I said no to three solid screens full of what I consider to be highly privacy infringing settings on install, all of which were on by default if you didn't do a "custom install."
Maybe there needs to be a law about default settings and privacy.
MS has a monopoly, through intent & ubiquity, on business class software, gaming & new computer sales(w/ OSX it is duopoly). Sure there are options for the technical folks, for everyone else it's spyware.
If we don't enact laws then jumping boats only leads to the next popular thing being careless with our privacy. I want to be certain that regardless of what software I'm using the people who developed that software have a common concern for the protection of privacy. When enough people have a common concern we usually enact those concerns in laws because it's the minimum we expect from civil participants in society.
But saying you want to use Facebook is like saying you want to get cancer.
If this trend continues, the company that replaces facebook will have much better respect of privacy than those that came before it.
There are a number of cultural issues that we'll have to face, but the cognitive dissonance that occurs in corporations whereby employees make decisions that benefit the company but harm themselves is one of the most important.
For the average computer user, Windows is not really necessary, and equivalent software exists on other platforms. For professional users this probably isn't true, and it'll depend on what their businesses choose to deploy, and how cross-platform that software is.
I currently work for a datacenter that officially support Windows and Mac, and allows employees to run Linux unofficially and self-support. While the community that arose from this is quite frankly awesome, it's been a troubling journey, and I still have some convenience features that I learned to live without. Windows, for all its faults, has tighter integration with all of our company's tools, and living without the un-managed company images and easy updates is unproductive for most of our staff that aren't linux/mac enthusiasts. The choice is there though, and I'm grateful for that.
Particularly to enthusiasts like me who like to do advanced stuff occasionally, ie not frequently enough that it makes sense to learn by heart all sort of commands, and where the cost of having to understand all sort of concepts and acronyms is prohibitive if I just want to do something once.
Windows for that is very powerful, the UI goes quite a long way.
Fine for doing the basics (slowly)... Until you need to do something even semi-powerful, then you will curse the lack of a good CLI.
I find in Windows that because most programs don't actually support a CLI at all, it's actually impossible to do lots of stuff that I'd like to do.
Plus I get a nice feeling when I can put together an elegant little sed (or whatever) command to do exactly what I need to do in seconds. The learning curve is high but the satisfaction is great, same as learning programming.
I can see how having to google for commands is a bridge too far for some people, but I get much more annoyed having to do extra mouse clicks everywhere than having to google a command that I can hopefully find a use for later as well.
Source: linux user who is forced to use windows all day at work.
I fundamentally disagree with that. If you are trying to set up a single Virtual Machine having never done it, you will go way faster with a UI than if you need to figure out the commands and how the whole thing works. If you need to set up 100 VMs then yes, CLI becomes the fast (and only practical) way.
> I find in Windows that because most programs don't actually support a CLI at all
Windows has CLI support for pretty much all advanced features, although admittedly scattered across various technologies. Where it lacks CLI is for user features, like customizing the UI of the desktop, switching off sounds, etc.
> The learning curve is high but the satisfaction is great, same as learning programming.
A steep learning curve is not a positive thing. Having a powerful IDE goes a long way to make a programming language self-discoverable and flattening the learning curve (Visual Studio for C# and VB is for that absolutely priceless). I wish CLIs had powerful autocomplete features that were aware of the state of the system (like you type "Stop-VM " and the autocomplete would suggest the names of the VMs available in that context). The most advanced CLI in windows (powershell) is miles away from being that good. And as far as I know there is none of that in Linux.
And keep in mind the problem is not just having to "google the syntax". You have ten different distributions of linux, 10 different tools to do the same thing, all have different syntax, acronyms, concepts and commands that will break the system if used against the wrong version. Since there is no easy way to visualise the state of the system, it is very hard for a non experienced user to progress in linux, and trial and error is time consuming and not fun.
I am not a fan of Windows, and in fact I am seriously considering switching to Linux rather than having to use Windows 10. But all these things are holding me back. I am not an IT professional and only have a limited amount of time I can spend re-learning the basics (firewalls, setting up websites, virtual machines, various jobs, etc).
What I wish existed is an environment that was maintaining a perfect symmetry between UI and CLI, where everything can be done with a UI, but where the OS gives you the CLI equivalent of what you are doing with a UI (a bit like Excel's record macros).
Just a comment: you can use a GUI in linux just like in Windows, it's just that mostly everything is CLI-aware, or has a CLI command as well, which is nice when you want to script something.
