Slashdot Mirror
Metadata in Vista Could Be Too Helpful
linumax writes "Windows Vista will improve search functionality on a PC by letting users tag files with metadata, but those tags could cause unwanted and embarrassing information disclosure, Gartner analysts have warned. Search and organization capabilities are among the primary features of Windows Vista, the successor to Windows XP due out late in 2006. While building those features, Microsoft is not paying enough attention to managing the descriptive information, or metadata, that users can add to files to make it easier to find and organize data on a PC, according to Gartner. 'This opens up the possibility of the inadvertent disclosure of this metadata to other users inside and outside of your organization,' Gartner analysts Michael Silver and Neil MacDonald wrote in a research note published on Thursday."
If my metadata could be viewed by other people inside and outside my organization, there's an easy solution to this.
Don't fill out the metadata fields!
Should it be a surprise MS hasn't taken adequate security measures in the "advance" of its operating system that seems like another attempt to compete with google? I say stick to Google Desktop http://desktop.google.com/. And your own directory architecture for organization.
Walk with Music;
Now we have a business analyst group trying to direct a computer software company how to write its software. When Gartner starts making new technology or being otherwise reasonably involved in technology, they can have a seat at the table. For now, this is just horrendously bad policy. Anyways, the Microsoft DOC format already contains a horrendous amount of metadata, the full history of changes that led to the current document, among other things. Where's Gartner's whines about that?
Nothing worse then searching for one thing, and coming up with a "*ultra-midget-fetish-sex-in-chocolate*" result when your g/f is around.......... That's my biggest gripe of indexers. Too easy to accidently find files. Like search for your g/fs name if you want pictures of her (and she is hooking over your shoulder wanting them), she may see her name come up in a convo between you and your bud that you'd rather her not see.
In undeveloped countries, the consumer controls the market. In capitalist America, the market controls you.
Like Big Bird says, remember to put your infants in the back seat, so the "safety" devices don't kill them.
No folly is more costly than the folly of intolerant idealism. - Winston Churchill
Help me out here, but what's so difficult about not storing metadata in-line ?
After 10 years of M$ Word disclosing secret information, you'd have guessed that "a removal tool" as mentioned in the article is obvious to anyone with half a brain as not good enough.
Storing the meta-data in a seperate file, or how about with the other metadata (i.e. with the inode) isn't so hard, is it? And it is quite obviously the right thing. There's even a big, red hint right there in your face: It's called meta-data. Might want to treat it different from the actual data, you know?
Assorted stuff I do sometimes: Lemuria.org
I find it a little annoying when someone does a "doom and gloom" review of a beta product, focusing on bugs or immature features. Its like doing a review of a building in progress and shouting out: "It has no roof! The rain will come right in! What are they thinking!"
Humor from a Genetically Molested Mind
I hear that the 2008 Toyota Prius will have a 7' high spoiler. What's up with that?
Oh, sorry... I just figured that we're talking about products that are still a few years down the pipe that haven't been anywhere close to finalized yet.
I don't know about anybody else, but we not only don't evaluate software years before it's released, but we generally wait until the software has been out for at least a year before even looking at it. I don't know what the point is of reviewing a product this early. The only thing that I can figure out is that it's a way to get a few more pageviews.
I don't respond to AC's.
How is this different than naming your file "Invoice for Asshole Larry.doc" and mailing it to the client? Simple solution: don't put potentially embarassing stuff in the metadata fields.
Do people really need an analysis to tell them this?
I've often been amused by what appears in the Properties pane of Word document sent by clients or what you can dredge up from Track Changes. Evidence of re-used documents, other projects, other clients, and deft attempts at redaction abound in the hidden metadata and edits.
The more data a computer saves (especially if hidden from plain site), the greater the chance of embarrassment and unintended leakage of sensitive info.
Two wrongs don't make a right, but three lefts do.
I know it's trendy here to bash windows, but this is FAR from a windows specific problem. Any file system that contains metadata could enable inadvertant disclosure of information, be it windows, mac, linux etc. The solution basically is to ensure that either a)your users are aware of what metadata is and how it works and to make sure that they get rid of any metadata on sensitive documents that they may send out or b) failing that, don't use the metadata.
Monstar L
If you have any kind of data which needs to be kept private (we have HIPPA compliance to worry about at our medical office), using Google desktop is a bit scary. Yes, it allows you to "lock out" certain data sources, but on machines where private data passes in a lot of different formats, things can easily slip through the cracks.
