TL;DR: "By using Windows 10, you relinquish any expectation of privacy".
Stallman is an optimist! This "privacy policy" is much worse than what we expect from malware [1]. Cryptolocker might hold my files hostage for some bitcoins, but they're not going to sell me out to aggressive lawyers or overzealous law enforcement.
Not happening. Sorry this has gone on long enough.
Closed both Microsoft accounts and cancelled my MSDN and AP subscription renewals.
I do a big chunk of my work on a CentOS desktop machine already. There's not much of a push to chuck everything in an 8.1 VM and start moving it all over. The MSDN licenses I need persist past the sub so that's enough for me.
I've been on the verge of doing this for a couple of months already anyway for ref.
Edit: Also, I'm really not happy about the pro-Microsoft spin all over the media recently. It appears to be covering up a number of nasty changes behind the scenes and lacking in critical analysis.
Edit 3: does anyone know of a decent 4G modem for a laptop, preferably one that works in Linux. I can then skip my phone as a tether and use a dumbphone.
Yes I agree entirely; you're 100% right. The only 3rd party service I now rely on personally is my domain registrar and an IMAP box which is unavoidable to participate in the world now. I've closed most of my online accounts with services over the last year already. I moved my code from github to local fossil instances about 3 months ago as well. Everything I use is hosted by reputable companies in the EU.
I'm not touching Android. Too many bad experiences there about a year ago for me.
The best solution is to run Replicant on a compatible device.
Short of that, you can just load CyanogenMod or another AOSP-based ROM on most devices. It's entirely possible to use Android without the proprietary Google Apps bundle.
That's a great deal. I've been looking for an email setup for the family that doesn't cost a fortune and this is the best I've seen. I am tired of running my own mail stack, what a PITA.
Indeed. Works out at £12 a year for me including domain. I tried loads of shared hosting before and it was all expensive and unreliable. You get 5 free boxes per domain as well which is enough.
If they did some static hosting included that'd be nice too but I can't complain.
"Finally, we will access, disclose and preserve personal data, including your content (such as the content of your emails, other private communications or files in private folders), when we have a good faith belief that doing so is necessary to:
1.comply with applicable law or respond to valid legal process, including from law enforcement or other government agencies;
2.protect our customers, for example to prevent spam or attempts to defraud users of the services, or to help prevent the loss of life or serious injury of anyone;
3.operate and maintain the security of our services, including to prevent or stop an attack on our computer systems or networks; or
4.protect the rights or property of Microsoft, including enforcing the terms governing the use of the services - however, if we receive information indicating that someone is using our services to traffic in stolen intellectual or physical property of Microsoft, we will not inspect a customer's private content ourselves, but we may refer the matter to law enforcement."
Definitely close your accounts if you want to protect your data, no fault there :) But make sure you know that this article doesn't actually tell an accurate picture.
It doesn't explicitly call out 4G support so you will have to work backwards.
fyi: some laptop firmware, such as thinkpads, have a whitelist of supported WWAN cards. If you can't find a suitable internal card you can use a USB dongle without restriction.
How do we not yet have a metric for noting specific security policies, so we can create a matrix of how different companies handle this information? I'm appreciative of information on what personal data policies Microsoft uses, but I'm more interested in how it compares to other companies. How is it the same or different than Google and Apple?
This is extremely important. Right now we have an extremely inefficient market with respect to privacy. Users don't know what policies companies have, and even if they know where to find that information, it's extremely inaccessible. Making it easy to compare services would allow users to actually distinguish based on this metric, which is the first step towards pressuring companies to actually compete on this metric.
Simplistically, this could be achieved with a set of data policy components (account information, login information, purchase information, location information, various activity information items, etc) and their policy on them in well defined terms, such as Not Applicable, Does not collect, Collects but does not share, Collects and may share, Collects and known to share. That would be the start of something beautiful.
With a much more clearly defined set of items they measure this is fairly close to an initial version of what I was describing. With that and a standardized legend for the rating for each item (save the specifics for a mouse-over) it would be fairly easy to create a service matrix of selected services.
TOSDR isn't just a good service, it has some momentum and an excellent dataset already. If the right people were to start contributing it could gather quite a lot of steam.
Besides being too broad, it tracks only a few items. I outlined five possible states above for how a company deals with a subject, a sixth would be "unknown". The EFF just has a star, which considering their goal, which is similar but not quite the same, is fine. They are looking to encourage companies to change by influencing the consumers as well, but I think they are going for a more emotional influence, while I am espousing a more informational influence. Make it easier to see the specifics in a more granular fashion so consumers can be informed.
Additionally I'm not entirely sure how to split out all the different things to track with regard to privacy, which is why I think it's a big project. But I see a need, and I think someone could do well for themselves filling that need.
I think expanding this EFF project would be both easier and better than starting your own, if they were interested. You get added publicity for free plus credibility.
They could have an expanded version with more details, which satisfies both goals.
I agree, but I'm not sure how amenable they are. It really depends on their goal for that page, and whether they think it achieves it better in it's current state.
Unfortunately, I'm far too burdened with commitments to do this myself, so it's more a call to arms than a statement of intent. :/
You really can't create a matrix of how different companies handle the information, because there is no practical way for you to determine that. You could, however, create a matrix of what different companies claim they do with the information. While this might be helpful to those who are inclined to believe that companies always do exactly what they say, it isn't going to be very helpful to those who want to protect information in a reliable way.
