Hacker News Reader

Comment by rkangel | Hacker News Reader

Actually, to me the MS statement is the most illuminating and I'm guessing that Canonical is getting some grumpy calls from Microsoft.

This is the last part of the Microsoft statement:

"Our terms with our publishers allow them to provide customers with implementation and technical support for their products but restricts them from using contact details for marketing purposes"

Canonical then tells us that this person was a Sales Representative, and it is clear from the content that this is a message aimed towards selling. Canonical has broken Microsoft's terms. That said, I can't see where that legal restriction is (e.g. can't see anything like that in https://azure.microsoft.com/en-us/support/legal/marketplace-...).

View on HN

> "On February 10th, a new Canonical Sales Representative contacted one of these developers via LinkedIn, with a poor choice of word. In light of this incident, Canonical will be reviewing its sales training and policies."

The part I find the most enlightening (ie: disturbing) is that Canonical's only regret is that the sales rep used "a poor choice of word" and they will train their salespeople better.

I assume the "poor choice of word" was when the salesman said, "I saw that you spun up an Ubuntu instance". Was Canonical's biggest regret that the salesmen INFORMED the user that they are monitoring installs and linking them to contact information?

Canonical never said "oh the salesperson wasn't supposed to market to you with this information", instead they basically said, the salesman wasn't supposed to TELL YOU that we are monitoring what you install and linking it to personal contact details.

> the salesman wasn't supposed to TELL YOU that we are monitoring what you install

Exactly. The old "I'm sorry I got caught" and not "I'm sorry I did it."

We can do better™

Legal wishes to remind you that that statement always needs this accompanying statement.

The word "better" does not imply a commitment towards customers and/or investors. *The word "do" should not be seen as referring to the taking of any specific course of action which may or may not yield tangible change. *The word "can" does not signify a concrete ability and is not forward-looking. *The word "We" should not be interpreted as Canonical Ltd. nor any of its subsidiaries or affiliated entities.

Reminds of the famous Bill Clinton qoute

>It Depends on what the meaning of the word is is

https://www.youtube.com/watch?v=j4XT-l-_3y0

Except he had a perfectly legitimate point there, as far as I understand, he just utterly botched the explanation.

There's a big difference between "is" and "was". Which is what he should have said. There were no semantic games in that particular statement, in stark contrast to some of the other things he said.

I'm sorry, but I am not completely aware of the broader context and just shared that soundbite as meme.

It's fine and understandable, it's just weird how the meme version is so detached from what the actual problems were.

Yeah, the only acceptable choice of words in this case would be: none.

It's all about plausible deniability.

Or as law enforcement call it: parallel construction.

The sales rep was probably expected to reach out claiming some other reason, making it look like the standard LinkedIn spam, but in reality much more targeted.

Yep, and the purported “retraining” will probably be more like, “use a vaguer or falser pretense to cold-call”.

I like how the vocabulary you use imply there is something highly nefarious happening here whereas it is all fairly standard direct marketing based on an exchange of data clearly highlighted in the TOS.

I don't really understand why everyone is up in arms here. In this case, Microsoft is basically a reseller. They told Canonical that they sold one of their product to a customer and Canonical reached out on LinkedIn, a professional social network. It all seems fair game to me. This is not some creepy internet tracking using dubious way to segment people. This is basic direct marketing in a B2B context.

It's all pretty tame.

>"This is basic direct marketing in a B2B context. It's all pretty tame."

Well maybe it is ok from that perspective. However my personal reaction as a customer to such sales approach would simple be something in line of GFY to that salesperson.

Unless you're the kind of person that actually sits and reads the EULA prior to hitting OK every single time, I'd say it makes complete sense people are up in arms. There is a difference between legally defensible and reasonable expectations.

It is actually completely unacceptable on what is advertised as a secure platform to engage in targeted marketing AT ALL. If any information about what my company is doing on your platform is shared to other companies, then you are not secure by any definition of the word that I'm aware of. It is not for you to judge what information is valuable or damaging for us.

> It is actually completely unacceptable on what is advertised as a secure platform to engage in targeted marketing AT ALL. If any information about what my company is doing on your platform is shared to other companies, then you are not secure by any definition of the word that I'm aware of. It is not for you to judge what information is valuable or damaging for us.

Security and data sharing have nothing in common. It is perfectly acceptable to share customers list when you are resellers if you clearly state you will do so in the contract. It doesn't become true because you write it in all cap and say it is not for me to judge. If you so value your company information, maybe you should start reading what you sign.

Once again, we are not talking about an unreadable EULA for personal software. Azure is a platform geared towards professional. Nothing creepy is happening here. That's Canonical reaching out and giving a potential customer a point of contact if they ever need support. This has nothing to do with broad data collection and spying and is perfectly reasonable. I don't understand why some commenters here find the idea of talking with an actual human being so traumatic.

Not who you are replying to, but I'd imagine your point:

> If you so value your company information, maybe you should start reading what you sign.

Is exactly what people are up in arms about. Even reading the EULA, you may not expect Microsoft to permit data sharing in this way. And if this is entirely unacceptable for you, then it's time to leave Microsoft.

Or you can make noise about it online like this, and cause Microsoft to realise this sharing will lose them customers. I doubt the data is worth the churn, and Microsoft will likely change the policy rather than lose the customers.

For the record, while in the midst of discovering a possible breach of contract with a company the size of Microsoft, it would be very good form, from a legal perspective, not to risk further jeopardy by openly saying that you've breached your contract. While lawyers are often distasteful to HN readers, they do have immense value in these situations, and they are completely correct to say "do not admit error at this time, not until we've formally analyzed it, post-mortemed it, and resolved our contractual obligations to Microsoft". Yes, y'all may want them to self-flagellate, but I'd rather see them honor their contracts and respect their lawyers first. They already admitted that they behaved inappropriately. The rest is just icing on the cake.

