Official list of phoned-home info revealed by Microsoft

If you already have access to the things I type and my metadata includes the websites I visit, you don't really need to phish me to get my credentials.

If a service also happens to not support 2FA and doesn't have some sort of account activity section, you can effectively have control of me over that service, without me ever doing anything wrong and me not even suspecting a thing.

The only company that tries at all to respect your privacy is Apple. Google has a photo album with facial recognition and automatic tagging and the ability to search based on what the subject of the picture is, but it requires that you upload all your pictures to their servers so they can search through them. Apple does the same thing but the pictures never leave your device.

You'd never expect to see Microsoft or Google get up on stage and say "we're intentionally giving up an entire revenue stream because we respect your privacy". Instead they subsidize the cost of their software with privacy invasion and then brag about how much better value for the money their products are.

"By accepting this agreement and using the software you agree that Microsoft may collect, use, and disclose the information as described in the Microsoft Privacy Statement (aka.ms/privacy), and as may be described in the user interface associated with the software features."

I think that means you'll be the one going to jail in your hypothetical scenarios.

I haven't read the EULA for windows 10, but I can't imagine the Microsoft legal team didn't think of this.

I'm really curious what you're imagining the corporate structure to be like here - what kind of "internal pushback" are you envisioning?

In particular, I don't see engineers as particularly getting paid to or even having access to the parameters of the specs they're fulfilling. Anyone bothering to wonder would likely just assume the system they'd be working on to do this would be fully covered by 'legal' in specific agreements with firms to track that info, or if asked would be told that the spec is what it is and not anything about the use case.

Legal, meanwhile, isn't going to take money to tell MS what they can't or 'shouldn't' do; but rather just to ensure they don't have exposure in doing whatever they want to do.

So I guess that just leaves the leadership - which you could argue you're surprised by, if the board/C-levels/etc were individuals particularly known for being privacy-oriented. (Yeah. At Microsoft.) Meanwhile, you have a likely strong potential profit motive in a platform able to shift that kind of control to devs, though at the 'cost' of potentially losing privacy-concerned users - and their profit motive believes they can just EEE those users out of a market of competing products, so they give the go-ahead.

So if there's a 'pushback' module that failed in this scenario, perhaps I don't see it; but I don't really see at what point you'd expect something like this to be 'stopped' internally.

I wish this were true, but it just isn't, sorry. In reality there are excuses. E.g. we have both old and new hardware lying around which can only be programmed/debugged by Windows. There is no alternative except for maybe spending tons of man-hours trying to reverse engineer the shit out of it and come up with something vastly inferior (but, yay, runs on linux). Or again spending tons of time 'correcting' the original choice of these devices and entire eco-system built around it over the years and switch to something which does have linux support. So: no alternative. Less prominent alternative-wise but still going strong: Visual Studio. And also the pretty-much-everything-just-works principle. Now this doen't really make me love Windows, but does illustrate there are reasons for the HN crowd using it. (next to linux in my case).

classified data should only be handled on isolated networks.

Having worked with universal logging in that context, it was eventually decided to be too much of a risk and we specifically neutered any features that would trigger HIPAA issues out of our product.

Customers are going to screw up configs. And when HIPAA charges you with $damages x number of releases, inadvertent logging can add up fast.

EDIT: Unless MS got their logging center HIPAA certified and has a special contract they sign with insurance shops. Not impossible, but seems improbable.

My last company was very paranoid about security. Things like never leaving your desktop unattended, changing password every 4 weeks, encrypted disks, encrypted emails, forbidding most of cloud services... All the while happily using Windows and Outlook.

Also, although Google knows everything about me, they have so far managed to prevent security incidents, leaks and embarrassing deals (apart being forced to provide backdoor to NSA). They seem to know what they are doing security-wise.

edit*: and it's extraordinarily expensive

I've deferred major upgrades at this point though because the last two hosed a few things on my system and reset a load of stuff I'm probably still in the process of finding out about.

Ubuntu LTS is really hard to break unless you're constantly screwing around. The same happens on windows.

Don't complain about community-supported distros. Buy a commercially supported distribution with long term releases, and you're set.

Also imagine the bandwidth requirements, for many people such a backup would run forever without completing.

The only thing odd about that is that The Register has a more neutral tone in it's subheading than normal. The main headline is using the default Register style (and if you go to the Reg's front page, you'll see plenty of tabloid-esque subheadings).

I suspect that since this has been the Reg's modus operandi for years, that there's no need for an editor to write headlines by now - the staff writers know what's expected and probably use the house style already. If anything, it's the po-faced subheading that's likely to have been tampered with on an ad-hoc basis.