If you want reliable protection, you eliminate or block those mechanisms which expose information to others. You could create a matrix which identifies different types of exposures and shows which can be avoided when using a given product or service. It would be a major task though, because technical details that are often not well documented can have a big impact on exposures. You couldn't afford to miss something like a user identifier that accompanies phoned home data.
Of course, the available information is what's presented. But what I outlined isn't any less effective because the specific actions are unknown. You have to assume if they say they can/may do something with regard to your data, it's being done (or can/will be done in the future). Privacy policy violations are actionable, so what they say they are allowed to do is what should be started with. If there's specific credible information that they do otherwise, them you use that.
The whole point is making it easy to judge how companies interact with their customers in regard to data and privacy so market pressure can do it's thing.
I like your idea at the end there. Any known examples of this? Or maybe a proof of concept?
Maintaining it would be a pain. I'd like to see each company maintain their own table of terms and policies.
Other than maintenance, I'm concerned about how conditional sharing would be expressed succinctly... of course it's just a watered down version but you'd have to do it carefully.
From your sibling comment, https://tosdr.org/ seems like it gets partly there. The items listed don't seem to be standardized for the initial view though. Then again, I just visited it for the first time in years (I had heard of it, but completely forgotten), so I don't claim to have a good idea of exactly what it offers.
The first step would be getting a formalized set of metrics, which is in itself a bit project. Once you have that, a framework to crowd source the specific answers from users (hopefully with references to a TOS/Privacy policy section) would be the easiest way to keep it up to date. Allowing comments and annotations for further info on a specific company's rating for an item that could be expanded would let people drill down on the details.
It is a little unsettling when you read these policies.
This is probably for Cortana. She has to understand and process your voice commands, learn your nickname and preferences to be effective. She already works in Windows Phone (very nicely), and I don't think a little phone processor would be enough to power her up. In fact, she doesn't work without an internet connection, at least in WP. What happens is that she takes the information you input to the cloud, processes it there with more than enough horsepower to do her stuff and brings it back to you. I suppose this is how it'll work as well on PCs.
So for all this to work, yes they need to collect our data. Face it, with any smart assistant that we want it's going to be the same, they're all cloud powered. Doesn't Siri also require a internet connection? Probably Alexa too, and any others work exactly the same.
It is a necessary evil to have a useful virtual assistant. Although if we don't want her we can opt out of the MSA account, as someone posted in the comments. Unsure if that removes all the privacy concerns, that would be useful to know. On Windows Phone it did (you can opt out of sending data to MS and Cortana is disabled).
On Windows 10 you can opt-out as well. In fact, using Microsoft account is an opt-in while installing. You can just make a local account and certain features would be off by default. If you try to access them it will remind you that you need an MS account to access them.
The fundamental problem with this privacy policy is the scary wording. When Gmail first came out, Google was (probably) the first company to read emails to figure out ads. But they enforced the not-touched-by-human-handsiness claim hard throughout. MS, on the other hand, not only says it will collect data but again and again mentions "disclose when necessary." There are too many uses of "disclose." It almost sounds like they will just hand over data without much conviction.
I went to the Privacy statement [0], to the "Reasons we share your data" (click on Learn More) and it does not sound scary at all (it' pretty much the same as any internet company that holds customer data). It's very clearly worded and I know exactly how/why my data will be used, so I can decide if I want to go ahead or if I don't.
There's also a Data Retention section further down that specifies how long your data is in their servers.
edit: In the top section (Personal Data we collect) it also says: "You have choices about the data we collect. When you are asked to provide personal data, you may decline. But if you choose not to provide data that is necessary to provide a service, you may not be able to use some features or services."
"Finally, we will access, disclose and preserve personal data, including your content (such as the content of your emails, other private communications or files in private folders), when we have a good faith belief that doing so is necessary to:
1.comply with applicable law or respond to valid legal process, including from law enforcement or other government agencies;
2.protect our customers, for example to prevent spam or attempts to defraud users of the services, or to help prevent the loss of life or serious injury of anyone;
3.operate and maintain the security of our services, including to prevent or stop an attack on our computer systems or networks; or
4.protect the rights or property of Microsoft, including enforcing the terms governing the use of the services - however, if we receive information indicating that someone is using our services to traffic in stolen intellectual or physical property of Microsoft, we will not inspect a customer's private content ourselves, but we may refer the matter to law enforcement."
> Face it, with any smart assistant that we want it's going to be the same, they're all cloud powered.
> It is a necessary evil to have a useful virtual assistant
Not necessarily. With things like the Jasper Project [0], you can run your own personal assistant that decodes voice on your machine and doesn't use the cloud. Granted, Jasper doesn't fit in your pocket (yet).
The real reason I'll never use Microsoft products again: I'm sick of legally purchasing software and being treated like a potential charlatan every time I change a component of my computer or upgrade. I have lost countless hours to Microsoft Tech Support for licensing issues (which, to be honest, are reasonably efficient these days). However, the older I get, the more I just plain resent having to deal with this intrusion into what should be an experience I control.
Microsoft licensing is hellish, I've worked with it for years and I still don't entirely understand it.
Indeed. Wait until you have to deal with an audit. Apparently, even on microsoft's advice on licensing, we still owed them about £50,000 of missing licenses after an audit...
Most of this was down to a SQL Server upgrade where core and CPU terminology was changed.
I'm currently arguing for serious considerations of SQL Server alternatives for selected new development work (and where reasonably achievable), in order to mitigate spiralling license fees. The main issue is that mostly those fees are paid by our customers, but ultimately our customer's cost is our cost. Collectively it's becoming a stupid amount of money.
