4y ago
Like I said last time: > Did we consent to this? Yes, unless Microsoft doesn't ask for consent in whatever country the author is from. There's a consent popup that you need to click through that informs you that the content of your slides are shared with Microsoft. This is part of "intelligent services" in case you're looking for the details. The author should be able to turn this feature off easily, but yes, they did consent to this. They just might have done so months ago and forgotten about it. Find out more about the "intelligent services" that also send the contents of your document to the cloud if you click on their respective buttons here: https://learn.microsoft.com/en-us/deployoffice/privacy/connected-experiences https://learn.microsoft.com/en-us/deployoffice/privacy/conne...
- layer8 4y ago
  At least in some countries, it legally may not constitute actual consent if the text is so unintelligible to a normal user that they don’t understand what exactly they’re consenting to. And we all know that most users just click “Agree” without understanding what exactly they’re agreeing to because that’s the only way they can get their work done.
  - jeroenhd 4y ago
    "To provide these services, Microsoft needs to be able to collect your search terms and document content" seems pretty explicit to me. This is what the Office settings say underneath the checkbox Another prompt ends in "Office will use your searches and document content to support and improve the Intelligent Services to you." The individual popups seem to follow a simple "what is it, what are some examples of it, what are you consenting to" structure. Any less details and you have no idea what you're agreeing to, any more details and you'll quickly lose people in the "EULA too long" problem. I disagree that agreeing is the only way people will get their work done. There are many ways to translate text and the "let me design a PowerPoint for you" feature is nothing more than a nice to have. There are plenty of offline themes to choose from and individual themes to download without ever enabling this setting.
- simiones 4y ago
  The text on that page is extraordinarily misleading, if indeed "Connected experiences" are sending your data to MS servers. Nothing on the page is explicit about the apps sending your data to MS, the only hint that this is happening is the footnote that these "Connected experiences" do not work if you are not connected to the Internet. For example, here is the description of the first type of such experiences: > Connected experiences that analyze your content > Connected experiences that analyze your content are experiences that use your Office content to provide you with design recommendations, editing suggestions, data insights, and similar features. For example, PowerPoint Designer or Translator. > The following table provides a list of connected experiences that analyze your content and also provides links to more information about them. They are going to quite long lengths to avoid mentioning where the data is analyzed.
treesknees 4y ago
I can't say whether the blog is correct or not, as I haven't seen the actual network traffic, but there are privacy controls that the author probably hasn't configured [1]. If it was configured correctly, Designer wouldn't even be available. So it's not as though every user of PowerPoint will have their data collected by Microsoft. [1] https://learn.microsoft.com/en-us/deployoffice/privacy/manage-privacy-controls https://learn.microsoft.com/en-us/deployoffice/privacy/manag...
- layer8 4y ago
  Still, Designer should display a notice that this is happening on first use (and until the user checks “Don’t show this anymore”, and maybe auto-turn that on again once a year), because a normal user doesn’t necessarily realize that this is happening. You shouldn’t have to be an IT/Office expert to have your privacy being respected.
  - jyrkesh 4y ago
    This is literally what it does today: the first time you use Designer or some other "intelligence" feature you get prompted to confirm that you're okay sending your data to Microsoft to use the feature, with a link to privacy policy and everything.
mrtweetyhack 4y ago
matternot 4y ago
How it was determined that it phones back the content of the slide ? From my understanding it's just exchanging some network packets.
matternot 4y ago
how was it determined that it is phoning home the content of the slides? One thing is to exchange network packets with a remote server, and another thing is to claim that it's leaking slide content.
twstdzppr 4y ago
Y'all sound a little too paranoid. Chill
HardwareLust 4y ago
Yes, you consented to this when you clicked through the TOS without reading it.
taubek 4y ago
I don't have PowerPoint on my computer so I don't know if it works without Internet connection. Can someone tell me what happens if there is no network access?
- system2 4y ago
  This post is speculation at best. Likely written by a teenager learning about windows and task manager features recently.
2b3a51 4y ago
Just wondering along the lines of 'perhaps a cigar really is a cigar'. What would Microsoft be doing with the text of every PowerPoint presentation once they have analysed the style/font/content information? Must be thousands of slides per hour 24/7 for years. How long is this information kept?
pradn 4y ago
There's a pervasive lack of precision in privacy discussions. There's a difference between a network request that does some computation on the server side, one that does the same but may log errors and increment counters, and one that actually stores the data temporarily or for a long time. And in the last case, there's a difference between the data being nigh-impossible for internal employees to access (perhaps only used as input for other automated systems), and data with few controls. What about the ability of the user to invoke a delete for all their data on the server side? There's so many dimensions. This is not a useless feature. I can imagine it might help someone make a better presentation. We have to weigh the potential privacy implications against that. And asking the user to consent for every little thing isn't the solution either. It's so annoying to be pin-pricked by dialogs. At work, this sorta thing should be decided at the organization level, by setting appropriate fine-grained org policies for Office.
- smolder 4y ago
  > This is not a useless feature. Yes, it helps Microsoft, and it helps The Powers That Be advance their goal of total information awareness to maximize their security and power and be unaccountable. As a bonus, the harm it does to users is hard to see and hard to reason about, so the genuine proponents and their useful-idiot accomplices throughout the tech (and political) world have been very weakly opposed in advancing the pervasive surveillance agenda.
- AnonymousPlanet 4y ago
  Do you make the same differentiation when it comes to what Chinese companies may collect from the computers of American companies? Especially this part: > there's a difference between the data being nigh-impossible for internal employees to access (perhaps only used as input for other automated systems), and data with few controls.
  - vachina 4y ago
    This bias is very apparent in most of western media. A Chinese software vendor could do as much as sending your keystrokes for autocomplete you bet it will be front page news on Reddit and here with every comment reminding me about Xinjiang and 1989. But Microsoft could upload the entirety of your hard drive and we would find apologists like OP rationalizing away the behavior. I’m not convinced either governments are not in kahoots with private companies.
NicoleJO 4y ago
Microsft windows store does the same thing, but worse. Check out the developer panel to see for yourself. Windows store downloads are accompanied by mouse trackers, keyloggers, and more.