It would really be nice to see smarter autocomplete on the CLI, hopefully someone is working on it. I can see why it might be complicated to implement though as you'd need better integration with the terminal for autosuggest popups, etc, and this might not work well over ssh.
Also a better way to find commands that you don't know about yet would be nice, maybe searching installed programs by feature? Like "findcommand image" would give you a list of programs that can modify images, and what they can do to them?
man [thing I want to know about]
[command I'm trying to run] --help
There is a learning curve for Linux, but realistically, I found it to be about the same learning curve as using anything I hadn't used before on a Windows system. For basic tasks, Ubuntu Desktop is pretty darn fantastic at working out of the box, and its Software Manager parallels the Windows app store quite nicely for programs that do normal things. (Web browsers, ftp clients, office software, music players, etc etc.)
I choose to run something more complex (Arch linux, presently) because I want to know more about my system, and because I like experimenting with desktop environments. But once you understand how one package manager works, you can perform most basic system administration tasks between the various distributions without a huge amount of effort, and the package manager takes care of most of the fiddly configuration details for you in the process. I find this far easier than trying to set up services in Windows, or dealing with the awful registry.
Of course, I do still keep Windows around. I have a dual boot on my home desktop, and I boot into Windows regularly for the sole purpose of playing games. For all the things I love about Linux, the one thing the community still hasn't gotten down as well as a Windows system is proper GPU acceleration. For now, Windows takes the cake easily on that, and it's reasonably stable when that's all I use it for.
I do find the lack of standardization on command arguments slightly annoying in linux... Is it [command] --help, [command] -h, or just [command] by itself? It would be nice if there was something that could be relied upon.
Also handling of filenames with spaces could be standardized as well. Is it -0, -print0, or --null to get null-termination? I always forget which program wants what.
Unfortunately, I have to keep Windows around for Ableton Live. Linux is not great for professional-ish audio.
In my opinion that shares a remarkable similarity to the concept of fraud: In law, fraud is deliberate deception to secure unfair or unlawful gain, or to deprive a victim of a legal right.
How can the user be responsible for their own actions when the results of their actions are deliberately obscured by the people who wrote the software?
That's debatable. The enforceability of an EULA depends on the details of the situation.
> contracts
Many are not a contract, which has specific requirements. Even when an EULA is a contract, unconscionable parts - perhaps a clause that is clearly about a "dark pattern" scam - can be nullified.
Also, every contract may contain clauses which may be ruled unenforceable. This is not an unknown, and is why every contract has a severability clause. [2]
[0] https://en.wikipedia.org/wiki/Standard_form_contract#Contrac...
[1] https://en.wikipedia.org/wiki/End-user_license_agreement#Enf...
Specifically: "No court has ruled on the validity of EULAs generally; decisions are limited to particular provisions and terms."
Also the privacy settings are not "obscure" there are options when updating and options in the settings menu quite visible.
Unfortunately, government legislation in the form of copyright law prohibits this. If it were up to me, copyright law would be repealed. But failing that, we can't have a situation where all the laws favor corporations and none favor individuals, at least not unless we want to slide into the kind of dystopia cyberpunk writers have been warning us about for generations.
AFAIK what it doesn't prohibit is sharing information on how to disable that spyware, or even software that will do it for you.
Take an original Windows ISO, feed it to an app, and out comes an ISO with your customisations. If you're feeling neighbourly and rebellious, you can share that ISO with others. This is not a new concept --- see projects like nLite, and all the various customised Windows versions that you can find on the torrent sites.
[Edit] Maybe add a sample of live data potentially usable with the requested permission? Give people the 'why does he want my fiancé's number?' moment
It's still inferior to Cyanogenmod's Privacy Guard feature that can silently revoke permissions without the app being aware of it, but I think it's a step in the right direction.
What I'm trying to say is that there are various other reasons people care about then just permissions and security.
I think it will cause the app to ask you for permission again when it starts, but it's good to know it's not a one-time-only option.
Externalized costs complicate the libertarian approach.
By extending the definition of 'force' to include 'being inconvenienced' we cheapen and muddy an important concept. Asking your colleague to convert a Word doc to a different format is inconvenient. But forcing compliance for something via fines, jail time etc. - essentially at gunpoint - is a much more serious affair, even if the person being forced is the CEO of one of those evil privacy-violating corporations.
Your appeal to worse problems[0] does not invalidate any of the problems with privacy violations we are discussing here.
Here's a better definition of externalized costs in the form of force: any behavior which, when engaged in by a company, causes other companies' or users' life options to be reduced (even if just by increasing inconvenience of safer/healthier/more private options), or which when practiced by a plurality leads to a net negative result for society at large, is an action resulting in externalized costs.
