They've done some brilliant things for developers this year, but sadly shipped a giant spyware operating system at the same time. From what I've read people are still trying to determine everything it's calling home.
* Pretty login screen photos, with a link at the top-right saying "Like what you see?". I click the link expecting to get the source for the image, instead I get "Cool, we'll show you more like that." So much for that nice new desktop background I was hoping for.
* Automatic updates leak RAM like a bloody sieve. I have 16GB of RAM, and every time it downloads an automatic update that RAM will inevitably fill to the brim. Eventually it'll also fill the page file, and the whole thing virtually grinds to a halt until I finally reboot and install the updates.
* Automatic update finishes and I see a friendly message saying "don't worry, all your files are right where you left them!" Two minutes later I see "Program X is not compatible with this version of Windows, so we uninstalled it for you."
* Frequently resets default programs to MS applications, usually as a result of a large automatic update. The inconsistency of this is the weirdest bit, it never resets the default browser, but every few weeks I have to re-set the default PDF reader and image browser.
* Managing screen resolutions/positions is not "advanced". Microsoft needs to sort out their configuration screens, this half-arsed hybrid Win10/Windows 9X system is just getting worse and worse.
You can also prevent the bug by disabling the Windows Network Data Usage Monitoring Driver by changing the registry key HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Ndu to "4" (disabling it).
I've searched, but have you found a list of those login screen pictures? I want them.
I haven't dug into the login screen pictures at all. After my first attempt to get the source, I just gave up on it. The funny thing is, if they hadn't put that "Like what you see?" link in at all, it wouldn't be as big a deal. It would still be a bit disappointing that I couldn't easily get to the source, but the fact that they got my hopes up and then disappointed me makes it that much worse.
Doesn't a default Android phone also do a lot of calling home? And Apple phones? Why is it so special when it's Windows?
Not true at all! It's impossible, without a hardware firewall. Their kernel network driver whitelists several microsoft domains and IP address ranges. What's worse Microsoft back-ported that phone-home crap and ships them as updates to Windows 7 and 8.x (of course the coincidentally stopped writting descriptions for their Windows updates). Not even mentioning how they force end users to upgrade to Windows 10 by displaying Windows 10 ads as popup dialogs and renaming Windows update buttons to click on the Upgrade button by accident, etc. It will hurt Microsoft's reputation a lot.
With Android and iOS an end user with a little bit of knowledge (power user) can deactivate the analytics, cloud sync and error reporting "features" by changing a handful of settings. Windows 10 resets the privacy settings every major update (Threshold 2), they go even as far as change the name of exe files and registry keys. It's not too late to fix Win10 and MS reputation though, do something in 2016.
See screenshot and guide at http://www.ghacks.net/2015/07/30/windows-10-and-privacy/
Alternatively, disable this service if concerned: http://www.ghacks.net/2015/11/19/microsoft-rena-and-telemetr...
But think about your doctor, your lawyer, etc. many smaller business, cheaper Windows 10 editon (non LTSB) they will unintentionally leak your confidential personal data. You say such PCs shouldn't be online at all? But they are and many of them run on Windows. Scary.
And almost certainly very illegal in a lot of places. Not only do you have whatever routine data protection rules apply, but in cases like medical data or legally privileged information there are higher standards required in many jurisdictions as well.
any evidence of that beyond "it phones home!"?
Are they more likely to than if they were using Windows 7? Or OS X, for that matter?
You make it sound as if Microsoft's software is actively trying to steal personal information, instead of just sending boring shit like "what error code did that crashing application just produce". Sure, it's possible that Windows 10 is more likely to leak data, but I'm not going to just accept it without at least a tiny bit of evidence.
And you don't need LTSB or Enterprise/Education SKUs to turn them off, you just get more convenient toggles there. Ultimately you're responsible for what services run on your computer, and your computer's configuration. If you don't trust the OS manufacturer, as someone else pointed out, why are you running their code in the first place? ;-)
Or because you don't trust any of the other options either, which is an entirely reasonable stance.
How?
It didn't matter if the file was on your super duper secret encrypted drive. It doesn't even matter if it's in the file name; maybe the preview code dumps the whole file contents in the error report. Maybe the preview code is buggy and just logs file names. The report is cached until you're next connected to the Internet and delivered as part of "routine diagnostics."
The line I always hear from Microsoft apologists is that "You can turn these features off at any time", but everything I've seen suggests this is only true for Enterprise and Education.
