What is it with MS these past few months? It's like they're trying to throw away the little community goodwill they managed to build up over the years.
They are as hostile to free software as they ever were. Why wouldn't they be? It's antithetical to their business model. The only thing that's changed is how sneaky they are about their time-honored tactic - embrace, extend, extinguish.
I was thinking the same. It's not been a good few weeks for them. They're quickly losing trust which was hard to acquire in the first place given their history. Maybe a timely reminder to mention Halloween [1] ?
- rebrand as open-source friendly, only open-source whatever narrow side-projects they barely care about but could be run on other systems (VSCode, Powershell); distribute official packages with spyware
- monopolize the education system by offering bribes including gratis hardware devices to whoever in State education will work with them to pretend Microsoft loves kids and kids need computers (with Microsoft software, obviously) to learn anything in the 21st century
- force manufacturers to deploy "TPM v2.0" on their new machines so they can run Windows 11, continuing the push so that people have 0 understanding and control over the machines they own (instead are controlled by the machines), and don't have a choice of system because "SecureBoot" [0]
- love Linux! let them integrate all your POSIX/Linux APIs in a VM on their system, so that you never have to use anything else than Windows ever again (embrace...) ; it's just like reverse-Wine (execute Windows program on free systems) except they have an army of developers with $$$$ and don't have to waste time reverse-engineering anything because they have the source code to both systems... how convenient!
- viruses are such a huge problem, if only we had some sort of digital signatures for software, and trustworthy places to get it from?! sure let's have a Microsoft market where you can buy adware/spyware signed by Microsoft, with two key advantages: 1) it's super faster because signed software is not inspected real-time by Windows defender 2) noone else can make their own "appstore" repository with their own signature keys (like we do with Flatpak/APT/nix/guix) ; very soon they can start to hide how to run programs unapproved by Microsoft like Android or MacOS [1] have been doing... and it's all for security, right? because app-store monopoly has definitely stopped malware (oooh that's a nice flashlight app you got there Google Play) without harming FLOSS/hobbyist devs (yeah sure)
It's just *washing (openwashing here) straight out of marketing textbooks. If you know/learn anything about capitalism and public relations, you won't be tricked next time!
[0] Briefly touched upon in this bigger article about how Microsoft is still evil, why Secure Boot has nothing to do with security, and why hardware manufacturers happily play along: https://www.haiku-os.org/blog/mmu_man/2021-10-04_ok_lenovo_w...
[1] There was even this worrying story at some point that MacOS would refuse to open applications (whether signed or not) because their centralized server could not be reached: https://news.ycombinator.com/item?id=25074959 <-- Soon coming to your Windows setup
Yeey, brave new megacorp world!
- is the exact same message being sent to many users?
- does it look like previous spam?
- are messages from this host being reported as spam by users?
We have plenty of techniques to filter out spam (those above and technical ones like DKIM to enable host reputation systems) and they mostly work great. What Google/Microsoft are doing is just monopolistic attitude and has nothing to do with spam filtering. Spam from big email servers is still common, but legit emails from smaller servers will not reach intended recipients, and will not produce any indication of that on either side of the communication. It's just silently going in the trash.
If there was at least a decent way to get allowlisted on their side, we could give them the benefit of the doubt and accept that email ecosystem has turned to an opt-in federation model. But the way they do it and prevent recourse is a clear abuse of dominant position to crush the competition.
Before I moved to fastmail, my email was consistently getting nullrouted by microsoft. Everything was setup correctly (SPF, DKIM, DMARC, ARC, etc...), and every other mail host I tried would receive my mail correctly. I send out a very low amount of email (3-4 per month?).
We (small devshop + some hosting + self-hosted email) hosted a few things for a foundation for years, and about two years ago they migrated the mail stuff to MS. (We continue to host a few sites, domains, DNS.) Now when they need something and send us an email we can't reply, because our IP is "listed".
Okay, I know spam can be bad, and fine-tuning spam filters is a PITA, so let's go through the delisting process, surely with enough perseverance eventually MS will tolerate us into their graces.
Well, it has been more than a year now, and still no luck.
---
We have completed reviewing the IP(s) you submitted. The following table contains the results of our investigation.
Not qualified for mitigation x.x.x.x Our investigation has determined that the above IP(s) do not qualify for mitigation.
...
¯\_(ツ)_/¯
Hello,
My name is [Kumar/Numan/Punith/Suresh/Sachin] and I work with the
Outlook.com Sender Support Team.
I do not see anything offhand for the IP (xx.xx.xx.xx) that would
be preventing your mail from reaching our customers.
Good bye and fuck off.
550 5.7.1 Unfortunately, messages from [xx.xx.xx.xx] weren't sent.
Please contact your Internet service provider since part of their
network is on our block list (S3150).
For devices I own, I gotta control the secure boot, or I simply don't own it.
If the schematics and code to the TPM were free and there were "tamper evidence" mechanisms in place, we could argue secure boot had some benefits for security. But in its current forms, it's just preventing users from owning their devices with little evidence for security for determined attackers.
Machines should be simpler and auditable: that's how reliable security works. Adding piles of shit on top the other piles of shit is just producing more overall shit.
Probably. But if my laptop gets stolen I would rather have the thief needing to spend a few million dollars in order to defeat Secure Boot.