Mikeb85 4y ago
Lol of course they are. Never change MS.
dougmwne 4y ago
This seems blindingly obvious? They use a cloud powered feature, then complain that information is sent to the cloud? According to this help article using designer for the first time will request permissions. https://support.microsoft.com/en-us/office/create-professional-slide-layouts-with-designer-53c77d7b-dc40-45c2-b684-81415eac0617 https://support.microsoft.com/en-us/office/create-profession...
- jsmith99 4y ago
  Yes, this is click bait. There is a message you have to approve to turn on 'connected experiences'.
- retox 4y ago
  From the 'article' >Fire up PowerPoint. Turn off all the cloud options.
  - dougmwne 4y ago
    No, this is specifically a cloud feature and you are warned and asked for permissions when you access it for the first time.
- JeremyNT 4y ago
  The blog post CLAIMS to not be using that feature, so charitably they could be talking about something different. Who knows though? They provide so little information and I have no particular reason to trust them without some kind of evidence. I'm flagging this article since all we can do is speculate.
ZebusJesus 4y ago
NextDNS for the win, great filter lists for Microsoft and apple.
ZebusJesus 4y ago
This is one reason i use NextDNS, they have a list of Microsoft and apple servers ready to be blocked with a simple toggle.
system2 4y ago
Dear Lazy OP, Please use wireshark or something else to explain what those packages are. It might be downloading design features or some other data it requires. 100 word article really doesn't do it for me.
ramon 4y ago
That is the price of AI, if you want you can move to an Amish town and give up on internet.
CarbonCycles 4y ago
This is a fascinating multi-faceted problem...there is the outright concern of how much of the data is being exposed, but there is also a much more subtle action at play. It appears that MS is using our data to continuously train their large DL networks to provide these recommendations...so what is to prevent a bad actor from cunningly constructing an asset that may trick the recommender into leaking insights from another company (or possibly poisoning the network itself)? These adversarial attacks have been well documented in academia.
dr-detroit 4y ago
nunobrito 4y ago
Office itself is a cloud service nowadays. That phoning home feature is part of the online saving so that you can resume work from a browser or contribute collaboratively with other users across the network like a google docs, but on the desktop. Does it beam home? Yes Do I like it? No We have LibreOffice for decades. Be the change.
trap_goes_hot 4y ago
This isn't a black/white issue. How about we let each person evaluate it for themselves? I find this feature useful, but if I were a sysadmin, I'd probably block it. Not because I don't trust MS, but just that it opens up a vector that I would not want to manage.
6stringmerc 4y ago
Just because it is phoning home data doesn't mean automatically it's sending your data - more than likely it's a block of stuff representing what is your data, because nobody wants to traffic in your copy/pasted email FW:FW:FW:FW graphic at 6MB you use on every slide for your company logo. It's just not practical to me, and if you don't like that generic thing, well, disable Design suggestions. Pretty sure there's a switch for that somewhere. Usually there is with Microsoft. Paint: having Admin rights when you can find it since Windows 95
A4ET8a8uTh0 4y ago
What I am kinda waiting ( and it is coming ) is for someone to find out that Excel actually gathers all interesting data under guise of automatic analysis ( ala copilot ). The financial sector will tremble as almost the entire human population existing in the spreadsheets in one form or another ( as long as they are on o365_v2 ) will have their data harvested daily and banks will be unlikely do anything about it. Oh, look. We don't need enter Jenkins account. Everything auto populates. And we did not even map it yet...
thedudeabides5 4y ago
Is this why the default fonts in my office randomly changed the other week?
alfiedotwtf 4y ago
So when US politicians say TikTok needs to be banned because it's effectively spyware, why are they silent when the same happens from US companies
- BlueTemplar 4y ago
  The answer is in the question...
dudeinhawaii 4y ago
This post seems to lack any useful information to come to the conclusion of "phoning home the content of PowerPoint slides". That said, if you use the tool in question, you'll notice that it only suggests layouts and these seem to be fairly generic. They don't seem to take into account the content so much as how the content is laid out. This could be as "simple" as Microsoft phoning home with the layout of the data (bullets vs title vs paragraph of text) combined with perhaps hash codes of any topical features (things that indicate technology vs food). I've never been "surprised" by the feature the way I am with Github Copilot where it sometimes feels like it's reading my mind. The Designer is just a simple way to click a button and get back 5+ recommendations on how you can layout the data. Without some kind of evidence, my explanation is just as valid as the blog. That which can be asserted without evidence can be dismissed without evidence.
nokya 4y ago
Microsoft and confidentiality of your data are two incompatible concepts. Microsoft is basically the editor of a set of tools designed to make employees more productive. As long as you use Microsoft products with this in mind, there's no ambiguity: you give Microsoft the data you work on, and it gives you productivity in return. Unless you are the actual CEO of a company involved in trade secrets (or a defense organization), you shouldn't care about Microsoft snitching the content of your slides, and everything else you write or see, to its own servers on the justification that it will make your experience better. It's not worth entering the debate, and if you accuse Microsoft you will probably need to accuse its competitors. Just remember to keep out of anything Microsoft when you process anything strictly personal, and you will be more than fine. P.s.: I almost forgot to answer your question. Yes, you approved this. And again, if it's not your company, your boss very likely approved it and wouldn't even consider the effort of looking into this, so it's not your business. Literally.
Tozen 4y ago
It's not just PowerPoint, but other Microsoft products too. Their browser (Edge) is known for being on constant phone home, close doesn't really mean close, self-update without user interaction, odd settings that cause privacy problems, after it updates itself makes changes to settings without user permissions or breaking various security-related extensions, etc... It's a pattern of general disrespect for user privacy and exploitation of unaware users for corporate and 3rd party entity benefit. Look no further than Microsoft's Copilot, which is in the spotlight, and arguably has no respect for users copyright. That PowerPoint (and other Office products) are phoning home users data, should be of no surprise whatsoever.
midislack 4y ago
Well, you do agree to license Microsoft any intellectual property you create with their software, for free, in perpetuity. So it’s kind of on YOU if you still use their products.
pjmlp 4y ago
While this isn't acceptable, millions enjoy sharing the content of their documents every day with Google, with a document suite running on their servers.
aagha 4y ago
Step 3 - Turn it off: https://www.avantixlearning.ca/microsoft-powerpoint/how-to-stop-design-ideas-in-powerpoint-disable-powerpoint-designer/ https://www.avantixlearning.ca/microsoft-powerpoint/how-to-s...