Of course, we don't have it on our main office machines, because they are running Slackware. Our machines that are locked into Windows for hardware interface reasons had to have Desktop removed from them after a couple of almost-incidents.
YMMV
Using plain ol' text since 1968
Having something like "post-it notes" that do not stick to the file, but instead are part of the directory entry for that file, might be more useful and safer. If someone sends me a file, I don't want that person's metadata to pollute my classification of files.
That's somewhat like what happens with e-mail - I receive plenty of mails that the sender marked as "high priority", but that are low priority to me. Metadata on the file should be objective; subjective information should be stored somewhere else and not be transmitted together with the file.
I would *hope* ( and no, I didn't read the article ), that the meta data for each file would have the same security permissions as the original file.
Otherwise, you'd be able to search for the meta data in the private files of other users.
Oh, that would be good. Play "try and modify the file when we think it is being sent off this system". Yet another kludge with lots of holes. Can you say zip files?
This is just another example of disclosures from the past where change log information was left in documents released to public forums. Very interesting info disclosed in some of those word documents. Must be standard procedure now for lawyers to check the change log info on documents they are sent.
And if people don't fill out the meta data info the fancy new search capabilities won't be as useful so why have them?
Turning to the metadata: Having lots of metadata to search can be a very good thing. But, if used improperly (e.g., having the index not properly secured from outside access or malicious software) they can be a bad thing (read: security risk).
So, as the grandparent said: "Like Big Bird says, remember to put your infants in the back seat, so the "safety" devices don't kill them."
"but those tags could cause unwanted and embarrassing information disclosure, Gartner analysts have warned."
Oh, you mean more embrassing than finding cookies and cached images from pr0n sites and the like? Unless you're considering self comments like "he's so hawt! I'd so tap that!" Not that you that most people's surfing already involuntarily discloses their personal data like a sieve.
I'd be less concerned about people appending credit card numbers and such to files, not embrassement.
You need a FREE iPod Nano
That would defeat the intents and purposes of metadata in a multiuser (read: most offices) environment...
For example, several years ago Microsoft reportedly posted its annual report as a Word document, which contained evidence that it was composed on a Macintosh.
That example is good for a chuckle (OK, maybe a belly laugh for us Mac fanboys), but suppose someone sent a document to a customer that showed it was filed in a folder named "Correspondence with Idiot Customers" without the sender realizing it...
When an employee comes to talk about a project I will often search for terms related to the project or sometimes by the employeees name in spotlight while they sit around my screen.
It doesn't sound like a metadata related problem to me. It sounds more like a furniture placement issue.
But seriously, de-selecting 'Mail' in the Spotlight pref pane, should stop spotlight from displaying results in its window, while retaining the full indexing facilities within Mail.app itself.
By having someone look at your screen it's your responsibility to prevent private info from appearing. The system knows you're logged in, but it certainly doesn't know someone other than you is looking at the information. Just like if you brought up your address book... you should know not to bring up confidential contact information. The system certainly can't take care of that for you.
Developers: We can use your help.
drwx------ 8 root admin 272 Dec 23 03:39 .Spotlight-V100
:)
Yes, if they manage to apply rights based system system wide, something like OS X, it won't be problem.
I mean if they are stealing, steal it completely
Note I had to 'sudo ls -la' to see it even.
(os x 10.4 "tiger")
Perhaps not coincidentally, those are the only two text document formats that get passed around between corporations.
I think you're seeing a conspiracy where none exists. If, for instance, AppleWorks suddenly overnight became the most popular word processor ever, and people were passing AppleWorks bills to the local senator over email... well, you'd have the same problem, because AppleWorks (and most, if not all, word processors) keep the same meta-data as Word and PDF does.
Comment of the year
Allchin stressed that Microsoft has broken new ground in Longhorn. For example, document icons are no longer a hint of the type of file, but rather a small picture of the file itself. The icon for a Word document, for example, is a tiny iteration of the first page of the file. Folders, too, show glimpses of what's inside. Such images can be rather small, but they offer a visual cue that aids in the searching process, Allchin said.
Kind of like Gnome has been doing for a few years now? How out of touch are these people???
All I have to say is "Follow the money" on the article
according to a compilation by Workshare, a maker of software that strips metadata out of files.
You wouldn't think that they have some invested financial interest in getting the the public overreacted about the dangers of metadata
Am I being reverse paranoid?
I'll never make that mistake again, reading the experts' opinions. - Feynman
Isn't the solution to your problem to not let the person you're searching about to stand around your screen?