What is your horse in the race?
I can't even bring myself to use Facebook with how little I trust them with my information, but my friends are comfortable logging every place they go in it for the whole world to see? I can't live in this world...
This isn't to say Facebook is better, it's just far easier to surprise someone with Google because Google makes it possible for you to see what they know about you. It's safe to assume Facebook has the same information.
I was already aware that they were doing it, but I was still shocked to see it in the Google Maps App (Menu-Your timeline).
Just seeing all that information about me with a nice calendar interface of where I've been on any date, I found very confronting. Up until then I had it in my mind as some ethereal "I know they have that information", but it's just so easily accessible it's scary.
And the creepy notification popups asking me for more information about places that I've been... Creepy.
It's still turned on for the time being, because I'm vaguely curious about the tracking itself, but I'm very nervous about the whole thing...
Also, you can change all the privacy defaults later. Windows 10 provides a lot of privacy controls, so I actually prefer to do it that way.
Update: thanks for the downvotes, redditors ;-)
If you don't disable this in a "custom" install, or later in the system settings, it's on.
On that (correct) definition, Windows 10 doesn't contain a keylogger.
UPDATE: First, it doesn't collect every keystroke. Second, it doesn't send every keystroke to Microsoft. It generates information for personalization purposes, some of which is stored locally on your own PC, and some of which is stored online where you can delete it at https://www.bing.com/account/personalization
Note: downvotes don't change the reality. If you can't handle truth, that's your problem.
That and Microsoft can probably turn it in a real keylogger if they want/have to but it's speculation
The point is that people are mis-using the word keylogger, either because they really don't understand what's happening, or as a device for scaring people. Neither is satisfactory, especially not on HN.
Microsoft wants to know how often people use, say, Notepad, but it has no interest at all in what you write in it.
They're doing that to improve the product, in exactly the same was as Google does with Gmail or Facebook does, though I think Windows 10 is a much lower privacy risk than those.
Personalization is another step, and you can turn it off. Every major voice recognition and handwriting program has always done this: they create templates (or whatever) that enable them to work better for specific users. Most of that info is held locally anyway.
None of this is remotely like a traditional keylogger.
Who knows what's on Microsoft's mind. They are burning bridges by including ads in Windows, by that alone they are (mildly) evil or insane so appeals to what Microsoft wants or is interested in loses meaning because they aren't acting completely rationally.
> It's dealing with anonymized, aggregated data
Even if I trusted them to not act maliciously I can't trust them to be competent, and there's plenty of historical evidence for that. Either they spew how they aggregate data or I don't trust them for the already mentioned reasons.
> you can turn it off.
Informed consent is the keyword. They didn't get it for arguably very invasive behavior many informed people would object to. I shouldn't be flying around turning three pages of settings off on my relatives' computers because Windows 10 installed itself or explain lengthily why turning certain settings isn't necessarily in their best interest, that's Microsoft's job and they failed at it.
Being upset about what Windows 10 actually does is fair enough -- I understand that not everyone wants things like telemetry and personalization (or maybe just not on Windows). It's not an excuse for claiming it does things that it doesn't do.
What would Microsoft do with billions of keystrokes from approaching 1.5 billion PCs? Especially since most of those keystrokes are probably Solitaire or GTA or some other game, or else they're from email or social networking (where somebody else has far more interest in your keystrokes).
In any case, running a real keylogger in Windows would be a magnet for the NSA and similar services, which would end up being far more trouble than it was worth....
> No.
Then you should say "It's not a keylogger because it doesn't send keystrokes anywhere". Not fuss about whether the definition of keylogger requires capturing every key.
But please explain how "send samples of my typing" does not involve sending keystrokes.
- frequency of different keystrokes
- frequency of keystrokes as a function of the preceeding 1, 2 or 3 keystrokes
- mean delay between any set of keystroke pairs
- standard deviation of delay between any set of keystroke pairs
Would you be able to design a system to collect this information that would not allow reproduction of any particular sentence typed by a user?
Would you be able to design a system that collects this information locally, creates the probability matrixes and sends them to Microsoft without sending the keystrokes themselves?
The proposed system above is almost trival to build, and yields significant and useful information that Microsoft would be interested in collecting.
I am not an expert in this area, nor am I clear that the above is what Microsoft is doing; but it is what I would imagine they want built, and it seems to be a pretty legitimate way to collect information without exposing the user to an actual keylogger and avoids most of the security issues that such a thing entails.
