5 ms·

Microsoft's Windows Recall feature is coming back in October

gnabgib 2y ago
Discussion (42 points, 11 hours ago, 19 comments) https://news.ycombinator.com/item?id=41321911 https://news.ycombinator.com/item?id=41321911
slowhadoken 2y ago
Creepy
blackeyeblitzar 2y ago
Microsoft really hates its power users and thinks they can get away with abusing its users. And they’re right - they can get away with it due to their market position, which is inherently anti competitive due to their size and number of products they own. The only solution is to break them up and tax them heavily. There is no working free competition for them after all.
- mrinfinitiesx 2y ago
  That's why it's on us to convert as many people over to Linux desktop as possible. I can't sell people linux, but I can sell them the dream. Let me preach this gospel. I got Manjaro, Debian, Fedora, iptables galore. Linux so easy your mamas can use it. No seriously, works out of the box. Microsoft aint gonna be screenshottin' NOBODIES SCREEN. Shady ass company. After that Crowdstrike stuff, this is some monopolistic act of terrorism. 6 CVEs, two notably: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-38193 https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-38193 and https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38063 https://msrc.microsoft.com/update-guide/vulnerability/CVE-20... One being where North Korea can take over ring0 entirely? Don't see this AI snapshot stuff ending badly at all, no sir-e! Linux for days.
  - pjmlp 2y ago
    Yep, https://www.cvedetails.com/product/47/Linux-Linux-Kernel.html?vendor_id=33 https://www.cvedetails.com/product/47/Linux-Linux-Kernel.htm...
  - bsmartt 2y ago
    linux has had some pretty bad bugs as well. "North Korea" (not sure why you threw that in? are they exploiting this specific vuln ITW?) can only drop this if they can send you packets which they'd need to be on your network to do, or for this machine to have ports open directly to the public internet, and that shouldn't be the case for my mama's laptop...
    - mrinfinitiesx 2y ago
      article on the NK bit for the 38193 CVE https://arstechnica.com/security/2024/08/windows-0-day-was-exploited-by-north-korea-to-install-advanced-rootkit/ https://arstechnica.com/security/2024/08/windows-0-day-was-e... https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38193 https://msrc.microsoft.com/update-guide/vulnerability/CVE-20... - the mitre.org link in my original comment. I pay attention to all the CVEs daily (or as much as I can). the other one is something found in IPv6 by a research group that allows root level remote code execution by exploiting IPv6 packets, but what I'm getting at is, Windows I'll be trusting, absolutely not if it's going to be playing with this 'Recall' thing.
      - bsmartt 2y ago
        thanks for the links. as far as i can telll 38193 is just a priv esc so they need code execution locally first. but the two exploits you linked could possibly be chained together and that would be a pretty sophisticated attack, especially when they were 0day. but still, if you are behind a router they cant just throw this at any consumer.
        mrinfinitiesx 2y ago
        Could load javascript on a page and have them send outgoing crafted packets with websockets, or just have the webserver send them catered packets and let NAT send it where it has to go. It was found by a research group so it's not 'known known' but these CVEs happen every day, as do they for Linux. 0days are rare, it's our hopes research/cybsec groups find them firsthand though. I'm just having a little fun with it is all, preaching the Linux Desktop gospel. I'm pro-privacy and I highly feel this Recall system opens up a new attack/exploit vector in new unprecedented ways that I don't even want to begin to imagine. I mean, it reads your screen and recalls everything you've ever done..
- Mashimo 2y ago
  Why does this optional feature have to do with hating power users?
  - zo1 2y ago
    Because of the way that they implemented it. I call it the "GMail Searchification Effect", that heavily focuses on "The Experience", is driven more by the UX and marketing teams rather than the technical team. They implement the features with no real configuration, no interoperability, no local options, no way to point to another server implementation, etc. Probably no way to script it, either.
    - TiredOfLife 2y ago
      There was configuration. It was literally only local. No servers.
    - bsmartt 2y ago
      have you bothered to do any research whatsoever? there are privacy oriented config controls documented in the top hit on google: https://support.microsoft.com/en-us/windows/retrace-your-steps-with-recall-aa03f8a0-a78b-4b3e-b0a1-2eb8ac48701c https://support.microsoft.com/en-us/windows/retrace-your-ste... and already developer apis for interop.. https://learn.microsoft.com/en-us/windows/ai/apis/recall https://learn.microsoft.com/en-us/windows/ai/apis/recall
      - zo1 2y ago
        No I didn't research it, and I was speaking in general terms about these kinds of features. Plus, with the backlash against this thing, one could have safely assumed there were big issues with it as there always is. Thanks for the links and the info, but I still believe it'll pan out in a very specific way. Time will tell I guess.