734 points by memorable 4y ago

I always assumed they built these features by scraping publicly available powerpoint presentations using their index from Bing.

deafpolygon 4y ago

You did consent to it, in the fine print. Unfortunately.

tgsovlerkhgsel 4y ago
Which is why GDPR has the concept of "informed consent", which is a fancy way of saying "consent hidden in the fine print doesn't count".
- deafpolygon 4y ago
  When installing office, you are told in the fine print to go read: https://privacy.microsoft.com/en-us/privacystatement https://privacy.microsoft.com/en-us/privacystatement ... it counts. The verbiage in there is quite disturbing.
  - reitanqild 4y ago
    It doesn't count anywhere that is protected by GDPR.
    - hulitu 4y ago
      > protected by GDPR This is like the firewall in windows 95: nice but useless.
      - real_dogbert 4y ago
        I wish I could disagree with you. GDPR technically does have real teeth, to the extent that one really shouldn't want to raise the ire of an EU Data Protection Authority. Unfortunately, enforcement to date, and the resulting fines, have been lackluster at best. When will people learn that disincentives like fines and such have to actually hurt to be effective in changing the behavior of corporations?
      - reitanqild 4y ago
        Many companies have gotten their first fines already. Hundreds of millions of shareholder value down the drain because they blatantly ignored the rules. No, most companies don't get a massive fine in the first round, but I already see enough have gotten then that even Google now allows me to opt out with a single click :-}
- nonrandomstring 4y ago
  And that the user may not have capacity to consent. That seems the salient issue today with regards to children and social media. Most of the giant social media companies profit from participants who cannot legally enrol.
  - real_dogbert 4y ago
    By "participants who cannot legally enrol," do you mean minors? I'm not tracking what the Venn diagram between those people and those who "may not have the capacity to consent" is.
    - nonrandomstring 4y ago
      EDIT: I was talking about kids. But Dogbert's comment actually deserves a bit more than "try using common sense instead of set theory" :) I tried thinking of classes of adults who lack capacity, other than the mentally unfit, senile or criminally insane. There's a lot of young people who are "deemed to consent" (the passive weasel-words of filthy scoundrels) in higher education. I've written about Turnitin in the Times and the "very dodgy circumstances" in which students are inducted into university and then find themselves coerced into tacit agreement to use tools which massively violate their privacy and other rights. The same applies to Microsoft products where institutions block choice and force students use insecure products that they would refuse if exercising their better judgement.
- msla 4y ago
  How willing would a government be to prosecute a company its IT infrastructure relies on? Even if you think Microsoft doesn't have kill switches, it still isn't obligated to do business with them.
mynameisvlad 4y ago
Not even. It’s an explicit feature that must be separately enabled, and requires Microsoft 365. > The first time you try out Designer, it may ask your permission to get design ideas for you. If you want to use Designer, select Turn on. https://support.microsoft.com/en-us/topic/53c77d7b-dc40-45c2-b684-81415eac0617 https://support.microsoft.com/en-us/topic/53c77d7b-dc40-45c2...
- CharlesW 4y ago
  Plus there are policies which allow admins to block PowerPoint Designer, as well as all Office 365 "Intelligent Services" (or "Intelligence Services", depending on your POV).
- deafpolygon 4y ago
  It will ask you to turn on "Connected Experiences".
- Semaphor 4y ago
  > it may ask your permission I wonder when that is? Because I haven’t used PP yet, and it didn’t ask me. Of course, we use Office 365, and maybe my boss turned it on globally? Does anyone know where the setting is?
  - mynameisvlad 4y ago
    Have you used the Designer feature? That’s what’s being talked about. It should prompt you when you first use it. If you’re on a work account, your admin may have enabled or disabled it already with GPO/MDM.
    - Semaphor 4y ago
      > Have you used the Designer feature? Yes. > If you’re on a work account, your admin may have enabled or disabled it already with GPO/MDM. It has to be a global Office 365 setting, my computer is not in the domain, I’m the only admin for it. That’s why I’m asking where the setting for the permission is, so I can have a look at it (I’m secondary admin for the O365 account) and potentially disable it.
nmeagent 4y ago
If I have one hope for the future, it's that 'accepting' click-through corporate EULAs containing unconscionable terms that few read will no longer be considered consent.

cm42 4y ago

"Informed Consent is just a theory. Besides [other app] already spies on you so who cares? Whaddareya doing in PowerPoint that's so sekret?"

Izmaki 4y ago
"I have nothing to hide so why should I care?" is the worst, misinformed argument in the history of mankind.
mtgx 4y ago
I know it's sarcasm, but you don't have to have "big secrets" in order to want privacy. Everyone knows what you're doing in the restroom, doesn't mean you're ok to going to a see-through public restroom.
Ninn 4y ago
In our companies slides we have tons of confidential slides containing info that could be misused for insider trading by MS engineers?
- lotsofpulp 4y ago
  It would not be insider trading if done by people outside your company. Edit: Nvm, I think I am wrong. https://www.investopedia.com/articles/investing/092616/how-insider-trading-prevented-corporations.asp https://www.investopedia.com/articles/investing/092616/how-i... >Another way that insider trading can occur is if non-company employees—such as those from government regulators or accounting firms, law firms, or brokerages—gain material nonpublic information from their clients and use that information for their personal gain.
  - deafpolygon 4y ago
    "Our AI is technically not an employee."
NayamAmarshe 4y ago
To that, I always reply with "I have nothing to hide but much to give".

beckingz 4y ago

I look forward to the day when PowerPoint is banned due to enterprise security concerns.

bnt 4y ago
How about Grammarly? Or G-suite? They have access to most of the companies out there. I find it terrifying people use Grammarly and it has access to every piece of confidential word written.
- ttrrooppeerr 4y ago
  Grammarly and Hola VPN are the two browser extensions that any IT Admin should be ban straight away in corporate machines.
  - formerly_proven 4y ago
    You guys allow users to install browser extensions?
- Someone1234 4y ago
  Grammarly should absolutely be banned. Their privacy policy is horrible. I'd suggest companies look into LanguageTool's "On-Premise" commercial offering or run the Java-based server themselves (with N-Grams). Is it as good as Grammarly? Nope, but it is "90%" as good and significantly more private.
- real_dogbert 4y ago
  G-Suite is a super interesting case in that you literally cannot use the product without handing over your data to Google. It certainly seems like companies would hate that, particularly those with data protection obligations. Google does theoretically require a Business Associate Agreement (BAA) if your use case is subject to HIPAA and you intend to store or transmit PHI using their services, but I don't know how they detect or enforce that. [1] --- [1]: https://support.google.com/a/answer/3407054?hl=en https://support.google.com/a/answer/3407054?hl=en

dhruvdh 4y ago

PowerPoint has a feature where it uses machine learning to suggest layout and design changes for your content. This feature most likely can be turned off, but of course it needs some data on what's on your slide to suggest changes. I hope this submission is flagged and removed. Just because you don't like Microsoft doesn't mean such misrepresentation is okay.

