Report on Microsoft Office and Windows software: still privacy risks remaining
privacycompany.eu
privacycompany.eu
It's not so long ago, in 2011, they had this video, targeting Google's privacy problems: https://www.youtube.com/watch?v=9x4_dozWkq0
Now they're no better than Google. What happened?
Today there's lots of old code from the era before automated tests were widespread in the industry, and often automated tests which were previously maintained by the testers are now bitrotting. The culture of testing is not strong among developers in some parts of the company. The beta program can't catch everything either.
So telemetry it is.
And you need some telemetry. Minidumps/coredumps make debugging certain kinds of crashes much easier, and Apple captures that sort of data too. And I guess seeing whether people use some widget in Office a lot/not at all could be useful for improving the product. In practice it also leads to issues with the GDPR and governments, which MS does ultimately fix.
Apparently Win10 Enterprise users have a switch somewhere where they can turn off almost all telemetry, but not so for Home and Pro users, say what you will about that.
I was at a company that did the same (at roughly the same time) - this was a terrible mistake. But it's very hard to discuss, because any dev complaining sounds like they want to avoid testing.
Dear manager that I hope reads this:
QAs, at least the ones under discussion, aren't just mindless pressers-of-buttons. They have a skillset and domain knowledge just like (but distinct from) devs. A dev should absolutely test their own code...but they will do so with their domain knowledge which will be by definition more limited than someone for whom such knowledge is a key part of the job. Devs should test so that only problems worthy of the QA skillset make it to the QAs.
Asking devs to do QA work is asking them to build skills that are not their strength, and that will come at the cost of their strengths. It is asking them to build skills they probably don't enjoy, and that will come at the cost of their job satisfaction. Having devs do QA work is as bad as devs that test nothing and leave it all for the QAs - it's an inefficient and ineffective use of resources and time.
There is nothing wrong with encouraging Devs to deliver higher quality code to the QA/Test engs. There IS something wrong with thinking higher quality code from devs mean you don't need a QA/Test Eng.
In either case, it's also like cutting off your left arm because you still have your right arm.
My experience is across three different companies now, and in the first two (not my current employer who... still do it wrong but it's the best I've seen), they fired the Ops guys and expected the Systems Engineers\Software Engineers to take those roles.
No overtime pay in either company for the extra work load that was placed on them (e.g. me) of course. So the only cost the companies incurred was productivity and the quality of work. The burden was entirely carried by the staff and to a greater degree the clients who accept a shoddier product and service.
Fortunately I quit both jobs to get to where I am now, though the old timers no doubt are still working ridiculous hours and are too scared to ask them selves "can I find better else where?".
Long term, doctors aren’t nurses and patients suffer. Eventually someone dies.
This ignores that it discards specialisation, not merely quantity, and that testers are generally cheaper than developers.
And then QA does their good job and gets hate for saying that accidental nuclear genocide [or whatever] might be a bad thing so let's fix that before release to the customer.
Sure, "code to spec and you're done". But are you actually really done? Are you sure?
> ... Devs are expected to test their own code now
I'll never understand this line of thinking. A good tester doesn't think the way a good developer does. It's a different but equal and necessary skill in order to provide a strong product.
Not only messy, but also quite deadly.
And messy.
I don't know how Apple does it, but crash reporters have been around for a long time (Netscape had one!) and would always ask you if you wanted to send a crash report.
Then you have products like SCCM that are now forever beta, and they play games with release cycles so that you literally have about a 3 week period to report substantial bugs and get a fix. Before that, the product isn’t generally available. (You need to use “pre-release” to keep up with the quarterly updates) After that, you’ll be told that it’s too late in the cycle to fix bugs, because they won’t be fixed until after the support cycle ends.
- B2B is a large part of their income, telemetry has probably damaged their reputation as a business vendor.
- They have mostly failed at social media (except LinkedIn and Skype, which they have bought). So, there is no strong need for them to collect all this data to profit off (otherwise free) social media.
- They have a strong developer story with WSL, Azure, etc. They could have replaced Apple as the darling of developers. But not with telemetry, start menu ads, etc.
- At least in the EU, more privacy is where the puck is going. They could take on Google's weaknesses.
Ironically, it's Europe where privacy championing Apple is way less of a player than Google when it comes to smartphones and services, especially compared to the US market.
So I'm not sure if a privacy conscious approach would buy them much in the EU, at least among consumers.
Overall, I would say consumers' privacy-sensitivity in Europe expresses itself largely in the increased usage of Telegram, Tor, Firefox, and Linux compared to the US.
That's partly because Apple's rhetoric is not always matched by the practical realities of its devices and services. Are they better than Google/Android? Sure, by a long way. Are they actually good? Different question.
