Hacker News Reader

Comment by 01acheru | Hacker News Reader

> Microsoft also plans to deploy its EU Data Boundary, though which EU customer data can be processed in compliance with data regulations, by the end of 2022.

IMHO that's the root of the problem. Why does MSFT need to process customer data? Yeah, we all know why, but I'm really getting tired of this shit!

It's not a problem paying for your product but leave my data alone, it is mine and that's it! No searching for emails, no training AIs on my code, no scanning images for "child porn", no reading my documents for "national security", etc... all the customer data you need to process is my email to send me a payment receipt or the size of the data I've saved to see if I'm over quota or whatever on that line.

And the same applies to all players in this field, not just MSFT who isn't even one of the worst offenders.

View on HN

It's a cloud-based product. So processing is a core part of the value proposition - the provider (Google, Microsoft) stores a copy of the data and exposes APIs that the frontends use to download the documents to the users' machines.

The alternative is a product that is not collaborative (no online collaboration, at least) or requires customers to hire a sys admin to install on their own servers and maintain it.

This isn't some nefarious plot by big tech to steal your data, it's the product people want.

I don’t want to collaborate with anyone. I don’t want that ‘functionality’ to get in my way. I don’t want to be driven to despair in an attempt to save a document to my local storage rather than to the OneDrive or whatever it’s called by default.

You really don't have to clarify your needs as one person are different from a school system. I would have figured as such.

I was prompted to reply by “it’s the product people want”. No, it isn’t. Not this person, at least.

Congrats. Guess who does want it? Almost every large organization on the planet.

You can build it to be E2EE.

Shared documents have been utterly game-changing. I never want to go back to mailing documents and presentations around and having to merge conflicting comments together again.

ADDED: And that's not even counting the fact that I can access my docs from multiple computers without worrying about shared network storage, etc.

If the customers are going to the lengths of legally intervening in your implementation it's not the 'product people want'.

There’s a case for cloud apps to move to a ‘bring your own data storage’ model. Draw.io does it, letting you load and save and share files using box or Google storage on the backend.

‘But the web app running locally has access to your data and can phone home to its servers in the US or wherever’ - yeah, and so can a locally installed application.

Locally installed application can be black holed. Hence why everyone fetishizes the cloud. They want the recurring revenue and your data, and you not to ask any probing questions, or getting pesky net admins getting pissy about all this data exfil from the network.

Wanting recurring revenue is not intrinsically an evil wish is it?

You’re responding to a point that the parent isn‘t making.

Enabling collaboration doesn’t mean AI training, exposing data within an organization doesn’t require MS to be scanning it, and their servers don’t need to be in the US. It makes business sense for them to do so, but isn’t a requirement per se.

I think their point is the definition of "processing" would also likely cover collaboration (i.e. you could stop AI training etc but you still wouldn't be compliant)

Agreed. When things are web hosted, there's all kinds of processing. Still. Spam filter, searching email history, even loading an email is considered processing the email.

I believe both Google and Microsoft try to firewall any Enterprise or business data from their consumer lines. This means none of it will get fed into AI filters for the most part. Though I'm guessing marking things is spam still is a global thing.

Schrems 1 goes even farther than that... the issue is the potential access by the US government of the EU data through strongarming Microsoft (or other US companies), which is in violation of EU rights.

There's no way around this issue while Microsoft-spawned EU companies are still part of Microsoft. I guess they could still sell open source software (to prove there are no backdoors, otherwise, after the Snowden scandal you have to assume that there are by default) that doesn't get to run on Microsoft's servers and that Microsoft doesn't provide technical support for... but how can this be a business ??

This looks to me to be a fairly solved problem, Gitlab can be instances you manage yourself and there is no specific limitations on what works on your self hosted ones. Microsoft provides server software for Outlook, ActiveDirectory, Sharepoint and the whole org management stack that doesn’t need Microsoft meddling with the data.

