Hacker News Reader

Comment by rl3 | Hacker News Reader

>Engineers, with permission from Microsoft’s privacy governance team, can obtain users' documents that trigger crashes in applications, so they can work out what's going wrong. The techies can also run diagnostic tools remotely on the computers, again with permission from their overseers.

So in other words: engineering access to your personal documents (and computer) is mediated by a group of people who also shouldn't have access in the first place. Got it.

When I close my eyes, it's almost like I can vividly picture the crappy NSA PowerPoint slides that must exist, detailing "Windows telemetry exploitation" or some such. At the very least, the information has to be incredibly useful for targeting purposes.

View on HN

If they are actually making copies of my documents, can anyone explain how Microsoft is not in blatant violation of the copyright laws of pretty much every country? They are actually potentially making unlawful copies of my copyrighted works, no?

Not to mention that they are undoubtedly copying trade secrets, state secrets, private patient data from hospitals, and on, and on, and on...

This seems like it should be an actual big deal. How is it allowed to continue?

You gave them permission to do all those things when you didn't cleanse your machine with fire after that automatic win 10 upgrade, even though you didn't have the legal authority to do so.

I think that means you'll be the one going to jail in your hypothetical scenarios.

I haven't read the EULA for windows 10, but I can't imagine the Microsoft legal team didn't think of this.

Because they're "not using the data". They would probably claim to be a dumb carrier(ala the postal service, even when mail is searched).

Laws around copyright and state secrets don't have this idea of "using the data" you refer to. They focus on copying, since "using the data" would involve showing intent, which is hard to do.

ISP's have argued that transmitting data doesn't count as making intermediate copies (even though router buffers do make copies), and the courts have largely bought that argument.

(Also, there are laws specifically covering searching mail; the post office doesn't have to make legal arguments one was or another about it.)

> ISP's have argued that transmitting data doesn't count as making intermediate copies, and the courts have largely bought that argument.

And yet, the only reason EULAs are valid is because some court decided that copying software from the disk to memory for execution counts as making intermediary copies...

Go figure.

Of course they are using the data. They are not collecting it (mainly) for the NSA, but primarily for themselves.

There's a rabbit hole of nested terms that you consent to when using Windows software: https://www.microsoft.com/en-us/Useterms/Retail/Windows/10/U...

"By accepting this agreement and using the software you agree that Microsoft may collect, use, and disclose the information as described in the Microsoft Privacy Statement (aka.ms/privacy), and as may be described in the user interface associated with the software features."

Someone should file a mass copyright infringement suit. Did they really have permission to copy those documents? Charge them on the RIAA scale of thousands of dollars per infringing copy.

There's implications for legal discovery here too. Remember the other day when one of the documents in the Uber/Otto case was found on a user's machine? What happens when people start sending in discovery fishing expeditions to get documents from Microsoft?

Also, think about them obtaining HIPAA protected data...

There is no copyright infringement. Anyone running Win10 has agreed to give them access via the EULA.

Except where I haven't.

EULA's aren't law in my opinion, and that's what laws are: opinions, collectively. I can't be forced to agree to something that strongly violates other contracts I'm required to be a party to, in my opinion.

All we need are rulings, and the enactment of laws, to support my opinion along with the cessation of wholesale data collection by the OS vendor.

While we're waiting for that all we have is technical solutions.

Although I can run Windows 10, I cannot give them the right to copy some of the documents that I keep on the system. The copyright to those files belongs to someone else.

Not sure that it's copyright infringement. It is straight-up theft though.

I believe you are correct as I understand it the crime is in the distribution not the possession.

The offence is the act of copying.

Do you have a source? This is what I'm going off of.

"How do I know what's legal and what's not when it comes to copying music/movies?

Here's the bottom line: If you distribute copyrighted music/movies without authorization from the copyright owner, you are breaking the law. (Distribution can mean anything from "sharing" files on the Internet to burning copies of copyrighted material onto blank CDs, DVDs, or Flash drives, and selling or giving them to others.)"

http://dmca.ucr.edu/faqs.html

Exact phrasing depends on jurisdiction, but see: https://www.copyright.gov/title17/title17.pdf especially §106 Exclusive rights in copyrighted works p16

"Subject to sections 107 through 122, the owner of copyright under this title has the exclusive rights to do and to authorize any of the following: (1) to reproduce the copyrighted work in copies or phonorecords"

Reproduction is infringement. Distribution of copies is also infringement but carries separate penalties. There's all sorts of carveouts and caveats, but remember Sony v Betamax: it took a court case to invent the time-shift exemption that making a copy of a broadcast TV program wasn't infringement.

