Hacker News Reader

Comment by minisooftwin | Hacker News Reader

> “If you’re faced with the tradeoff between security and another priority, your answer is clear: Do security,” the company’s CEO, Satya Nadella, told employees.

Satya's model of making security a priority at Microsoft:

- Cram ads in every nook and corner of Windows. Left, right, centre, back, front, everywhere. What else is an operating system for?

- Install a recorder which records everything you do. For the benefit of users of course - you know, what if a user missed an ad and wants to go back and see what they missed.

- Send a mail to your employees and tell them "Do security". Mission accomplished - Microsoft is now the most secure platform.

View on HN

The Microsoft bribes scandal broke not too long after I had to take the "hey don't do bribes" training at Microsoft.

That event really drove home for me the fact that all of the trainings, emails, processes, etc. are mostly plausible deniability. There are people who care about security at MS. I know, I've met them, but for the most part all of this exists so that Satya can plausibly say in court or in front of congress, "well we told them to do security better. This is clearly the fault of product teams or individual contributors, not Microsoft policy and incentives."

I dunno, that’s a pretty cynical take. Isn’t it just as plausible that they became aware of the bribes internally and were trying to curtail them when the scandal broke out? Or maybe the “don’t do bribes” training actually worked enough for someone to whistleblow even if official internal channels failed? Those who are doing wrong often try to stymie others from making positive changes out of fear, greed, etc.

Edit: I just want to add that there are things to be cynical about - I’m not completely naive. If it’s your legal department heading up the training then you can be pretty sure that there was a cause for it.

Yes, massive companies are a nest of conflicting priorities. The sales team wants to do whatever it takes to win the deal, and the legal team wants everyone to behave ethically at all times. The board wants to be shocked(!) when it turns out those goals are in conflict, with the ethical side sometimes losing out, to remove any personal risk to themselves.

> legal team wants everyone to behave ethically at all times

do you really believe that? compliance under scrutiny, more like it

The best job is sitting around and doing nothing. So ideally yes.

But sure, ethically speaking when things get heated they will exploit every loophole they can find to avoid liability. So, lawful evil?

> The best job is sitting around and doing nothing.

That sounds like a terrible job.

Well you can take it as literally or figuratively as you wish. Depends on the person.

Most corporate law guidance is about risk mitigation, not about ethics. Less activity generally translates to less risk.

You can see a similar phenomenon with security professionals. True, the only secure computer is one disconnected from the Internet, turned off, put in a Faraday cage, on the moon, under armed guard - but that's not useful.

> under armed guard

Get rid of the guard. They might turn the computer on.

Even if everyone in the company magically complied with the wishes of the legal department, they would still have work to do. Defending the company against frivolous lawsuits and incoming regulations, suing competitors and other bad actors outside of the company, writing and evaluating contracts, and any internal legal consultation needed.

Having worked with many lawyers... for the most part, yeah. Legal wants you to behave ethically at all times, not because they necessarily have some ideological commitment to ethics (though some do), but because it keeps the company out of lawsuits.

The overwhelming goal of a company's legal department is "don't get sued", followed by "if sued, lose as little money/leverage as possible".

In general the lawyer in the room is going to be far more risk-averse than the engineers, product people, sales people, or marketers.

The trick is that outside of some limited circumstances the legal department at companies are not the final say. Many lawyers who "go in house" (i.e., quit a private outside firm and go work directly for a company) find this frustrating. They come into a room, say "don't do that", and then a few weeks/months/years later someone did it and now they have to prepare for a lawsuit.

That doesn't seem plausible, because you can't stop bribery by telling people that bribery is against the rules. Everybody already knows that.

If they became aware of bribery and genuinely wanted to stop it, the way is to publicly punish the culprits as harshly as they can, to demonstrate to others that enforcement of the rules can happen.

Yes and no. You might not even realize that what you did constitutes giving or receiving a bribe. What cracks me up though is that all large US megacorps give tens of millions of dollars in thinly veiled bribes to officials each year, as they browbeat their employees into not accepting a god damn fruit basket from a thankful client.

Probably neither, "don't do bribes" training is standard onboarding procedure at any Fortune 500 company. Just ironic timing from OPs POV

Not just onboarding. Most, if not all, large companies waste at least an hour of their employees time on this per year, while themselves bribing politicians in DC.

It was, in fact, a story arc in an at the time recent-ish season of SBC[0].

