3 ms·

"Old" is a bit of a stretch here ;) But I'm glad to hear they've committed to making changes. Given the misrepresentations they made regarding the initial roll

"Old" is a bit of a stretch here ;) But I'm glad to hear they've committed to making changes. Given the misrepresentations they made regarding the initial rollout plan (the target of most criticism, mine included), Microsoft has to prove themselves here and I'll wait until qualified security folks get their hands on this before coming to any conclusions. What we know is that the initial version was a non-starter, and this new info validates the concerns we've all been expressing. I truly hope Microsoft does an acceptable job of addressing this. It remains baffling and worrisome that it took a public outcry for them to implement what sounds like a baseline level of acceptable protection.

wvenable 2y ago
Well it is "old" since the article is about Microsoft's blog post where they discuss all these changes! https://blogs.windows.com/windowsexperience/2024/06/07/update-on-the-recall-preview-feature-for-copilot-pcs/ https://blogs.windows.com/windowsexperience/2024/06/07/updat... > It remains baffling and worrisome that it took a public outcry for them to implement what sounds like a baseline level of acceptable protection. It's possible this was the intention all along but as a early-beta feature this was just the MVP. The reason it was rolled out to early testers at all was to get feedback.
- haswell 2y ago
  > It's possible this was the intention all along ... to get feedback If they're relying on public feedback to realize how completely unacceptable the initial rollout was, that again points to deep problems at Microsoft and is why I'm saying this is baffling.
  - wvenable 2y ago
    Microsoft is a big organization with different teams. It wouldn't surprise me if this front-end AI team didn't consider the larger security implications -- having it stored in your profile probably seemed sufficient. It's the same security all your documents have, your browser cache, etc.
    - haswell 2y ago
      They clearly did not consider the larger security implications. That is both the point and the problem. This points to structural issues at Microsoft.
      - wvenable 2y ago
        Maybe security oversight happens later in the process. No need to bother with that if the feature doesn't even work.
        haswell 2y ago
        If so, that's a problem. It might explain why this happened, but that doesn't mean it's an acceptable practice, especially after recently claiming that security is a primary focus for all project teams. Security requirements often completely change the architecture of a product. Things can be built without security that are significantly more challenging to accomplish when strict data security requirements are in place. Architectures that assume no security often completely break down when security is tacked on top. If this is a matter of a product not yet getting "security added", that again raises major concerns about how Microsoft is building products.
        wvenable 2y ago
        It doesn't sound like they're going to have significant problems adding more security to this product. For advanced as it sounds, it's not that complicated of a technology. It's just plugging together a bunch of existing technologies. I could probably MVP this app in a week myself given what is available. I think that exploratory development is, in general, a good thing. Bogging down all development with middle-management procedures might certainly have caught this early. But that doesn't necessarily make that a better way to build products. The scary thing about Recall isn't actually Recall itself. It's that AI makes this kind of product possible and really easy. I'm sure we're going to see implementations of this idea everywhere and not just on PCs. Imagine AIs watching security cameras.

wvenable 2y ago

Well it is "old" since the article is about Microsoft's blog post where they discuss all these changes! https://blogs.windows.com/windowsexperience/2024/06/07/update-on-the-recall-preview-feature-for-copilot-pcs/ https://blogs.windows.com/windowsexperience/2024/06/07/updat... > It remains baffling and worrisome that it took a public outcry for them to implement what sounds like a baseline level of acceptable protection. It's possible this was the intention all along but as a early-beta feature this was just the MVP. The reason it was rolled out to early testers at all was to get feedback.

haswell 2y ago
> It's possible this was the intention all along ... to get feedback If they're relying on public feedback to realize how completely unacceptable the initial rollout was, that again points to deep problems at Microsoft and is why I'm saying this is baffling.
- wvenable 2y ago
  Microsoft is a big organization with different teams. It wouldn't surprise me if this front-end AI team didn't consider the larger security implications -- having it stored in your profile probably seemed sufficient. It's the same security all your documents have, your browser cache, etc.
  - haswell 2y ago
    They clearly did not consider the larger security implications. That is both the point and the problem. This points to structural issues at Microsoft.
    - wvenable 2y ago
      Maybe security oversight happens later in the process. No need to bother with that if the feature doesn't even work.
      - haswell 2y ago
        If so, that's a problem. It might explain why this happened, but that doesn't mean it's an acceptable practice, especially after recently claiming that security is a primary focus for all project teams. Security requirements often completely change the architecture of a product. Things can be built without security that are significantly more challenging to accomplish when strict data security requirements are in place. Architectures that assume no security often completely break down when security is tacked on top. If this is a matter of a product not yet getting "security added", that again raises major concerns about how Microsoft is building products.
        wvenable 2y ago
        It doesn't sound like they're going to have significant problems adding more security to this product. For advanced as it sounds, it's not that complicated of a technology. It's just plugging together a bunch of existing technologies. I could probably MVP this app in a week myself given what is available. I think that exploratory development is, in general, a good thing. Bogging down all development with middle-management procedures might certainly have caught this early. But that doesn't necessarily make that a better way to build products. The scary thing about Recall isn't actually Recall itself. It's that AI makes this kind of product possible and really easy. I'm sure we're going to see implementations of this idea everywhere and not just on PCs. Imagine AIs watching security cameras.