> frequency of keystrokes as a function of the preceeding 1, 2 or 3 keystrokes
Sequence that's unusual in a language and has reported frequency that's above what you'd expect from errors will probably be part of recurrently entered password. Depending on how stupidly the telemetry is done this could be leaking significant amounts of data for certain users. Did random poorly informed user agree to this? Probably not.
I agree with you: I think it should.
I also think we should get the same info for Android and iOS as well, but we don't. Further, what about the massive amount of telemetry built into online services such as Gmail and Facebook? Again, there is only silence....
By the way, I think that the typing stuff is only relevant to on-screen keyboards, where Microsoft does a huge amount of tricky stuff to make text entry more accurate. [0]
Windows 10 obviously has a built-in touch keyboard....
[0] https://blogs.windows.com/windowsexperience/2012/12/06/the-s...
Although that's about Windows Phone, Windows 10 is a mobile operating system designed to merge the PC, phone and Xbox platforms.
Don't derail. What's going on there is travesty as well, doesn't mean that Microsoft should get a license to break established practice on PC compatibles if Apple and Google decided to take a dump on phones.
> Further, what about the massive amount of telemetry built into online services such as Gmail and Facebook?
They are services, they can't not touch information, when you use these services it's implied that data is processed by them (unless there's some very fancy client side encryption that almost nobody use) and you implicitly agree to it.
> I think that the typing stuff is only
More interesting to wider audiences would be what you can prove. Why wouldn't Microsoft be more specific, why wouldn't they publish exactly how everything is processed if everything was really beyond reproach as I believe you suspect.
Nobody is going to turn the clock back for you. If you don't want a cloud-supported mobile operating system delivered as a service and supported by an app store, then you should stop using Windows 10. Your choice. Nobody will mind.
Or you can use Windows until 2020, but remember, that now has telemetry as well.....
Is a nice word for invasive to poorly informed people. Just because it's trendy (or "modern") doesn't mean that it isn't ostensibly bad.
> Your choice.
It's my choice and Microsoft has every right to crap on their users (if they obtain informed consent, which is again very much arguable). I'll have to sell relatives on switching to Linux and I'd prefer if I didn't have to do that. Lastly, that's beyond just my choice, Microsoft is setting dangerous precedents on x86 platform.
The whole world is moving to mobile OS's, so why on earth would you think that Microsoft wouldn't go the same way?
There's always Linux for the 2% who care.
Doesn't mean they aren't bad. You are trying; please don't be a walking logical fallacy. E.g. Windows's security story isn't admirable, to say the least, even though sales are healthy as well and have been historically. Sales doesn't indicate informed consent. Consumers buy what WE peddle them. Some people managed to push them invasive tech and I'm sure many would prefer other options if they could have them and were informed of them. But between iOS and Android there is little choice. Still doesn't mean that because people were pushed to badly designed software on phones that this is excuse good enough to push it on PCs.
The contract that you opt-into and on-by-default on W10 indicates that if I clicked the desktop and proceeded to type the entire source to the death star, there is a possibility that all or part of those keystrokes would get sent to MS and possibly stored, even though I had no intention of communicating or transmitting that information.
It is not good that you're calling people out as having problems and being below the level of discourse expected on HN just because their definition of keylogger includes programs that only log the keys used in other programs part of the time. That you won't acknowledge any chance that your definition isn't the best one.
* http://www.pcworld.com/article/2974057/windows/how-to-turn-o...
* http://www.pcadvisor.co.uk/how-to/windows/how-disable-hidden...
In passing, yes, there was a keylogger in the Technical Preview version of Windows 10.
The old adage, 'never pay any attention to what companies say, only what they do', is as true as ever.
This also works for politicians.
Serious question: are games that important that you'll take these intrusions rather than switch to (Calculate) Linux?
I run Little Snitch on my Mac. The number of "outgoing" connections for every tom dick and harry app and OS call is nearly as bad as what Win10 gets lambasted for.
Install 3rd party apps, it's a great thing to watch.
Stop with the hyperbole. It is the industry standard and that is what needs to be fixed.
2) This is not just about the number of connections that are made. It's about the amount of information that could be collected through those connections.
And Microsoft's Privacy Statement asks for legal permission for them to collect, store and share any of your content.
Apple's Privacy Policy does not, as far as I can tell.
Microsoft is gathering analytics data plain and simple. Everything is turned on by default, some of which can't even be disabled.