[0] Microsoft's yearly training that is done in the form of a TV drama about MS employees facing ethical dilemmas

An hour? My annual training is typically about 6 hours of drudgery, and often about 2/3rds repeat courses from years previous. Great fun.

That's just the ethics training, depending on your role there's much more than that.

But this is exactly why it's standard procedure. I worked for a huge Credit Reference Agency and it was very obvious that this is ass covering.

Sarah and Bob in the New York Office of Huge Corp must take the training so that the CEO can swear all his employees know not to bribe people. In the event that Manuel, who is given $100 000 per week of company money to bribe the locals in Melonistan so that they don't interfere with Huge Corp's operations is actually brought before the government and forced to spill the beans the CEO will insist they had no idea and some Huge Corp minion gets sacrificed. Manuel will be replaced, Melonistan will be assured quietly that his replacement will provide make up money ASAP.

In Arms this is even worse, because there it's secretly government policy to bribe people, even though it's also illegal. So then sometimes even if you can prove there was a crime, the government will say "We'll take that evidence thank you very much" and poof, the crime disappears, if you make too much fuss you'll be made to disappear too.

Maybe. However such training is essentially considered mandatory compliance at any publicly traded company once you reach a certain size, especially if you sell to the government, and IMO probably not related to any specific event they became aware of.

I've had to do the same mandatory anti-bribing public officials training annually at US companies a fraction the size of Microsoft. The anti-bribe training is so common at large companies in the US, there are companies that sell ready made one-size-fits-all training videos specifically on this topic that are then usually the thing the employee has to sit through anually.

In my experience, different cultures have different feelings on the moral failings of bribes. Some of my colleagues grew up in countries where it is a common business practice, it probably makes sense for large orgs with global employee base to have to establish some kind of baseline for acceptable business practices. Similarly, I know several people who came to study computer science in the US and tried to bribe police officers upon being pulled over for speeding, simply because it's how you handle the matter where they grew up.

> dunno, that’s a pretty cynical take

Just days ago a major US corporation was found guilty of hiring Death Squads in Columbia. Literally to murder people.

Why do we have this common illusions that corporation will not steep down to the dirtiest crimes they can get away with?

https://www.bbc.com/news/articles/c6pprpd3x96o

The article you linked says that Chiquita was extorted into illegally paying money to a Colombian death squad, who also murdered people, and were ordered to pay restitution to the victims' families. It doesn't say that they paid the death squad to murder people on Chiquita's behalf.

Yes, hence why I take all those company values trainings as Bull******.

Eh. For the most part, the trainings can be taken at face value. Even if the management's dealings with governments and partners are questionable, no company wants random employees accepting personal kickbacks from vendors.

There's a liability avoidance component to trainings, but mostly for non-business misconduct. For example, for sexual harassment, the company will say they tried everything they could to explain to employees that this is not OK, and the perpetrator alone should be financially liable for what happened. That defense is a lot less useful in business dealings where the company benefits, though.

Microsoft has for over two decades been one of the largest and most sophisticated employers of security talent in the industry, and for a run of about 8 years probably singlehandedly created the market for vulnerability research by contracting out to vulnerability research vendors.

Leadership at Microsoft is different today than when the process of Microsoft's security maturation took place, but I'll note that through that whole time nerd message boards relentless accused them of being performative and naive about security.

It would help if there weren't all these employees and ex-employees stepping forward to talk about how Microsoft is performative and naive about security. I won't go as far as to say that, but I will say I don't think my incentives as an IC lined up with the security-focused mindset that company execs tout publicly.

I don't think anything is going to help here; it's just a message board fixity that companies like Microsoft are unserious about security.

Same Microsoft got their master authentication secret stolen and they still don't know how that happened.

It's also turned out that it's impossible to revoke or cycle that secret. The whole issue is so hushed now, I don't know what happened at the end.

Same Microsoft one of their license golden keys on some installation media, too.

Even if they're serious about security, these events don't look good.

I don't know what "looks good" means. Every major tech company has had multiple bad things happen that would look very bad to people on message board.

None of them got their two different, non-revocable master keys stolen, I may say.

It's been a while now but at one point, just about every giant tech company simply make install'ed a key-material-leaking TLS bug on just about every endpoint they ran. The bug was introduced by, effectively, some guy on the internet. It implemented a feature statistically nobody was going to use.

It's trivial to re-frame all sorts of mishaps as evidence of unseriousness about security, especially if done selectively and in hindsight. It doesn't really tell you much of anything meaningful.