- shiroiushi 2y ago
  They get away with it because their users absolutely refuse to leave for greener pastures. It's not because of the number of products they own, it's because their users think "PC == Windows", and scoff at anything offered as an alternative, usually with some excuse about MS Office, or some other very specific software that most users don't use. Meanwhile, in reality, it's easier than ever to be MS-free, thanks to the rise of web-based applications. There's lots of alternatives to MS Office, including MS's own Office365 online, as well as Google docs, LibreOffice, and others. Most users just use their computers for web browsing anyway, and that can be done on any computer. 20+ years ago, people had much better excuses, because most software was run locally, so if they used some proprietary Windows-only application, they were basically stuck unless they could get it running in WINE, but those days are mostly gone. But people want to stick with what they know (even though it's actually constantly changing with every new Windows version), so they'll put up with whatever crap MS wants to put in Windows: spyware, ads, etc. Of course, some people are rebelling and leaving Windows, as we saw in the recent article about Linux desktop usage being at an all-time high, but it's still only about 5%, though that's a lot better than 20 years ago.
  - qnleigh 2y ago
    Nah, Windows 11 finally pushed me over the edge, and as soon as I switched I realized the only Microsoft product I really liked was OneNote, which now works on Android and Mac.
    - shiroiushi 2y ago
      I'm glad you switched (welcome!!), but I didn't mean to imply that zero Windows users are switching, just that the numbers are very low. So many of them complaing about all this crap, swear they're going to switch to Linux, but never do. They're all talk and no action. And we can see it in the numbers. As I pointed out before, the stats are showing a slow rise in Linux marketshare, so obviously there are some people switching, which is great of course. But at this rate it'll be a long time before MS really has to worry. And don't forget, a huge portion of MS's customer base and revenue source is businesses, not individuals, and businesses are probably even less likely to dump Windows. Lots of individuals these days don't even use a PC, they just use a phone or tablet.
username81 2y ago
Am I the only one who doesn't think that recall is a bad thing? Of course Microsoft's implementation is a buggy privacy nightmare, but the core idea of being able to see what happened a week/month ago and process it using LLMs looks really useful. I'm looking forward to something like this, but local, FOSS and for Linux.
- aurareturn 2y ago
  I want an LLM to ingest everything I do - on device.
  - TiredOfLife 2y ago
    Thats is literally what Recall is.
    - aurareturn 2y ago
      But I want a GPT-4 level LLM using that data.
- laserbeam 2y ago
  If it happens on a remote server, I ain't using it. If I can control the server or it's running locally, then it's not a horrible idea.
  - pjmlp 2y ago
    Well, in a way that is what happens in ChromeOS, and plenty of people swear by their Chromebooks, and having each click going through webservers all over the place, starting with Google's.
  - renegat0x0 2y ago
    Recall, even if run locally, is a security and privacy nightmare. Imagine all of your activities and data stored on one database. It was discussed many times by security experts.
bhhaskin 2y ago
Microsoft is slowly making the transition from Windows being a OS to Windows being an Ad platform.
- cedws 2y ago
  Slowly? It happened 10 years ago.
- TiredOfLife 2y ago
  That is relevant to the Recall feature how?
- pjmlp 2y ago
  Even tough I like to be on Microsoft ecosystem, I have to acknowledge that Azure is the new golden goose in terms of Azure OSes, now that we are back into timesharing. And Windows suffers from that.
- kasabali 2y ago
  Slowly? LOL. That has been the direction full throttle since the day Windows 10 was released.
- AmVess 2y ago
  It already is an ad platform. They want to turn it into the surveillance platform of choice for governments, businesses and law enforcement alike. Windows is already a privacy farce. The OS and 3rd party drivers capture a large chunk of what you do. Imagine having everything you do in one tidy location that can and will be used against you at the drop of a hat.
renegat0x0 2y ago
Microsoft is slowly making the transition from Windows to SAAS, where user is the product. Yeah, maybe recall data are stored locally. Windows accounts were always local some time ago. Remember. A frog is boiled slowly.
oldpersonintx 2y ago
[dead]
nicman23 2y ago
NO, really?? Who would be able to have had guessed it >>!>!>!???!??
ptek 2y ago
Windows 7-64 bit supports up to 192GB. Still got 6 years until that is standard on cheap laptops. Can use that instead.
moi2388 2y ago
It’s the equivalent of a keylogger with image (and in the future video or full replay ability) UX. No thanks.
ChrisArchitect 2y ago
[dupe] More discussion: https://news.ycombinator.com/item?id=41321911 https://news.ycombinator.com/item?id=41321911
kurikuri 2y ago
Ah, yes. I wonder how many federal machines will now never update to Windows 11 because of FIPS 140-3 SSP leakages.

