Hacker News Reader

Comment by esotericn | Hacker News Reader

The base version of Windows 10, their flagship product (if not in terms of revenue, then mindshare) is stuffed full of adverts and defaults on about 6+ options related to telemetry the last time I installed a VM.

I think it would benefit large companies like Microsoft to realise that this sort of behaviour has knock-on effects. Every MS product is tainted by this because it ultimately has effects on trust.

If it's not making them, or can't be linked to, significant amounts of revenue, it would surely be beneficial in terms of customer numbers to stop doing this. Why?

I don't understand, or believe, that they're making significant amounts from this. It feels like bean-counter style decision making that doesn't take in to account the wider picture.

Anyone from MS willing to chime in?

View on HN

I'm not supporting the Windows-10 style telemetry (I have it turned off) but I don't think this is about money.

Let's take a hypothetical example of where you assign a given user a random ID, based on something (machine ID). You then track what this user is doing, in general, in the operating system.

You can find data points such as what % of users discover/use X feature, how many pin applications to the taskbar, use X app with Y app, have night mode enabled, etc.

This allows you to expend resources where they are actually needed, to improve the features that the majority of people would find benefit in.

And at the end of the day, none of the above features require knowing anything about WHO that person is. Sure, they can be classified into groups based on how they use the software, such as "business user", "power user", or "gamer" ... but not "John Doe at 123 Main Street, Hollywood, California".

This is likely all for product improvement and not for $$$. Why do they subject end-users and not opt-in testers for this? To get real world data at scale.

>but not "John Doe at 123 Main Street, Hollywood, California".

How can you be so sure? Between IP addresses and what wireless networks are available you can get a decently precise location for the majority of users. And this is assuming you don't just capture the address and name when they type it in.

Okay, so maybe they aren't using it for evil yet. How many times has a large corporation been able to indefinitely resist the pull of an alternative revenue stream where the majority of the cost has already been paid?

> How many times has a large corporation been able to indefinitely resist the pull of an alternative revenue stream where the majority of the cost has already been paid?

Agreed. They are mining and storing a mineral (our data) that they may enrich and sell (or lose via theft) one day in the future. This is the worrying part. This is a direct violation of GDPR which states that if you don't need the private data for an explicit purpose for the user (not your company) then you are not allowed to keep it.

But it’s not your data they are collecting.

They are collecting usage-stats, aggregated data, in a way which deliberately has been decoupled from your identity so they won’t have to face the kind of liability issues you just mentioned.

If anything, MS seems like one of the few big actors in IT which “gets” GDPR, and they are using it their advantage in the enterprise market.

Of course unwanted telemetry (no matter how anonymized) is going to taint that image somewhat.

If my actions generate the data then it's my data, decoupled from my identity or not. Without my actions there's no data for them, ergo it's my data.

If they'd like to give me some consideration for my data I'd be happy to entertain their offer. (Being granted the right to use the software, in cases where I'm paying for the license, doesn't constitute consideration to me.)

Your comment (action) just caused my aggregated cell-phone data-usage to increment by 200 bytes.

Do you own that data? Where do you draw the line?

Actually you don't. By that logic your order history on Amazon is your data but it is expressly not.

If there is transparency with regards to the algorithm used, name one good reason why anonymized data is verboten.

Not alleging there is such transparency here, just raising the question. It always seems like even anonymous telemetry is considered harmful, and I don't understand why that is from a conceptual standpoint.

It's conceptually difficult for me to understand how anonymised data can be useful in any way.

There's probably, like, a particular way I move the mouse from the bottom left to the top right corner of my screen. A 'mouse cursor gait', if you will.

To be frank though, there doesn't need to be a reason. You're treating this as a Stockholm-syndrome esque situation - I don't need to use Windows, I definitely don't need to justify why I don't like certain aspects of it.

Mine was more a general question, not specifically regarding Windows itself.

Some people do need to use Windows for various reasons. Consider yourself lucky if you don’t.

This is a common theory of telemetry but ultimately I don't think it makes sense.

It's a relatively new addition to the landscape and Windows isn't any better or easier to use than the 2000/XP days - at least in ways which telemetry would influence - the genuine improvements are all obvious wins like display compositing, kernel stability, etc.

It also dismisses the point that by including telemetry you've excluded some users, and your automated collection won't be aware of it at all in many cases.

Some won't ever use Windows 10 as a main desktop OS because it attempts to spy on them. They won't recommend it to others or develop for it either.

Other power users will use it, but will opt out. So your telemetry is now completely biased towards non-power-users.

This isn't sour grapes - I wouldn't be using Windows anyway because I'm a free software advocate - I just wonder if they've realised that the incentives line up to effectively ignore some of their "best" users.

> This is a common theory of telemetry but ultimately I don't think it makes sense.

It makes loads of sense, to me. It started with the Customer Experience Improvement Program, WAY back in the Windows 2000 era, if I recall, which you would see an option to enable or disable when you installed a Microsoft SDK. They clearly saw benefit from this information, so they expanded it to include the whole OS.

