Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

My application ran away and called home from Redmond

medium.com

Post reply on HN
Print view View original

81–90 of 143 posts

Re: My application ran away and called home from Redmond

#81

Post by lazyasciiart »

Silhouette wrote: post #68
lazyasciiart wrote: post #53

Earlier quoted context omitted.

I'm not sure how you would invoke HIPAA with no medical professionals involved. It doesn't just magically apply because you wrote down your own medical information.

You could replace HIPAA with GDPR again, since almost any medical information about an identifiable individual will constitute sensitive personal data that requires the stronger protections under that law.

I'm not sure the GDPR protections are invoked by you giving them personal data they didn't ask for, but it'd be an interesting case! (Seems like anyone could screw a company by putting their name+address in the comment field of an anonymous survey, etc?)

Re: My application ran away and called home from Redmond

#82

Post by Silhouette »

lazyasciiart wrote: post #81
Silhouette wrote: post #68

Earlier quoted context omitted.

You could replace HIPAA with GDPR again, since almost any medical information about an identifiable individual will constitute sensitive personal data that requires the stronger protections under that law.

I'm not sure the GDPR protections are invoked by you giving them personal data they didn't ask for, but it'd be an interesting case! (Seems like anyone could screw a company by putting their name+address in the comment field of an anonymous survey, etc?)

If the data was uploaded deliberately through a system they operated, it is hard to see how they would be anything other than the data controller within the GDPR framework, unless maybe they actively tried to avoid collecting the personal data and it was supplied anyway. But it would be hard to argue that was the case if they were uploading data in ways the user of the computer in question probably wasn't even aware of.

(As an aside, if they are sweeping data on such a broad scale without being transparent about it and the only authorisation for doing so is buried deep in some legal document, it would be interesting to consider whether they were not only potentially in breach of GDPR but also various criminal computer misuse laws.)

Re: My application ran away and called home from Redmond

#84

Post by GhettoMaestro »

0xffff2 wrote: post #44
moomin wrote: post #34

Earlier quoted context omitted.

Assume for a second this is correct. What's to stop virus writers from embedding a ToS preventing Microsoft from running the code? I'm not saying you're wrong, I'm saying it's really hard to work out how this is meant to work.

I don't think a virus is relevant here. I'm not a lawyer, but the idea of a "terms of service" for an unwanted and maliciously installed executable seems nonsensical. Virus authors can include whatever TOS they want, but the "user" hasn't agreed to the TOS practically by definition.

Unfortunately the law doesn’t view common sense answers like that as easily as you and I.

Re: My application ran away and called home from Redmond

#85

Post by GhettoMaestro »

0xffff2 wrote: post #25
GhettoMaestro wrote: post #23

Earlier quoted context omitted.

Pretty sure by you having this malware submission feature enabled you have given a limited license for them to execute the binary. You're barking up the wrong tree.

You (the user) may not have the right to grant such a license.

Good point. What about anti-virus or cloud-detonation services ? Sounds like there would be a similar type of challenges with those re licenses?

Re: My application ran away and called home from Redmond

#86

Post by lazyasciiart »

Silhouette wrote: post #82
lazyasciiart wrote: post #81

Earlier quoted context omitted.

I'm not sure the GDPR protections are invoked by you giving them personal data they didn't ask for, but it'd be an interesting case! (Seems like anyone could screw a company by putting their name+address in the comment field of an anonymous survey, etc?)

If the data was uploaded deliberately through a system they operated, it is hard to see how they would be anything other than the data controller within the GDPR framework, unless maybe they actively tried to avoid collecting the personal data and it was supplied anyway. But it would be hard to argue that was the case if they were uploading data in ways the user of the computer in question probably wasn't even aware…

I couldn't find any internet information on data not deliberately collected, so it's possible that nobody has figured out how GDPR applies (or I had the wrong search terms).

Re: My application ran away and called home from Redmond

#87

Post by jumpingmice »

AlexandrB wrote: post #2

From a copyright law perspective, this seems wild. Microsoft is downloading and running binaries from entities that may have never given Microsoft license to do so, including Microsoft's competitors. All based on a permission setting configured by an unrelated third party (the user).

Indeed the ENTIRE basis of the EULA is that the user copies the software by executing it, whereupon a copy exists both on-disk and in-memory. This is long settled jurisprudence. I’m sure that if Microsoft downloads and runs an AGPL-licensed work they expose themselves to pretty severe problems.

Re: My application ran away and called home from Redmond

#88

Post by secabeen »

TeMPOraL wrote: post #17

Ok, so if I compile an executable that pops up a screen with a picture I drew + lots of personal and medical information about me, and phones me whenever it's executed, and then just leave it on my machine only for it to phone home from Redmond, can I sue them for copyright, GDPR, HIPAA violations and whatnot? How good is their "new unique binaries" detection? Could I do the same with just a bunch of files wrapped in…

Running unknown executables in a sandbox and watching what they do is pretty common in advanced malware prevention software, and I expect that there's something in the TOS for Defender that grants them the permission to do this.

Re: My application ran away and called home from Redmond

#89

Post by moron4hire »

AlexandrB wrote: post #2

From a copyright law perspective, this seems wild. Microsoft is downloading and running binaries from entities that may have never given Microsoft license to do so, including Microsoft's competitors. All based on a permission setting configured by an unrelated third party (the user).

There is also the issue that MS would have been given the copy by someone who did not have rights to distribute it, so the infringement is with the user.

Re: My application ran away and called home from Redmond

#90

Post by icebraining »

cududa wrote: post #72
em-bee wrote: post #55

Earlier quoted context omitted.

i believe fair use only applies to software that you legally acquired. if microsoft copies an application from my computer without asking, then it did not legally acquire it. malware is a different case. malware entered my computer with the permission of the malware creator. i didn't steal it from them, but it came to me willingly. hence i am allowed to analyze it, and i am allowed to delegate that task to someone el…

Yes but who’s to say it came to your machine under such circumstances

Microsoft is the one that has to prove it has a valid license, not the other way around.
Post reply on HN