Discussion (42 points, 11 hours ago, 19 comments) https://news.ycombinator.com/item?id=41321911 https://news.ycombinator.com/item?id=41321911

slowhadoken 2y ago

Creepy

blackeyeblitzar 2y ago

Microsoft really hates its power users and thinks they can get away with abusing its users. And they’re right - they can get away with it due to their market position, which is inherently anti competitive due to their size and number of products they own. The only solution is to break them up and tax them heavily. There is no working free competition for them after all.

mrinfinitiesx 2y ago
That's why it's on us to convert as many people over to Linux desktop as possible. I can't sell people linux, but I can sell them the dream. Let me preach this gospel. I got Manjaro, Debian, Fedora, iptables galore. Linux so easy your mamas can use it. No seriously, works out of the box. Microsoft aint gonna be screenshottin' NOBODIES SCREEN. Shady ass company. After that Crowdstrike stuff, this is some monopolistic act of terrorism. 6 CVEs, two notably: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-38193 https://cve.mitre.org/cgi-bin/cvename.cgi?name=2024-38193 and https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38063 https://msrc.microsoft.com/update-guide/vulnerability/CVE-20... One being where North Korea can take over ring0 entirely? Don't see this AI snapshot stuff ending badly at all, no sir-e! Linux for days.
- pjmlp 2y ago
  Yep, https://www.cvedetails.com/product/47/Linux-Linux-Kernel.html?vendor_id=33 https://www.cvedetails.com/product/47/Linux-Linux-Kernel.htm...
- bsmartt 2y ago
  linux has had some pretty bad bugs as well. "North Korea" (not sure why you threw that in? are they exploiting this specific vuln ITW?) can only drop this if they can send you packets which they'd need to be on your network to do, or for this machine to have ports open directly to the public internet, and that shouldn't be the case for my mama's laptop...
  - mrinfinitiesx 2y ago
    article on the NK bit for the 38193 CVE https://arstechnica.com/security/2024/08/windows-0-day-was-exploited-by-north-korea-to-install-advanced-rootkit/ https://arstechnica.com/security/2024/08/windows-0-day-was-e... https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38193 https://msrc.microsoft.com/update-guide/vulnerability/CVE-20... - the mitre.org link in my original comment. I pay attention to all the CVEs daily (or as much as I can). the other one is something found in IPv6 by a research group that allows root level remote code execution by exploiting IPv6 packets, but what I'm getting at is, Windows I'll be trusting, absolutely not if it's going to be playing with this 'Recall' thing.
    - bsmartt 2y ago
      thanks for the links. as far as i can telll 38193 is just a priv esc so they need code execution locally first. but the two exploits you linked could possibly be chained together and that would be a pretty sophisticated attack, especially when they were 0day. but still, if you are behind a router they cant just throw this at any consumer.
      - mrinfinitiesx 2y ago
        Could load javascript on a page and have them send outgoing crafted packets with websockets, or just have the webserver send them catered packets and let NAT send it where it has to go. It was found by a research group so it's not 'known known' but these CVEs happen every day, as do they for Linux. 0days are rare, it's our hopes research/cybsec groups find them firsthand though. I'm just having a little fun with it is all, preaching the Linux Desktop gospel. I'm pro-privacy and I highly feel this Recall system opens up a new attack/exploit vector in new unprecedented ways that I don't even want to begin to imagine. I mean, it reads your screen and recalls everything you've ever done..
Mashimo 2y ago
Why does this optional feature have to do with hating power users?
- zo1 2y ago
  Because of the way that they implemented it. I call it the "GMail Searchification Effect", that heavily focuses on "The Experience", is driven more by the UX and marketing teams rather than the technical team. They implement the features with no real configuration, no interoperability, no local options, no way to point to another server implementation, etc. Probably no way to script it, either.
  - TiredOfLife 2y ago
    There was configuration. It was literally only local. No servers.
  - bsmartt 2y ago
    have you bothered to do any research whatsoever? there are privacy oriented config controls documented in the top hit on google: https://support.microsoft.com/en-us/windows/retrace-your-steps-with-recall-aa03f8a0-a78b-4b3e-b0a1-2eb8ac48701c https://support.microsoft.com/en-us/windows/retrace-your-ste... and already developer apis for interop.. https://learn.microsoft.com/en-us/windows/ai/apis/recall https://learn.microsoft.com/en-us/windows/ai/apis/recall
    - zo1 2y ago
      No I didn't research it, and I was speaking in general terms about these kinds of features. Plus, with the backlash against this thing, one could have safely assumed there were big issues with it as there always is. Thanks for the links and the info, but I still believe it'll pan out in a very specific way. Time will tell I guess.
shiroiushi 2y ago
They get away with it because their users absolutely refuse to leave for greener pastures. It's not because of the number of products they own, it's because their users think "PC == Windows", and scoff at anything offered as an alternative, usually with some excuse about MS Office, or some other very specific software that most users don't use. Meanwhile, in reality, it's easier than ever to be MS-free, thanks to the rise of web-based applications. There's lots of alternatives to MS Office, including MS's own Office365 online, as well as Google docs, LibreOffice, and others. Most users just use their computers for web browsing anyway, and that can be done on any computer. 20+ years ago, people had much better excuses, because most software was run locally, so if they used some proprietary Windows-only application, they were basically stuck unless they could get it running in WINE, but those days are mostly gone. But people want to stick with what they know (even though it's actually constantly changing with every new Windows version), so they'll put up with whatever crap MS wants to put in Windows: spyware, ads, etc. Of course, some people are rebelling and leaving Windows, as we saw in the recent article about Linux desktop usage being at an all-time high, but it's still only about 5%, though that's a lot better than 20 years ago.
- qnleigh 2y ago
  Nah, Windows 11 finally pushed me over the edge, and as soon as I switched I realized the only Microsoft product I really liked was OneNote, which now works on Android and Mac.
  - shiroiushi 2y ago
    I'm glad you switched (welcome!!), but I didn't mean to imply that zero Windows users are switching, just that the numbers are very low. So many of them complaing about all this crap, swear they're going to switch to Linux, but never do. They're all talk and no action. And we can see it in the numbers. As I pointed out before, the stats are showing a slow rise in Linux marketshare, so obviously there are some people switching, which is great of course. But at this rate it'll be a long time before MS really has to worry. And don't forget, a huge portion of MS's customer base and revenue source is businesses, not individuals, and businesses are probably even less likely to dump Windows. Lots of individuals these days don't even use a PC, they just use a phone or tablet.

