Windows 8.1 Bing passes local PC searches to advertisers | Hacker News Reader

Windows 8.1 Bing passes local PC searches to advertisers

computerworld.com

96 pointstanglesome45 comments

"Do people at Microsoft ever talk to anyone outside their own groups?"

From friends of mine who have worked at / are working at Microsoft, sadly this is a fairly common question, and the answer is "no" more often than you'd hope. Hopefully the new re-org helps them, because they desperately need to be rowing in sync.

Some examples:

http://channel9.msdn.com/Forums/Coffeehouse/VC11-Firefox-Met...

http://arstechnica.com/civis/viewtopic.php?f=15&t=1209093

In that first example, I kind of agree with some of the guys there. Why would VC++2012 need to officially support an officially unsupported OS? VC++2012 was released more than a decade after Windows XP was released. Windows XP support ended in 2009, extended (security) support only goes through early 2014. Ubuntu LTS only goes for 2 years, Windows XP "LTS" goes through 14 years.

Unless I'm missing something, Microsoft really has no reason to care if you want to target Windows XP. Their official response should be (and is) to upgrade to a supported release. Windows 7 was released almost 4 years ago and is supported until 2015/2020. How long can you complain that an ancient OS is no longer supported before you accept that fact?

Well, they cared enough that they added support for XP in an update to VC2012. I was talking about how they added it.

I agree with your points, but Ubuntu LTS releases are actually supported for 5 years, not 2 (with new LTS releases coming every two years).

Good catch, thanks.

Well, to be fair in many large organisations, most people are not even interested enough in their own job to talk about it with their colleague.

Hell nowadays, I'm happy when people in the same team talk to each others, normally without band-aids: daily standup, weekly status, monthly get together, ...

So now MS is playing catch-up with Canonical? http://arstechnica.com/business/2012/09/ubuntu-bakes-amazon-...

There are a variety of other "lenses" (most of which are third-party):

http://askubuntu.com/questions/38772/what-lenses-for-unity-a...

* search AskUbuntu.com questions

* calculator

* search Google Books

* find map, time, temperature, wind speed for a particular city

* search ThePirateBay

* search Wikipedia

* search YouTube

You get the picture. But you are correct, Canonical did it first.

"Our goal is to make search advertising easier for our customers, while providing the best consumer experience with the most relevant results for the tasks they are looking to accomplish."

I can imagine the conversation now:

Exec 1: It's for our customers.

Exec 2: Like the people who pay for the OS?

Exec 1: No, not those customers, the ones with money. You know, advertisers!

So frustrating.

This is one step away from identifying your "pirated" songs and movies, and then sending the data over to RIAA/MPAA, and (if they're really insane) a few steps away from allowing DCMA's on those files, and deleting them from your PC. Then Richard Stallman vision of the future would be complete.

Think it's not possible? They were already blocking TPB links in MSN a year or so ago, but thanks to backlash I think they reverted that.

Oh, and I won't even go into the many ways this data could be given to the NSA - your local data. Plus, your documents now get saved by default in Skydrive.

Strictly speaking, aren't we always one step away from being one step away from being one step... etc. ad infinitum?

Sending your local search details across a network just because is bad on its own merits, you don't need to link in a dystopia as everything can be Kevin Bacon'd to the Brave GNU RMS84.

Edit: And as indicated in a separate comment in this thread by someone who actually tried to reproduce, the search queries aren't even sent to the advertisers directly, but to the search provider just as with any other search!

Why is this getting flagged? It's not like the story is false. I've been aware of this for a few months, but for some reason the media hasn't picked up on it yet, and I was wondering when it was going to blow up, because it's exactly what Microsoft has been campaigning against Google about.

This is HN where we defend spammers and cold-callers.

Waiting for the CEO of some go-nowhere marketing startup to come in here and tell me that this is a good thing.

This is HN, where some people run small businesses and know how hard it is to acquire customers.

Newsletters aren't spam and most cold callers only call once, or will stop calling if you ask them.

>Newsletters aren't spam

Unsolicited marketing e-mails are spam. Unless I have explicitly opted into them I mark them as spam in GMail.

Yes. By "newsletters" I meant "marketing email you've subscribed to".

Personally, I'm okay with receiving a newsletter from a service I've subscribed to (but only from the company—no "special partners"), even if I didn't specifically input my email address in a "subscribe to our newsletter" form, as long as there is a permanent way to unsubscribe.

Sorry, if your startup has to resort to spam and cold-calling then the market isn't there/isnt ready for you.

But you can easily turn it off by apt-get remove ... wait ...

