Hacker News Reader

Comment by GordonS | Hacker News Reader

Microsoft has faced so much criticism for their approach to telemetry - I don't really understand why they don't at least provide the option to opt out of all telemetry.

If they left it enabled by default, but provided an option to opt-out, realistically only a small segment of users would do so, and most of them would likely be power users who are already taking other steps to try to prevent telemetry being collected and/or sent. So they'd take an insignificant hit to telemetry, but would gain a lot in goodwill.

Any reason not to do this?

View on HN

Telemetry isn't just a tool for product managers, but it's also a goldmine for national security agencies (more than just the NSA; Bing is unblocked in China for a reason).

Anti-government meme made with GIMP at a specific timestamp? One search through the telemetry logs to find who exported a file at that exact moment.

Any data collection is also government surveillance unless proven otherwise.

Microsoft provides a tool that allows you to see all telemetry that’s captured

https://blogs.windows.com/windowsexperience/2018/01/24/micro...

I don’t work for microsoft anymore but I laugh at these sorts of suggestions. I don’t know much about bing but I do know a decent bit about the telemetry pipeline and the idea of an anti government meme detection is ludicrous at best.

With all due respect, the danger to a telemetry pipeline is almost always downstream effects, like court orders to intercept network data or human assets that knowingly exfiltrate data. Even if you assume that Microsoft has the best of intentions and that all of the telemetry is for the purposes of improving the software experience, it’s a naive assumption that this doesn’t increase the attack surface substantially. With no user accessible kill switch and with all teams operating with good intentions, you still stand to create scenarios like telemtry-for-surveillance, even if the probability of such a scenario is small in the grand scheme of things.

> the idea of an anti government meme detection

That's a fun strawman you made, but the actual idea in the post was that telemetry might note when different programs do events like save.

Imagine believing that Windows telemetry contains such data.

Imagine not knowing about The Coalition for Content Provenance and Authenticity https://c2pa.org/

Imagine trusting Microsoft.

Because they are pivoting to being an ad company like Google.

GDPR requires the opposite, data collection has to be opt in. I don't really see why the telemetry they capture doesn't count as peoples personal data honestly, it should given how much behavior information is available from it.

I believe it’s only opt in when it contains user identifying information. Information on did a feature work or not and how long search indexing took isn’t particularly sensitive once you strip off any device identifiers.

But... You've just described how fingerprinting on the web works. How is this not uniquely identifying information?

Reply on news.ycombinator.com