Office365 shouldn’t be some wildly different software that can’t live outside of Microsoft’s full grasp.

The difference is that Outlook, AD & Sharepoint were all designed to be deployed on-premises as an option from the start.

Most of 365 appears to be designed and architected to be a multi-tenanted SaaS solution, so I suspect it's not anywhere near as simple as just spinning up your own 365 instance.

365 is probably thousands of microservices behind the scenes which all have their own unique infrastructure requirements and will be actively managed by Microsoft. I suspect running these in your own datacentre would not be an easy feat without complete re-engineering by Microsoft.

> without complete re-engineering by Microsoft

We come to the same conclusion: Microsoft chose a different way for Office 365 where it could provide the service to more consumers while also keep way more control, in particular making it easier to justify recurring subscriptions at large.

It goes hand in hand with their cloud efforts and pushing for more services, so I understand the motivation. I also kinda wish this trend stopped.

It's also a different architectural model - i.e. why don't we also have the options of privately hosted versions of Google Docs?

Licencing might be one reason, but deployment complexity is probably the bigger reason.

Except nobody has their definition of processing. I think some German working group also rejected Office 365 because they could not nail Microsoft down on what "processing" means and targeting minors with overly broad agreements when schools are already operating under stricter than normal data processing constraints is a no go even if your name isn't Epstein.

Parent had no point since they fundamentally misunderstand what data processing is, and so are you.

> It's a cloud-based product. So processing is a core part of the value proposition

not necessarily, if I choose a cloud product, it's to avoid having to manage the mail and data servers, not to have the content of those servers rifled through

You don't want a spam filter in your email? Everything should go straight to inbox? And that's not even mentioning the processing they have to do to figure out whose email it is in the first place.

> This isn't some nefarious plot by big tech to steal your data

It is though. They could design it in a way that it operates on your data but they have no access to the data outside of these strictly defined operations. If that was a priority to solve, it would be solved.

> it's the product people want.

These two things are not mutually exclusive.

Despite which, this is not true. There are no non cloud options if MS Office anymore, or of the Adobe Creative Suite. This stuff has been forced on us, often by work, and then the other options were removed. Hence the nefarious plot thing.

To my knowledge, they make money off of selling SAAS software here and not ads. It being cloud based is done to get recurring revenue. Office and Photoshop hit a point where it will satisfy vast majority of customer needs a while back. That's when the recurring payment model was put in place. To deal with piracy and paid customers not updating their software for years.

That might be the case now but who knows where the future takes them. A smart legal council once told me even though you have a great relationship with the organization right now the contract you sign is binding and when ownership changes and revenues needs are different you really don't know who you are up against and what they will do with your data. Not that we have any real power except to try and use another product...

A lot of their money is from enterprise contracts. These businesses have strict privacy requirements and would immediately end their Microsoft contracts or sue the company is they were monetizing their data. Let alone businesses with regulated privacy laws like medical or fintech. No business would touch them with a 10 foot pole.

For Windows Home or other free/bundle solutions, it's a different situation. But not for enterprise or pro/higher-tier customers.

MS is a big ad player now. They have the ad contract with Netflix and are growing the business. Advertising is not the only use of this data. MS also makes billions from service contracts with the DOD. The services sold are not detailed or disclosed to the public.

> They could design it in a way that it operates on your data but they have no access to the data outside of these strictly defined operations.

That is exactly what Google and Microsoft do with their enterprise products (free or not). They don't crawl your data at all.

> They don't crawl your data at all.

This is impossible to prove.

Law often doesn't need 'proofs', it's enough to state that they don't.

But they do. Viva and Cortana read my O365 hosted work email (and I believe other data, including Sharepoint files) to provide a "daily briefing" email which picks up topics and queries from recent emails and foist some primitive organisational methods. AFAICT this is a service that has been subscribed to over and above any vanilla O365, but I'm not interested in the legal osculum infame. Both I and the data are in the EU, so they have to appear to play by those rules.