username81 2y ago

Am I the only one who doesn't think that recall is a bad thing? Of course Microsoft's implementation is a buggy privacy nightmare, but the core idea of being able to see what happened a week/month ago and process it using LLMs looks really useful. I'm looking forward to something like this, but local, FOSS and for Linux.

aurareturn 2y ago
I want an LLM to ingest everything I do - on device.
- TiredOfLife 2y ago
  Thats is literally what Recall is.
  - aurareturn 2y ago
    But I want a GPT-4 level LLM using that data.
laserbeam 2y ago
If it happens on a remote server, I ain't using it. If I can control the server or it's running locally, then it's not a horrible idea.
- pjmlp 2y ago
  Well, in a way that is what happens in ChromeOS, and plenty of people swear by their Chromebooks, and having each click going through webservers all over the place, starting with Google's.
- renegat0x0 2y ago
  Recall, even if run locally, is a security and privacy nightmare. Imagine all of your activities and data stored on one database. It was discussed many times by security experts.

bhhaskin 2y ago

Microsoft is slowly making the transition from Windows being a OS to Windows being an Ad platform.

cedws 2y ago
Slowly? It happened 10 years ago.
TiredOfLife 2y ago
That is relevant to the Recall feature how?
pjmlp 2y ago
Even tough I like to be on Microsoft ecosystem, I have to acknowledge that Azure is the new golden goose in terms of Azure OSes, now that we are back into timesharing. And Windows suffers from that.
kasabali 2y ago
Slowly? LOL. That has been the direction full throttle since the day Windows 10 was released.
AmVess 2y ago
It already is an ad platform. They want to turn it into the surveillance platform of choice for governments, businesses and law enforcement alike. Windows is already a privacy farce. The OS and 3rd party drivers capture a large chunk of what you do. Imagine having everything you do in one tidy location that can and will be used against you at the drop of a hat.

renegat0x0 2y ago

Microsoft is slowly making the transition from Windows to SAAS, where user is the product. Yeah, maybe recall data are stored locally. Windows accounts were always local some time ago. Remember. A frog is boiled slowly.

oldpersonintx 2y ago

[dead]

nicman23 2y ago

NO, really?? Who would be able to have had guessed it >>!>!>!???!??

ptek 2y ago

Windows 7-64 bit supports up to 192GB. Still got 6 years until that is standard on cheap laptops. Can use that instead.

moi2388 2y ago

It’s the equivalent of a keylogger with image (and in the future video or full replay ability) UX. No thanks.

ChrisArchitect 2y ago

[dupe] More discussion: https://news.ycombinator.com/item?id=41321911 https://news.ycombinator.com/item?id=41321911

kurikuri 2y ago

Ah, yes. I wonder how many federal machines will now never update to Windows 11 because of FIPS 140-3 SSP leakages.