5 ms·

Please note this heinous and inexcusable overreach is over five years old and was addressed shortly after being caught: https://web.archive.org/web/20200307082

Please note this heinous and inexcusable overreach is over five years old and was addressed shortly after being caught: https://web.archive.org/web/20200307082846/https://community.wacom.com/wacom_experience_program/ https://web.archive.org/web/20200307082846/https://community... Wacom now has an opt-in for data collection. What should be the real continuing inexcusable outrage is that Windows, even today, grants all applications full access to read the titles of all windows with no way to disable it. If you run Windows, ask yourself what information that leaks and if you trust everything running on your machine not to exfiltrate that.

perching_aix 1y ago
I asked myself and the answer is no. Now what? I have dealbreaker problems with Linux and Mac. I'm also not going to pull a Terry Davis and make my own OS, and I'm not willing to participate in the circus that is open source either. With these in mind, what am I supposed to do, move to the mountains and live the life of a hermit? Once again, not happening. It'd appear that I'm between a rock and a hard place - exactly as designed. This is what an ecosystem grip is like.
- Buttons840 1y ago
  "What option do I have left after rejecting every other option?" I guess the answer, for you, is that you have no other option. For others, I'll say that I've had 3 Wacom tablets (I keep upgrading), including one with a screen and they have all worked well enough with open-source drivers. They're popular enough that you can do some research to know how they will work on Linux.
  - perching_aix 1y ago
    > I guess the answer for you, is that you have no other options. Yes, which is exactly what I was getting at. I'm not in the situation where if only I spent some time on introspection and "asked myself", I'd all of a sudden have this lightbulb moment that hey, what if I just switched to Linux or bought a Mac instead, despite what people like GP might like to think. This is a lot like when people try to - sometimes kindly, sometimes not - invite people's attention to the fact that e.g. they're fat. As if somehow this key piece of realization was the only thing keeping them from starting on a lifestyle change and taking ownership of their diet. It's juvenile there, and it's juvenile here too. Except in this case, I'd argue it goes even further: it's willfully dishonest. As if it was normal that the only way out were the options listed. As if all these options were playing on an equal field.
    - deleted 1y ago
      [deleted]
- baobun 1y ago
  FreeBSD?
  - perching_aix 1y ago
    Let's also not forget NetBSD. /s
- Liftyee 1y ago
  I'd say that in these cases, when there really is no viable option (including just not using...) then the optimal course of action is to choose the "least worst". Compromises work where ultimatums fail.
  - perching_aix 1y ago
    I agree. This is why I continue to stay on Windows, for now.
concerndc1tizen 1y ago
> the real continuing inexcusable outrage is that Windows, even today, grants all applications full access to read the titles of all windows with no way to disable it. IIUC, X11 had the same problem, but Wayland allows sandboxing to prevent this? And MacOS has some degree of sandboxing? But many applications require "Accessibility" permission that similarly gives far too many privileges?
- duskwuff 1y ago
  > But many applications require "Accessibility" permission that similarly gives far too many privileges? I haven't run into too many applications requesting that permission, outside of desktop automation and window management tools (Hammerspoon, Magnet, etc) which need it to do their job.
  - concerndc1tizen 1y ago
    Yeah, but any application with that privilege can log all keystrokes and upload it to a third party. Obviously this privilege needs to be far more fine grained and have limitations, i.e. registering a hook on particular key combinations, rather than listening on all key events.
    - jcelerier 1y ago
      How do you implement an app that displays all the keys you type on screen then no matter which Wayland compositor? (For when you're making video tutorials of an app)
      - NekkoDroid 1y ago
        In short: you wouldn't. What you are suggesting is overstepping 2 security boundries for unpriviledged apps/processes: 1. Reading global key presses 2. Drawing in an always-on-top window with transparent content Both these things would require that process to get special user/compositor opt-in permissions and integration. Your best bet would be using compositor plugins/native integration, or maybe you could hook into some toolkits (this is usually what FPS overlays do, hook into the graphics APIs). That is at least my current knowledge and there might be already some wayland extensions/XDG-portal that allows it, but not to my knowledge.
jfim 1y ago