For example, assume that you do not wish to transfer any data to or from your Apple device via any third party online system, including Apple's own iCloud, at least not unless it is fully end-to-end encrypted and there is no realistic possibility of the external system reading the data. Instead you prefer to keep everything local, for example connecting to another device over your local network or directly using one of the secure wireless mechanisms. This should be an entry-level requirement for any genuinely privacy-focussed system, yet to this day Apple's lock-in effects and the lack of end-to-end encryption for many types of data using iCloud are in direct conflict with achieving that most basic of privacy requirements.
Apple has only just introduced the ability to transfer everything from one iPhone to another directly. You still infamously can't transfer many common data sets onto or off those phones through standard protocols, and Apple's proprietary software seems to have a poor track record, again pushing users towards iCloud.
If the particular app you have in mind doesn't support that feature (most of the ones I use do), that's not Apple's fault.
And the fact that Apple's entire system uses a proprietary storage scheme and doesn't support standard protocols other than for a few specific cases like photos clearly is a decision that Apple has deliberately made.
IME, wirelessly iTunes can be flaky, though better than in the past. My direct personal experience is that if you use a wire, as stated, it's flawless.
Originally iMessage was supposed to be opened up for third parties but that never happened for some reason.
Isn't that mostly explained by the fact that EUR prices have VAT included (typically 20%) and US prices do not?
Even things like the giant Console rewrite and WSL apparently owe just as much to telemetry meriting their resources as the (return) of Azure and DevDiv's "developer-first focus" to Windows (after all these years).
(A fun irony of the "Start Menu debacle" to which you refer was more of a sample size problem than a telemetry problem. With Windows Vista-8 keeping telemetry primarily opt-in, they mostly only had interesting subsets of newbie/casual users that clicked yes during setup and power users with vested telemetry interests. Newbie/casual users tend to launch apps "Search only" or "Desktop only" keeping all their shortcuts on the desktop. Power Users tend to use alternate launchers or become increasingly "Search only" over time, especially if you count Win+R old timers, which Windows did. Microsoft had a good argument that trying to make the telemetry opt-out would avoid such biased sample sets going forward.)
I'm used to this on web and mobile - because arguably their apps are their private property which I'm using, but there's something incredibly uncomfortable about my operating system running an experiment on me. I get that Windows is also Microsoft's property, but it's the lowest level in the stack, which makes my hardware more theirs than mine if they're able to do what they want with it.
I'm not even against telemetry as long as it's transparent.
Maybe I'll go back to Linux soon.
The biggest/wildest example that was A/B tested to date was Sets. Sets was a feature/system where nearly every window in Windows was heterogeneous tab-capable. (Illustrative example: Open a Word document, add a tab for some OneNote notes, add a browser tab for some research. Save it all as a Set to the Windows Timeline as Set, open it all back up at once.) But ultimately Sets never made the cut out of testing (too many compatibility issues, not enough telemetry usage, too confusing a UX sometimes, not enough apps in the wild with Windows Timeline support, etc) and it sounds like the project is now dead.
(Supposedly it was partly dropped too because apparently they were piggy backing on Edge's UWP tab control and with Edge going "Edgmium" that tab control was considered less critical infrastructure to any team and less of an "in-box" control to piggy back off of. Microsoft Terminal got a version of the UWP tab control pushed out into the open source UWP control toolkit, but probably not in time to be reconsidered as an in-box control for Windows.)
(I was sad I never ended up in the group with Sets turned on. I wanted to play with it.)
(ETA: Also, I really hope as Edgmium gets closer to launch it uses a XAML Island to pick back up the UWP tab control where possible. That would be one great way to feel a bit more Edge and a bit less Chrome knock-off.)
They fail to understand that "Be Like Facebook" is not a positive aphorism or outcome.
Office has sent documents in crash dumps up to Microsoft for a long time. None of the hand wavy security guys say much about it, because it isn’t an audit finding.
Hardly, from my perspective, but do you have sources for that claim, or for Apple formerly being the "darling" for that matter?
Much much bigger than Apple by having much much more marketshare of everything except smartphones.
Don't their Enterprise and business editions of windows omit all the telemetry?
Overall well done PrivacyCompany and the Dutch Ministry of Justice and Security. Still seems to be fights left to have, but this is definitely a step in a positive direction.
> Still seems to be fights left to have, but this is definitely a step in a positive direction.
Indeed. From the article:
"The Dutch government’s new privacy terms and conditions do not (yet) apply to data processing via Windows 10 Enterprise or the mobile Office apps. It is not possible to minimize data traffic in Office Online. From at least three of the mobile apps on iOS, data about the use of the apps goes to a US-American marketing company that specializes in predictive profiling. This is done without providing any information about the purposes of this processing, and without giving the users or administrators any possibility to prevent this processing."
