Slashdot Mirror
XP, Phone Home
Randomeyes writes: "The Register reports that Windows XP has functionality built-in to the Search Companion module that allows Microsoft to log users internet searches. Information collected includes user IP address, search term and related information. A cookie is also set. 'TrustUnWorthy Computing' anyone?" Tanveer1979 writes: though, that "the bright side is that it doesn't send anything to internet, it only downloads files, and compares the files on your computer with the files on server. And I guess a little effort is needed for the malicious to program it to send your data to web."
they were so forgiving! It's sounded bad to me... but maybe I'm getting out of touch with what it's really doing.
If it contacts the interent on a local file search, then that's bad. If it contacts microsoft when I search the net, that's bad.
This "we can't identify you" stuff is a lie that should be well known by now. What they mean is "they don't have your name in the file, we would have to look that up".
Maybe someone can explain why half the article is about mentioning this doesn't matter?
-pyrrho
the bright side is that it doesn't send anything to internet
Doesn't sound so bad to me.
Donate background CPU time to fight cancer.
In the USA, Internet access is usually a monthly subscription and that's it. No phone charges, no charge per minute, just a certain amount of bandwidth per dollar spent.
In Europe, some people have now got access to 2 types of "free" Internet (neither is free).
Which brings me to my point. If Internet connections are configured in such a way (as often they are) that the connection happens transparently because the username and password are stored, then people are going to pay call charges to search their local disk. If they don't realise this (especially in the case of ISDN connections) then they may run up quite a bill when they do an extensive search every time they lose a file.
I don't like this Internet-integration with the desktop in the OS. Sure, if I want it to happen, I can download some software helper. No doubt by hacking the registry or something equally scary for any novice user, you may be able to switch this off. But it reeks of abuse of my phone line.
It's interesting, no, that Microsoft do not necessarily take account of the European market when it comes to actual Internet access. Sure, they do multi language support but what about this particular Internet case?
I have clients who have been caught with huge bills due to shit like this before. Like transparent connections happening when they are not surfing when connected to an ISDN router which connects when any packet that is non-local causes a router to connect. I know that this can (and is) fixed on the router with better access lists, but the packets themselves come from crappy Microsoft things like MSN Messenger trying to auto-connect at boot and various SMB packets.
It's time that the Internet was a separate part of the desktop. Plenty of people embrace the Internet, but many others will not, especially in countries where it is still expensive just to stay online an hour costs me $2. That's right, a crappy 33.6K connection costs me $2 due solely to phone connection charges.
Conversion Rate Optimisation French / English consultant
Yes, but Bash, Netscape etc. doesn't trasmit that dat back to an 800lb gorrila, my friend.
There's your news.
Obviously this isn't surprising. You have information Microsoft could possibly sell, and it is certainly information they can use. Of course they're gonna try to get it, and try to keep it quiet. This is happening more and more often, and it's everyone, not just Microsoft.
:)
I do use XP, mostly as a gaming platform, but I use Mozilla, and when I'm not playing games often I am running Linux on the same box. This doesn't have me worried one bit. Some people are gonna get all in a twist about this, but this is just a small step towards the ultimate goal: human batteries.
This does make me wonder, however, since Microsoft is causing bandwidth to be used on my network for activities I have not expressly envoked, can I charge them for use of my connection?
I say, charge them for use of my bandwidth. They won't get it free out of me. I just wonder where do I send my bill..
Maybe maybe not.
I am 99.999999999999% sure the makers of BASH don't intend to make money off of your BASH history nor did they have any evil intent when they wrote that feature.
I am about 90% sure MS DOES intend to make money and had evil intent when they wrote their feature.
In the end evil is as evil does. We'll see what MS does with it.
War is necrophilia.
Ever heard the idea that if you throw enough "crap" at a wall something is going to stick. With all these companies suddenly forgetting how to treat their customers, it takes a lot of action by informed people to oppose things like this.
I fear that we risk spreading ourselfs thin in the upcoming onslaught of unreasonable software, privacy policies.
Chicago2600.net more than a lifestyle, its a survival trait.
This is stupid. Why are people being so paranoid? Of course a search engine needs to know what you're searching on! You reckon Google doesn't log what you searched on? Or your IP? Of course it does... Stats are valuable - even if you don't sell them to anyone. The Register is known for spamming it's own front page with poorly written "non-event" news stories written by poorly informed editors feasting on hype from other news sites.
I'm disappointed in any slashdot editor who thinks we need these stupid articles pointed out to us.
Nick...