> What should be the real continuing inexcusable outrage is that Windows, even today, grants all applications full access to read the titles of all windows with no way to disable it. That's there because it's been in there forever in the win32 API, and changing that would break applications. For example, a long time ago, I wrote a small application that would iterate through a list of executables, launch each one sequentially, and for as long as that executable ran, it would look at the window that had the current focus, enumerate every control, and then send a click message to any control that would contain the words yes, agree, continue, accept, install, ok. Made my life easier to automatically install software on computers unattended. There are plenty of other applications that require looking up other windows and sending them messages for all kinds of user workflows, things like autohotkey and so on. Changing that behavior would break all of them.
- poisonborz 1y ago
  Why? Just disable for all by default and have a permission popup open for each, stating that disabling it may crash that app.
- 94b45eb4 1y ago
  If the user is prompted to give permission for the application to have access to this information then at least you know which ones are doing it and can avoid using them if you are worried about it.
  - LadyCailin 1y ago
    This suggestion is not exactly a walled garden, but it moves very suddenly in that direction. Not sure that’s a great direction to head in.
  - jfim 1y ago
    In the case that was mentioned above, hardware frequently has drivers which can run as part of the kernel and can read the memory of other processes, among other things. A user of some hardware would be very likely to install a driver for it, without realizing that a malicious driver can basically do whatever it wants on their system. In practice, if the software one wants to use is not trustable, then it shouldn't be run, at least on current mainstream desktop operating systems.
jaoane 1y ago
>What should be the real continuing inexcusable outrage is that Windows, even today, grants all applications full access to read the titles of all windows with no way to disable it. No thank you, I want to keep my OS with apps that are powerful and that doesn't show me a useless permission prompt every five minutes.
- poisonborz 1y ago
  Why useless? Permission prompts were the best inventions of mobile OSes, there should be much more of them actually. On desktop there could be ways added to sidestep them, eg. defined in bulk in a processname.permissions file somewhere protected.
  - MyPasswordSucks 1y ago
    > Why useless? "This program is asking for extended permissions. It's asking: File permissions: Read, write, and modify" Now, is this because it allows me to select a custom avatar from the files on my device and save it after cropping it in the app? Or is it because it's going to check all my files and upload the really juicy ones to Scary Hacker Doods and change my name in all my documents to "Ima Dichwied"? I dunno! I have no way of knowing! Gosh, I guess I'll just figure out if I trust the app or not and click "sure" if I do, which means I'm in the exact same boat I'd be in before the permission prompt addicts came into vogue, except with the added annoyance of a popup (and occasionally an app which then needs to be restarted because the initial lack of access threw it into an unexpected state). This does not benefit me. It does not make my device safer. It does not make me feel safer. It does not make my experience more pleasurable. It will never do any of those things. It only serves to slightly raise my baseline level of annoyance. And I'm someone who (sometimes) knows what I'm doing! It's even worse for people who aren't tech-savvy! The Joe Sixpack user class has split into two camps, one of which is mindlessly clicking "YES I want to run it, YES it can make changes, YES I'm sure, YES the .msi called by the .exe can also run and make changes, YES I want the free 30-day trial of Pro Premium Plus edition, YES I consent to automatic billing on day 31, YES install the browser toolbar, YES let's play Global Thermonuclear War!" because they're, surprise surprise, completely desensitized to warning prompts thanks to the over-proliferation of nattering popup nonsense, and the other of which is thrown into a state of catatonic call-a-geek terror because their GPS app is asking for permission to view their location.
Aerroon 1y ago
I think applications should not have internet access by default. They should require the user to give them permission either temporary or permanent permission to connect to the internet. Ultimately that's where the security bottleneck is. I'm frankly disgusted that drivers for hardware like this need to connect to the internet in the first place. This data is clearly not being used to improve the user experience. If it was, then it wouldn't have been a surprise for Wacom that it was collected. Other companies, like Microsoft, also wouldn't be making such terrible UI/UX decisions time and time again, if this data was actually used for improving the user experience.
- alok-g 1y ago
  More than a decade back, I used to do this using firewall rules. Ot used to be a single-click firewall setting to disable all apps by default, have a pop-up show up when an app not already in the rule set would try to access the Internet, and thus keep building / refining the rules. One workaround apps had was to open a browser window to send information over. There's no reason I would want mouse / keyboard / pen-tablet / printer, etc. drivers to be accessing the Internet, not even for checking for updates. And there's no real reason for these drivers to be more than a kew KB in size, leave alone 100+ MBs like these have been since ages.
deleted 1y ago
[deleted]