We're only keeping it around due to a pile of stored procedures and coupling (see an earlier thread on this I was whinging about). PostgreSQL is the next step. We'll pay for support via EnterpriseDB still.
Our main SQL cluster is two 48 core HP machines with 512Gb of RAM each and a big EMC SAN. We want this as lots of much smaller machines but you can't really scale down SQL Server once everything is coupled into it.
Right. Funny how 'best practice' became to use stored procs rather than generated queries. Partly because it constrains and defines the API exposed by the DB and greatly helps avoid SQL injection issues. Those things can also be achieved with a well written code layer, and as for the 'API', well, we have so many stored procs that that argument has become somewhat tenuous.
There's the performance aspect as well - having the DBA know what queries will be 'thrown' at the server. But again, it's not black and white, it's more that the stored proc does tend to limit really bad SQL queries moreso that open ended srting queries, but 'it depends'.
Nice reference discussion, thanks. Sounds like we're on the same wavelength.
Our main issue (IMO) is that if you get a SQL Server person in to solve SQL Server performance issues then you're likely going to go down the route of one massive all powerful SQL Server box which just compounds the problem. A broader solution of moving away from pure SQLServer and towards distributed work, caching layers, etc. is probably a saner long term path to take. But in business short term thinking generally takes precedence over long term.
While I use PostgreSQL whenever I can, it is significantly easier to design a backend using a cluster of SQL Server machines, than it is to design a backend using several commodity machines with PostgreSQL. The former is just more mature, but you pay for that.
I agree with respect to traditional architectures but most of our stuff runs from our cache layer (97% of queries are cache hits) so we're moving to lots of smaller and cheaper instances with a cache front end (memcached). We literally use the database as a storage engine going forward and nothing clever.
Cache hits versus misses. The latter may result in multiple SQL queries whereas the former are returned from the cache. Imagine the cluster we'd need to support that!
It is, but the nature of the application demands that a write query is not considered done until it is guranteed persisted on the disk, and the same data is rarely queried often enough to warrant a dedicated cache layer. The data that is queried often is so far handled by SQL Servers buildin caching gracefully.
That isn't the same as we couldn't get some benefit, because we could especially as the userbase scales. But so far we haven't had to scale to the point where it's worth the added complexity to persuit. One can only look forward to the day it is.
Yes. We stick with memcached. Every node in our cluster has an uptime of over 3 years handling up to 5000 requests a second so we're quite happy to leave it. In fact it's the most reliable thing I've ever seen I think.
Redis looks nice but I suspect that it may be easy to lean on it too much for functionality. We were looking at it for a couple of tasks but haven't found much motivation to move yet.
that's why I never, ever, EVER have official Windows installed. you should get soemthing extra when paying, and that extra shouldn't be inconvenience. heck, I have put cracked windows even on laptops that had Win licence with them on purchase, just because of this (you changed HDD, doubled RAM or similar? forget it! this ain't the same machine, and you won't run this OS again! just have this one hour call and maybe...)
Even back in the days of Windows XP, the call was 10 minutes and you talked to an automated machine and just read it your license key. Not an hour long call.
But it was tedious though. The OS gave you a tremendous long number you had to punch into your phone and then it gave you numbers in return you had to type into the OS, but as that screen wasn't available to you you first had to write them all down (If I remember it correctly!).
I'm not sure they do that anymore for home users. A year ago I upgraded every part of my PC except the hard drive. Plugged the existing Windows-installed hard drive into a new mobo, processor, and video card and it just ran some updates for new drivers. Never asked me to re-license. And I've used this same license key to re-install Windows maybe five times since Windows 8 came out, never had any problems.
I have swapped hardware many many times, multiple re-installs of Windows 7 and _never_ had an issue with licensing on a single key. I am very confused and skeptical of your claims.
Well, at least you paid for those product which should give you better consumer protection than when you didn't (for Google/Facebook products for instance). But IANAL.
I wonder if what we're seeing here is basically the beginning of a new era of some sort of feudalism, and the end of "the age of equality".
The French revolution, US revolution etc. talked about and put equality into their constitutions, and that has kinda been the prevailing world view ever since. Although, I guess the real cause for this were technologies like the printing press, gun powder and the assembly line - technologies that made people more equal.
But now, even if most people hear about this, I'm guessing that most will continue using Windows. For the last 200 years or so, we've had various leaders standing up for the little guy, but I wonder if anybody will bother in the future, when they see that most "little guys" will not even bother to switch operating systems or use a different search engine in order to preserve their freedoms and rights.
We have been in an economic feudalism for the last century. The fact that companies have all the right and none of the duty of a normal person in front of the law with the all power money can buy means there is a strong disparity between normal citizens and them. Corporation have effectively replaced the Lords of the previous despotic regimes in the Western World.
Only when we cease to consider Corporations more important than the rest of the economic actors can we move the balance of powers back where the it has been intended by the previous revolutionary movement.
But this is kind of off-topic with this news.
I hope MSFT get a bash for this kind of niceties and implement an opt-out solution for all their in-built spyware.
See [1] for an overview of corporate personhood. They don't get all of the protections and rights of a human being, but they do get a surprising number of them (like free speech) even though they never die, have children, or serve in the military. They also can't be jailed, and not all laws that apply to a natural person apply to a corporation. I'm sure that GP has some other examples of "none of the duty of a normal person" in mind, but that's what I know of off the top of my head.