These daily briefing emails I get at work remind me that "We are watching you." I complain about this to our security team and ask why they let Microsoft read our emails. They do not give me much of a response. I assume they get something out of the bargain.

It is possible that microsoft segregates the processing state of Viva and Cortana such that no human outside your organization has access to the data without accessing the permission-controlled keys.

Yes, ultimately Microsoft holds the keys to your encrypted data at rest but billions of dollars are riding on them managing customer keys well.

In fact, Microsoft makes that claim about Viva Topics https://learn.microsoft.com/en-us/microsoft-365/enterprise/m...

“Machine Learning ("ML") models are trained on public web data, and as such do not contain any customer data from your tenant. In the future it's possible we will use customer data to improve accuracy of the ML models, in which case the data handling of ML models will follow the same policies as any other customer content (including data residency, retention, access control, sensitivity).”

This is why audits exist.

Are they perfect? No

Failing these audits would be more expensive than just following the law.

Although they do (or at least have in the past) anonymize the data and use it for internal research.

That is crawling data.

> There are no non cloud options if MS Office anymore

That's thankfully not true. For example:

https://www.microsoft.com/en-US/microsoft-365/p/office-profe...

> There are no non cloud options if MS Office anymore

This is wrong.

https://www.microsoft.com/en-US/microsoft-365/p/office-home-...

Additionally, if you're a business There are various non-cloud volume licensing options available.

See the price difference though. $140 for this version of Office, up front, against Office 365 for 6.99/mo.

Most people will pick the latter for cost. It would take a full two years of payments for O365 to equate the price.

But that's the thing, at 6.99 you're also paying with your data. What you're really saying is you want it for free.

Also, 2 years to make back the cost really isn't that bad. I have a 2007 Office dvd and it still works fine on W10, so if you keep this new version of office for 16 years, you made back your money 8 times over.

They could design it in a way that it operates on your data but they have no access to the data outside of these strictly defined operations. If that was a priority to solve, it would be solved.

If you’re thinking of end to end encryption, that doesn’t discharge from GDPR. When person-related data is processed outside of the EU, even just to store encrypted bits, it must comply with all aspects of GDPR.

The genie is out of the bottle, cloud cooperation is a given for modern software. The question has moved on to how to regulate those clouds in ways that prevent the harmful sides. GDPR is one attempt to do that.

All I have to do is skim any privacy policy these days and virtually every cloud service has written theirs in a way that I can pretty much guarantee they're selling my data to someone.

I picked up electrical engineering as a hobby because I want a smart home but there isn't a single IoT device on the market that I can trust won't phone home to sell my data. On the bright side I've found soldering isn't too hard and prototype size batches of PCBs are cheaper than ever.

For the prosumer smart home, I highly recommend going with the low end industrial automation (ie https://automationdirect.com, https://findernet.com, etc) rather than “IoT” brands. Way more powerful, everything is interoperable, and the business model is much simpler. No phoning home.

If I wanted something that was more akin to putting legos together that's definitely the way, but I found it quite enjoyable to go down to the low level of electrical design, and any application that can be accomplished by flipping a switch can be made wifi-compatible with an ESP32 module and a relay or TRIAC circuit (TRIACs are nice because they don't have a lifetime rated in switching cycles). I don't have to worry about my microcontroller phoning home if I wrote the firmware it's flashed with!

> It's a cloud-based product

It was done so to be a data farming monster. There is absolutely no justification why word processor needs to be a "cloud product"

You seem to have an incorrect definition of "processing". It's not about scanning your data or doing anything special with the content. If your data is in the cloud they're automatically processing it.

Exactly... feel like a lot of people have 0 perspective on how all encompassing the GDPR is

I've worked on plugin software for a super common enterprise ticketing application. The fact that we need to make sure one person can't see another person's data mean we need to record the user names or a unique identifier number of some sort. But these numbers can be related back to a living breathing human being, so that's processing personal data according to European law and makes selling to Europe seem almost insurmountable if you aren't venture capital funded happy to burn very large piles of cash.