This collects lots of data for them, which helps them understand the usage of their products better, and a nice side benefit is that they can use the knowledge gained by organizing and inspecting this data in their "big data" offerings on Azure and in other places internally.

The greatest benefit of Microsoft's telemetry to others is that everyone focuses on MICROSOFT's telemetry, argues about MICROSOFT's telemetry, debates MICROSOFT's telemetry, endlessly, while literally 90% of the rest of the software you use (99.9% if you count software you use that isn't on your computer, like servers, routers, web sites, and so on) collects telemetry, also, even when you think you've turned it off. Nearly every game you have installed on your phone collects FAR more about you than Microsoft has ever dared try to collect, and no one knows or gives a damn because "OMFG MICROSOFT I HATE MICROSOFT

I don't care if they collect usage information from me. I truly don't. The entire Internet is trying to make me feel like I should care about usage data that originates from my computer, but I don't. I don't feel like it's my data if it truly is telemetric data about software usage.

I would use more free software if more of it were good enough to use. Of course, a lot of free software is GREAT, and I use a lot of that stuff, rather than paid alternatives.

To expand on that last bit -

The reason they might want to just collect all data without asking is that there's a chance that making it opt-in could cause bigger bias problems in the data you collect. For example, what if "power users" are significantly more or less likely to opt-in? You could end up with a very distorted view of what features are most popular, or are giving people the most trouble.

Not saying that this concern is well-founded (I really don't know), or that this choice makes sense from a business perspective (I'm skeptical). Definitely not saying that this is the ethical choice to make (it isn't). Just trying to shed light on a possible thought process.

It's also worth mentioning that Microsoft is, to the best of my knowledge, relatively scrupulous about keeping their telemetry data anonymous. Meaning that they're still being way less sketchy about this stuff than your average e-tailer, or mass market retailers like Wal-Mart and Target.

Do you have a cite for how well they anonymize? Is it as strong a position as Apple (e.g. differential privacy)?

Except they are taking things like file names, e-mail headers, recipients, and even in some cases they are taking documents. The recent recommendation from them was as follows:

From - https://www.theregister.co.uk/2018/11/16/microsoft_gdpr/

"...[Microsoft] also recommends simply not using the web-only version of Office 365, or SharePoint Oneline. And it recommends periodically deleting the Active Directory accounts of VIP users and creating new accounts for them so that the diagnostic data associated with those accounts is eventually deleted."

Seriously, we should be deleting and recreating accounts in our own fucking domain to keep the data anonymous? Why is that on us?

They have you AD account info, and diagnostic data directly tied to it. There's no anonymization going on here at all. They're gathering it recklessly.

Also from that link:

"Much of what Microsoft collects is diagnostics, the researchers found, and it has seemingly tried to make the system GDPR compliant by storing Office documents on servers based in the EU. But it also collected other data that contained private information and some of that data still ended up on US servers."

Power users are already the only ones opting out. Maybe that's why it has become what it is.

Good point, I spent a few hours tweaking win10 exactly to my taste and telemetry was one of the first things to go.

How much time have you spent making sure what you set hasn't been overridden after an update? Once I realized it was going to be a life-long battle, I swore off all MS products for personal computing.

The problem is that a lot of their telemetry and data comes from the Windows Insider program. These are the users who get the releases early to test. I don't know an average person who would want to test new features early, and deal with buggy releases and more frequent updates. And I don't know any power users who would even try to use an insider build for daily production use, since it's going to interfere with day to day work. If I had to guess, the insider builds are put mostly on people's secondary computers, where they will log in and fiddle around, then go back to doing what they really need to on a stable build. Seems like their data is biased from the beginning to me.

> You can find data points such as what % of users discover/use X feature, how many pin applications to the taskbar, use X app with Y app, have night mode enabled, etc.

> This allows you to expend resources where they are actually needed, to improve the features that the majority of people would find benefit in.

Let me give you a different idea. Instead of allowing you to expend resources where they are actually needed, it allows you to (often incorrectly) guess what users are trying to do.

Product improvement? You're not improving the product at all if you're not directly engaging the user.

Keep in mind that your IP address is part of your PD under the definition of GDPR.

I don't mind the telemetry, I object to advertisements for Windows Store apps on the lock screen.

That is clearly about money.

> but I don't think this is about money.

> to improve the features that the majority of people would find benefit in.

> This is likely all for product improvement and not for $$$.

Read those sentences again. They are doing it so they can make $$$, whether that means nefariously using your data for advertising/tracking OR improving the product, it 100% translates into making money for them. Improving the product means they continue to sell the product you continually pay for.

I think you're missing the overall point - any for-profit entity that tells you it won't infringe your rights, will eventually infringe on your rights. Especially one that takes $110B/yr in revenue. I'd be happy to share countless stories of for-profit entities, especially in tech, that do this.