perching_aix 1y ago

I asked myself and the answer is no. Now what? I have dealbreaker problems with Linux and Mac. I'm also not going to pull a Terry Davis and make my own OS, and I'm not willing to participate in the circus that is open source either. With these in mind, what am I supposed to do, move to the mountains and live the life of a hermit? Once again, not happening. It'd appear that I'm between a rock and a hard place - exactly as designed. This is what an ecosystem grip is like.

Buttons840 1y ago
"What option do I have left after rejecting every other option?" I guess the answer, for you, is that you have no other option. For others, I'll say that I've had 3 Wacom tablets (I keep upgrading), including one with a screen and they have all worked well enough with open-source drivers. They're popular enough that you can do some research to know how they will work on Linux.
- perching_aix 1y ago
  > I guess the answer for you, is that you have no other options. Yes, which is exactly what I was getting at. I'm not in the situation where if only I spent some time on introspection and "asked myself", I'd all of a sudden have this lightbulb moment that hey, what if I just switched to Linux or bought a Mac instead, despite what people like GP might like to think. This is a lot like when people try to - sometimes kindly, sometimes not - invite people's attention to the fact that e.g. they're fat. As if somehow this key piece of realization was the only thing keeping them from starting on a lifestyle change and taking ownership of their diet. It's juvenile there, and it's juvenile here too. Except in this case, I'd argue it goes even further: it's willfully dishonest. As if it was normal that the only way out were the options listed. As if all these options were playing on an equal field.
  - deleted 1y ago
    [deleted]
baobun 1y ago
FreeBSD?
- perching_aix 1y ago
  Let's also not forget NetBSD. /s
Liftyee 1y ago
I'd say that in these cases, when there really is no viable option (including just not using...) then the optimal course of action is to choose the "least worst". Compromises work where ultimatums fail.
- perching_aix 1y ago
  I agree. This is why I continue to stay on Windows, for now.

concerndc1tizen 1y ago

> the real continuing inexcusable outrage is that Windows, even today, grants all applications full access to read the titles of all windows with no way to disable it. IIUC, X11 had the same problem, but Wayland allows sandboxing to prevent this? And MacOS has some degree of sandboxing? But many applications require "Accessibility" permission that similarly gives far too many privileges?

duskwuff 1y ago
> But many applications require "Accessibility" permission that similarly gives far too many privileges? I haven't run into too many applications requesting that permission, outside of desktop automation and window management tools (Hammerspoon, Magnet, etc) which need it to do their job.
- concerndc1tizen 1y ago
  Yeah, but any application with that privilege can log all keystrokes and upload it to a third party. Obviously this privilege needs to be far more fine grained and have limitations, i.e. registering a hook on particular key combinations, rather than listening on all key events.
  - jcelerier 1y ago
    How do you implement an app that displays all the keys you type on screen then no matter which Wayland compositor? (For when you're making video tutorials of an app)
    - NekkoDroid 1y ago
      In short: you wouldn't. What you are suggesting is overstepping 2 security boundries for unpriviledged apps/processes: 1. Reading global key presses 2. Drawing in an always-on-top window with transparent content Both these things would require that process to get special user/compositor opt-in permissions and integration. Your best bet would be using compositor plugins/native integration, or maybe you could hook into some toolkits (this is usually what FPS overlays do, hook into the graphics APIs). That is at least my current knowledge and there might be already some wayland extensions/XDG-portal that allows it, but not to my knowledge.