Afaik exchanging business cards in Europe technically involves violating the GDPR if you pass them on to someone else at work without explicit permission. But contacting the person for permission also isn't allowed, Honda got HUGE fines for that iirc

>Afaik exchanging business cards in Europe technically involves violating the GDPR if you pass them on to someone else at work without explicit permission

A bit off topic, but...I would have thought it depends on how you got that card. If someone hands me their card in a private meeting I wouldn't share it anyway. I would offer to do an introduction.

If someone had cards in a display stand on their public front desk it is really advertising, and I am quite sure you could share it. Sounds like a GDPR scare story.

My point is not about doing anything special with their customer's data, it is that if they didn't do anything beyond the basic processing needed for their services to work it would be straightforward to migrate their offerings to Europe complying with local laws.

Instead, if you are used to doing whatever you want with the data you store it takes years to build an European service since many parts of your process need to be reviewed and maybe even rebuilt.

It was about time for those laws to finally kick in and we started to see a change.

You can always encrypt your data if you don’t want Microsoft to train its models, red your emails, etccc

But it is inconvenient. And, if we look on history convenience have always won, eg plastics.

This isn't some sort of nefarious "processing": re the GDPR, storage is a form of processing.

So is deletion.

And, as the processor, they are required to do as the controller (you) instructs.

Can i instruct to "do not collect"? Or could they for example "do not collect" until i ask them to?

It's a SaaS product. "Collecting" is how it does anything.

> re the GDPR, storage is a form of processing.

That's not true, which lawyer told you this?

I'm honestly really tired of the FUD surrounding GDPR, it's not actually that complicated.

https://ec.europa.eu/info/law/law-topic/data-protection/refo...

Check YOUR FUD at the door please.

Storage with intent to process. Not storage itself.

IE if you send me a file and I put it on a drive and don’t give it to anyone or read it on behalf of anyone but you: it’s fine.

It literally isn't. The source provided by the parent confirms it. There is no 'with intent to process' clause.

> Processing covers a wide range of operations performed on personal data, including by manual or automated means. It includes the collection, recording, organisation, structuring, _storage_, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data.

> It includes the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction of personal data.

I feel like you're intentionally missing the second section here.

Regardless, GDPR has hundreds of provisions where it excludes data as long as it's not processed, "storing is processing" in so far as it's secure and not being used by anyone except the account holder isn't going to stand up in any court on the planet, even luddite ones.

You might be parsing the sentence incorrectly. I'd generally read it as:

> It includes {the [(collection), (recording), (organisation), (structuring), (storage), (adaptation or alteration), (retrieval), (consultation), (use), (disclosure by {[transmission], [dissemination] or [otherwise making available]}), (alignment or combination), (restriction), (erasure) or (destruction)] of personal data}.

So there is no "second section" of the sentence, just a long list. The text of the GDPR has the exact same list [0].

[0] https://gdpr-info.eu/art-4-gdpr/

>And, as the processor, they are required to do as the controller (you) instructs.

There seems to be a terminology issue here, "You" would generally be the data subject, not the data controller, unless you are a company.

If you're directly using Office 365 or Google workspace, then MSFT/Google would be the data controller (the primary company who handles the private data), and any subcontractors involved would be data processors on behalf of the controller.

If you're a user in the school system, and have no direct agreement with MSFT/Google, then the school may be the data controller and MSFT/Google handling that data on behalf of the school.

Amen.

This is not the product I want. Not even close.

"Tech" companies never ask users what they want. The company decides what it wants, sets the direction that is most profitable and users follow along (after all, what choice do they have). Then "tech" company employees and spokespersons claim this is what people want. Ex post facto. Bullshit!

IMHO, HN commenters can speak for themselves. However there is no reason to believe they can speak on behalf of users.

Reply on news.ycombinator.com