I remember that incident.

I think there's a difference between compiling and installing a buggy software and developing the whole infrastructure yourself on top of the operating system that you solely develop and build.

But that's me.

Microsoft isn't a single entity! Like any large corporation there are many teams and people doing great work, and they are many teams and people incentivized to downplay that work.

To be fair, it's not really possible to come up with good policy to handle this at scale. It would be too intrusive to require employees to divulge their private financial accounts (and near impossible to audit that the employee has truly divulged all their financial accounts), and the more internal controls you put in place, the slower the deal-making gets, with no guarantee of good behavior.

At higher levels compensation is now tied to security outcomes. This is as committed as it gets. Definitely not theater.

It will still be theater. Security outcomes will be gamed.

To be fair to Satya, every leader should be judged on what they do not what they say. This isn't a Microsoft or Satya problem, pick a large corporstion and you'll find examples of this behavior everywhere.

Words in an email hold absolutely no weight, when leaders choose to trade security for something else that's all employees need to know.

In particular when you need to answer to shareholders and can be voted out of your position/company. I don't pretend that Microsoft's past hasn't been an issue, but if we compare the past to present, Satya has had somewhat of a positive impact (although know there's a lot behind the scenes that I'll never know about, as well as most). It's good to be critical of every company, otherwise the end users get rolled over.

I have no broad evidence of this, but I suspect that the more beginner-friendly Linuxes are guilty of a lot of the sins that you laid out here. I seem to remember some controversy with Canonical recording your searches when hitting the super key, and Ubuntu having Amazon ads built in by default.

People who love to geek out about computers can of course install Arch or Gentoo or NixOS Minimal and then audit the packages that they're installing to see that there's no obvious security violations, but it's unrealistic to think that most non-software-engineer people are going to do that.

I really don't know how to fix this problem; there will always be an incentive for Microsoft (and every other company) to plaster as many ads as they think that can get away with, as well as collecting as much data as possible. I don't know that I would support regulation on this, but I don't know what else could be done.

Debian is a perfectly reasonable choice for casual linux users. Ubuntu's supposed usability improvements over Debian are greatly exaggerated. It's mostly just marketting.

Fair enough. I haven't used Debian in quite awhile (I think since 2009 or so?), so I can't speak to current stuff, but I do remember it being pretty hard to install then. I'm sure they have refined it considerably since then, and of course I am fifteen years more experienced now than I was.

Personally it's hard for me to go back after I accepted the dogma of NixOS, but maybe if I manage to talk my parents into using Linux I'll install Debian for them.

install arch. not even kiding.

make a "shutdown" button on the desktop that locks everything and do a full upgrade.

any issue is solved with, try tomorrow after a reboot. you'd be surprised how fast fixes arrive at rolling distros

I do NixOS-minimal. As far as I'm aware it doesn't really add any runtime overhead in comparison to Arch, the package manager is generally quite good at figuring out which changes are going to break your system, and everything is snapshotted on every rebuild so for the most part I can be fearless. Doing a full upgrade is generally as straightforward as pointing to the latest version's repo and doing something like `sudo nixos-rebuild switch --upgrade`.

That works great for a geeky dude like me, but I don't think I'll ever be able to convince my parents on the beauty of NixOS, so having a straightforward mypackage.deb thing that they can download and click on to install stuff probably would be an easier sell.

I ran Arch for about a year, and I liked it, but I had to abuse the `snapper` tool because I was constantly breaking things with the video driver and the like. It worked but I personally think that NixOS's model is just more elegant.

you still need a os. and i fail to see how nix would make video driver problem any better.

the problem with running debian is that fixes are often not backported, specifically for things end users will care about, like libre office

> you still need a os. and i fail to see how nix would make video driver problem any better.

That's actually easy to answer; video drivers can be really finicky to get working. If you screw it up, it's very easy to get into a state where you have no GUI. Nowadays I am proficient enough to work my way around the command line and I probably could fix a bad driver, but 13 years ago that wasn't really the case, and if I broke the GUI there was a risk where I'd have to nuke the machine and start from scratch. I've also had issues where updating the kernel breaks drivers, and I wasn't able to figure out how to downgrade it.

With NixOS, since adding packages and boot parameters and the like require a rebuilding of the configuration.nix, and each rebuild takes a snapshot, if something is broken all I have to do is reboot and choose a previous generation to get it into a working state, and I can debug the configuration from there.

