Wacom drawing tablets track the name of every application you open (2020)
robertheaton.com
robertheaton.com
https://web.archive.org/web/20200307082846/https://community...
Wacom now has an opt-in for data collection.
What should be the real continuing inexcusable outrage is that Windows, even today, grants all applications full access to read the titles of all windows with no way to disable it.
If you run Windows, ask yourself what information that leaks and if you trust everything running on your machine not to exfiltrate that.
With these in mind, what am I supposed to do, move to the mountains and live the life of a hermit? Once again, not happening. It'd appear that I'm between a rock and a hard place - exactly as designed. This is what an ecosystem grip is like.
I guess the answer, for you, is that you have no other option.
For others, I'll say that I've had 3 Wacom tablets (I keep upgrading), including one with a screen and they have all worked well enough with open-source drivers. They're popular enough that you can do some research to know how they will work on Linux.
Yes, which is exactly what I was getting at. I'm not in the situation where if only I spent some time on introspection and "asked myself", I'd all of a sudden have this lightbulb moment that hey, what if I just switched to Linux or bought a Mac instead, despite what people like GP might like to think.
This is a lot like when people try to - sometimes kindly, sometimes not - invite people's attention to the fact that e.g. they're fat. As if somehow this key piece of realization was the only thing keeping them from starting on a lifestyle change and taking ownership of their diet. It's juvenile there, and it's juvenile here too. Except in this case, I'd argue it goes even further: it's willfully dishonest. As if it was normal that the only way out were the options listed. As if all these options were playing on an equal field.
IIUC, X11 had the same problem, but Wayland allows sandboxing to prevent this?
And MacOS has some degree of sandboxing? But many applications require "Accessibility" permission that similarly gives far too many privileges?
I haven't run into too many applications requesting that permission, outside of desktop automation and window management tools (Hammerspoon, Magnet, etc) which need it to do their job.
What you are suggesting is overstepping 2 security boundries for unpriviledged apps/processes: 1. Reading global key presses 2. Drawing in an always-on-top window with transparent content
Both these things would require that process to get special user/compositor opt-in permissions and integration. Your best bet would be using compositor plugins/native integration, or maybe you could hook into some toolkits (this is usually what FPS overlays do, hook into the graphics APIs).
That is at least my current knowledge and there might be already some wayland extensions/XDG-portal that allows it, but not to my knowledge.
Wayland to my knowledge is isolated by default, with non-isolation being opt-in by both compositor and application via FD shenanigans, but don't quote me on the specifics.
That's there because it's been in there forever in the win32 API, and changing that would break applications.
For example, a long time ago, I wrote a small application that would iterate through a list of executables, launch each one sequentially, and for as long as that executable ran, it would look at the window that had the current focus, enumerate every control, and then send a click message to any control that would contain the words yes, agree, continue, accept, install, ok. Made my life easier to automatically install software on computers unattended.
There are plenty of other applications that require looking up other windows and sending them messages for all kinds of user workflows, things like autohotkey and so on. Changing that behavior would break all of them.
In practice, if the software one wants to use is not trustable, then it shouldn't be run, at least on current mainstream desktop operating systems.
> 99% ?
The single biggest strength of Windows is its ability to run most applications from 30 years ago, and practically all applications from 20 years ago, without a hitch.
Something similar to disabling SIP mode on macOS.
No thank you, I want to keep my OS with apps that are powerful and that doesn't show me a useless permission prompt every five minutes.
On desktop there could be ways added to sidestep them, eg. defined in bulk in a processname.permissions file somewhere protected.
"This program is asking for extended permissions. It's asking:
File permissions: Read, write, and modify"
Now, is this because it allows me to select a custom avatar from the files on my device and save it after cropping it in the app? Or is it because it's going to check all my files and upload the really juicy ones to Scary Hacker Doods and change my name in all my documents to "Ima Dichwied"? I dunno! I have no way of knowing! Gosh, I guess I'll just figure out if I trust the app or not and click "sure" if I do, which means I'm in the exact same boat I'd be in before the permission prompt addicts came into vogue, except with the added annoyance of a popup (and occasionally an app which then needs to be restarted because the initial lack of access threw it into an unexpected state). This does not benefit me. It does not make my device safer. It does not make me feel safer. It does not make my experience more pleasurable. It will never do any of those things. It only serves to slightly raise my baseline level of annoyance.
And I'm someone who (sometimes) knows what I'm doing! It's even worse for people who aren't tech-savvy! The Joe Sixpack user class has split into two camps, one of which is mindlessly clicking "YES I want to run it, YES it can make changes, YES I'm sure, YES the .msi called by the .exe can also run and make changes, YES I want the free 30-day trial of Pro Premium Plus edition, YES I consent to automatic billing on day 31, YES install the browser toolbar, YES let's play Global Thermonuclear War!" because they're, surprise surprise, completely desensitized to warning prompts thanks to the over-proliferation of nattering popup nonsense, and the other of which is thrown into a state of catatonic call-a-geek terror because their GPS app is asking for permission to view their location.