Regarding their power, I think that corresponds to corporations' ability to amass wealth and influence (often) faster than an individual. Of course there is a spectrum -- national defense contractors with billions of dollars in the bank can have a surprising amount of say in the way things are run, but an incorporated small business might have a hard time getting a local zoning issue addressed.
Ok, the comment was a bit extreme and the reality is surely a bit more like a multiple of shade of gray.
But what the other comment mention is on the right track as members of a corporation can easily rip the benefice produced by it, but can as easily distance themselves from it, should it find itself in financial or legal troubles. Of course one can argue that owners and decision makers from that particular entity can be sued individually. And that's fine as well.
And before anyone mention, that investor should have some kind of protection, may I kindly remind you that there should be a balance: the Greek bailout (and the other big bailout from the last few years) is anything but a way from private entities to off load onto the public some mistakes they have made. I don't know of a single instance of a family that has had their debt wipe out during the same period.
I guess there is a critical size to acquire for any social actor to be able to leverage the government and the law makers into protecting them from catastrophic outcome.
> Summing up these 45 pages, one can say that Microsoft basically grants itself very broad rights to collect everything you do, say and write with and on your devices in order to sell more targeted advertising or to sell your data to third parties. The company appears to be granting itself the right to share your data either with your consent “or as necessary”.
And this differs from Google's and Facebook's usage policies how?
Throwing out a red flag at this point for a corporation stating that people^H^H^H^H^H^H^H users are their product is the quintessential example of "closing the barn door after the horse is out."
We (edit: used to[0]) paid for windows, we shouldn't be the product.
I believe the problem (and I am outraged about that) comes from the fact people are paying for Windows and practices such as the collecting of e-mail and contact shouldn't be necessary for 1. the OS to run smoothly and 2. for MS to cover for a low selling price.
The OS and its default bundled application's set price should be enough to guarantee MS doesn't need a user's private data and metadata to provide the product (aka: we gave MS some money, they shouldn't need our private data to make money in order to keep the price `low').
There are many things like "data about network you connect to" that need to be collected and stored on the device unless the user wants to introduce the same password over and over again. This has to be stated somehow and phrased.
Now if MS stores it on-line through the windows account for convenience it's almost the same thing if it's encrypted and hashed so MS just stores something that can't be exploited if leaked.
I have been looking at Surface recently and now I wonder if I can run Debian on it.
[0] but considering the upgrade path implies a paid product (win 7/8) it's a huge change for the user and my point still stand.
You make a cogent argument, which I almost completely agree (excluding an OS vendor storing account info on their own servers).
The consideration I hope to make evident now is: how do your points differ when applied to an Andriod device for which Google has been paid their licensing fees by the device manufacturer?
Facebook's offerings are different, true, yet their Machiavellain use of whatever is presented to them warrants inclusion in this type of discussion IMHO.
While Android is open source, the Google
applications, like the Play Store, Gmail,
Google Maps, Google Play Services, and others
must be licensed. This licensing agreement is
called the "Mobile Application Distribution
Agreement" (MADA) and comes with tons of
restrictions.[1]
This is only one example and the monetary considerations are unknown.
The difference is that this has been Google's and Facebook's business model ever since they became profitable, while MS was in the business of selling software products to users. The fact that they include this now combined with windows (the previously second largest cash cow) now being effectively free, indicates that MS sees user data as the future of their business too. Given MS makes their money mostly with enterprise/businesses I doubt that this will succeed.
> The difference is that this has been Google's and Facebook's business model ever since they became profitable, while MS was in the business of selling software products to users.
I respect the point you are making, yet must point out that all it does is establish a timeline. There is no significant difference between the three companies' treatment of their customer base in this regard.
And don't forget, including Google _also_ includes Andriod.
> Given MS makes their money mostly with enterprise/businesses I doubt that this will succeed.
I believe it would not be a surprise to find that the enterprise/ultimate/wtf-ever-they-call-it are excluded from this. Of course, I'm sure a user could receive the same exemption should they choose to pay the fee...
> here is no significant difference between the three companies' treatment of their customer base in this regard.
Correct. What's different is the customer's expectation (so far) about this treatment. IMO this is significant.
> I believe it would not be a surprise to find that the enterprise/ultimate/wtf-ever-they-call-it are excluded from this. Of course, I'm sure a user could receive the same exemption should they choose to pay the fee...
I would certainly hope this to be the case, but so far this is AFAIK just speculation. Did MS think as far as building in these use cases? After what they did to the desktop UI (even on Windows Server) on Windows 8 I have stopped to just assume Microsoft knows what they're doing.
Thanks. I would agree that the expectation on smartphones is different, but we're still also talking about desktop users. This might be just one of the delicate issues a Software company runs into when trying to do hybrid desktop / mobile OSes, of which I consider Win10 to be the first major one (i.e. with relevant usage numbers).
> And this differs from Google's and Facebook's usage policies how?
This article has nothing to do with Google and Facebook. It doesn't even mention them.
I think the article's purpose is to dispute the claim that the terms aren't as "straightforward" as Microsoft would have us think, as evidenced by the sarcastic closing line, "So much for clearly understandable and straightforward terms of service."
In part, it is quite convincing. Phrases like "or as necessary" and "we collect voice input, as well as your name and nickname" is a little unsettling to me.
> This article has nothing to do with Google and Facebook. It doesn't even mention them.