pjc50 4y ago
So you agree that Microsoft sends the content of your Powerpoint slides (and, by extension, all DoD powerpoint slides, since they're notorious users of the application) to Microsoft?
- dislikedtom2 4y ago
  It's implied that he does not agree since he claims that the claim is misrepresentation.
- horsawlarway 4y ago
  > and, by extension, all DoD powerpoint slides, since they're notorious users of the application This is a pretty huge exaggeration here. Closed rooms exists and are used when appropriate. And just because something is enabled in the consumer version by default does not imply it's enabled and available in enterprise settings. Last time I dug through the office GPO templates - basically every phone home feature was easily disabled on an org level if desired. Further - what do you think something like Google Slides is doing with your data? It's ALL stored on Google's servers by default.
NikolaNovak 4y ago
Right; when I saw title I assumed Designer was going to be the context. I've also observed that Designer only works when I'm online, so I figured out that it uses external servers to generate suggestions. I suppose it could/should be more obvious/explicit on the Designer pane itself, something like "This is an online feature that uses Microsoft's servers to generate recommendations", or a more user-friendly language. Note however that the article is light on details; does it send a full content of slides? Some hash of text and images? A non-identifiable abstraction of layers involved? This could be done well or poorly. (I don't think the submission should be flagged FWIW, but I agree that it's not of good enough quality to deserve great ranking; but that's of course subjective:)

ttrrooppeerr 4y ago

> Did we consent to this? I did. I guess the author didn't read the T&Cs.

soganess 4y ago
Chief Justice(of the United States) John Roberts suggested that he doesn't read them. Trying to call people out for not doing so or not understanding the technological reason why data is sent doesn't seem productive.

sheerun 4y ago

The next era will be of Offline Apps because of stuff like this

NayamAmarshe 4y ago
FOSS and offline-first is the future.
- cassianoleal 4y ago
  2023 is the year of Linux on the desktop?
  - trelane 4y ago
    It was quite some time ago. You didn't get the memo?
    - yjftsjthsd-h 4y ago
      "The future is already here – it's just not evenly distributed."
  - snapcaster 4y ago
    Yes, along with Beowulf clusters to run our infrastructure
  - bodge5000 4y ago
    Joking aside I think we are getting close, Photon did a lot to bridge with Windows in terms of gaming, GUI is often times at least on par with Windows/MacOS, if not better (obviously thats subjective), and reliability/performance has already been there for a while. That being said, I still think theres more work to do, and arguably the hardest work is ahead.
    - _chu1 4y ago
      Linux is on par with Windows kind of but not really. It's a little ghetto For example, desktop environments are just wonky and buggy most the time, random games don't work, WINE is the worst piece of software on the planet, drivers suck, other random weird issues.

Someone1234 4y ago

This is a one paragraph claim that doesn't provide resources to show that their claim has basis. It could very well be entirely accurate, but there's no information contained here to know one way or the other. For example there have been numerous claims made previously that link ANY network traffic to a supposed invasion of privacy, but once you delve into the underlying traffic it isn't nearly as nefarious as it initially seemed. This article is telling you to "open up the network monitor of your choice" but network traffic and CONTENT are apples Vs. oranges, and yet we're meant to draw conclusions from that? We're meant to know Microsoft are taking your slide's content whole-hog? Isn't that yet to be determined?

sammy2255 4y ago
I was expecting at LEAST some screenshots lol
- throwaw20221107 4y ago
  Yes. OP's post doesn't present any evidence that those packets being sent actually contain your personal data. Show us some data from an actual packet or GTFO. That being said, I don't doubt that they do :)
jeroenhd 4y ago
Powerpoint indicates that message content is being used for design proposals in the consent prompt. The Microsoft website says it "analyses your data": https://learn.microsoft.com/en-us/deployoffice/privacy/connected-experiences https://learn.microsoft.com/en-us/deployoffice/privacy/conne...
nosmokewhereiam 4y ago
Can Wireshark render this in PCAP? Would it just be encoded and Wireshark could decode it out of the box?

RajT88 4y ago

This doesn't bother me too much (but it would if I worked at a different company - I'd have concerns over company secrets). It's the browsing history which is by default sent to GOOG/MSFT which bugs me. On by default, and I'd swear I've seen it get reset on Chrome. Chrome: Settings > Sync and Google Services > Make searches and browsing better Edge: Settings > Privacy, Search and services > Personalize your web experience

semi-extrinsic 4y ago

I've raised this point repeatedly in different orgs. It's met with some combination of indifference and lack of understanding and not-my-responsibility-ism, but I'm sure that this will eventually blow up hard in some company's face - like 9-digit settlement for breach of contract, or worse things like breach of export control laws. Enterprise data security on the "MS Office level" at this point is like driving 60 mph on a road with no lane dividers. You just pray that you never meet a drunk driver or someone texting in oncoming traffic who suddenly swerves into your lane. You pray that none of your employees click the wrong button and bankrupt the company.

real_dogbert 4y ago
Yeah, I'm surprised every healthcare related business doesn't either ban PowerPoint or block this "feature" somehow. HIPAA is a hell of a drug.
- colechristensen 4y ago
  HIPAA is tame compared to export control and classified information handling. Single occurrences can get you 7 or 8 digit fines and prison sentences.
- reaperducer 4y ago
  I'm surprised every healthcare related business doesn't either ban PowerPoint or block this "feature" somehow. I work in healthcare, and the legal department bars me from using Google Analytics for HIPAA reasons. Meanwhile, IT made Chrome the only browser the employees are allowed to use on every Windows machine in the org.
  - happythebob 4y ago
    Did you read the article? I find your jaded sense of cynicism to be different than critical thought. I don't see any proof in the article posted about its claims. It's just very easy to get jaded, cynical people to support the right headlines on social media. Hacker News, be better.

bitwize 4y ago

Microsoft Office is, in general, straight up spyware now. It reports usage statistics back to your boss. Marietta can now see exactly how long YT's mom took to read that toilet paper memo, and make disciplinary decisions accordingly.

someweirdperson 4y ago

With all data stored on a sharepoint or onedrive, and powerpoint running in a browser... where's the news?

Waterluvian 4y ago

Obtaining user data should be a horrifying prospect for companies. They should obsessively work for alternative ways to not need it for their goals. And when they need it, to be ridiculously careful about it. (you could substitute "user data" for "application state" here) But it's not because there aren't sufficient consequences. Memory leaks don't properly crash the company as they should.

danuker 4y ago
> Memory leaks I suspect you mean data leaks, in the context of your comment. But memory leaks should be a thing of the past also - they hint at the quality of the underlying code.
Nevermark 4y ago
> Memory leaks don't properly crash the company as they should. Typically, companies just worry about about liability leaks. Which they take seriously enough to dedicate a lot of lawyer time to plugging redundantly with innocuously vague disclosure wording, terms of service wording, difficult to find and inconvenient to use opt-out tools, etc.