Most of the Apple connections are feature-related (geod, appstored, akd, inappurchased, iCloud if you made the mistake of enabling it, etc). There are notable exceptions in Spotlight searches and the about dialog. Apps can be pretty bad, thank the lax US privacy laws, the industry's lack of backbone and Apple's disinterest for that one.
Ultimately it's a question of intent and trust. Microsoft has shown that they're willing to use dark patterns to get their way and force invasive analytics on their users. Apple hasn't done that yet.
I say this not to be combative, but because I think you and the average consumer operate under very different definitions of "privacy invasion." It's really important to recognize this.
Microsoft should make it official and say they're an advertising company too if that's what they want and give Windows 10 really for free forever (not this limited time under certain conditions crap).
Could you be more specific about the concern though? I actually don't see what MS is doing that other competitors are, from a practical perspective. I'll try to be very specific as well. I've done some research here and this is what I've observed:
1. Individual apps in Windows send back telemetry commensurate with other apps I've got on OSX. They send back usage data that includes my activity. This used to be a very web-specific thing, then it was a mobile-specific thing, but I think most app store apps I have now open connections to a telemetry collector like Mixpanel or Kahuna. This used to be unusual, but now is the norm for every commercial app, and as someone building and managing said apps all I can say is "people want this stuff so good and so cheaply now, I don't know how else we could possibly get the data we need to deliver it that cheaply."
2. Win10 even at rest seems to send back very tiny amounts of data as part of its update checks and general telemetry. This seems really really similar to what OSX is doing, but of course I'm eager to see a security researcher break into this data. I'm sure there is slightly more to it. But people are shocked that Microsoft can discuss Edge hours used and pages viewed, and I think literally every competently executed application could produce those figures in 2016. To be honest, I trust Microsoft with this data more than I do tiny ISVs just using canned products outside their sphere of expertise to manage updates and analytics.
3. I think the "keylogger" people discuss is something nearly every OS does by default on its search engines and something every browser does as well: do debounced as you type pre-queries on search items. It's measurably more invasive with Spotlight or Cortana because you might be searching for indexed file content. I'm unaware of what else people might be discussing and I can't find many relevant alternative culprits here.
I don't disagree MS could be more obvious with its intentions on Win10. What's most frustrating is that from a consumer and even developer standpoint, Win10 is rapidly emerging as the best of all worlds for developers. The next major edition (which most of us are running via fast/slow rings) and the current iterations of MS-first-party hardware are directly competitive with Apple's offerings, and hardware wise they're quite good now.
So we're left in this awkward space where Apple has really dropped the ball on progressing their OS and they're profoundly developer unfriendly and even quite exploitative, Linux is still all but unusable on modern mobile and portable hardware without substantial commercial work layered on top, and Win10 is delivering a really functional environment with support for Linux that is done in FreeBSD's excellent style of direct compatibility.
It might make more sense for us to treat analytics collection like we would with ads via Adblocker. There's probably a massive addressible market if that's not already a product. Windows actually has fantastic and sophisticated per-application permissions controls that could be automated here...
Since everything is free now, spyware is the only viable B2C business model.
Everything is not free and spyware is not Microsoft's business model. (It makes very little money from ads, and most of that is sold by AOL for Bing.)
The Windows B2C business model is to charge OEMs to install Windows code on PCs, and to charge users for upgrades. This is exactly what it was before.
UPDATE: The extra profit from Windows 10 is earned from your use of Bing. (You will recall that Google and other search engines pay vast sums to get people to use their search by default.) In the case of Windows 10, your extra use of Bing comes from Cortana firing up the Edge browser and doing a Bing search. You may well find this annoying or even evil, but it seems to me that OK Google and Siri do much the same thing.
And because, as you say, "little of the Windows revenue come from upgrades," Microsoft didn't give up much income by making the Windows 10 upgrade free for one year (though it did add a bunch of server and bandwidth costs).
To compensate for falling PC sales, Microsoft is clearly heading online as rapidly as possible, with Office 365, CRM, Azure etc.
It's also heading cross-platform with online services and dozens of apps for iOS and Android, and Linux support in Azure and Windows 10.
Times change....
But my point was that the Windows 10 business model hasn't fundamentally changed, even if Microsoft manages to make a bit of extra money via Bing ads and Windows Store apps.
Those were the 3 concerns and while my personal privacy standards are a lot higher than that, these companies are targeting the mass market so I don't think this attitude should come as a surprise. While we can and should try to educate the mass market I think if you want a more private and secure product then using the same product they use will probably always leave you disappointed.