What do you think the EULA is for?

Jesus fucking christ! What are they thinking! I cannot comprehend how an organization of Microsoft's size was able to deploy this without huge internal pushback.

There's really no excuse for any of the HN crowd to be running this garbage. It's RCE as a feature! Linux, Linux, Linux, guys.

There's really no excuse for any of the HN crowd to be running this garbage

I wish this were true, but it just isn't, sorry. In reality there are excuses. E.g. we have both old and new hardware lying around which can only be programmed/debugged by Windows. There is no alternative except for maybe spending tons of man-hours trying to reverse engineer the shit out of it and come up with something vastly inferior (but, yay, runs on linux). Or again spending tons of time 'correcting' the original choice of these devices and entire eco-system built around it over the years and switch to something which does have linux support. So: no alternative. Less prominent alternative-wise but still going strong: Visual Studio. And also the pretty-much-everything-just-works principle. Now this doen't really make me love Windows, but does illustrate there are reasons for the HN crowd using it. (next to linux in my case).

Airgap 7 for debugging/interoperability; refactor on a modern OS that isn't W10. Problem?

If your business relies on legacy software that can't be refactored without prohibitive cost, you're probably about to be 'disrupted' by something anyway.

I have a mission-critical DLL with functionality I can't replicate due to patents. It's not about cost. It's due to the patent holder not wanting an alternative in the market place.

This actually sounds like a good use for WINE. If the DLL has few external dependencies, it could probably be made reliable enough for mission critical stuff.

I'd have to pass validation on a non-conforming platform according to the manufacturers documentation. Good luck with convincing regulatory bodies of that.....

you're probably about to be 'disrupted' by something anyway

Obviously. But by that time we'll have switched to something better already.

Unless you crack it somehow, 7 does not work airgaped.

give me one example of any legacy system that can only be debugged or accessed by a windows 10 computer and i will send you $100 in bitcoin, right now.

I would, if I had made such claim. I already explained there is no strict 'can't do that' because given enough time there's always a way.

No. You choose to use Windows. You choose to use shitty hardware that doesn't work with free software. You choose to use Visual Studio (protip: dev on Linux is better than on Windows even without VS). You choose, and you have chosen wrong.

So should we be filtering our applications to companies who are hiring by their dev environment? (Nah man I'm for it, let's kick the platform holy wars into gear again lol)

As I mentioned elsewhere, idealism is all well and good but pragmatic realities are often all that the people 'in the intermediary' can or will concern themselves with. You're not going to make much headway convincing them that an available option that served their purposes was 'wrong'.

Frankly, we're lucky to have Linus Torvalds et al. continuing development of the Linux kernel etc. as FOSS endeavours. Between the pushes for internet fast lanes, against it being a utility here, against hardware hacking, and so on, we're basically on borrowed time from corporate conglomerates having the right-of-way as far as tech governance goes.

I wonder if the folks from the EFF will stick around once they can no longer avoid being outlitigated and outbankrolled at every turn, or if they have a backup country they're heading to.

>So should we be filtering our applications to companies who are hiring by their dev environment? (Nah man I'm for it, let's kick the platform holy wars into gear again lol)

Yes. All your comment is doing is excusing away ethical failures. The most ethical path isn't always the easiest one.

While I don't know how far your advocacy will go in business environments for which nearly every actor - applicants, employers, customers - in the majority operate on pragmatic considerations, and in markets which destroy any non-pragmatic actors for them; but I applaud your efforts and look forward to hearing about any progress you make on this issue.

You've still failed to convince me that there exists a "morality" mechanism that failed in Microsoft's case, per my original question, by the way. The simple fact of the matter is that they're not concerned with morality, and so long as you continue to believe in it as 'existing' in a corporate world without being able to point to 'where', you'll find that shock you felt in your initial comment more often than you'd like.

>While I don't know how far your advocacy will go in business environments for which nearly every actor - applicants, employers, customers - in the majority operate on pragmatic considerations, and in markets which destroy any non-pragmatic actors for them; but I applaud your efforts and look forward to hearing about any progress you make on this issue.

This doesn't have to be true. What should and can happen is that more people take the high road, especially technical people, and work to lower the barrier of entry and make it more practical to join them on the high road.

>You've still failed to convince me that there exists a "morality" mechanism that failed in Microsoft's case, per my original question, by the way. The simple fact of the matter is that they're not concerned with morality, and you'd be a fool to think otherwise.

I don't think otherwise, obviously. The difference between us is that it matters to me.

> This doesn't have to be true. What should and can happen is that more people take the high road

"Doesn't have to be" is not "is" for a reason. What "is" evolved from what "was", and what 'was' was a system that had such efforts competing with profit-motivated ones.

