Slashdot Mirror
Microsoft's Telemetry Additions To Windows 7 and 8 Raise Privacy Concerns
WheezyJoe writes: ghacks and Ars Technica are providing more detail about Windows 10's telemetry and "privacy invasion" features being backported to Windows 7 and 8. The articles list and explain some of the involved updates by number (e.g., KB3068708, KB3022345, KB3075249, and KB3080149). The Ars article says the Windows firewall can block the traffic just fine, and the service sending the telemetry can be disabled. "Additionally, most or all of the traffic appears to be contingent on participating in the CEIP in the first place. If the CEIP is disabled, it appears that little or no traffic gets sent. This may not always have been the case, however; the notes that accompany the 3080149 update say that the amount of network activity when not part of CEIP has been reduced." The ghacks article explains other ways block the unwanted traffic and uninstall the updates.
Customer Experience Improvement Program... for those of us used to wading through the pile of sewage that is Windows in a corporate environment, it is well known and enjoyed about as much as annual performance appraisals.
There are consequences to every action
-- Tigger warning: This post may contain tiggers! --
"Raises privacy concerns" is elliptical speech: it's made to be deliberately obscure. (It uses "causes concern" to convey the central point without giving any information about what the point is.)
It's also passive voice, in that there's no person performing the action, the action is simply "caused" by something. (For comparison, consider "we wrote reports" versus "reports were written".) Hence, there's no person or group responsible, it's simply an aspect of situation.
And finally, the phrase uses framing to soften the effect. Your personal information isn't being harvested, the system simply "raises some concerns".
Taken as a whole the headline tries to get the reader emotionally involved by stating something we should be concerned about, without saying in concrete terms *that* there is anything to be concerned about, and that it's *other people* who are concerned.
Meh. This didn't work on me, I'm not actually concerned, I'm going to ignore it.
(Propaganda success!)
https://github.com/WindowsLies...
Someone is on the case!
Prove anything by multiplying Huge Number times Tiny Number
And it's a failure b/c they ignore what people really wanted: the Start Menu.
Instead we got the Start List: 100+ icons to scroll through.
Only Santa's list is longer.
Obama's legacy: (N)othing (S)ecure (A)nywhere and (T)error (S)imulation (A)dministration
I'll just try it again without the rest of the post. Now I get "Your comment has too few characters per line (currently 38.5)." Again, fuck you Slashdot. Let's see if this line can fix it. Let's see if this line can fix it. Let's see if this line can fix it. Let's see if this line can fix it. Let's see if this line can fix it. That didn't work "Your comment violated the "postercomment" compression filter. Try less whitespace and/or less repetition.". Try again.
ECHO OFF
REM --- remember to invoke from ELEVATED command prompt!
REM --- or start the batch with context menu "run as admin".
SETLOCAL
REM --- (as of 2015-08-26):
REM KB3012973 - Upgrade to Windows 10 Pro
REM KB3021917 - Update to Windows 7 SP1 for performance improvements
REM KB3035583 - GWX Update installs Get Windows 10 app in Windows 8.1 and Windows 7 SP1
REM KB2952664 - Compatibility update for upgrading Windows 7
REM KB2976978 - Compatibility update for Windows 8.1 and Windows 8
REM KB3022345 - Telemetry [Replaced by KB3068708]
REM KB3068708 - Update for customer experience and diagnostic telemetry
REM KB2990214 - Update that enables you to upgrade from Windows 7 to a later version of Windows
REM KB3075249 - Update that adds telemetry points to consent.exe in Windows 8.1 and Windows 7
REM KB3080149 - Update for customer experience and diagnostic telemetry
REM KB3044374 - W8,8.1 Nagware for W10
REM KB2977759 - W10 Diagnostics Compatibility Telemetry
REM KB3050265 - Windwos Update services update to upgrade to W10
REM KB3068707 - Customer experience telemetry point. W7,8,8.1
REM --- uninstall updates ... /b /wait wusa.exe /kb:3012973 /uninstall /quiet /norestart /b /wait wusa.exe /kb:3021917 /uninstall /quiet /norestart /b /wait wusa.exe /kb:3035583 /uninstall /quiet /norestart /b /wait wusa.exe /kb:2952664 /uninstall /quiet /norestart /b /wait wusa.exe /kb:2976978 /uninstall /quiet /norestart /b /wait wusa.exe /kb:3022345 /uninstall /quiet /norestart /b /wait wusa.exe /kb:3068708 /uninstall /quiet /norestart /b /wait wusa.exe /kb:2990214 /uninstall /quiet /norestart /b /wait wusa.exe /kb:3075249 /uninstall /quiet /norestart /b /wait wusa.exe /kb:3080149 /uninstall /quiet /norestart /b /wait wusa.exe /kb:3044374 /uninstall /quiet /norestart /b /wait wusa.exe /kb:2977759 /uninstall /quiet
echo uninstalling updates
start "title"
echo - done.
start "title"
echo - done.
start "title"
echo - done.
start "title"
echo - done.
start "title"
echo - done.
start "title"
echo - done.
start "title"
echo - done.
start "title"
echo - done.
start "title"
echo - done.
start "title"
echo - done.
start "title"
echo - done.
start "title"
I really want to like Windows 10. It seems to have a lot of nice features, was a smooth upgrade from 7, and probably the single most painless OS upgrade I've had on any MS platform (I had to correct a single driver, for a minor issue, and that was it).
