Hacker News Reader

Comment by terminalbraid | Hacker News Reader

Please note this heinous and inexcusable overreach is over five years old and was addressed shortly after being caught:

https://web.archive.org/web/20200307082846/https://community...

Wacom now has an opt-in for data collection.

What should be the real continuing inexcusable outrage is that Windows, even today, grants all applications full access to read the titles of all windows with no way to disable it.

If you run Windows, ask yourself what information that leaks and if you trust everything running on your machine not to exfiltrate that.

View on HN

> What should be the real continuing inexcusable outrage is that Windows, even today, grants all applications full access to read the titles of all windows with no way to disable it.

That's there because it's been in there forever in the win32 API, and changing that would break applications.

For example, a long time ago, I wrote a small application that would iterate through a list of executables, launch each one sequentially, and for as long as that executable ran, it would look at the window that had the current focus, enumerate every control, and then send a click message to any control that would contain the words yes, agree, continue, accept, install, ok. Made my life easier to automatically install software on computers unattended.

There are plenty of other applications that require looking up other windows and sending them messages for all kinds of user workflows, things like autohotkey and so on. Changing that behavior would break all of them.

Why? Just disable for all by default and have a permission popup open for each, stating that disabling it may crash that app.

If the user is prompted to give permission for the application to have access to this information then at least you know which ones are doing it and can avoid using them if you are worried about it.

This suggestion is not exactly a walled garden, but it moves very suddenly in that direction. Not sure that’s a great direction to head in.

In the case that was mentioned above, hardware frequently has drivers which can run as part of the kernel and can read the memory of other processes, among other things. A user of some hardware would be very likely to install a driver for it, without realizing that a malicious driver can basically do whatever it wants on their system.

In practice, if the software one wants to use is not trustable, then it shouldn't be run, at least on current mainstream desktop operating systems.

In practice, what percentage of windows users does the above translate to "Do not use windows or a computer at all?" What's your estimate?

> 99% ?

There’s nothing wrong with a breaking change for good reasons. Locking down the API to protect user privacy and security is one of those good reasons.

It's okay as long as there is a way to opt out. Windows has a "compatibility mode" which users can enable for any executable. That could restore the old API behavior.

The single biggest strength of Windows is its ability to run most applications from 30 years ago, and practically all applications from 20 years ago, without a hitch.

I agree with an opt out but it should be difficult. Like entering recovery mode and enabling a legacy mode from the terminal. That way if you’ve got some industrial application you’ve got a way. But malicious software has a hard time getting users to enable it.

Something similar to disabling SIP mode on macOS.

Remember, we're talking about a hardware driver here! It has access to the kernel, so it can ultimately do whatever it wants, the API just makes it easier.

FUCK YOU! DO NOT TAKE AWAY MY AUTOHOTKEY.

> the real continuing inexcusable outrage is that Windows, even today, grants all applications full access to read the titles of all windows with no way to disable it.

IIUC, X11 had the same problem, but Wayland allows sandboxing to prevent this?

And MacOS has some degree of sandboxing? But many applications require "Accessibility" permission that similarly gives far too many privileges?

> But many applications require "Accessibility" permission that similarly gives far too many privileges?

I haven't run into too many applications requesting that permission, outside of desktop automation and window management tools (Hammerspoon, Magnet, etc) which need it to do their job.

Yeah, but any application with that privilege can log all keystrokes and upload it to a third party. Obviously this privilege needs to be far more fine grained and have limitations, i.e. registering a hook on particular key combinations, rather than listening on all key events.

How do you implement an app that displays all the keys you type on screen then no matter which Wayland compositor? (For when you're making video tutorials of an app)

In short: you wouldn't.

What you are suggesting is overstepping 2 security boundries for unpriviledged apps/processes: 1. Reading global key presses 2. Drawing in an always-on-top window with transparent content

Both these things would require that process to get special user/compositor opt-in permissions and integration. Your best bet would be using compositor plugins/native integration, or maybe you could hook into some toolkits (this is usually what FPS overlays do, hook into the graphics APIs).

That is at least my current knowledge and there might be already some wayland extensions/XDG-portal that allows it, but not to my knowledge.

I mean the reality of things is I'll just add myself to the input and video groups and let the process do what it wants for my computer to be useful

The accessibility permission isn't just for listening to key events. It's for looking at and manipulating content on screen, e.g. moving windows around, sending synthetic keyboard/mouse events, etc. Registering hooks on a specific key combination is a separate API which doesn't require elevated permissions.

> IIUC, X11 had the same problem, but Wayland allows sandboxing to prevent this?

Wayland to my knowledge is isolated by default, with non-isolation being opt-in by both compositor and application via FD shenanigans, but don't quote me on the specifics.

>What should be the real continuing inexcusable outrage is that Windows, even today, grants all applications full access to read the titles of all windows with no way to disable it.

No thank you, I want to keep my OS with apps that are powerful and that doesn't show me a useless permission prompt every five minutes.

Why useless? Permission prompts were the best inventions of mobile OSes, there should be much more of them actually.

On desktop there could be ways added to sidestep them, eg. defined in bulk in a processname.permissions file somewhere protected.

> Why useless?

"This program is asking for extended permissions. It's asking:

File permissions: Read, write, and modify"

Now, is this because it allows me to select a custom avatar from the files on my device and save it after cropping it in the app? Or is it because it's going to check all my files and upload the really juicy ones to Scary Hacker Doods and change my name in all my documents to "Ima Dichwied"? I dunno! I have no way of knowing! Gosh, I guess I'll just figure out if I trust the app or not and click "sure" if I do, which means I'm in the exact same boat I'd be in before the permission prompt addicts came into vogue, except with the added annoyance of a popup (and occasionally an app which then needs to be restarted because the initial lack of access threw it into an unexpected state). This does not benefit me. It does not make my device safer. It does not make me feel safer. It does not make my experience more pleasurable. It will never do any of those things. It only serves to slightly raise my baseline level of annoyance.