Actually, it's even easier than that in Windows because you don't have to remember some cryptic command or package name - you can just go into search settings and flip the switch to Off.

Just like in Windows XP/Vista when you configured the updates to always be manual? Yeah, except that Windows is their OS and your settings are just guidelines ;)

Yes, just like that. Please show me a case where the setting is not followed because I have no clue what you're talking about nor can I find anybody complaining that it has not worked as advertised.

Furthermore, you're also free to disable the clearly labeled "Automatic Updates" service and then you can happily spend your time downloading and manually installing update packages. You can even get separate software to do this for you or even build your own.

You sure are right about one thing though. Windows is their OS...and it's a good thing too because I have just never had the time or the inclination to build my own ;)

Microsoft has the option to override your settings, just as it happened when they pushed the WGA validation tool in the wild. When it happened several years back, you had to completely disable updates, because if you had it set on manual, it was still automatically installed. This coupled with the fact that the WGA validation wasn't working properly / had bugs, has led to serious problems for many users.

Also, with Ubuntu for example, you don't have to build it yourself, but it's yours in a way that Windows will never be.

There are all sorts of things in Ubuntu that I'd have to "completely disable" in order to make it do what I want. So what if I can pick apart the code and rebuild it? I don't ever want to do that.

Honestly - let's weigh the options here. With Windows I may have to beat the OS into submission once in a while, but I'd have even more work making Linux even fulfill the most basic requirement like...oh say, having "file creation time" stamps. (Now I know Ubuntu currently defaults to Ext4...but seriously - why did we need to wait so long for that?)

I'd rather pay Microsoft every month to use their tightly integrated, high quality computing ecosystem because it actually offers what I need with the least amount of hassle.

I hear this argument a lot. Do you fix your own car dude? Do you change the oil by yourself? I don't but I have a trustworthy mechanic that does it for me and I don't have to suffer the inflated prices of my car's manufacturer. This is even more important for transportation companies that have their own mechanics, just as many companies have their own IT department.

On the quality of Windows my experience has not been the same. For me working with it is like death by a few thousand cuts. Skipping over the fact that the developer tools that I need do not work well on Windows, every time I had problems I could find no way to debug what happens, so really the standard is to just reformat and install everything from scratch. How IT departments live with Windows I'll never know.

The difference here is that I don't need a mechanic at all to get what I need from Windows because Windows is not missing many very basic features. Five years ago, if we wanted file creation timestamps in Linux, we'd have to use an alpha or beta filesystem and hire a "mechanic" to fix or even install it. That's why everybody is using Windows and that's why you hear that argument a lot.

Furthermore, if you're not using Microsoft tools to develop for Windows then you're using the wrong tools. If I go try and use Visual Studio on Linux - it won't work. Go figure.

If they sell ads, then chances are they pass your information along to others.

Google, Apple, Microsoft, Ubuntu. At least with Ubuntu, you can disable/remove it.

Switch to Debian, or some other alternative. Privacy comes at a cost...Crappy thing with Microsoft is you are paying them to pass your info along.

With Microsoft you can disable it too:

"Fortunately, you can turn this functionality off without much trouble"

There's a bit of FUD here - all web searches (Google, Bing, whatever) go to first parties that sell tidbits of information about your searches and a bit of space on their web pages to third parties. That much has always been known. The allegation that it passes local PC searches directly to advertisers well, that seems a little unfounded. So I checked, I installed fiddler, set it up to proxy my Windows 8.1 preview Surface Pro, and typed in some search terms.

Here's what I found as a result of typing in "procmon":

With "Use Bing to search online" disabled

When I begin typing in the search box, there is a single GET request to https://www.windowssearch.com/settings?setlang=en-US&cc=US with generic cookies that indicate my device type (the User-Agent is WindowsConnectedSearch/1.0 (Windows NT 6.3.0.0.9431.7;x64;Microsoft+Corporation;Surface+with+Windows+8+Pro;Slate;6.3.0;Touch;) and some cookies that may indicate a device or installation ID. It appears consistent between search results. However, "procmon" is not sent, nor is the first letter of my search result, and typing additional letters doesn't result in any more queries.

With "Get search suggestions and web results from Bing" enabled but "personalized results" disabled

Bing gets my search term when I finish typing. An explicit GET request for https://windowssearch.com/suggestions?qprocmon&cc=US&setlang... is sent and the response is, of all things, XML formatted with an <rss> element and tags that appear to indicate it's valid RSS. The cookies sent are the same as above, and no requests are sent to "advertisers", except it's reasonable to believe Microsoft might set the price for keywords based on their popularity.