Agreed. My point was not that the article critiques either of those organizations, simply that this move by Microsoft is quite comparable. To the point of being indistinguishable, IMHO.
> I think the article's purpose is to dispute the claim that the terms aren't as "straightforward" as Microsoft would have us think, as evidenced by the sarcastic closing line, "So much for clearly understandable and straightforward terms of service."
I recommend detailed reading of the ToC's the various Google and/or Facebook offerings which you are interested in as well then. Perhaps they are less shrouded in "legalese", but I submit their implications are no less disturbing.
>> And this differs from Google's and Facebook's usage policies how?
Let's remember that you aren't running your desktop on facebook, you can use custom android rom or self-built chromium that doesn't interface with google.
You don't see a significant difference between terms of service governing the use of data you entrust to computers owned by some web service, and terms of service governing the use of data you store yourself on your own computer?
> And this differs from Google's and Facebook's usage policies how?
Was waiting for someone to bring that up. Microsoft has never done anything different than Google does yet, until now, no one bothered to check up on Microsoft. However, Microsoft has its tentacles more tightly wound around Windows users.
What I find most disappointing is that Microsoft could have stopped all of this in the beginning if they had simply put adblockers on IE way back when they were giving the finger to all of the anti-trust legislation anyway. Google would have had to have a different model, and the currency of the Internet would be money.
If you charge me $25/year to use facebook, I know what that means. If you charge me $25/year to use google, I know what that means.
Now, however, the currency of the Internet is privacy, and not very many of us know what that means. It's still too abstract- and abstract thinking is hard for many of us.
Please, your first sentence adds nothing, and it angers me.
In that day, targeted ads weren't a major source of revenue (revenue models were still being worked out). Many web sites built primarily for Microsoft then-that is, taking advantage of their standards-breaking browser. The public didn't really cared about any other browser (by that I mean the same "public" that doesn't really care about privacy now).
Microsoft did many bad things in that day. But if you wanted people to be able to use your site it had to work in IE (version 5 or 6 or so-I don't really remember). If it didn't work in Netscape it was no big deal. The web page would say "best viewed in IE5.5 or later" (or whatever version).
So, no, websites couldn't afford to block Microsoft. They would lose their customers.
I wish I could be angered by your reply, unfortunately it just amuses me. Web sites rely on advertising dollars for revenue. To be denied this revenue from the dominant browser would have created a revolt.
>So, no, websites couldn't afford to block Microsoft. They would lose their customers.
I see. So they can't afford to block Microsoft, but they can afford to have their main revenue stream cut off by Microsoft.
I'm going to hold off on the "free upgrade" to Windows 10 until I can find a trustworthy and comprehensive blog post on how I can disable all of the privacy-invading "features".
Not linking a Microsoft account with the local account seems to be a good starting point. I also plan to do my best to get rid of OneDrive and Cortana, neither of which I have any use for. But I have no idea how to go about discovering and tackling all the other possible channels for data leakage, which we're bound to hear about in the days and weeks to come.
Free upgrade means you're no longer a customer. It's a cliche, but it fits perfectly this time. Some of the things I'd like to disable will probably require upgrading to the Pro edition, which of course is only available to paying customers.
It's a valiant effort, but you're navigating a privacy minefield. Even if you find/disable all the known things, a single windows update can introduce a new opt-out "feature" that undoes it all. Your effort might be better spent migrating to a less invasive system.
"Today we were unlucky, but remember we only have to be lucky once – you will have to be lucky always."
Well, I guess it's inevitable as long as I'm using a proprietary operating system. I don't expect Apple to be any better. Heck, even Ubuntu nowadays comes with ads that you need to opt out of.
At least if I get Windows 10 Pro, I'll be able to turn off non-security-related updates.
Actually, no. That article was dated Mar 31, 2014, so I assumed that they switched the configuration option by 14.10.
.... but some searching indicates that they won't get around to disabling online searches by default until Unity 8 is default in Ubuntu. It seems that Unity 8 won't be default until 16.04 [1] or later [2]. So I rescind my previous statement. Canonical deserves as much scorn as you can dish out for disregarding their users' privacy for 3 years and counting.
I dislike the Microsoft privacy policy. I don't see a better way for it to navigate the legal minefield. If they promise any meaningful kind of protection, it is inevitable that it cannot be delivered.
The wired world leaks data. Much of it by design, e.g. to a first approximation all browsers work with cookies, store history, cache content, use some sort of thumbprint for SSL, etc. No browser vendor promises operational privacy because implementing it would make the browser unusable. Just using NoScript (as I do) is a bit of a pain in the ass. Microsoft has a browser plus a whole lot more stuff including third party vendors, and big stacks of cash to make itself a lawsuit magnet...some lawyer somewhere will allege transmitting an IP address is breech under a strong privacy policy.
The reality is that nothing you do on a computer connected to the internet should be considered private. The Microsoft privacy policy reflects this reality even if it upsets the world some of us wish existed [so long as we don't have to give up our mobile GPS, Uber, and iTunes]. But it hasn't existed since the days of credit card processing over copper. I admire Stallman, information wants to be free. Alas "An atom blaster point is a good weapon, but it can point both ways."
> The reality is that nothing you do on a computer connected to the internet should be considered private.
So let's accept that as a baseline? Why is that even 'normal' ?
It's my PC, not theirs. I licensed the OS, but I didn't tell them to do any other thing. My PC is connected through routers which at least for the first hops I control myself, how is it then 'normal' I still am not able (!) to stop an outside company from peeking into what I do on my pc?