Mo3 4y ago

I wonder what the NSA or any other of these three-letter agencies think about that, I can remember much of the leaked information consisting of Powerpoint slides.

newsclues 4y ago
They probably have access to the data feed.
yjftsjthsd-h 4y ago
It sounds (from other comments in this thread) like there's an org-level way to disable it, so they probably just use that to force it off.
deleted 4y ago
[deleted]

SanjayMehta 4y ago

I don't even allow browser search suggestions; this is beyond the pale.

deleted 4y ago

[deleted]

NotYourLawyer 4y ago

Why doesn’t this article include the packet capture or whatever data he has that shows exactly what’s being sent?

Arnavion 4y ago
Because that would be more effort than posting clickbait.
Beltalowda 4y ago
One possible reason is that the actual data that's being sent is a lot less nefarious than is being implied. I've seen people vehemently argue that merely checking if a new version is available amounts to horrible invasive unethical tracking. You might want to turn that off for the truly paranoid situations, and that's fair, but it's of course completely different than "sends all your data". I don't have a Windows machine and I certainly don't have PowerPoint, so I can't actually check anything myself. But I see a lot of confirmation biasing going on in this thread, and I bet most people didn't check anything either. All I can give this article is a shrug.
- mixmastamyk 4y ago
  Many folks are aware MS has been all-in on telemetry for perhaps a decade now. They pioneered activation two decades ago. Explicitly in the TOS. Producing more evidence is left as an exercise at this point. Edit: no more posts allowed for me. Reply below: That’s exactly what telemetry is, today. Grammarly built a whole business on this. Copilot, etc. Refusing to believe that times have changed because you’ve not been paying attention, is not a compelling argument.
  - Beltalowda 4y ago
    "Telemetry" is not "sending the contents of your documents" (or at least, not necessarily so). This comment kind of demonstrates my point about the complete lack of nuance in these conversations. And to reply to your reply: > That’s exactly what telemetry is The common understanding of telemetry is sending metadata about how people are using software. That is, things like "this button was clicked", "this feature was used", etc. That is my understanding of the word anyway. Either way, this is a bit of a boring semantic discussion; my point is just that there is nuance to these things, and that this article doesn't really tell us anything concrete beyond "the network is used". Well, okay ... but for what, exactly? Because that does matter.

user3939382 4y ago

What I want is Little Snitch on steroids built into the OS where every process, including all native ones, including UI apps, are blocked from network connectivity by default, and the user gets an easy monitor of outgoing traffic with TLS/SSL inspection built in (you'd need some OS API to enable that). Kind of like granular oauth permissions, apps should have to declare which outgoing they have, a description/why, and allow inspection of the actual traffic. What Adobe CC, Google Chrome, MS Office, and macOS/Windows itself do with this background network connectivity is completely out of control and abusive to the user. They get away with it because the vast majority of users are non-technical and don't realize it's happening. I've profiled and decrypted the background traffic on a stock Android install and the volume was also appalling. Getting macOS to 0 background traffic involved blackholing large Apple IP blocks at the router, whereas some of their processes use random IPs from these ranges and don't use DNS. Just as the general public doesn't have the awareness or ability to fight for their privacy rights I doubt any of this will ever be remedied.

Kim_Bruning 4y ago
We could go to our EU representatives and ask for them to make it mandatory. Though I suspect it'll go down the same way as the GDPR, at least at first. (Lessons have already been learned of course)
- account42 4y ago
  We really just need a clarification/ruling that ANY telemetry is not essential to providing a service and thus requires informed consent before it can be collected and consent cannote be required to use the service. And then enforcement against all these applications. I don't think adding technical layers to block these data leaks is going to work long term.
3pt14159 4y ago
> with TLS/SSL inspection built in (you'd need some OS API to enable that). I'm not sure of that. Provided you can add a cert to your OS, you should be able to get away with a piece of protocol downgrade network gear that you can then pipe to a different (ideally, offline other than UDP receive) computer for analysis. You'd need to disable HSTS, but other than that I think it should be the solution you're looking for. Oh, and for good measure, ethernet cable instead of wifi.

teekert 4y ago

I guess since we all use MS mostly for business purposes we don't care so much about privacy. It's something our managers sign off on, in the name of security, features and really nice value for money. But oh boy, do they know a lot about us and our businesses. I mean, my office apps have "LinkedIn services" on by default [0], so they are linking all the things to all the things. [0]: https://support.microsoft.com/en-us/office/linkedin-in-microsoft-apps-and-services-6d7c5b09-d525-424a-9c18-8081ee7a67e8 https://support.microsoft.com/en-us/office/linkedin-in-micro...

roody15 4y ago

The future of personal computing is really dark these days. I just attended an apple event for education and government. The amount of data tracking and the standardization/normalization of this behavior is dystopian. What happened to computers being just fun and a source of exploration and freedom? Microsoft, Gooogle, Apple all constantly push their cloud based accounts … where everything is tracked.

eastbound 4y ago
On the other hand, Atlassian’s stock lost 66% of its value, and it could be because investors notice that converting people to the Cloud is not currently working. Atlassian should have better bet on their Server solutions, but they really really wanted to be a cloud operator. “For strategic reasons.” Maybe for governmental reasons, who knows.
- jsty 4y ago
  > it could be because investors notice that converting people to the Cloud is not currently working Given the barn storming financial performance of other cloud operators and Atlassian's impressive record in (un)reliability, I think investors are quite aware that converting people to the cloud is going swimmingly most places that aren't Atlassian.
- Mountain_Skies 4y ago
  It's a contentious issue in AppSec where most vendors want you to upload source code to their cloud for anything other than the most basic of scans. There are SLAs for how long the vendors can retain the source code they scan, but many clients are not aware of how much of these scans are performed manually behind the scenes by humans and how few of the vendors have their compliance audited. The possibility of a vendor failing to properly secure your source code is risky enough on its own, but it being accompanied by detailed reports of the security vulnerabilities in the code should cause some hair to stand on end.
  - q-big 4y ago
    > It's a contentious issue in AppSec where most vendors want you to upload source code to their cloud for anything other than the most basic of scans. Write the source code in some Assembler language (or even binary code ;-) ). Or use some obscure programming language that the vendor cannot scan, thus having a reason not to upload it.