As I said, the market environment is one inherently toxic to those who do not prioritize profit margins - as those who do not are eventually outmoded, outmarketed, outpriced, or (at net loss) simply outwaited by those who have the bigger bankroll (or the biggest sharks capable of working from 'credit' on the backs of investor confidence).

It's not sustainable because those who 'try and take the high road' are punished with failure (and those who do not rewarded) by the simple 'agnostic' market forces generally aggregating the desire to narrow margins. Efforts to outlive that motive have existed in the past, and will likely exist in the future, but do not last because they cannot compete with that motive.

> I don't think otherwise, obviously.

Yet you believe them to have 'failed' to address the morality issue internally (which you expressed surprise at. Believing they would do otherwise?); which you ascribed to the programmers who worked on the software. They don't necessarily know what the work product's end use/implementation will be; that knowledge is likely 'kept on a need to know basis' away from them; and to somehow escape the market forces they're subject to to 'take a bigger stand' against.

Many people could and would starve taking such a stand, and it would not stop the system or slow it one whit; it would keep grinding on with further applicants to the field who do forego morality in lieu of bread on the table.

As I asked elsewhere [0], if you have some idea for how "morality" can be introduced by such actors into their decision process without jeopardizing their livelihoods - I'm sure they would happily hear you out over your third option which would allow them to have both. But if you cannot, I'd warn that asserting "what matters to them" is not as much as "what matters to you", even knowing that no route exists for them to support the cause you tell them they don't 'care' about. That would only serve to alienate them from your message.

[0] https://news.ycombinator.com/reply?id=14059446&goto=item%3Fi...

Have I really? I'm verry happy with my job so that choice an sich wasn't wrong. Oh yes I started that job and entered into a world where it was mostly Windows (that, and the hardware had been chosen already btw). Well, it's ok for you to have the opinion that the young me was doing wrong by not having looked further for another job where there's no trace of Windows, but given that young me hardly even knew Linux existed that sounds pretty ridiculous. Also, stop making silly assumptions and giving false protips. You have no clue how much of my time is divided between Linux/Windows/Mac nor how much experience I have with developping on Linux, nor what kind of software, so your generalizations have no ear here.

You're making plenty of assumptions about me. I started in the Microsoft world. I was a frequent attendee and speaker at local MS user groups and conferences, a volunteer at TechEd, and I sat on the review board for the C#, ASP.NET MVC, Entity Framework, and Azure certification exams.

I have the same background as you and I still think you're wrong here.

Have you written anything about your...uh...conversion? =)

No, maybe some day.

I'd be interested to read it. :)

> internal pushback

I'm really curious what you're imagining the corporate structure to be like here - what kind of "internal pushback" are you envisioning?

In particular, I don't see engineers as particularly getting paid to or even having access to the parameters of the specs they're fulfilling. Anyone bothering to wonder would likely just assume the system they'd be working on to do this would be fully covered by 'legal' in specific agreements with firms to track that info, or if asked would be told that the spec is what it is and not anything about the use case.

Legal, meanwhile, isn't going to take money to tell MS what they can't or 'shouldn't' do; but rather just to ensure they don't have exposure in doing whatever they want to do.

So I guess that just leaves the leadership - which you could argue you're surprised by, if the board/C-levels/etc were individuals particularly known for being privacy-oriented. (Yeah. At Microsoft.) Meanwhile, you have a likely strong potential profit motive in a platform able to shift that kind of control to devs, though at the 'cost' of potentially losing privacy-concerned users - and their profit motive believes they can just EEE those users out of a market of competing products, so they give the go-ahead.

So if there's a 'pushback' module that failed in this scenario, perhaps I don't see it; but I don't really see at what point you'd expect something like this to be 'stopped' internally.

I seriously hope not. That sounds like a really fucked up culture, that's definitely not normal. Moral integrity as an engineer should cause you to speak up regardless of your salary and with enough internal noise higher ups should rethink their strategy.

Engineering tends to assume it works for the "good guys", and I suspect the people that rolled this out did not consider NSL's and the other onerous legal implications of giving themselves access to everyone's hard drives.

I'm not saying it is right, but I suspect a lot of naive engineers and middle management designed the telemetry system.

They produced a product most people cannot use in good conscience; in the long run, it will be Microsoft's loss.

"Moral integrity" doesn't really have anything to apply to to the day-to-day work of an engineer. A moral compass can't work without a magnetic field of context.