Privacy is analogous to security. The only private computer is one that is not turned on. Connecting a computer to the internet makes information about you less private. That's as true running Linux as it is for Windows...turn it on and connect it to the internet and information about you leaks because the fact that your computer connected to the internet is loggable on the internet side of your router.
More importantly, that information about you leaked because of your deliberate decision to connect to the internet. The only way Microsoft could have protected you is to prohibit your connecting, and even then you'd probably work around it because that's more or less how Windows 3.1 machines connected to the internet (with 3rd party software, I'm not suggesting Microsoft prohibited connecting, they just didn't support it).
Load on user land apps and more information leaks, and Microsoft can't prevent it. Run OS features that require a web backend and there's more information leaks. Nobody can provide a fulfillable written guarantee of privacy for web connected apps. Microsoft's privacy policy reflects this reality.
Can Microsoft treat your with a different level of respect for your privacy than Google? Perhaps, since its business model is different. So it's really a matter of tradeoffs and trust and alignment of interests. If Microsoft's policy is a problem, and it's no worse than Google's provision to use your data for new products and services, then don't use Windows. But at least Microsoft is being honest for the industry standard definition of "honest". That that standard is less than "We'll use your data however we please" is unfortunate.
How much more or less invasive is Microsoft than other companies for comparable services? Without a good way to assess this, you run the risk of moving to a worse service, by whatever definition you want to use for worse. The market is very inefficient due to lack of comparable information to do with privacy policies. You can read all the policies of the services you want to use, but keeping that straight and making a decision based on it is quite a large task.
If you don't encourage alternatives based on things like privacy or security, then nobody will be left to develop those alternatives. The thing with voting with your wallet is that it works in two ways - it discourages these monstrous companies like Microsoft, Google, Facebook, Apple, etc. from doing invasive things and it encourages smaller players into developing the better alternatives that we need.
Any of the popular Linux distributions are much less invasive than Microsoft's Windows 10, plus if you have the resources, you can audit it for backdoors (e.g. my government can certainly audit a Linux distribution, but they'll never be able to audit Windows). A Linux distribution is currently the only reasonable choice for privacy and security. Also take disk encryption. The way Microsoft is doing it lately is for the encryption keys to be sent to their servers, tied to your Microsoft account. On Linux you've got dm-crypt, ecryptfs, battle hardened firewalls and SELinux/AppArmore, all open-source and open for inspection, free as in beer as well.
Of course, you've set myself up for failure by demanding "comparable services". You know what, I could live without things like Cortana, Google Now, or Siri for a long time and while I get the potential, for now there is no benefit. Google Now somewhat helps with my traveling or daily commute, but that's a task for my phone, not for my laptop. Microsoft is continuing to break the utility of the desktop. That's too bad because all of this post-PC craze is misunderstood and I hope others will jump on the created opportunity.
I didn't mean "comparable services" to imply that the the competition had to match all services, just that when comparing, you match the services you actually plan on using. I think we are of a similar mind on this, I just wanted to highlight that lambasting company X as bad without showing how it compares to it's competition is less useful than that same assessment with comparisons. I ranted about this yesterday elsewhere in this same submission. I'm firmly of the belief that at least some of the lack of importance put on privacy by consumers is how hard it is to compare between providers on this feature.
I think Windows 10 is pretty much free as in beer for most ordinary users so the wallet threat is pretty flat.
I read Microsoft's policy as more legal cover for the reality that data gets stored all over the place. The internet is full of caches and nobody can guarantee that they can identify all of them, much less control them. The nature of people's complaints show how vulnerable Microsoft is to some jury believing "they should have known."
If you want privacy, don't turn on your internet connected devices. TANSTAAFL.
I think at this point, most people have a really screwed notion of price ...
1. preinstalled / bundled Windows is not free, the "Windows tax" being very real
2. this upgrade is not free for XP / Vista users
3. Windows 10 is not free and will probably cost about the same price as Windows 8.1, which is $120 for the Standard version or $200 for the Pro version - it might turn out to be cheaper this time, but that's only because they are changing the license to be tied to a particular device
4. Windows being a platform, is a complementary to Microsoft's Office 365, OneDrive, the Windows Store, Exchange, etc... the Windows Store in particular charges a revenue fee and is the only source possible for "modern apps"
5. personally I can't use the standard version, as it is missing features I need, like BitLocker or the ability to make a bootable USB drive - things that with the other operating systems I get for free
So in case I haven't been hibernating to wake up in some weird future in which a beer costs $200 and comes with strings attached, yes, voting with your wallet is significant.
Linux with support from Redhat costs money, too. On the other hand, I've got four Windows licenses at the house that I can upgrade for the price of Ubuntu...which I will do, even though only one machine doesn't primarily run Ubuntu.
I think Windows 10 is pretty much free as in beer for most ordinary users so the wallet threat is pretty flat.
Why is it free? First of all because they are scared to death that iOS and Android will eat their lunch in the consumer space. Secondly, because they want to sell services and SaaS (Office 365, etc.).
For the latter part, you can certainly vote with your wallet.
Andriod and iOS are probably not very good evidence that the road to fat quarterly returns is paved with sales services and SAAS subscriptions over a free operating system base layer...at least in the consumer space.
I'd say RedHat/Fedora/CentOS ecosystem is probably a more likely business model. Microsoft was already in that space (e.g. Mono).