But at least give consumers the option. Even if it's in Advanced Settings, just like every other obscure privacy invading Microsoft feature.
> It's a feature, not a bug.
Really? You might want to rethink your talking points here... There really isn't a good connotation with this phrase.
I criticize Apple and Ubuntu equally, as well. Apple's telemetry is comparable, though it is worth saying they've made major public pushes for privacy. This is not to say I trust them, but the effort is noted. (In fact, elsewhere in this thread I criticized Apple for sending data to iCloud.)
Comparing Ubuntu telemetry to Microsoft's is disingenuous at best, and outright deceptive at worst. I'm not a huge Canonical fan and I disagree with some of their practices, but saying they are at the same degree of privacy violations as Microsoft is ludicrous.
I'm not a student or a teacher, so I don't think I can buy the education edition either.
However, through the MOSP (for 5-250, now called "Microsoft Online Services"), you can get Windows Intune with Software Assurance for Windows for $11/user (at least when it was announced), which includes Software Assurance, which then includes a copy of Windows 10 Enterprise (to upgrade/install on PCs for licensed users) as well as management tools.
There's a way to add Office 365 on a per-user basis to your Intune subscription as well, as long as you maintain annual commitments (or some gibberish like that). I'm not entirely clear on the details, this is why Microsoft usually has folks call in for pricing and such. But I hear it's easy to manage.
There's two methods of enterprise/education licensing, per user and per machine. Home/Pro are sold per-machine only, with varying features. See license agreements for details ;-)
Ultimately, you can disable most/all of the Windows 10 spying yourself without special editions of Windows, they just make it easier for folks paying the big bucks.
If your threat model is that the OS provider is hostile, no amount of changing of settings will protect you from their actions...
No, the threat model is that centrally collected data will be pilfered by the government or the company itself. If it's just not collected in the first place the temptation won't be there to abuse it.
It's like saying, "if your threat model is that the government is hostile, there is nothing you can do to prevent them from getting information from you."
There are lines the government won't cross (e.g. US govt torturing your family members in front of you) and there are lines Microsoft won't cross (e.g. secret exfiltration of your files).
It's why I'm so puzzled that people jump on MS specifically for this, Google have been doing all the same stuff for years and no-one seems to care.
That said on your lines that people wouldn't cross, I'm afraid I have not confidence in either of your examples. The US gov. has totured people for years, I see no reason to believe they wouldn't do it to family members if they thought it would meet their goals, and MS would exfiltrate data if provided an appropriately authorised requirement by the US government...
Probably because until recently, Microsoft software is what you used if you didn't want to use those cloud-everything services from organisations like Google.
The thing is, almost every piece of research I've seen from independent sources suggests that most users don't really want or care about these digital personal assistant gimmicks. Once you got past the hype, this was a point a few different articles made around the time Win11/Cortana became available.
That certainly seems more credible to me than the story the OS vendors' marketing teams would like us to believe. After all, I know plenty of people who use Android and iOS devices, but in my entire life I don't think I have heard the words "OK Google" spoken non-ironically outside of a tech presentation, and I have also literally never seen (heard?) anyone using Siri other than to show how badly it got something wrong and laugh at it. I mean, anecdotes and data and all that, but if almost everyone I know has a smartphone and literally no-one I know seems to be using these features that we're told users want, that's an astonishingly unrepresentative sample.
Unfortunately, for the immediate future there is a lot of momentum behind these features, because so many corporate heavyweights have spent a fortune on promoting them. It would be borderline career suicide for any senior executive in a relevant position to hold their hands up and say they made a mistake on this one so soon.
Maybe the OS provider should stop being hostile.
Personally I hate this kind of feature and try to actively avoid products which have it, however I feel I am in a minority of general consumers in that feeling.
> If your threat model is that the OS provider is hostile, no amount of changing of settings will protect you from their actions...
IMO, it has less to do with the OS provider being hostile and more to do with eating up resources and increasing available malware attack vectors.
On defaults I would prefer it to be opt-in but I know exactly why it isn't. Software vendors want you to use the features they develop so that you'll be more involved in their ecosystem, if they're off by default chances are you won't turn them on, which defeats the purpose.
Gotta say I don't see your resource point, do you have any evidence that these features have an appreciable impact on the average system?
I'm not sure what this even means in this context. It's not about protecting against a threat model that may someday manifest, it's actual, specific actions that are known to be occurring currently and that can't be opted out of (let alone opted in to) that are being objected to.
And certainly nothing to do with "cloud based features" of Windows 10.