So: use Office on iOS, and it'll send usage data off to some predictive profiling marketing firm.
Why, as a (presumably) paying user, is it OK for Microsoft to do that?
I've been sitting for months on this article explaining my belief that advertising is a cancer on modern society, and I can't get myself to publish it, because literally every other day brings another thing I want to include on the list of damage being done. I'm not even actively looking for examples anymore; I just open HN and - lo and behold - top story tells me that MS Office mobile apps send data to US predictive profiling company, because of course they do.
Edit: Sorry I don't have any exact citations, he said it in an interview wit Ryan Grant, so I'm sure he has a source he read somewhere.
That by itself isn't necessarily damaging though, is it? Without knowing what company is getting the data, what data they are getting, and what they are profiling for, how can we come to any conclusions?
What if they are just trying to segment users into casual and power users and are using the data to guide future product development and design?
That said, the data sharing should definitely be opt-in.
Is that something you'd hire an external marketing company for predictive profiling, though?
Sure, the quote doesn't give much information about the company and their use of data, but when evaluated in context of typical data sharing with third parties, it's highly damning until proven otherwise.
I don't know. Are there predictive profiling companies that don't work in the marketing sector?
At least, unless it is cancer cell growth.
Oops.
@Microsoft folks here: This, if true (edit: in the way presented here) is outright disgusting.
I have lately found myself defending you when people have been complaining about telemetry (I'm a developer myself so I can see the value), but selling (or giving away) data from Office apps to profiling companies is not ok.
I honestly believed that your upside of such deals was the ability to easily upsell me to a paid version of this software.
This, again if it is correct, is disgusting and might easily be a huge GDPR issue despite how many cookie warnings anyone adds.
Indeed, remember that warnings here a not enough to comply with the GDPR. IANAL, but GDPR requires opt-in rather than opt out, there should be a clear choice, permission should be asked for specific purposes. Also, it should be possible to withdraw permissions, one should be able to retrieve all the stored data, and the data has to be removed on request.
My understanding as well. And the way it has been presented to me is that clear choice means easy to understand (and notice).
Consent should be given by a clear affirmative act (...) such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject’s acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent.
> The suite of apps is free of charge for consumers with devices smaller than 10.1 in (26 cm), but business customers need to purchase an Office 365 subscription to take full advantage of the suite on larger screens.
You need to sign up for a Microsoft Account either way.
Italy https://www.linuxjournal.com/content/italian-army-switches-l...
France https://joinup.ec.europa.eu/collection/open-source-observato...
Seeing is believing. This has often been used as a strategy to get license discounts from Microsoft.
The interesting take-away from the article and the linked article is that in part they used the GDPR and Dutch privacy laws to force Microsoft into compliance:
The processing of diagnostic data for so many broad and undefined purposes is contrary to the principle of purpose limitation. Additionally, in most cases, there is no legal basis for processing the diagnostic data for these purposes. As (sole or joint) controller, Microsoft cannot rely on the consent of employees as referred to in the GDPR because of the dependent position of employees. At the same time, consent is required under Section 11.7a of the Dutch Telecommunications Act for retrieving data via the Internet, through built-in software, if such processing is not strictly necessary.
Which means that the GDPR does have teeth, which is good for everyone in the EU, not just governments or larger organizations. Similarly, the EU court of justice has recently decided based on the GDPR that web sites must ask consent for sending personal data by loading Facebook like buttons:
https://www.reuters.com/article/us-eu-facebook-dataprotectio...
Can any MS employees jump in and justify how you find this acceptable?
I'm curious to see how MS responds. There are several unanswered questions that I'd like answered. Specifically:
1. Any disputes about the factual nature of these claims?
2. If not, what is the third party doing with the data?
* Google Firebase Analytics
* HockeyApp
The former I've seen in about 90% of apps I've downloaded from the Google Play Store. The latter claims to be "the best way to collect live crash reports, get feedback from your users, distribute your betas, and analyze your test coverage." Oh, and Microsoft owns it. [1]
Neither seems particularly unusual to me. I wonder what has caused this much outrage:
* Assumptions about the nature of the "tracking" ("specializes in predictive profiling" leaves a lot to the imagination)
* Assuming that other apps aren't doing the same thing
* A general expression of anger at all apps that have embedded scripts like these
[1] https://devblogs.microsoft.com/bharry/microsoft-acquires-hoc...