This actually happened somewhat recently; I had a NixOS server that I was controlling via SSH that I broke the networking support for. It's kind of annoying to control a server if you can't connect to it, but all I had to do is plug in a keyboard and a portable monitor, reboot, and select a previous generation, and fix the broken change, and rebuild. The entire process took like fifteen minutes.

> the problem with running debian is that fixes are often not backported, specifically for things end users will care about, like libre office

Are there not more evergreen releases of Debian?

> Are there not more evergreen releases of Debian?

Debian sid or "unstable" is a perfectly fine rolling release distro.

I'm willing to bet that you knowing NixOS is going to make Debian installation a completely easy and smooth experience. If you can use Debian stable, you are going to setup a rock solid system for your parents. If you can start the installation by using an Ethernet cable instead of wireless, I think you will have an easier time, but once you get all the updates complete you should be able to switch over to wireless fairly easily. With Debian stable, it really doesn't take very much time to figure out if you're going to have hardware issues within an hour or so of beginning installation. This is coming from someone that seems to have less knowledge than you do about Linux, and has also installed systems for people that were not very forgiving when things go wrong. I suggest starting with Debian stable because security is backported, and if you can get it running within approximately an hour, you should be good for quite a while. That's not to discount what everyone else has said here, just my experience as someone that is closer to a "consumer" level of Debian usage than a sysop. I did get into Linux with Red Hat in the 90's, and have dealt with the pain of manual configuration, but haven't had to deal with it in over 10 years now. I mostly deal with Windows and .NET development now, but am looking to get back into Linux now that I can make use of .NET and drop server costs and resource usage.

Oh I have no doubt that I could easily set up Debian now if I wanted to. Since that last time I tried it I've installed Arch and Gentoo and Ubuntu Server (converted into a desktop OS) and ran through the Linux From Scratch book once. I'm pretty sure that I could get the 2009 version I had trouble with as a 19 year old working pretty easily now.

Sadly, I don't think I'll be able to convince my parents to switch to Linux in the super near future; I need to work on them for awhile and maybe I can convince my dad (though he's pretty entrenched in Windows).

> ... the problem with running debian is that fixes are often not backported, specifically for things end users will care about, like libre office

I don't disagree completely with your general sentiment, but the latest version of Libreoffice is available today in Bookworm backports.

> do remember it being pretty hard to install then.

It has always been easier than windows, which has never stopped the millions of people who used to format their drive and reinstall every few years after suffering from slowdowns.

I agree, I discovered Ubuntu around 2003/2004 when they were giving out free CDs to anyone that requested them. Once I discovered that Ubuntu was based on Debian, I started using Debian and wouldn't look back. Even if you need something that only Ubuntu provides, you can get the .deb package for it and install it yourself. I prefer relying on Debian stable if I need to maintain anything for more than a year or two (and am realistic that software usually fails fast, or hangs around for a long time). It's possible that my knowledge is dated at this point, but I always preferred working with the Debian filesystem and tools more than Red Hat/Fedora's filesystem and tools (rpm and yum). Apt and apt-get somehow "clicked" with me more than Red Hat's tools, and I even took multiple classes on Red Hat administration and general usage (although do far less administration in comparison to software development than I used to do in the early 2000's to mid-2010's).

I mean, if you have no evidence of this, why even post such an (incorrect) conspiracy theory comment?

Well the Amazon ads in Ubuntu absolutely did happen, as well as the searches with the super key. [1]

I'll admit it's maybe a bit of an extrapolation to assume that they're as bad as Microsoft, which is why I disclosed that I didn't have a ton of evidence for this.

[1] https://www.gnu.org/philosophy/ubuntu-spyware.en.html I realize that GNU is sort of conspiratorial in its own right, but at least one entity seemed to agree that there's problems with it.

Well, here are the facts (I was an insider at the time, and this is my testimony).

Searches were anonymized and sent through Canonical servers to provide extended search result sets. This was configurable and could be disabled. Canonical of course had your IP address so they could reply, just like any and every HTTP server does. Your search query was not stored anywhere or aggregated, and it was not associated back to the originating IP address except to reply. Your privacy was respected and protected at all times.

The Amazon search did appear as a plugin in an early prelease. It was never shipped in a released Ubuntu.

The goal was to make things as easy as possible, even for the technically averse (who were still commonplace a decade ago), while still respecting and protecting your privacy.