As a small business owner, my main concern is that there are no assurances that my competitors large and small will not be able to see my contracts/suppliers/budgets/sales/processes at some point due to this ambiguous 'disclosure' mentioned or perhaps through some flaw that allows access to the data collected from the computers used in my small business.
I must be missing something here since I know Microsoft wants Windows to be used for businesses and the privacy of this information is vital to that.
I'll get the popcorn ready while waiting to see what hospital IT have to say about this.
They have already banned use of Microsoft's new mobile Outlook apps (iOS,Android,Win Phone) when they found out that these are actually thin clients to a cloud service that performs MITM on the hospital Outlook server to download, store and processes all email (the cloud servers aren't even fully Microsoft--they became Microsoft's via acquisition). And of course it stores usernames and passwords in order to accomplish this (confirmed by common sense, obtuse fine print and deceptive non-denials by Microsoft support). The penalties in HIPAA and HITECH aren't jokes (and now include jail time).
I just forwarded some comments re MS's privacy statement to a law-related listserv. But everyone responded they couldn't see the text I cited from MS. It turns out that the document looks very different with noscript than it does without. With all script allowed (ie for those using IE/edge) all the scary stuff hides behind "learn more" buttons.
Does this apply to users of Windows 10 in general? If so, it's going to be totally unacceptable to law firms, DoD customers, and anyone who competes with Microsoft or their advertisers.
Most of the privacy invasion comes with logging in with a MS account. You can login with a standard windows or domain account and then all this integrated cloud stuff doesn't really apply.
Not completely true. Don't forget you need an account, for instance, to buy, install and use MS Office 360. I bet if it wasn't for the Office, many people would move away from Windows easily.
And don't forget windows comes with Defender installed, which collects user metrics out-of-the-box.
IE/Sparta also collects your usage data. Even windows "search" does.
That is demonstrably not true. But that is not even what I was asking about.
What I was talking about is an online feature, called Windows Account, which works online by default(!). Therefore we must ask ourselves what is Microsoft doing with that information.
Despite all the "new security features" in Windows 10, or perhaps in spite of them as a work-around, Windows 10 seems to be the most "law enforcement friendly" OS yet (not just out of Windows all versions, but out of all operating systems).
I had a feeling about this ever since the first announcements that Win10 would be (monetarily) free. That old saying is still relevant as ever: "If you're not paying for it, you're the product being sold."
Anecdote: Created new and unique Microsoft account 3 weeks ago with the sole purpose of testing w10, used it only ONCE to log into w10 vm. Started this VM today, logged into outlook and what do I see? 2 spam messages and one google news bounce.
How do you trust a company like that with any data?
I suppose you're implying that Microsoft sold your new account name to spammers? It could also be that you used a name that you, or someone else, have used at a different place and the spammers simply try sending mail to all the big email providers with that name in the hope of reaching someone. That would seem like a more probable explanation to me.
Not sure what the fuss is about, the same old rule applies: if you want your data to be private, don't use any form of cloud services - server based voice/video chat, cloud storage services (google drive, skydrive, icloud), digital assistants (siri, cortana, google now), any contextual based delivered services which "learns" anything about you to provide you with any form of automated and/or dynamic experience.
If you want to be treated like you live in a box, then you're going to have to live by it.
Everyone complaining and "fed up", closing their MSDN accounts, boycotting MSFT products - you're in an echo chamber which won't be felt as our devices become more service oriented rather than boxed solutions. MSFT is trying to stay relevant, not undermine their massive user base. Whether it is right or wrong, I don't have an opinion on, but if you think MSFT is a pioneer in this space, you're being unjustly biased.
I guess the only thing we can complain about is that we aren't given a "closed/boxed" solution and able to accept the TOS to services we want on an adhoc basis - we have to go and disable services and hope that the TOS we agreed to needn't apply.
Perhaps these are growing pains for the direction services are heading, or we'll just learn to accept invasion of privacy as a default.
Just spend the 1-2 weeks learning Ubuntu or any other distro. It is so worth it in so many ways, to at least familiarize yourself with the UI. A lot of people think Linux is too hard, or too clunky but it's honestly not for the vast majority of tasks. It just has a switching cost like anything else.
The major issue with any Linux distro is the multiple ways it can break and when it happens, you either have to be very knowledgable in that particular distro and software installed, or you need to pay for support so they can fix it. In the past, I've resorted to make a script that check various forums for issues mentioning updates waiting. If non have popped up after 1 week, the updates is probably safe to install. Probably includes when it isn't, and can easily result in a full day of downtime trying to fix a X11 driver problem until the specifics and canonical workarounds have been learned.
I simply don't have time for that on a day to day basis where I need my machines to just work. I need it to work to the extend that I now have a base machine running Windows and with VMWare Workstation installed. All production work is done inside a VM with daily snapshots so I can always go back to before it was broken, and then tackle the issue when I have time for it. If my machine suddenly goes up in smoke, I can restore my production machines on another machine. I never have more downtime than buying a new machine, installing VMWare WS, and restoring my VMs results in.
Honest question: when was the last time you used Linux or Ubuntu? I haven't seen an X11 issue in years. Your argument still has merit, I've been burned on misconfigured packages in the past. But for everyday use (browser, text/image editing, chat, docs, etc) these problems simply don't exist. The network, print, display, and audio drivers have gotten very good if not on-par with Windows.
About a year ago I switched back. Ubuntu doesn't really feel like it's providing me anything Windows cannot, and Arch tends to go down burning when it is most needed to be reliable.