I think there's a big difference between these two things:

> 1: Using customer data to improve your product, to make them happier paying for it, which makes $$$

> 2: Using customer data to sell to someone else or to sell the user's attention, which makes $$$

The extra level of indirection through a product that you deliver to the user that provides value to them makes a huge difference between these two ethically.

That said, I will admit that a company can move from 1 to 2 completely seamlessly, without the knowledge of the user. A bean counter, unscrupulous wallstreet exec, or changing priorities may take something that was intended to only ever be 1 and turn it into 2. This risk may be too high for you and that's your call to judge, but I find it hard to fault a company just for trying to improve their product.

I do wish more companies took Apple's "differential privacy" approach which allows the data collection technology itself to draw a hard line between 1 and 2 that can't be crossed invisibly.

> but I find it hard to fault a company just for trying to improve their product

Nor do I. So the argument thusly is -> why make the opt-in/out so difficult to manage (e.g. dark patterns)?

Windows XP did not have this kind of telemetry, yet everyone loved it and things were improved with service packs. I don't agree with this spying.

It's the same excuse always. Nowadays everyone suddenly needs tracking for everything, from softwares to TVs and cars.

Everybody did not love it, it looked like a toy compared to the ‘rock solid’ Windows 2000. Only when Windows 7 came out everybody suddenly loved Windows XP.

Windows 7? I thought Windows Vista was the highly successful recruiting tool for the Windows XP Fan Club.

You are right, I must have blocked that subconsciously.

This kind of argument is what companies always say is the reason for telemetry, yet somehow it finds it's way into being sold and abused for spam with distressing frequency. At this point it behooves us to not take information that has repeatedly been proven to be false at face value.

>I think it would benefit large companies like Microsoft to realise that this sort of behaviour has knock-on effects. Every MS product is tainted by this because it ultimately has effects on trust.

Those kinds of effects are hard to measure and quantify even if they are critically important to the long term success of a company, whereas the revenue from whatever they're doing with this data is directly reflected in their quarterly earnings report.

I run Pi-Hole DNS and Windows 10 is extremely noisy. I'd say half of my top 'blocked domains' are Microsoft owned, and there's only one part-time Windows machine on my network.

I guess it depends on what's on your network. Here's my top blocked devices (https://i.imgur.com/TQxvnmi.png)

Roku devices are far and away the noisiest devices on my network.

Android seems pretty awful too, the higher the version number the more noisy it gets.

All of my Windows machines are running with the lowest level of telemetry that Microsoft permits you to set, I don't use any of those reg hacks hosted on github. Interestingly a Windows 7 laptop is much noisier than a Windows 10 laptop. Surprisingly Windows Server 2012r2 makes the shit list too. What's strange though is an always on Windows 10 desktop isn't even on the list.

Interestingly Amazon Echo and Google Nest DNS traffic is rarely blocked despite them being the top clients (behind Roku) by a fair margin.

I mean, yeah, everything is kind of crappy.

The DNS logs for my home network are full of proprietary stuff.

All of my actual work systems do queries when I use them and that's it. Extremely rarely there'll be a hit out to NTP.

It's quite amusing, because by percentage, the systems I use 8 hours a day are barely even represented in the logs (contrast with my Android phone attempting to hit Google DNS and being prevented by the firewall, over and over, _forever_.)

I used to have a s8 with a firewall. Every 2 minutes it blocked a connection attempt to google 24/7...

>Anyone from MS willing to chime in?...

If MS is making money from this, the last thing anyone involved in it will do is tell you how much.

And since there's seems to be a GDPR violation in here, the only thing a microsoft employee would be authorised to do is refer you to the official press release.

The entire tech sector is being funded with advertising money. Monetization of personal data is the elephant in the room that nobody in the industry wants to talk about ever.

The Enterprise version was full of adverts. After running through latest updates, I had to uninstall store apps again. I'm getting a new PC in a week, I fully expect to spend time tracking down a Powershell script to uninstall a bunch of crap (thinking about it: that script was for visual studio to uninstall crap add-ons).

https://github.com/madbomb122/BlackViperScript

I was made aware of this from blackviper.com, a great place for windows service configuration information and reccomendations.

This may help you with the new PC:

https://news.ycombinator.com/item?id=18156776

https://news.ycombinator.com/item?id=18156955

Maybe they want to be more like google, ad-driven - when you compare revenues and overall state of the companies, I can understand why some top managers decided for this. Also testing how much users will allow, which is a threshold constantly moving towards more apathy.

Its dumb, dangerous to users and I hope they will get a massive slap on the wrists. But Win10 is out for long time and nothing is happening.

This. If they’re convinced that it’s a good path for home users, it needs to be an automatic off for Enterprise editions not an ever changing list of Group Policy and MDM rules.

Wouldn't they be saving tons by not having to hire QA or do user experience testing? They can just push stuff into the wild and see how users tolerate it.

Reply on news.ycombinator.com