TheRealDunkirk 4y ago

Is there any way to tell if your company has opted in? Mine makes a huge show of classifying Office documents and barking about the policies of what can be shown to outside people. It would be hilarious to find out that they've done this, and are letting Microsoft slurp up all the stuff that would get us fired if we sent it to an outside email address.

g_p 4y ago
I believe this is covered by the "Optional Connected Experiences" option. On Mac, this is accessible via the App's main menu > Preferences > Privacy. Looks like these instrucitons should help you check: https://learn.microsoft.com/en-us/deployoffice/privacy/optional-connected-experiences https://learn.microsoft.com/en-us/deployoffice/privacy/optio...
pavon 4y ago
When I click "Design Ideas" (rightmost icon in Home ribbon), I get a prompt that says "This experience is unavailable. Your organization's admin has turned off the service required to use this experience." This is despite both the Privacy -> "Turn on Optional connected experiences" and "Automatically show me design ideas" options being modifiable by me (and give the same results whether enabled or not), so I guess the Group Policy options are more fine grained.
- TheRealDunkirk 4y ago
  In options (under General), I see there's a tick box for the feature, and it is checked. I have a button that says "Designer," and it seems to work. Nice! Next time someone in IT tells me something as moronic as "all web application authentication code must be written in C," or that "SAML authentication happens by adding a key to the HTTP header," -- both of which have actually happened -- I'll have a nice redirection to share.

danuker 4y ago

LibreOffice FTW. https://libreoffice.org/ https://libreoffice.org/ It may be glitchy in some areas, but I've been using it since graduating high school, and I can do whatever I want with it.

acomjean 4y ago
If you deal with csv (or their tab separated cousins..) libre office sheets (spreadsheet) is really great. I'm on linux desktop now and this lets me read and write MS office files and works quite well.
- danuker 4y ago
  TSV is my favorite also. Quote all you want, no need to unescape in whatever program you interop with.
deleted 4y ago
[deleted]
squarefoot 4y ago
This. I've installed Linux+LO for years to a lot of people (also a couple times when it was in the earlier StarOffice incarnation, can't recall if under Windows or OS/2, certainly not Linux), being extremely clear on one thing: "this is not Microsoft Office, it's not as powerful as Microsoft Office and you may find some incompatibilities here and there (that was true especially during the old times), but the features 99% of users need are all here. Keep it for a while, and if it doesn't work for you, I'll install your Microsoft Office back for free and you lose nothing". It was a success almost everywhere, but it's extremely important for "normal" users to be comfortable with the different tool; remember that we value privacy, Open Source, etc. they don't. If something that they don't perceive as important requires a change in their workflow, they'll refuse that, so I don't even talk them about different file formats and just set it up to read/write in MS Office formats from scratch.
- q-big 4y ago
  > but the features 99% of users need are all here. I cannot believe this, in particular for the comparison Excel vs. LibreOfice Calc: the latter is used insanely actively in the finance and insurance industries, thus any proper user sampling should bias towards these industries. On the other hand: users in these industries know Excel really well and use very advanced features of it.

deleted 4y ago

[deleted]

didip 4y ago

Can you imagine, receiving all powerpoint content from your competitors (the rest of FAANG) in real time?

kolbe 4y ago
I can't imagine powerpoint is a useful application to any org that hires mildly talented designers
- thfuran 4y ago
  Big presentations at conferences may involve designers but there are surely many internal meetings at many levels that have a lot of PowerPoint and no designers.

jklinger410 4y ago

"We use MS products for our business because it provides enterprise level security"

reaperducer 4y ago
About ten years ago, I worked at a company where we were prohibited from using any Microsoft products at all — in the name of security. When I tell Windows-centric tech people that these days, they can't wrap their brains around it. There is no institutional memory of Microsoft's dumpster fire days.

msla 4y ago

And governments think Microsoft doesn't spy on them, that it's impossible to hide communications.

underscore_ku 4y ago

use Linux... it's free and doesn't spy on you

kolbe 4y ago

If I were ever in a position to tell investment banks what to do, I would demand every pitch of theirs happen in a jupyter notebook.

deleted 4y ago

[deleted]

bastardoperator 4y ago

Meanwhile half the slide decks I see are built on Google. You can't even get to the slides without phoning home.

klyrs 4y ago

Well that's cool, it's just like Copilot but for confidential and proprietary information! I wonder if I can get a sneak peek into my competitor's quarterly reports using this suggestion feature...

MasterYoda 4y ago

I use "simplewall" [1], a firewall to windows. What I like about it is you get a popup window every time a new program want to send data out, then you could block or accept it or temporary accept it. It's crazy how many programs that wants to talk to the internet constantly. [1] https://www.henrypp.org/product/simplewall https://www.henrypp.org/product/simplewall

DerekBickerton 4y ago

On Windows there is Glasswire[0] for blocking applications that phone home. Just find the offending process and block it. It's not a perfect solution though as Windows 10/11 has hundreds of things that phone home and blocking them has unintended side effects (things crash randomly if they can't talk to the Internet). [0] https://www.glasswire.com/ https://www.glasswire.com/

heikkilevanto 4y ago

So, what is the best way to game the system? Make many offensive Power Point presentations or silly layouts and hope the system starts to recommend them to others?

Terretta 4y ago

> Did we consent to this? Yes, explicitly, and not in 60 pages of legalese, in a dialog box.

dustedcodes 4y ago

Microsoft and Google have OneDrive and Google Drive where most slide decks are stored anyway so in some ways this is barely newsworthy, on the other hand I guess if someone purposefully selected Office instead of Google slides for their presentations and thought using an offline app which doesn't save the files to their OneDrive would keep them secret might get surprised by this feature.

moffkalast 4y ago
Well with Google Slides you know they'll be storing your data quite obviously right off the bat. The problem isn't so much the storing as the lying.

shmerl 4y ago

LibreOffice is an option.

adamsmith143 4y ago

This seems kind of shocking, is MS really hoarding the trade secrets of like every Fortune 500 company on their servers?

squokko 4y ago

Oh, the humanity! When you CLICK THE SLIDE DESIGNER button it sends your slides to a Slide Designer service? What hath God wrought?

dagmx 4y ago

This post is dubious at best. It makes a “do your own research claim” without sharing anything concrete. Yet, this plays into people’s own confirmation biases so it’s already being taken verbatim by people here.