Considering most engineers' main concern is just to meet a spec and get it shipped, I don't really see how the burden of ethical justification falls to them, when they don't even necessarily know how it'll be used. Can't really see how they could act as moral gatekeepers in a corporate structure.

That's extremely idealistic.

We humans are so lacking in moral integrity that we participate in wars, domestic violence, substance abuse, abuse of power, organised crime, the list of morally reprehensible shenanigans we get up to is as long as you want it to be.

Thinking the average software developer at large-software-company is an angel and prepared to put their head on the chopping block is fanciful.

>We humans are so lacking in moral integrity that we participate in wars, domestic violence, substance abuse, abuse of power, organised crime, the list of morally reprehensible shenanigans we get up to is as long as you want it to be.

What are you getting at? Are you telling me that I shouldn't think poorly of people who participate in wars, domestic violence, substance abuse, abuse of power, and organized crime?

>Thinking the average software developer at large-software-company is an angel and prepared to put their head on the chopping block is fanciful.

Healthy companies don't have a chopping block they put your head against for speaking up. Jesus christ people.

> What are you getting at? Are you telling me that I shouldn't think poorly of people who participate in wars, domestic violence, substance abuse, abuse of power, and organized crime?

Probably just that you should recognize that the human potential for depraved self-interest being what it is, arguing for what "should be and can be" will never supplant what is, because 'what is' has a near-endless supply of eager workers to support it.

> Healthy companies don't have a chopping block they put your head against for speaking up

"The chopping block" equates to being fired and not able to earn enough to pay off student loans/debts/bills, which are potential costs to a person in the software engineering position you describe as the one that 'should be' taking a stand for your ethics. Job market forces will simply replace this person with minimal cost, and the effort will keep humming along without them.

Not everyone has the privilege of being able to think of idealism and earnings as a tradeoff. Many in the field are trying to earn their way to a better life than the one in their past home, for their families, etc. Idealism is several steps beyond what they can (literally) afford to be thinking about.

This is exactly what I mean, thank you for further elaborating on my comment.

Wow thanks, what is this Linux of which you speak?

B-but muh video games ;_;

> When I close my eyes, it's almost like I can vividly picture the crappy NSA PowerPoint slides that must exist, detailing "Windows telemetry exploitation" or some such

With approval from the gods-on-high at Microsoft, you can stop imagining and have your application fetch those slides for you! :D

The worst part is that this is hyper-targeted and by request, which is the worst possible version of NSA targeting.

The worst part is that the user has to intentionally enable Full diagnostics for this to happen.

Isn't enabled by default and the user has to intentionally disable it?

I installed Windows 10 on a computer last week and every single privacy option was set to the more invasive default. I had to change them all.

Correct. Also they have a tendency to revert settings to those which benefit MS more - they claim 'bugs' but their bugs always seem to benefit themselves.

Yes this is why I dumped win 10. I can't turn off defender. I have to registry hack to shut it down, then it comes back in a week.

Nope. I don't care how much MS pretends to change. They are still scum.

Why would you want to turn off defender? It's the best anti-virus you can get on W10.

* Have used a computer for 18+ years, never gotten a Virus

* Defender slows my compile time down by a good 30-50%

* No interest in providing contents of my files to Microsoft.

What do you base this claim on?

To quote whoever working on Chrome security: "The best of a bad bunch".

Antivirus are terrible pieces of software that prevents triviality you shouldn't have downloaded in the first place.

From the article: "Basic is the default setting, though members of the Windows 10 Insider Program have their systems set to Full."

Edit: sorry quoted wrong article.

I just did a fresh install of the latest stable version (1703, no insider build). Full is the default.

Although the change from previous versions is that you get the "Full-Basic" switch on the initial setup screen.

edit: it's the same setup screen that is shown in the article (The Register). I guess you must have been reading some other article.

It's enabled by default and it will be re-enabled by patches even if you turn it off. But nice try attempting to blame the user for Microsoft being awful.

Even if someone chose to enable telemetry, it is not reasonable to expect them to predict this level of invasive access.

Could someone elaborate or direct me to information regarding the back-porting of telemetry to windows 7?

I permanently have this remove_crw.cmd to uninstall some windows 7 update on my desktop and I'm unclear whether it could be outdated.

I looked into this, came to the conclusion that I was screwed, then switched back to Linux.

There are some github projects and commercial programs from various anti-virus companies that try to turn off the backported telemetry, but Microsoft repeatedly thwarted such efforts over the last few years.

You might be safe from Microsoft data slurps if you run Windows XP, but it doesn't get security updates any more. Therefore, you probably shouldn't give it network access. At that point, you may as well run air-gapped windows 10.

Reply on news.ycombinator.com