My biggest problem was multiple monitors. The setup was, and still is, an absolute pain to get working properly with difference screen size and dynamic docking/undocking of a laptop.
Transparency is a dependency of trust. While many components of OS X are open-source, even more are entirely proprietary and opaque, and therefore untrustworthy. Not to mention that Apple is the king of absurdly-long-and-unreadable EULAs.
Zeitgeist stores your information on it's datahub, where 3rd party applications can retrieve it from. Nothing prevents such applications from sending this information elsewhere, once accessed.
As this comes out-of-the-box by default, and is in fact a pain to switch off, I compare it to this new windows behavior.
All your criticisms apply to syslogd as well: it stores your information in a central location (/var/log), which 3rd party applications can read and upload to somewhere else, and lots of software expects it to be there, so it can be a pain to switch off too.
Should we compare syslogd to the new Windows behaviour?
A normal user application, i.e. firefox, should not have access /var/log/messages. The zeitgeist db can be queried by any application running with the users privilege.
Although to be fair the fedora 22 installation I'm running allows me read the logs launching journalctl as a user, so there's that.
I don't think zeitgeist has much to do with the Windows behaviour (or with the scopes behaviour). It's just a potential security risk, albeit a minor one.
A normal user application, i.e. firefox, should not have access /var/log/messages. The zeitgeist db can be queried by any application running with the users privilege.
Zeitgeist itself runs with the users privilege (it's not a system daemon, it's started by the user's session), so that hypothetical application could simply log the data itself. There's no leak of information to underprivileged processes.
I know that, what I meant was that there is information stored about the past, that a malicious application could not get otherwise (i.e. it can record stuff only from the moment it is installed).
On similar note, I rememember someone arguing that the baloo/nepomuk db was a security threat, I guess since it makes slightly easier to search among the files on the system for a string like "password".
Both claims are technically true, and in neither case I believe they are practically relevant, neither for security nor for privacy. I was nitpicking, I guess.
Usually, free software comes with privacy and privacy comes with free software, so the first thing that you should look for is the distribution's policies on free software. Distributions like Debian and Fedora, for example, have a strong commitment to free software (see Debian's Social Contract[0] and Fedora's licensing guidelines[1]) and are not going to spy on you or put ads on your system. The Free Software Foundation maintains a list of distributions that contain only free software[2], and these distributions aren't going to collect your data and send it to third parties without your consent either.
Ubuntu, on the other hand, does not have such a commitment to free software, and has included Amazon ads in the Unity dash in the past.
If the setting are synced between computers and Cortana is a personal assistant, how they can work without backing up the data and collecting the behavior?
First is technical. Encrypt everything on originating devices and store the encrypted copy to which Microsoft would have no key (not even escrowed one). Not like this works for all cases, but a lot of data - like browsing history or WiFi AP passwords - does not require server-side processing.
Another is legal approach. Have sane privacy policies - not "we'll use your data as necessary" - and make sure users opt-in. Not like this also works - certainly not against all adversaries, but at least you can sue.
Network effects mean that there are few pragmatic options left. The GP may well be free to use alternatives but at what cost? Should they be selecting future employers based on the employer's choice of software?
I may well be free to go live in a (digital) cave but presenting it as a viable choice merely exacerbates the existing problem.
True, but there's a difference between 1. your employer having a bunch of information about you and 2. your employer signing up to a ToS with third parties that effectively hands over all your info to them.
Point 2 is probably not unusual but were starting to see (imho) more pernicious attitudes. Examples include the current Windows discussion, where your employer may be perfectly happy to sign (on the employees behalf) that your data be sent off to Microsoft (and used for whatever Microsoft deems 'necessary'). There was also the announcement of Facebook at Work, which I'm sure would be more than happy to cross-correlate the 'work' you with the 'personal' you, in order to 'provide a better service'.
In both these scenarios, I'm sure the company will act to protect itself from exposure, but it's unclear what choices the employees really have.
I downvoted you because I think this is an uncharitable reading of the parent comment. Furthermore, one could argue that Microsoft alone is not responsible for the creation of an opt-out privacy-hostile software ecosystem, so perhaps your statement is also hyperbolic.
Anyone up for making a Windows version of XPrivacy that generates a fake advertising ID, randomized so there's no way to associate any two sessions with each other.
I'd be interested to see an independent audit on how much of this data they (and google/facebook/apple/etc) are collecting is being used to help improve training of Cortana as an assitant (or other tools that directly assist the user like Google Maps) , and how much of this data is really just for selling to advertising companies, and how much is mandated by governements.
I know this isn't binary some data may be dual purposed (training and ads for example) but I'd like to see an audit of what it's used for.
People need to take into consideration the fact that that is how you build an assistant or an AI. You need collective data gathered from a vast majority of interactions with a user.
Besides, I am pretty sure this is how Google, Apple do it. All big corporations use your data in a form or another.
It's worth noting that Microsoft is heavily afflicted with the "left hand doesn't know what the right hand's doing" syndrome. Most of its product departments have antagonistic relationships with one another at best. The cloud services department(s) could have entirely different policies and philosophies from the one that makes Windows, which further has different policies and philosophies from the team that makes Office, which further has different policies and philosophies from the team that makes Surface tablets, etc.
Stallman is an optimist! This "privacy policy" is much worse than what we expect from malware [1]. Cryptolocker might hold my files hostage for some bitcoins, but they're not going to sell me out to aggressive lawyers or overzealous law enforcement.
[1] http://www.networkworld.com/article/2926215/microsoft-subnet...