Now if I were to worry about state level espionage I would combine the secure boot with a strong password for device theft, and not bring the device anywhere a long-term evil maid attack might occur. But in that case I am still happy if my stolen laptop requires a few million dollars, and that an evil maid also needs to somehow defeat secure boot before being able to do anything to some of my device.
Secure boot isn't perfect. But no practical security measure is. Secure boot is effective at making attacks more difficult, and that means it has value.
It just so happens that such value is most relevant for company-based security. And sadly it seems to be pushed on private devices for other reasons. But the move towards abuse of secure boot does not mean we should ignore the security benefits it gives to company-issued laptops.
1. Any signed app with good reputation will be ignored by Windows Defender and other AV tools. That's how Windows security works: the anti-virus programs focus their attention on activity by code that they don't recognize. Signatures are how to handle "good" polymorphic code like app updates whilst stopping "bad" polymorphic code like viruses that constantly rewrite themselves. This isn't connected to the app store.
2. You can in fact make your own app store. Windows 10 comes with something called App Installer. You put an MSIX file and a .appinstaller file on your web server, and open the XML file with a special protocol handler. The app is downloaded, installed, lightly sandboxed (but not aggressively so: win32 apps will work fine), and Windows keeps it up to date for you. This is basically the same experience as the App Store itself, but decentralized.
Now, MS runs the world's largest source code sharing service and many of these young developers launch proprietary MS code editing tools daily.
We old timers always knew what the end game was, but young people lack the context and so many are already hooked on MS now. It's not obvious to me that they will ever care enough to switch no matter how hostile MS behaves.
I have a feeling MS will continue to dominate due to network effects and vscode/wsl being a nice enough experience. It'll take them resting on their laurels or some great act of user hostility to change this status quo.
Not all of us. I had just barely started being willing to trust Microsoft again, and they've repeatedly shown themselves to be hostile since the initial "Github is cool! And WSL! And VSCode!", enough is enough.
I've read the Halloween documents, I know where this goes.
VSCode is still not entirely open source and the official builds have spyware included.
It's worth bearing in mind for those considering switching.
Spyware is NOT the same as gathering Telemetry data.
You can also just turn off Telemetry in VSCode in the settings.
I think a vast majority of people on HN gather data on customer usage of the products that they build. Because it ultimately makes us able to tailor the products better for our customers. It's just ignorant to put this in the same category as applications that slurp up as much data as they can for e.g. ad-profiles or to sell that data off to the highest bidder.
Telemetry and spyware differ only in the way collected data is used.
A lot of software lets you opt-out from Telemetry gathering when you install it. I would not think Spyware would do this.
And I feel like saying it's "only in the way collected data is used" really makes a small thing out of something that is very important. There's a very big difference in doing something maliciously and doing it to genuinely try to make your software better!
Lots of spyware that wants to remain on one side of a less dramatic divide simply provides "options" for example in the installer that are opt in and vaguely defined that no sane individual fully understanding his options would opt for.
Such software isn't usually cryptolocking your family pictures instead its frequently grossly violating your privacy and selling your time and attention to third parties who in turn may opt to use this bought and paid for back door into your computer to waste your time or cryptolock your family pictures.
Here's a clue. If you have to make a feature opt out because nobody on earth would opt in given time and expertise sufficient to understand your offer then you are victimizing your user. I cannot think of a case where any data collection being anything other than opt in would be acceptable.
No, they first and foremost differ in the kind of data is collected. Spying is not spying if you anonymously collect information about how frequently a feature/future/option is used only.
So, the OP was correct in calling it just spyware?
Why do people jump into defending corporations that repeatedly abuse their customers when they do unknowable hidden actions?
And the illusion that it will always be possible to disable telemetry is just that, an illusion.
As a developer, how do you know the data you're collecting now won't be used maliciously in the future by your org?
I'm absolutely all for privacy and limiting unnecessary gathering of data. But there's nuances to this discussion and labeling everything that has any amount of telemetry as "Spyware" does not do anyone any good.
Maybe it's not "hurr durr" and people have a legitimate reason to hold that opinion. To those people, any distinction between spyware and "good" telemetry is merely academic and effectively irrelevant.
My favorite part is when someone figures out "telemetry" includes the MAC address, and the dev team just goes completely silent.
There's an honest, non sneaky way of gathering usage information: pay for rigorous testing and price the cost into the product. Telemetry is lazy, invasive, and user hostile by default. Every bit of information acquired from users should be given with informed consent or not collected at all.
It's hard to really stand up to that kind of situation.
Hashed MAC address: a cryptographically (SHA256) anonymous and unique ID for a machine.
Although I disagree that they should have this to begin with, it being anonymized is still a pretty important detail.
The fact that they are taking uniquely identifiable information from you, and the fact that their company is as deep in the Ad game as Google, is more than damning enough.
"hurr durr" strawmen on the other hand...
Such a feature should be disabled by default.
It's precisely because it's technical people who know better that you see "telemetry" labeled as "spyware", which it is, and it's how we called it back in the 1990s/2000s.
The only reason people these days call spyware "telemetry", is because it got normalized by large companies, and is now defended by devs who figure it's better to ship spyware to people than to give a damn and talk with users.
We don't collect customer data, we ask for feedback directly.