Mind you, where I live, political assassinations, industrial espionage and assassinations and whatnot, although rare, DO exist, so privacy is important (specially for me since I AM actually registered officially as a politician although I never won any election)
But I use Windows for three main reasons:
1. To not "forget" how to use it, so I can maintain other peopel computers (for example a bunch of computers on some of my startups use windows because users refuse to switch to Linux for whatever reason).
2. So I can use some CAD and 3D software that are Windows-only (I am so mad at this, not even OSX versions of some of them exist, and they are so finnicky, even on Windows they are so unstable, using Wine and whatnot they just crash a lot), mind you I am talking both about mechanical engineering and whatnot CAD, and 3D art software, I work with both (one of my startups is a game design company, another one sells replacement parts for industrial machinery)
3. To play some games...
That said I am managing to phase a bit to Linux better now, my SO has a dual-boot machine but she never logs in on Windows, and I am often gaming on her machine and making sure to buy only games that can run on her machine, still some of my favourite already owned games are Win-only and don't run on Wine. (and lot other favourite games are DOS but... DOSBOX is awesome :D)
https://www.overclock.net/forum/132-windows/1587577-windows-...
https://betanews.com/2019/07/11/microsoft-adds-telemetry-win...
/tinfoilhat
-Minimum (Security)
-Full
The report goes into lengthy detail explaining the default level is Full:
« The IT-pro’s (administrators) of the Enterprise version can choose between three telemetry options (Security, Basic or Full). If the administrator chooses to suppress the privacy-related set-up experience and does not adjust the setting otherwise (e.g., by group policy), the default diagnostic data level setting is Enhanced. 51 At that level, Microsoft explains it collects “Additional insights, including: how Windows, Windows Server, System Center, and apps are used, how they perform, advanced reliability data, and data from both the Basic and the Security levels.” 52 . In that case, the setting for diagnostic data presented to end-users is set to Full »
Does anyone know what, if any, product improvements have been made thanks to telemetry?
https://arstechnica.com/information-technology/2017/04/micro...
"As an example the company offered us, there was a problem with the Windows Alarm app. The Alarm app can have more complicated interactions than one might think, due to its interactions with system sleep (it can wake a machine up if necessary) and the notification framework. Some Windows users reported that their alarms weren't consistently going off. As is often the case with annoying bugs, the problem was intermittent, appearing to occur randomly and hence difficult to reproduce for debugging. With information collected at the Full level from a broad range of affected machines, the company's developers were able to ascertain the precise combination of factors leading to problems, and discovered that alarms became more unreliable as they grew older. The bug was fixed, and a patch was deployed.
Another problem the company described to us was that certain combinations of audio drivers and audio hardware were resulting in audio that was broken or missing certain special effects. The telemetry data enabled the exact pairings of drivers and hardware that had issues to be pinpointed, enabling a fix to be developed."
It's an especially hard sell for me as, anecdotally, I've had _far_ more issues with Windows 10 than I ever had with 7. Recent one (1903 update) - virtually all text disappeared (desktop icons, menus, Notepad docs all appeared blank, and it made the address bar in Chrome take up about half the screen for some reason). On about 1/10 reboots, it would _eventually_ work if I restarted explorer.exe (text would start appearing in Task Manager, which was my cue to restart explorer). Safe Made, clean installing my graphics divers (assuming it was some sort of rendering bug), and sfc/DISM all failed to fix it. I eventually fixed it by (which was a shot in the dark more than anything):
1. Taking ownership of C:\Windows\Fonts
2. Deleting everything in \Fonts except files that are in use
3. Using sfc /scannow to restore to contents of \Fonts
4. Restoring ownership to Trusted Installer
All in all, not a fun process, and a couple of hours lost. I then wasted another 20 minutes or so as subsequent Windows Updates were failing, so I rebooted a few times to retry and was troubleshooting Windows Update. Apparently it was just installing in the background, but didn't feel like telling me that (it was just saying "Install now", then giving me a generic error code).
Similar issues have happened often enough that I'll delay updates until I know I don't _need_ my machine for at least a day. I never got to that stage with XP/Vista/7.
I would surely donate some quid myself but I'm also 100% sure a lot of big names would follow making the thing self sustainable, as I'm not the only one feeling uncomfortable by knowing that my personal data is managed by companies that profit from people personal data (therefore including Google and others). This problem hits everyone: I may choose not to use any of their software on my machines, but I have no chances of convincing either my doctor or my lawyer to do the same, unless the practice becomes widespread and non technical users too are made aware of the issues.
Well that's a dark pattern if I've ever seen one. Worse it suggests that before version 1905 there were only two options for telemetry, and neither of them was no telemetry.
There was this report posted last year [1] where Norwegian Consumer Council was reviewing dark patterns used at facebook, Google and Windows.