But I'm really, really sick of just how blatantly Microsoft is trying to jam every single stupid thing into this, and tie it back to their cloud based bit. And I might even be okay with some of that, because I'm well aware that I wind up giving a lot to Google when I'm using stuff on Android. I might even use some of it, if they weren't going far beyond even what Google does.
The final straw was when they wanted to essentially remove my local account on the machine and replace it with me using a Microsoft account for my local login. No, sorry, but Redmond can go get fucked if they want that. It's one thing to have stuff in a cloud based application that has its own password, but it's another thing for that cloud based password to be my entire system. Perhaps I'm being overly negative, but it's just too much, that they want all this personal data, and they want to tie it all not just to what I do in application land with Outlook/Bing/Edge/Cortana/Skype whatever, but down to the OS level? No. And if it gets worse, I may just have to bite the bullet and do my PC gaming on Linux, and give up on doing anything bleeding edge.
No, the guys who wanted more tracking took that guy out for a beer. That's the guy who killed off DoNotTrack. Like Private Browsing in Firefox or Incognito Mode in Chrome, DNT was about the balance between privacy on one hand and convenience/features on the other hand. DNT was supposed to mean that the user valued privacy more than convenience and features at the moment. Here's what was supposed to happen, what DNT was intended for:
Case 1, no DNT header:
I go to Slashdot, and have not set a specific DNT header. I therefore get the DEFAULT tracking/personalization behaviors of Slashdot, including:
I'm not redirected to Beta, because Slashdot tracks that I set "do not showme beta".
On my mobile device, I'm not redirected to m.slashdot.org, because again Slashdot tracks my preferences based on some identifier/cookie.
Case2, with DNT header:
I launch a Private Browsing window in Firefox, or an Incognito tab in Chrome.
The browser prompts "DNT: Do you want to tell web sites to avoid identifying you or tracking your preferences? Some features and preferences may not work in DNT mode."
I click "yes, send the DNT header".
Slashdot sees that I have expressed that I want a higher level of privacy than the default, that I am willing to give up personalization in exchange for privacy.
Slashdot does not set a cookie, and I get redirected to m.slashdot.org or beta.slashdot.org each time. It does not track me to know my preferences between sessions.
It's all about the balance between privacy and convenience. Much like Incognito / Private Browsing mode disables the browser history, autocomplete, and other useful features in exchange for better privacy.
In short, the purpose of DNT was to communicate the user's desire to value privacy over convenience.
By violating the spec and sending DNT as the DEFAULT, the DNT header in IE suddenly meant "the user probably wants the DEFAULT balance between privacy and convenience". Since IE sent DNT by default, it no longer provided any information about the user's priorities regarding convenience vs privacy. It therefore became completely useless for it's purpose. That guy killed DNT.
-----
Here's a concrete example. Quoting from the DNT policy:
| all user identifiers, such as unique or nearly unique
| cookies, "supercookies" and fingerprints are discarded
Do you really think that all sites are going to get rid of cookies, including "don't show me Beta" cookies, for anyone and everyone using IE? Just because Microsoft thought it was a good idea? No friggin way. If the USER chose to actively ticked the box, perhaps so. Because Microsoft's marketing team thought that "Do Not Track" sounded good and that breaking most web sites was an acceptable side effect? I don't think so.
Would the editors consider adding a section for analysis of Windows updates so we can read then decide if we want them instead of having to go on click marathons through the desktop client? Even some sort of Patch Tuesday digest just indicating which of the updates are actual security patches would do it.
Political debates have me rolling my eyes so much I think I got optical whiplash. I should sue. - Foamy The Squirrel
Both scripts fail to make use of a simple FOR command.
FOR %A IN (list) DO command [ parameters ]
I put this in my tomato "Scripts" section. Basically grabbed all of the dig output for settings-win.data.microsoft.com and vortex-win.data.microsoft.com, cnames, and authorities for them.
Possibly excessive. I'm ok with that. YMMV.
iptables -I FORWARD -d 8.26.215.27 -j DROP
iptables -I FORWARD -d 64.4.54.254 -j DROP
iptables -I FORWARD -d 8.26.204.25 -j DROP
iptables -I FORWARD -d 198.78.199.155 -j DROP
iptables -I FORWARD -d 204.160.105.155 -j DROP
iptables -I FORWARD -d 4.23.46.155 -j DROP
iptables -I FORWARD -d 65.55.44.108 -j DROP
Why, again, do people still use Windows?
Because it runs the programs they need to run and works with the devices they use. That is the primary purpose of an operating system, nobody turns on their computer just to use the operating system.
Customer Experience Improvement Program...
It's a Microsoft customer service, in the sense of "the farmer got in a bull to service his cows".
The thing that worries me it that there are now dozens of articles about which updates to remove to disable telemetry or the Windows 10 update nagbox. We've been saying that installing security updates is fundamental to keeping your computer secure. This goes against that. Do we really want to teach people to uninstall random updates based on shady blog articles?
Earlier I had all automatic update checkboxes checked, because I trusted that security updates are just that - security updates. From now on I'll be checking all the updates manually before installing, and I really hate to have to do that.
And before anybody recommends switch to Linux, I already use Linux as my main OS.
Only dumb birds land downwind.