jfim 1y ago

> What should be the real continuing inexcusable outrage is that Windows, even today, grants all applications full access to read the titles of all windows with no way to disable it. That's there because it's been in there forever in the win32 API, and changing that would break applications. For example, a long time ago, I wrote a small application that would iterate through a list of executables, launch each one sequentially, and for as long as that executable ran, it would look at the window that had the current focus, enumerate every control, and then send a click message to any control that would contain the words yes, agree, continue, accept, install, ok. Made my life easier to automatically install software on computers unattended. There are plenty of other applications that require looking up other windows and sending them messages for all kinds of user workflows, things like autohotkey and so on. Changing that behavior would break all of them.

poisonborz 1y ago
Why? Just disable for all by default and have a permission popup open for each, stating that disabling it may crash that app.
94b45eb4 1y ago
If the user is prompted to give permission for the application to have access to this information then at least you know which ones are doing it and can avoid using them if you are worried about it.
- LadyCailin 1y ago
  This suggestion is not exactly a walled garden, but it moves very suddenly in that direction. Not sure that’s a great direction to head in.
- jfim 1y ago
  In the case that was mentioned above, hardware frequently has drivers which can run as part of the kernel and can read the memory of other processes, among other things. A user of some hardware would be very likely to install a driver for it, without realizing that a malicious driver can basically do whatever it wants on their system. In practice, if the software one wants to use is not trustable, then it shouldn't be run, at least on current mainstream desktop operating systems.

jaoane 1y ago

poisonborz 1y ago
Why useless? Permission prompts were the best inventions of mobile OSes, there should be much more of them actually. On desktop there could be ways added to sidestep them, eg. defined in bulk in a processname.permissions file somewhere protected.
- MyPasswordSucks 1y ago
  > Why useless? "This program is asking for extended permissions. It's asking: File permissions: Read, write, and modify" Now, is this because it allows me to select a custom avatar from the files on my device and save it after cropping it in the app? Or is it because it's going to check all my files and upload the really juicy ones to Scary Hacker Doods and change my name in all my documents to "Ima Dichwied"? I dunno! I have no way of knowing! Gosh, I guess I'll just figure out if I trust the app or not and click "sure" if I do, which means I'm in the exact same boat I'd be in before the permission prompt addicts came into vogue, except with the added annoyance of a popup (and occasionally an app which then needs to be restarted because the initial lack of access threw it into an unexpected state). This does not benefit me. It does not make my device safer. It does not make me feel safer. It does not make my experience more pleasurable. It will never do any of those things. It only serves to slightly raise my baseline level of annoyance. And I'm someone who (sometimes) knows what I'm doing! It's even worse for people who aren't tech-savvy! The Joe Sixpack user class has split into two camps, one of which is mindlessly clicking "YES I want to run it, YES it can make changes, YES I'm sure, YES the .msi called by the .exe can also run and make changes, YES I want the free 30-day trial of Pro Premium Plus edition, YES I consent to automatic billing on day 31, YES install the browser toolbar, YES let's play Global Thermonuclear War!" because they're, surprise surprise, completely desensitized to warning prompts thanks to the over-proliferation of nattering popup nonsense, and the other of which is thrown into a state of catatonic call-a-geek terror because their GPS app is asking for permission to view their location.

Aerroon 1y ago

I think applications should not have internet access by default. They should require the user to give them permission either temporary or permanent permission to connect to the internet. Ultimately that's where the security bottleneck is. I'm frankly disgusted that drivers for hardware like this need to connect to the internet in the first place. This data is clearly not being used to improve the user experience. If it was, then it wouldn't have been a surprise for Wacom that it was collected. Other companies, like Microsoft, also wouldn't be making such terrible UI/UX decisions time and time again, if this data was actually used for improving the user experience.

alok-g 1y ago
More than a decade back, I used to do this using firewall rules. Ot used to be a single-click firewall setting to disable all apps by default, have a pop-up show up when an app not already in the rule set would try to access the Internet, and thus keep building / refining the rules. One workaround apps had was to open a browser window to send information over. There's no reason I would want mouse / keyboard / pen-tablet / printer, etc. drivers to be accessing the Internet, not even for checking for updates. And there's no real reason for these drivers to be more than a kew KB in size, leave alone 100+ MBs like these have been since ages.

deleted 1y ago

[deleted]