With full personalized results enabled

Bing gets the above, plus a request was sent to https://www.windowssearch.com/fd/auth/signin?..etc.. to sign me in when I ticked the box. The request also sent a header indicating my current latitude, longitude, and accuracy, and appeared to send additional headers. But none of that went directly to advertisers, although Microsoft I'm sure can share it with whomever they like.

Now, lastly, until I actually click one of the non-local search suggestions that show up (not the files that show up) I don't get any more search queries. If I click one of the suggestions, like "procmon64.exe", I don't get any requests to any domain except "www.windowssearch.com". Even though I get thumbnails of web pages and snippets of relevant text below them, my request never went to an advertiser directly.

As well, even if I type a loaded search term like, I'll use the band "One Direction" for example, and select the search suggestion, I get a page with some local files (apparently One Direction matched EntityFramework.xml in some Visual Studio projects... interesting), artist information, tracks by them, albums and videos, web pages, Store apps, and related searches. But most importantly, my machine never contacted any remote host other than www.windowssearch.com.

So what Microsoft is doing is more innocuous than what the privacy-paranoid users of Ghostery already prevent. There were no third party domain names reached, no advertisers directly sent my search results, and never was the content of any local file uploaded. None of the GETs had a body.

Also, and finally, group policy can be used to completely disable the requests and businesses could always filter or block the domain windowssearch.com.

I'm a proponent for privacy, but let's not spread FUD.

Disclosure: Works for Microsoft, but not directly in these parts of the company.

Thanks for digging into this. If you feel like there's a real privacy issue here, or even just a significant disconnect between reasonable expectations and what is actually happening, please get in touch: m-a-r-a-y (without the dashes) at microsoft dotcom.

wait: so what I understand is that

windows 8.1 will, by default, transmit all local searches -- including things like my ssn to find the file I keep my gf's ssn in, plus any of the other things that I currently type into spotlight to do a full text search -- to microsoft. These search phrases will be subject to a retention and sharing policy that no doubt amounts to dozens of pages of text written by lawyers with an eye to making it difficult to understand that can be changed at whim. And that can be shared, along with identifying info, with the NSA either through subpoena or asking nicely or flat out cash money.

so what exactly is the fud? You didn't see the exact phrase go into their rtb so therefore it doesn't?

I suppose so, yes. I guess my question to you would be, why are you complaining about the privacy implications of this when your example involves storing sensitive data as plaintext, given the propensity of the average user to use online document storage like Google Drive these days, I doubt you should be too concerned about your hypothetical.

because anybody who claims they think end users understand that any search phrase they type on their computer will end up being shared with advertisers and stored forever is a liar

Frankly, it's a good reason never to touch a msft product. At least google has the excuse they don't charge their users; I wonder why msft's is?

So what you're saying is that you believe it's acceptable for Microsoft to use OS features to scrape arbitary interesting-to-third-parties data from the OS it's hosted on, and it's the user's fault for not encrypting it?

Just to follow up: What, precisely, is the default behavior?

It's one thing if you have to enable "send search info to MS to enhance results", its another thing entirely to have that data being sent by default (and thus trapping the clueless).

The default is that your search text gets sent to Microsoft and not, AFAIK, to advertisers directly. I can definitively say that at the very least, Microsoft has established a firm barrier of separation between the advertisers and the Windows client. For example, it's not just a web page with embedded advertiser's javascript/html that it displays when you get your search results, everything is curated by Microsoft and delivered by their servers.

So you confirmed that every local search goes to MSFT servers? It is default, isn't it? And it's hard to turn off? You mention group policy -- I know that tool and it's harder than "just change in the registry" which is far from easy for plain users.

That's really, really bad. Local search sent to MSFT by a hard to change default is crossing the limit IMHO.

No, group policy is used in enterprises to disable things on a company-wide basis. By all accounts (even the original article) it's easy for end users to disable.

Typing "Bing" or "search" or "personalize" or many other variants in the search all give options to configure that data sharing directly from the OS in a very easy manner.

What's a "local" search? Is the behavior you describe observed when "Files" or "Settings" are selected in the "What to search" box, or only when it's set to "Everything" or the web options?

Your privacy is our priority! I mean, it's our priority to sell your privacy.

SCROOGLED!

> I'm not saying that this type of functionality is unprecedented. Google has long incorporated that kind of capability in Android and Google Instant search. But it's a new move for Microsoft.

Since when does "Google Instant Search" search my PC?

I often give Microsoft the benefit of the doubt, but if this is true then they have truly screwed up. Whoever thought that this was a good idea should be fired. This would never have happened with Gates.

Reply on news.ycombinator.com