I've tried Googling, but it's hard to find pages which discuss it without knowing the right terms to search by. Can you help provide a link so I can learn more?
I would take a crash dump over a poorly written (or nonexistent) bug report e-mail any time.
That's completely wrong and only the willfully ignorant would believe that.
http://arstechnica.com/information-technology/2015/08/even-w...
http://www.disclose.tv/news/a_terrifying_traffic_analysis_of...
Or from the horses mouth:
http://www.forbes.com/sites/gordonkelly/2015/11/02/microsoft...
On the other hand, Microsoft has a history of complying with government authorities.
Everything you type, in every application you run, all the time. You can't block this "telemetry" with Windows either. Microsoft has hard coded the DNS entries to bypass HOSTS file checking.
Also voice and camera records get sent to Microsoft.
None of this is contingent upon having or logging in to your Microsoft account. You don't even have to be using Microsoft features like Cortana or Bing. Microsoft has made the business decision that if you are running their OS, you are using their computer, not yours. They seem to be right that the majority are willing to hand over the keys for a "superior user experience".
The only way to prevent 10 from phoning home is either to disconnect it from the Internet, or connect through a dedicated firewall machine which blocks the collection endpoints. Win 10 will still be running that key logger in the background, though. It's built in.
And that's just one thing off the top of my head, I'm sure there are many others. Ultimately, if you REALLY care about privacy you probably shouldn't be using any mainstream operating systems for mobile, desktop, etc.
If you want to see this info and/or enable/disable it: https://www.google.com/maps/timeline
I'm sure the implications of this isn't obvious for most people, just as express settings in Windows aren't obvious.
You don't get to point at some other examples of Bad Thing happening and hand-wave it all away like our concerns are not valid.
Some of Windows 10's features come from the convergence with the smartphone platform (Notifications, Cortana).
As well as being a mobile OS that runs lots of mobile apps, Windows 10 also has cloud integration (OneDrive, Windows Store etc).
This shouldn't be a shock. Nadella has been saying "mobile first, cloud first" since he got the CEO job.
> Most people don't have all their critical financial or business information on their phones
Why would you imagine Microsoft was incorporating such info in its anonymized telemetry? It's not like telemetry was exactly a new thing.
As a matter of fact, Windows Update has been scanning people's hard drives for years (with MRT, the Malware Removal Tool), and collecting crash data since XP.
in the UK at least most banks have mobile apps which run on android, people do e-mail (which controls most of their sensitive information) and other items on mobile devices, so their security would be every bit as important as a windows/OSX PC...
Hi, it's 2015 calling, how are things in 2010?
There is no button before this screen with "convenient" recommended defaults that rob you of privacy. You pretty much have to go through this screen, agree (or not) to each one and continue.
And later, as you use the device, there is no changing your preferences behind your backs.
Deleted comment
See also: http://sockpuppet.org/blog/2014/04/30/you-dont-want-xts/
So I don't think the data they send back is 'spyware' in the sense that they want to know more about you and then sell it or use it to sell other stuff to you. But I don't have proof. :)
Unfortunately, given that the other sting in Windows 10 is automatic, compulsory updates, even if your hypothesis is true today there is no guarantee it will remain true tomorrow.
I'm a little sad about the whole Windows 10 situation, really. From the more credible commentary I've read now that the dust has settled, it seems like a reasonable OS under the hood. It also seems like with enough effort you could mitigate or work around the worst of what is there, maybe even in some of the non-Enterprise versions.
However, those privacy and control issues are complete deal-breakers for me. Recent behaviour by Microsoft has abused the Windows update mechanism for earlier versions that I do use, and it has also included a disturbing number of outright broken updates. Unlike a surprising number of professional reviewers, I am therefore not willing to give them the benefit of the doubt any longer. If I can't turn things off reliably on my own computer if I don't want them to happen, and I can't trust that questionable things will be opt-in instead of opt-out, then unfortunately none of the rest matters very much for either my own personal or my businesses' professional purchasing decisions.
It seems to me MS is simply going to the "let us take care of your system, we know what's best for you" approach - which is not only insulting, but highly suspect.
When you make using an OS compulsory on several fronts (many of which I can't control), I really have to ask myself if I should try making a move to a more open, more secure OS.
I've no doubt you're right. Unfortunately, if there is one thing in computing that really shouldn't be some sort of super-connected, ever-changing, as-a-service rubbish, it's the basic OS your whole machine runs on. This direction was inevitable the moment they appointed Nadella CEO, but I've always maintained it was another case of Microsoft trying to jump on the bandwagon long after other big players and then misjudging when it did.