Of course, no matter what you do, someone is going to scream for everyone to come witness the oppression inherent in the system. We did it anyway with the expectation of baseless knee-jerk outcry and we were not disappointed.

Yeah, fair enough, I'll admit what I said was probably reductive, and if you worked on it you certainly know a lot more than I do; obviously the engineers at Canonical aren't idiots and they're not mustache-twirling supervillains. Just to be clear, I did run Ubuntu on my laptop for quite awhile (for about two years starting immediately after ZFS got integrated support), and I did like it, so I don't mean to suggest it was a terrible product.

I guess I'm just always worried about for-profit companies, because their goal isn't necessarily always aligned with the customer's best interest.

> I seem to remember some controversy with Canonical recording your searches when hitting the super key, and Ubuntu having Amazon ads built in by default.

It was also other way around with Microsoft. If you deploy Ubuntu VM in Azure, they contacted you in LinkedIn to offer commercial support.

Not joking: https://www.theregister.com/2021/02/11/microsoft_azure_ubunt...

It's not surprising when a linux distribution was taken over by a capitalistic firm, it decided to forgo good values, and instead prioritized profits over everything else.

> I really don't know how to fix this problem

Stop using software made by companies that do bad things. Improve the software that doesn't.

> Stop using software made by companies that do bad things. Improve the software that doesn't

Or stop buying their stock... but that is difficult thing to embrace. As, we know, these companies are very profitable.

I'm not even sure how that's really realistic in the US at least.

I think a lot of people with full-time desk jobs have a 401k or a Roth IRA, and most of those are stock-based (which is really the only way to make sure your money doesn't decay in value due to inflation), and those are generally going to be stuff like total-indexes or S&P500-based index funds.

There's probably technically something else you could peg it to, so that's probably not strictly true, but I think an awful lot of people are sort of buying Apple stock without fully realizing it.

I don't really think that's realistic. I can of course use software from non-profits or something at home, but we all work for a living, and every single job I've had has relied on software from a for-profit company in one way or another.

I guess I don't have to be an engineer, but even if I were to go be a cashier at Taco Bell or something, I would still be stuck using a proprietary POS system.

Unless I want to go live in a unabomber shed off the grid, I'm probably going to be stuck using software made by companies that do bad things. The software world is overwhelmingly run by Microsoft, Apple, Google, and Oracle (and probably a few others I'm missing), all of which do bad stuff all the time.

> can of course install Arch or Gentoo or NixOS Minimal and then audit the packages that they're installing to see that there's no obvious security violations, but it's unrealistic to think that most non-software-engineer people are going to do that.

It's a fantasy to think that random devs can audit kernel/security code. No single person can. Too many lines of code to audit (that you didn't write yourself). Even if you hired a team, by the time the team does the audit, the goalposts have moved with new source code.

Sorry, I guess I didn't really mean to imply I was going to dissect everything line by line, but I can at least look to see if every package in there is directly open-source and if there are any packages that are being pulled in that are frequent security concerns.

ETA: I know I can technically do that with Ubuntu or Fedora or OpenSUSE as well, it's not like it's a secret which packages they include, but what I like about NixOS Minimal or Arch is that I have to explicitly add every package I want. There are transitive dependencies obviously, so there of course can still be stuff on my machine I'm not happy with, but I still think it's better.

> if there are any packages that are being pulled in that are frequent security concerns.

As an individual, do you think you can do that? I know a lot of packages with security concerns where CVEs are never issued. You just need to go to their PRs and luck into finding descriptions of a security fix. I doubt this would scale for a given individual.

I agree Microsoft is a problem. I just wish you tech guys took an equally critical stance towards Google, a genuine ad company.

And Apple, the upstart ("stealth mode") ad company.

The upstart ad company that spent years and tens of billions of dollars to develop a privacy focused AI in the cloud platform? The same upstart that offers encrypted cloud storage that even it can’t decrypt? Congrats on the false equivalency argument.

Guys like you do yourself a disservice. No one takes your hyperbolic statements seriously. Keep posting this nonsense if it makes you feel better.

It's not hyperbolic, I genuinely believe (and there is plenty of evidence suggesting it as well) that Apple is building a massive ad empire.

BTW, related to all their "encrypted" cloud, if the CCP having the decryption key is not enough to convince you of the BS, they also clearly showed their hand a couple years back when they wanted to introduce local on-device scanning of customers' pictures and comparing against an opaque database of hashes produced by nameless government-connected entities, including uploading the unencrypted pictures for review by humans who'd later send them to authorities. It took massive uproar to change that direction (but not before the same Craig guy who's now talking about the "private cloud" took his time to educate us "screeching minority" about how we misunderstood the thing - e.g. "you're holding it wrong").