And of course, it kinda also doesn't change much, since (assuming I've learned to give in and submit to Moloch's $HOME) now all my documents are in the siloed "these documents can be accessed by apps" area, still just as ripe for upload to Scary Hacker Dudes or CTRL-H shenanigans. Giving the app access only to its own personal directory would make the hypothetical avatar feature impossible (well, possible only through exiting out, opening gallery, finding a suitable image, manually copying that image over to the app's personal directory... and all that on mobile... yeugh), as well as a whole lot of other features we (should) take for granted.
So in the end, we still have the initial pointlessness, we've just sprinkled in a fair amount of annoyance on top.
In the case where you want an app to have persistent access to a directory, it's true that the easiest way is to use the normal filesystem layout and then take the default mappings, but at least with flatpak you can tell it to map in arbitrary different directories and then use them just fine (ex. I've used this to give Steam storage on external disks).
These features are effective when used, and while they can have inconveniences, those rough edges can be rounded off by customizing the protections (while still protecting most of the system).
*As long as it isn't GTK browser on Windows, which absolutely should be a U.N. matter.
It's more of a question of computer literacy and will be better with time.
I'm frankly disgusted that drivers for hardware like this need to connect to the internet in the first place. This data is clearly not being used to improve the user experience. If it was, then it wouldn't have been a surprise for Wacom that it was collected. Other companies, like Microsoft, also wouldn't be making such terrible UI/UX decisions time and time again, if this data was actually used for improving the user experience.
One workaround apps had was to open a browser window to send information over.
There's no reason I would want mouse / keyboard / pen-tablet / printer, etc. drivers to be accessing the Internet, not even for checking for updates. And there's no real reason for these drivers to be more than a kew KB in size, leave alone 100+ MBs like these have been since ages.
I have an old unbranded Chinese tablet that came with a CD-ROM containing the driver, configuration utility, their source code, and even a datasheet for the MCU it used. A huge contrast between merely selling a product, and trying to control the whole "experience". IMHO we need more of the former, but corporate attitudes strongly encourage the latter.
We can't keep assuming code run on-device is trustworthy. Not just in the "not malware" sense. In that of "does what the user wants and nothing more, nothing less."
I feel like this post is from a couple decades old time capsule. 99% of corporate software is just data exfiltration endpoints now, especially the kind of software that hardware manufacturers tend to make for Windows, which is bloated panels with a couple toggles that are only here to collect your data. The privacy policy is simply a cover-up in most cases. It's not like you have a choice either, because other manufacturers are the same. This stuff needs active countermeasures that treat it as hostile, but since it's hardware it often has low-level access.
Again and again: any PR containing "confusion" seems BS to me.
Stop gaslighting! Take responsibility!
The operating system where these things happen should also be blamed.
Related discussion and developments then: https://news.ycombinator.com/item?id=22247292
And again later, https://news.ycombinator.com/item?id=29056847
They're much more configurable than Wacoms proprietary drivers and also telemetry-free. It's so widely used that they've even been directly integrated into the new osu! lazer client.
The details of how the data was captured was helpful.
The things I found most interesting fall into 3 parts:
Part 1) It's heartening to see people enjoying their kids:
> I told my son to clear my schedule. He bashed two wooden blocks together in understanding, encouragement, and sheer admiration.
Go Dad! Enjoy it while you can!
If you have an experience like mine: as a 57yo at the time, and well aware of what was coming. When I went from daily interacting with my son, who was finally old enough to speak with as a adult, he suddenly moved away to college over a weekend and I almost never see him any more 8-(
I never expected the fully anticipated experience of empty-nest to affect me so strongly 8-/
Part 2)
> I care about this for two reasons.
> The first is a principled fuck you.
I had to laugh 8-) This somehow reminded me of a line in one of my favorite movies: The Live Aquatic.
Bill Murray's character is asked: This leopard shark is an endangered species. What would be the scientific purpose of killing it?
To which he replies: Revenge...
Part 3) The obligatory proprietary OS bashing:
Several times, the author states: "A device that is essentially a mouse..."
It should be pointed out, that a mouse is a USB class device. That is to say, it is a standard USB device that requires no proprietary driver (except for the purpose of exfiltrating data that the mouse maker has no functional need of, or other "value added" purposes)
Pretty much any special feature of the device can be implemented as a user space library.
The author is working on a Mac, the situation is even worse on windoze, where even a actual mouse will ask you to install a custom device driver.
This is why linux, with a broad support of standard USB class devices, is now significantly superior to windows in USB device support. For almost any typical type device, when you plug it into a linux computer, it just works. No driver install or other configuration needed.
Even if you need a driver to support your tablet on some version of an OS that doesn't provide support, there is a GPL waycom driver:
https://github.com/linuxwacom/input-wacom
tl;dr: linux good, windoze sux, mac getting worse...
In the current world, every computer company in any way associated with h/w or s/w or online activity is now also in the data borker business.
This is similar to the way the car dealership industry is now basically a subdivision of retail loan banking. Try buying a car with cash, versus a lease or loan. But, of course, it's not just milking the idiot herd for all it can, its "maximizing efficiency", for somebody...
So much for the glowing future brought to you by unbridled capitalism...
That's it. Try not to use Waycom, or at least not on Mac or windoze...