mixmastamyk 4y ago
https://news.ycombinator.com/item?id=31727293 https://news.ycombinator.com/item?id=31727293
- Springtime 4y ago
  I'd too be interested in further analysis (eg: ruling out false alarms, such as some update check) so that I can say to others with more certainty that something is of potential concern, rather than it being shot down later if someone does a more rigorous analysis. Just because one could say a company has done controversial things before doesn't mean there's no benefit in verifying claims.
  - mixmastamyk 4y ago
    It’s in their TOS and stated as a feature. https://news.ycombinator.com/item?id=33509159 https://news.ycombinator.com/item?id=33509159 There’s an expression, paraphrased as “when someone tells you who they are, believe them.”
    - Springtime 4y ago
      I mean, it's fine if one is personally satisfied with not explicitly having evidence of the specific alleged data collection here, but speaking from experience when the time comes and people inevitably prod further for sources and only hand-wavy arguments can be produced I've found it's not the strongest/most compelling result for motivating a potential change of behavior. Anyone here could believe this is occurring and it wouldn't likely surprise them but actually knowing concretely can have the effect of changing things. Consider the difference between people assuming various things about the NSA pre-Snowden vs post leaks and how it affected change (or at the least a better basis for it).

jeroenhd 4y ago

Like I said last time: > Did we consent to this? Yes, unless Microsoft doesn't ask for consent in whatever country the author is from. There's a consent popup that you need to click through that informs you that the content of your slides are shared with Microsoft. This is part of "intelligent services" in case you're looking for the details. The author should be able to turn this feature off easily, but yes, they did consent to this. They just might have done so months ago and forgotten about it. Find out more about the "intelligent services" that also send the contents of your document to the cloud if you click on their respective buttons here: https://learn.microsoft.com/en-us/deployoffice/privacy/connected-experiences https://learn.microsoft.com/en-us/deployoffice/privacy/conne...

layer8 4y ago
At least in some countries, it legally may not constitute actual consent if the text is so unintelligible to a normal user that they don’t understand what exactly they’re consenting to. And we all know that most users just click “Agree” without understanding what exactly they’re agreeing to because that’s the only way they can get their work done.
- jeroenhd 4y ago
  "To provide these services, Microsoft needs to be able to collect your search terms and document content" seems pretty explicit to me. This is what the Office settings say underneath the checkbox Another prompt ends in "Office will use your searches and document content to support and improve the Intelligent Services to you." The individual popups seem to follow a simple "what is it, what are some examples of it, what are you consenting to" structure. Any less details and you have no idea what you're agreeing to, any more details and you'll quickly lose people in the "EULA too long" problem. I disagree that agreeing is the only way people will get their work done. There are many ways to translate text and the "let me design a PowerPoint for you" feature is nothing more than a nice to have. There are plenty of offline themes to choose from and individual themes to download without ever enabling this setting.
simiones 4y ago
The text on that page is extraordinarily misleading, if indeed "Connected experiences" are sending your data to MS servers. Nothing on the page is explicit about the apps sending your data to MS, the only hint that this is happening is the footnote that these "Connected experiences" do not work if you are not connected to the Internet. For example, here is the description of the first type of such experiences: > Connected experiences that analyze your content > Connected experiences that analyze your content are experiences that use your Office content to provide you with design recommendations, editing suggestions, data insights, and similar features. For example, PowerPoint Designer or Translator. > The following table provides a list of connected experiences that analyze your content and also provides links to more information about them. They are going to quite long lengths to avoid mentioning where the data is analyzed.

treesknees 4y ago

I can't say whether the blog is correct or not, as I haven't seen the actual network traffic, but there are privacy controls that the author probably hasn't configured [1]. If it was configured correctly, Designer wouldn't even be available. So it's not as though every user of PowerPoint will have their data collected by Microsoft. [1] https://learn.microsoft.com/en-us/deployoffice/privacy/manage-privacy-controls https://learn.microsoft.com/en-us/deployoffice/privacy/manag...

layer8 4y ago
Still, Designer should display a notice that this is happening on first use (and until the user checks “Don’t show this anymore”, and maybe auto-turn that on again once a year), because a normal user doesn’t necessarily realize that this is happening. You shouldn’t have to be an IT/Office expert to have your privacy being respected.
- jyrkesh 4y ago
  This is literally what it does today: the first time you use Designer or some other "intelligence" feature you get prompted to confirm that you're okay sending your data to Microsoft to use the feature, with a link to privacy policy and everything.

mrtweetyhack 4y ago

matternot 4y ago

How it was determined that it phones back the content of the slide ? From my understanding it's just exchanging some network packets.

matternot 4y ago

how was it determined that it is phoning home the content of the slides? One thing is to exchange network packets with a remote server, and another thing is to claim that it's leaking slide content.

twstdzppr 4y ago

Y'all sound a little too paranoid. Chill

HardwareLust 4y ago

Yes, you consented to this when you clicked through the TOS without reading it.

taubek 4y ago

I don't have PowerPoint on my computer so I don't know if it works without Internet connection. Can someone tell me what happens if there is no network access?

system2 4y ago
This post is speculation at best. Likely written by a teenager learning about windows and task manager features recently.

2b3a51 4y ago

Just wondering along the lines of 'perhaps a cigar really is a cigar'. What would Microsoft be doing with the text of every PowerPoint presentation once they have analysed the style/font/content information? Must be thousands of slides per hour 24/7 for years. How long is this information kept?

pradn 4y ago

There's a pervasive lack of precision in privacy discussions. There's a difference between a network request that does some computation on the server side, one that does the same but may log errors and increment counters, and one that actually stores the data temporarily or for a long time. And in the last case, there's a difference between the data being nigh-impossible for internal employees to access (perhaps only used as input for other automated systems), and data with few controls. What about the ability of the user to invoke a delete for all their data on the server side? There's so many dimensions. This is not a useless feature. I can imagine it might help someone make a better presentation. We have to weigh the potential privacy implications against that. And asking the user to consent for every little thing isn't the solution either. It's so annoying to be pin-pricked by dialogs. At work, this sorta thing should be decided at the organization level, by setting appropriate fine-grained org policies for Office.

smolder 4y ago
> This is not a useless feature. Yes, it helps Microsoft, and it helps The Powers That Be advance their goal of total information awareness to maximize their security and power and be unaccountable. As a bonus, the harm it does to users is hard to see and hard to reason about, so the genuine proponents and their useful-idiot accomplices throughout the tech (and political) world have been very weakly opposed in advancing the pervasive surveillance agenda.
AnonymousPlanet 4y ago
Do you make the same differentiation when it comes to what Chinese companies may collect from the computers of American companies? Especially this part: > there's a difference between the data being nigh-impossible for internal employees to access (perhaps only used as input for other automated systems), and data with few controls.
- vachina 4y ago
  This bias is very apparent in most of western media. A Chinese software vendor could do as much as sending your keystrokes for autocomplete you bet it will be front page news on Reddit and here with every comment reminding me about Xinjiang and 1989. But Microsoft could upload the entirety of your hard drive and we would find apologists like OP rationalizing away the behavior. I’m not convinced either governments are not in kahoots with private companies.