So yes, they have amazing PR, but they're just as bad (if not worse) than the likes of Microsoft and Google.

1. https://appleinsider.com/articles/24/04/10/apple-makes-it-re...

2. https://sneak.berlin/20231005/apple-operating-system-surveil...

3. https://news.ycombinator.com/item?id=34299433

> you know, what if a user missed an ad and wants to go back and see what they missed.

Unrelated, and maybe this actually exists, but with the rise of LED billboards, there have been more than one occasion where a billboard was displaying something and it cycled too fast, or the print was too small.

I would actually be interested in visiting the billboards website that lets me click on the geographical billboard location and show me what it’s been showing.

> you know, what if a user missed an ad and wants to go back and see what they missed

I have meetings with adtech guys and this gets pitched every time. Along with "a way to save ads so you can watch them again at home later!" And "alexa enable ads that you can talk to!"

Sheesh you guys are annoying.

- I do not see ads in “every nook and corner of Windows” and neither do you.

- I do not have a recorder installed on my Windows machines and neither do you.

- no one qualified to make that statement has said that Microsoft is the most secure platform.

It is so hard to listen to anyone who exaggerates at this level. If anything, it drives interest in Microsoft because these are all obviously false statements and some readers will wonder what your true motive is. You just raise suspicion in yourself.

At least you used a new account to distance yourself from any other identities you may have here. In fact I would say that was the only smart move in your entire comment.

Anyway, this is a damning revelation by the whistleblower and I hope Microsoft feels a good amount of pain because of it. NEVER make any decision with money as your sole input. It will always be a bad decision, and it’s just a matter of time until that decision bites you or someone you care about.

Hey Jer, please review the CELA policy about disclosing your employment connection to Microsoft.

I don’t work for Microsoft, and I never have.

You're getting downvoted for your tone most likely, but I agree with this statement:

> - I do not see ads in “every nook and corner of Windows” and neither do you.

As a professional "Windows user" logging 8+ hours a day on my PC, I see no ads. Unless you count "OneDrive" ads which in that case, would mean I see iCloud ads on my iPhone too. I'm fine with classifying these as ads, but I'm certainly not seeing them "in every nook".

Are these ads only bundled with a certain versions of Windows?

Disclaimer: I do not work for Microsoft or Apple.

> Are these ads only bundled with a certain versions of Windows?

Yes. Enterprise customers can get builds without them, but home users can't.

I keep hearing that, but I still see plenty of ads (and other dark patterns like data collection you can't turn off) in Enterprise builds.

I heard Win10 LTSC was somewhat better so I'm hoping there will be a Win11 LTSC coming out at some time with longer support.

You can absolutely turn off everything, but you don’t change those settings on the Win10 enterprise machines themselves. You can, technically, but it’s registry stuff. You put the machines in an Active Directory domain and you configure group policy to turn those things off, and you push those policies to the workstations in the domain.

This is 100% normal everyday stuff for enterprise customers, and an enormous pain in the ass for someone who pirates Windows Enterprise.

I'm running Windows 11 Home 23H2 22631.3737

No ads - like anywhere.

I don't get ads in Windows 10 or 11 Pro. I don't think you need Enterprise. When I first install Windows, I turn off every single feature that you're presented with (advertising ID, the ink workspace/writing recognition, safe search suggestions in the browser, etc.) and I haven't had any ads pop up on me (or software installed that I didn't specifically install myself). I turn off Cortana and don't use it, I have the search set to only search my local machine and not use Bing. I really don't feel like I go out of my way to turn these "features" off, I can get a Windows machine running in under an hour, and then it's hours of updates. The original screen that asks you for advertising ID and everything I posted previously does come back with a major Windows update, but I just turn off everything again, and I'm back to no ads. I work in Windows and .NET development, but I still don't deal with any of these annoying issues.

Same thing here, and I'm running Home (22631.3737). I turn most "things" off, but nothing insane and I don't see any ads.

From my experience in big tech they would be categorized as privacy concerns not security. Might just be different conceptual models here.

About an ad missed. Are I'm the only one who would rewatch an ad on Youtube? There is no easy way to do it

Say one thing, do another.

Reply on news.ycombinator.com