>Canonical never said "oh the salesperson wasn't supposed to market to you with this information"

Canonical never said "oh the salesperson shouldn't have had this information".

There's only one way they could have used it.

Very reminiscent of that Netflix tweet calling out a small group if people for some extraordinary binge watching.

“The first rule of the the surveillance economy is don’t talk about the surveillance.”

As I recall their tweet did not indicate that they had direct access to the identity (such as name or address) of those people. I think they mentioned their municipality?

Of course they have the raw data, but it's possible the people who sent that tweet just have access to a database that contains only anonymized data.

I guess I don't understand the quote from Microsoft's statement. Canonical provides "implementation and technical support," right? But they're not allowed to use user data from Microsoft to market those services? How else would that data even be useful for Canonical's "implementation and technical support" services?

This is the full quote from MS, provided in The Register article:

"Customer privacy and trust is our top priority at Microsoft. We do not sell any information to third-party companies and only share customer information with Azure Marketplace publishers when customers deploy their product, as outlined in our Terms and Conditions. Our terms with our publishers allow them to provide customers with implementation and technical support for their products but restricts them from using contact details for marketing purposes."

My interpretation is:

Every time you buy or use something from the Marketplace, MS will give your contact details to the Marketplace publisher. That publisher is then restricted in what they can do with the information. They may not use it for Marketing, they may use it to provide technical support.

Yeah, I agree with your interpretation and that makes sense from Microsoft's perspective. Just one open question that that raises: does a name and employer count as "contact details"? Do Microsoft's terms allow Canonical to reach out to someone on LinkedIn for marketing purposes as long as they don't look them up using the email address Microsoft gives them?

And if the answer to that last question is no, what can Canonical do with the data that's actually valuable to them? If I were given access to a database of sales leads that I was explicitly disallowed from contacting, I would actively avoid even accessing the data to avoid any accusation or perception that I violated those terms, just in case I independently got in touch with those same leads through a different channel.

So I don't know the answers to your questions - but here's one interesting thing - according to GPDR your email address is personal information as you'd expect. However your work email address is not. Companies can do all sorts of harvesting and collection on professional information that they can't on personal.

This is not strictly true. Sales@example.com would not be considered personal data, bob.smith@company.com would be

If they discover a huge security problem with the distribution you installed, they can contact you and help you upgrade to a non-vulnerable version? This like like what "technical support" is supposed to mean

How more reasonable it would have been for Microsoft to provide the publishers details to consumers instead of the other way around.

Interesting that this is not so.

Microsoft can earn more money this way (selling data for sales purposes), so their behavior meets my expectations.

Mine too, it is hilarious that they present this gratuitous data sharing as "this is normal/we are the victims as much as you are"

But they aren't selling the data

On the off chance you are not being sarcastic, do you think that Canonical got the data for free?

Yes? Its pretty evident that when you publish a marketplace app, the details of those that installed it are automatically stored for use by the vendor. All of the statements above align with this, unless you're insinuating that Microsoft are liars.

This sounds like plausible deniability to me. "We sell your details to companies whose products you're using - which would be really useful marketing information; but they say they don't use it for that, so we did what we need to."?

Microsoft being lily-white (/s) would ensure they had GDPR-like positive consent from customers that they could pass on those customers info to specific third parties...

The idea that companies keep some sort of information wall between their support and marketing departments is pretty ridiculous. MS have to be fully aware of this, surely.

So, the story is Canonical taking part in the same crap as the more overtly crap companies, and just this one agent not being clever enough to keep their leads under wraps.

GDPR obliges companies to provide information on all this parties PII has been passed to. Given cookie lists (or UBlock blocked files) are hundreds of companies long I'm surprised we're not getting reports of who is buying up all this info.

By waiting for someone to reach out for "implementation and technical support," at which point Canonical already has the data they need to investigate deeper? Not that that's even great, because 99% of the people who spin up a service will never contact Canonical and shouldn't have their info shared.

Yeah, I thought about that possibility, but I'm skeptical because the usefulness of Canonical getting that data directly from Microsoft seems really minimal. Whatever data Microsoft is collecting from its clients (I'd think it's at most metadata about base images, instance types, and maybe number of instances and usage patterns) should be trivial for those clients to provide to Canonical, if needed, if and when they initiate a support contract.

> But they're not allowed to use user data from Microsoft to market those services? How else would that data even be useful for Canonical's "implementation and technical support" services?

The data on who was doing what would be useful for providing implementation and technical support to people who has already contracted with Canonical for those services, both for providing the service and, depending on price structure, possibly for billing.

> The data on who was doing what would be useful for providing implementation and technical support to people who has already contracted with Canonical for those services

So then why should everyone else who doesn't have any contact with Canonical have their data forwarded to them too? This should be opt-in rather then opt-out, let alone always happening with no way to opt out

"Ubuntu Server on Azure best practices guide.pdf"

“Ouch. Big bug. Let’s contact the users who installed it from the azure marketplace. Good thing we got their names when they installed it!”

> That said, I can't see where that legal restriction is

It's probably part of the contract between MS and Canonical.

Which is a problem. I'm much happier if that restriction both exists and is enforced. If we can't see that contract, then it's all based on trust, and trusting tech companies with personal information has not gone well so far.

> but restricts them from using contact details for marketing purposes ... Canonical then tells us that this person was a Sales Representative

I don't understand - what's the difference between marketing and sales? Sales is trying to sell you something? But that's also marketing?

Reply on news.ycombinator.com