To which I'd add, it also shows a problem with the culture in the organisation that makes the stuff. It's not so much arrogance, but something more akin to carelessness: an inability to appreciate that other people - including some of your customers - may have different criteria and preferences than yours. I personally doubt whether the people who developed this even thought to ask themselves whether this behaviour would be considered reasonable, nor that it was ever considered in any formal reviews that may have taken place. And it's far from the first time that I've got that impression about MS: their use of that reserved field in the Kerboros protocol feels similar: not so much malicious as just a failure to know and appreciate the etiquette that had grown up in an area that they were entering for the first time.
There's a reason we keep 800lb gorillas in cages...
Would you all kindly read the damn article before you start your ranting.
It all boils down to the fact that when you use the file search tool, it connects you to the internet and downloads a privacy policy type of file.
That's it, the end. Period.
When you are on the internet and perform a web search through XP, they log what you searched for... Even google does this for purposes of finding the most popular sites, and creating a table of the most popular searches and all that. This subject is not only trivial, but misleading in the context of the article... They quickly switch from talking about an offline file search which downloads a single text file when you first use it, to a completely different subject of a search tool recording what you searched for.
Of course, the ironic thing being that this web search tracking is no worse than the Netscape 6 tracking discussed a short while ago.
And if you haven't heard it enough so far, local file searches download a single damn file when you first use it. May seem a stupid thing to do, but it's not phoning home, it's not tracking your habbits, etc.
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
For those who don't know, Thomas C. Greene is the Register's equivelant of Jon Katz. His job is basically to find things to be angry about, and he does that very well indeed. He has just enough technical savvy to appear credible (think Steve!!! Gibson!!!!!), but that doesn't actually give him any deep cosmic insights.
If you were blocking sigs, you wouldn't have to read this.
Hey, it only downloads a file, so let's stop thinking now. There are some things bothering me here though, but maybe you can help me with it, so i can soon embrace blissfull ignorance again:
Do the other downloaded files alter the system behaviour in any way? They're providing information connecting file-extensions to file-types at least, and that might have some impact on a windows system. And if they don't do anything at all, why download them? Maybe i'm using a special app with uncommon file-extensions and took some pains upon me to make the system recognize them. Will that work be undone with every search query?
Then "downloading" is not a onesided action. To download a file i have to establish an internet connection, and in that process all kind of information is transmitted, not just the ip. I don't think someone concerned with network security of some larger corporation would be too happy about all their desktop machines sending out packets announcing their ip, the number of hops to them and the type of their operating system beyond the firewall to a specific location without need. Also why should anyone trust Microsoft not to collect all that ip-addresses to compile a nice list of windows-XP installations, maybe to set up a BSA-raid?
And finally: Why do such a "stupid thing" as downloading a privacy statement for an action that can be performed locally? Just to get some load on Microsofts server? Microsoft is paying for that bandwith, so why put extra load on it? Well, maybe someday in the future Microsoft will quietly decide to change their privacy policy and start collecting information about your local/intranet searches. But there's no need for you to know that. Only your Operating System needs to know.
"By the way if anyone here is in advertising or marketing... kill yourself." -- Bill Hicks
Google logs my search terms when I search, along with my IP address!
The difference is, Google is a good company with a solid privacy policy, and they have never given me a reason not to trust them. Microsoft on the otherhand, is a convicted monopolist, has had way too many security problems(they can't protect thier own data, what makes me think they can or will protect mine ?) and has repeatedly shown that it can not be trusted.
"Our products just aren't engineered for security,"
-Brian Valentine,VP in charge of MS Windows Development
No one is forcing you to use Windows. You've never had so many choices. Linux, Mac, BeOS, atheOS, etc.
You left out a small part of the Privacy Policy:
Microsoft will occasionally update this Statement of Privacy to reflect company and customer feedback. Microsoft encourages you to periodically review this Statement to be informed of how Microsoft is protecting your information.
Basically, this policy is in effect until MS decides to change it. When (not if) they decide to change it, any information they have already collected will be subject to the _new_ privacy policy.
We've seen it happen already with Yahoo!, among others.
I'm starting to wonder if these trolling articles bashing Microsoft are a just a plot to get us to read articles and see those new ads. This comment at the end of Timmothy's summary is what got my attention.
/etc/passwd to the net and I suppose with a little effort you could send a full inventory of your installed RPM's to the net too. It doesn't mean it is happening though. This is just plain irresponsible journalism here, if you can call cutting and pasting user submitted links journalism.
Tanveer1979 writes: though, that "the bright side is that it doesn't send anything to internet, it only downloads files, and compares the files on your computer with the files on server. And I guess a little effort is needed for the malicious to program it to send your data to web."
The last line about a little effort needed for the malicious program is just pure speculation. With a little effort you can send the contents of
'Same speed C but faster'