And I'm someone who (sometimes) knows what I'm doing! It's even worse for people who aren't tech-savvy! The Joe Sixpack user class has split into two camps, one of which is mindlessly clicking "YES I want to run it, YES it can make changes, YES I'm sure, YES the .msi called by the .exe can also run and make changes, YES I want the free 30-day trial of Pro Premium Plus edition, YES I consent to automatic billing on day 31, YES install the browser toolbar, YES let's play Global Thermonuclear War!" because they're, surprise surprise, completely desensitized to warning prompts thanks to the over-proliferation of nattering popup nonsense, and the other of which is thrown into a state of catatonic call-a-geek terror because their GPS app is asking for permission to view their location.

I think I agree with your general point, but I have to point out that the correct solution - implemented by Flatpak, Android, and I believe macOS and iOS - is that selecting an avatar should use a file picker that only hands the app access to what it needs, and a request for full filesystem access is a red flag.

Yes, but now I have to contort my file organization around the preferences of the machine, which is completely backwards to how the user:device relationship should be. My files belong where I feel they belong, optimized for the idiosyncratic and individualized workflow that works for me.

And of course, it kinda also doesn't change much, since (assuming I've learned to give in and submit to Moloch's $HOME) now all my documents are in the siloed "these documents can be accessed by apps" area, still just as ripe for upload to Scary Hacker Dudes or CTRL-H shenanigans. Giving the app access only to its own personal directory would make the hypothetical avatar feature impossible (well, possible only through exiting out, opening gallery, finding a suitable image, manually copying that image over to the app's personal directory... and all that on mobile... yeugh), as well as a whole lot of other features we (should) take for granted.

So in the end, we still have the initial pointlessness, we've just sprinkled in a fair amount of annoyance on top.

Er, no? To select an avatar, the app triggers a file picker, you navigate anywhere in the filesystem and pick a file, and the system hands the app just that file with no access to anything else.

In the case where you want an app to have persistent access to a directory, it's true that the easiest way is to use the normal filesystem layout and then take the default mappings, but at least with flatpak you can tell it to map in arbitrary different directories and then use them just fine (ex. I've used this to give Steam storage on external disks).

These features are effective when used, and while they can have inconveniences, those rough edges can be rounded off by customizing the protections (while still protecting most of the system).

Oh, yeah, duh. Sorry about that. The file picker route is generally fine*, though I still think the edge cases where I want a program to be able to modify another program's files in-place are numerous enough that I don't think it should become a "soft-standard" on desktop environments.

*As long as it isn't GTK browser on Windows, which absolutely should be a U.N. matter.

What would be the alternative? Overcensored app stores and corps insisting on them?

It's more of a question of computer literacy and will be better with time.

No... besides the concerns about creating a proprietary walled garden, that just causes prompt fatigue and they will allow anyway, creating the same problem again and further irritating users.

You should be able to choose to switch off security as you wish. You should also be able to choose to leave it on.

I think applications should not have internet access by default. They should require the user to give them permission either temporary or permanent permission to connect to the internet. Ultimately that's where the security bottleneck is.

I'm frankly disgusted that drivers for hardware like this need to connect to the internet in the first place. This data is clearly not being used to improve the user experience. If it was, then it wouldn't have been a surprise for Wacom that it was collected. Other companies, like Microsoft, also wouldn't be making such terrible UI/UX decisions time and time again, if this data was actually used for improving the user experience.

More than a decade back, I used to do this using firewall rules. Ot used to be a single-click firewall setting to disable all apps by default, have a pop-up show up when an app not already in the rule set would try to access the Internet, and thus keep building / refining the rules.

One workaround apps had was to open a browser window to send information over.

There's no reason I would want mouse / keyboard / pen-tablet / printer, etc. drivers to be accessing the Internet, not even for checking for updates. And there's no real reason for these drivers to be more than a kew KB in size, leave alone 100+ MBs like these have been since ages.

I asked myself and the answer is no. Now what? I have dealbreaker problems with Linux and Mac. I'm also not going to pull a Terry Davis and make my own OS, and I'm not willing to participate in the circus that is open source either.

With these in mind, what am I supposed to do, move to the mountains and live the life of a hermit? Once again, not happening. It'd appear that I'm between a rock and a hard place - exactly as designed. This is what an ecosystem grip is like.

"What option do I have left after rejecting every other option?"

I guess the answer, for you, is that you have no other option.

For others, I'll say that I've had 3 Wacom tablets (I keep upgrading), including one with a screen and they have all worked well enough with open-source drivers. They're popular enough that you can do some research to know how they will work on Linux.

> I guess the answer for you, is that you have no other options.

Yes, which is exactly what I was getting at. I'm not in the situation where if only I spent some time on introspection and "asked myself", I'd all of a sudden have this lightbulb moment that hey, what if I just switched to Linux or bought a Mac instead, despite what people like GP might like to think.

This is a lot like when people try to - sometimes kindly, sometimes not - invite people's attention to the fact that e.g. they're fat. As if somehow this key piece of realization was the only thing keeping them from starting on a lifestyle change and taking ownership of their diet. It's juvenile there, and it's juvenile here too. Except in this case, I'd argue it goes even further: it's willfully dishonest. As if it was normal that the only way out were the options listed. As if all these options were playing on an equal field.

FreeBSD?

Let's also not forget NetBSD. /s

I'd say that in these cases, when there really is no viable option (including just not using...) then the optimal course of action is to choose the "least worst". Compromises work where ultimatums fail.

I agree. This is why I continue to stay on Windows, for now.

Reply on news.ycombinator.com