NicoleJO 4y ago

Microsft windows store does the same thing, but worse. Check out the developer panel to see for yourself. Windows store downloads are accompanied by mouse trackers, keyloggers, and more.

Mikeb85 4y ago

Lol of course they are. Never change MS.

dougmwne 4y ago

This seems blindingly obvious? They use a cloud powered feature, then complain that information is sent to the cloud? According to this help article using designer for the first time will request permissions. https://support.microsoft.com/en-us/office/create-professional-slide-layouts-with-designer-53c77d7b-dc40-45c2-b684-81415eac0617 https://support.microsoft.com/en-us/office/create-profession...

jsmith99 4y ago
Yes, this is click bait. There is a message you have to approve to turn on 'connected experiences'.
retox 4y ago
From the 'article' >Fire up PowerPoint. Turn off all the cloud options.
- dougmwne 4y ago
  No, this is specifically a cloud feature and you are warned and asked for permissions when you access it for the first time.
JeremyNT 4y ago
The blog post CLAIMS to not be using that feature, so charitably they could be talking about something different. Who knows though? They provide so little information and I have no particular reason to trust them without some kind of evidence. I'm flagging this article since all we can do is speculate.

ZebusJesus 4y ago

NextDNS for the win, great filter lists for Microsoft and apple.

ZebusJesus 4y ago

This is one reason i use NextDNS, they have a list of Microsoft and apple servers ready to be blocked with a simple toggle.

system2 4y ago

Dear Lazy OP, Please use wireshark or something else to explain what those packages are. It might be downloading design features or some other data it requires. 100 word article really doesn't do it for me.

ramon 4y ago

That is the price of AI, if you want you can move to an Amish town and give up on internet.

CarbonCycles 4y ago

This is a fascinating multi-faceted problem...there is the outright concern of how much of the data is being exposed, but there is also a much more subtle action at play. It appears that MS is using our data to continuously train their large DL networks to provide these recommendations...so what is to prevent a bad actor from cunningly constructing an asset that may trick the recommender into leaking insights from another company (or possibly poisoning the network itself)? These adversarial attacks have been well documented in academia.

dr-detroit 4y ago

nunobrito 4y ago

Office itself is a cloud service nowadays. That phoning home feature is part of the online saving so that you can resume work from a browser or contribute collaboratively with other users across the network like a google docs, but on the desktop. Does it beam home? Yes Do I like it? No We have LibreOffice for decades. Be the change.

trap_goes_hot 4y ago

This isn't a black/white issue. How about we let each person evaluate it for themselves? I find this feature useful, but if I were a sysadmin, I'd probably block it. Not because I don't trust MS, but just that it opens up a vector that I would not want to manage.

6stringmerc 4y ago

Just because it is phoning home data doesn't mean automatically it's sending your data - more than likely it's a block of stuff representing what is your data, because nobody wants to traffic in your copy/pasted email FW:FW:FW:FW graphic at 6MB you use on every slide for your company logo. It's just not practical to me, and if you don't like that generic thing, well, disable Design suggestions. Pretty sure there's a switch for that somewhere. Usually there is with Microsoft. Paint: having Admin rights when you can find it since Windows 95

A4ET8a8uTh0 4y ago

What I am kinda waiting ( and it is coming ) is for someone to find out that Excel actually gathers all interesting data under guise of automatic analysis ( ala copilot ). The financial sector will tremble as almost the entire human population existing in the spreadsheets in one form or another ( as long as they are on o365_v2 ) will have their data harvested daily and banks will be unlikely do anything about it. Oh, look. We don't need enter Jenkins account. Everything auto populates. And we did not even map it yet...

thedudeabides5 4y ago

Is this why the default fonts in my office randomly changed the other week?

alfiedotwtf 4y ago

So when US politicians say TikTok needs to be banned because it's effectively spyware, why are they silent when the same happens from US companies

BlueTemplar 4y ago
The answer is in the question...

dudeinhawaii 4y ago

This post seems to lack any useful information to come to the conclusion of "phoning home the content of PowerPoint slides". That said, if you use the tool in question, you'll notice that it only suggests layouts and these seem to be fairly generic. They don't seem to take into account the content so much as how the content is laid out. This could be as "simple" as Microsoft phoning home with the layout of the data (bullets vs title vs paragraph of text) combined with perhaps hash codes of any topical features (things that indicate technology vs food). I've never been "surprised" by the feature the way I am with Github Copilot where it sometimes feels like it's reading my mind. The Designer is just a simple way to click a button and get back 5+ recommendations on how you can layout the data. Without some kind of evidence, my explanation is just as valid as the blog. That which can be asserted without evidence can be dismissed without evidence.

nokya 4y ago

Microsoft and confidentiality of your data are two incompatible concepts. Microsoft is basically the editor of a set of tools designed to make employees more productive. As long as you use Microsoft products with this in mind, there's no ambiguity: you give Microsoft the data you work on, and it gives you productivity in return. Unless you are the actual CEO of a company involved in trade secrets (or a defense organization), you shouldn't care about Microsoft snitching the content of your slides, and everything else you write or see, to its own servers on the justification that it will make your experience better. It's not worth entering the debate, and if you accuse Microsoft you will probably need to accuse its competitors. Just remember to keep out of anything Microsoft when you process anything strictly personal, and you will be more than fine. P.s.: I almost forgot to answer your question. Yes, you approved this. And again, if it's not your company, your boss very likely approved it and wouldn't even consider the effort of looking into this, so it's not your business. Literally.

Tozen 4y ago

It's not just PowerPoint, but other Microsoft products too. Their browser (Edge) is known for being on constant phone home, close doesn't really mean close, self-update without user interaction, odd settings that cause privacy problems, after it updates itself makes changes to settings without user permissions or breaking various security-related extensions, etc... It's a pattern of general disrespect for user privacy and exploitation of unaware users for corporate and 3rd party entity benefit. Look no further than Microsoft's Copilot, which is in the spotlight, and arguably has no respect for users copyright. That PowerPoint (and other Office products) are phoning home users data, should be of no surprise whatsoever.

midislack 4y ago

Well, you do agree to license Microsoft any intellectual property you create with their software, for free, in perpetuity. So it’s kind of on YOU if you still use their products.

pjmlp 4y ago

While this isn't acceptable, millions enjoy sharing the content of their documents every day with Google, with a document suite running on their servers.

aagha 4y ago

Step 3 - Turn it off: https://www.avantixlearning.ca/microsoft-powerpoint/how-to-stop-design-ideas-in-powerpoint-disable-powerpoint-designer/ https://www.avantixlearning.ca/microsoft-powerpoint/how-to-s...