I suspect a lot of people are going to watch with something of an open mind until the year after launch when the deadline for a free update to Win10 expires, and then there are probably going to be some hard questions asked about adoption levels and revenue streams and why so many businesses and home users are still on 7/8, and then Nadella is going to decide to spend more time with his family and be replaced by someone who pushes Microsoft firmly back towards its traditional and probably much more successful roots in 2-3 years before Win7 support runs out and forces some really serious questions to be asked by Microsoft's core customer base.
Perhaps, but I think if you're the CEO and the flagship product most associated with your business goes to hell, the buck stops with you.
Ironically, someone like Terry might be best placed to clean up the mess, as a shift back towards in-house but centralised technologies like Exchange (a team he ran for a long time) could be Microsoft's best strategy for competing both technically and in PR with the online-everything brigade.
No, the lack of opt-out is suspect, and in this context the claimed "need for telemetry" is plain intelligence-insulting! What really is sought in this sadistic game from their part is the option of having greater power/control over the devices installed with their product. Stop giving them the benefit of the doubt about that!
I don't see how small medical offices can use Windows anymore (big ones will use Enterprise Windows and shut all that stuff off). If the calendar and email are being sent to the cloud, then that sounds like a potential HIPAA violation.
I don't understand why consumers can't easily disable all data sharing with Microsoft. I don't think Apple is as bad and now I'm thinking about buying my first Mac in a long time and running a VM for the few Windows applications I absolutely need.
I only have access to Windows 10 Pro and would like to turn off all personalization options. All I want my operating system to do is support the applications I want to run.
I've found some of the Powershell scripts that do things like uninstall the XBox music app (or whatever it's called), but after an update it just reappears. It's very frustrating.
I'm not sure how is W10 different than Android/MacOS. Actually, on Windows you at least can skip the account registration. On mac you can't even get updates if you don't register. Android doesn't even let you use the OS properly without account.
I'm not sure what you mean by this, can you explain further?
I will say, that I've had a couple of Android phones for perhaps 4-5 years now and while I initially did use the bundled OS on my first one, I have never signed in with a Google account.. I use CyanogenMod now on a Nexus S with no Google apps and the phone doesn't seem to be without features that I might desire, indeed there are vast number of developer options that I don't use. Certainly there are third party apps that I know exist that I just can't get (F-Droid is limited sometimes) but that is not really OS functionality in my opinion.
I've used a (company-issued) Sony phone for two years with in a such way, that the only account on the phone was for our Exchange, with built-in E-mail, Calendar, Contacts apps. Granted, the Play Store was not available, Youtube and Maps didn't work, but they were not the reason why I had that phone.
http://betanews.com/2015/02/22/os-x-ios-and-linux-have-more-...
https://www.gfi.com/blog/most-vulnerable-operating-systems-a...
It's are incredibly misleading, as it:
- doesn't take into account the severity of the bugs; - doesn't take into account the time to fix the bugs, or if they are still open; - bundles some OSs, while separating Windows on several different categories; - compares OSs with incredibly different lifespans; - compares OSs with incredibly different amount of included software.
It's an article created to make Windows look artificially good, nothing more than that.
A product can be secure from malicous attack whilst still leaking information to the Operating System provider, unless of course you don't trust the provider of your OS, in which case you're completely stuffed anyway :)
Microsoft have made a lot of advances in the security field and have a generally good relationship with the security community. In contrast, I would perceive Apple as having a less good relationship with the security community (they're very secretative about what they do, they've taken actions like revoking Charlie Millers Dev creds for pointing out vulnerabilities). Linux is of course not uniform enough to e able to assign a single value to it but there are some potential concerns about their view of security bugs as just being like any other bug...
That's like Apple deputizing OS X's vulnerabilities as "features" and calling it quits.
My test for defining vulnerability derives from whether a reasonable, knowledgeable party would put sensitive information on the system. Windows 10 fails this test. I find it difficult to see how anyone would describe its as "hardened," hence the request for a source.
It's stipulated that 7 will be the new XP, and 2015 may be the first year to start XP-ization of 7.
No worries though, they're shipping all the invasive spyware in coming 7 and 8 updates anyways so we'll both be assimilated soon enough.
What about google now?
If all mainstream OS' are doing a specific thing (gathering information about users to fuel certain features), why should MS face particular approbrium for doing the same?