LibreOffice is an option.
Microsoft is phoning home the content of PowerPoint slides
151–160 of 391 posts
Re: Microsoft is phoning home the content of PowerPoint slides
#152Earlier quoted context omitted.
Yeah, I'm surprised every healthcare related business doesn't either ban PowerPoint or block this "feature" somehow. HIPAA is a hell of a drug.
I'm surprised every healthcare related business doesn't either ban PowerPoint or block this "feature" somehow. I work in healthcare, and the legal department bars me from using Google Analytics for HIPAA reasons. Meanwhile, IT made Chrome the only browser the employees are allowed to use on every Windows machine in the org.
Did you read the article? I find your jaded sense of cynicism to be different than critical thought. I don't see any proof in the article posted about its claims. It's just very easy to get jaded, cynical people to support the right headlines on social media. Hacker News, be better.
Re: Microsoft is phoning home the content of PowerPoint slides
#153What I want is Little Snitch on steroids built into the OS where every process, including all native ones, including UI apps, are blocked from network connectivity by default, and the user gets an easy monitor of outgoing traffic with TLS/SSL inspection built in (you'd need some OS API to enable that). Kind of like granular oauth permissions, apps should have to declare which outgoing they have, a description/why, an…
> What I want is Little Snitch on steroids built into the OS where every process, including all native ones, including UI apps, are blocked from network connectivity by default, and the user gets an easy monitor of outgoing traffic with TLS/SSL inspection built in (you'd need some OS API to enable that). If you want to you can do that with Linux. Sure you'd need to use the CLI, and a combination of tools but you can…
Nah, you can't. The issue is the "easy monitor outgoing traffic with TLS/SSL" part.
It is not impossible but it is far from easy. If the application uses statically linked SSL client (as it should if it is commercially distributed) then you have to modify the application (for example in memory) to get a copy of everything that gets written to the SSL stream.
Re: Microsoft is phoning home the content of PowerPoint slides
#154Earlier quoted context omitted.
I don't really care that it has a feature that's the reason they're sending data off to Microsoft, I care that they're sending data off to Microsoft and it's not blatantly obvious to the user.
> The first time you try out Designer, it may ask your permission to get design ideas for you. If you want to use Designer, select Turn on. https://support.microsoft.com/en-us/topic/53c77d7b-dc40-45c2... Considering it has to be explicitly enabled and includes a privacy policy, I’m going to say it’s “blatantly obvious” to the user.
> it may ask your permission to get design ideas for you.
> get
We're not worried about get, but about send. Funny how they managed to omit the most worrisome term from their permission dialogue, huh?
Re: Microsoft is phoning home the content of PowerPoint slides
#155Earlier quoted context omitted.
I don't really care that it has a feature that's the reason they're sending data off to Microsoft, I care that they're sending data off to Microsoft and it's not blatantly obvious to the user.
> The first time you try out Designer, it may ask your permission to get design ideas for you. If you want to use Designer, select Turn on. https://support.microsoft.com/en-us/topic/53c77d7b-dc40-45c2... Considering it has to be explicitly enabled and includes a privacy policy, I’m going to say it’s “blatantly obvious” to the user.
> to get design ideas for you.
This statement asks for permission to fetch data, not to upload my data.
Uploading data based on this statement is a blantant violation of customer expectations, so obvious you don't need to be neither a ux expert nor a lawyer to see it, you just need to read carefully.
Re: Microsoft is phoning home the content of PowerPoint slides
#156What I want is Little Snitch on steroids built into the OS where every process, including all native ones, including UI apps, are blocked from network connectivity by default, and the user gets an easy monitor of outgoing traffic with TLS/SSL inspection built in (you'd need some OS API to enable that). Kind of like granular oauth permissions, apps should have to declare which outgoing they have, a description/why, an…
I used little snitch for so many years but stopped using it a while ago for some reason. Is it still as good as it used to be?
Re: Microsoft is phoning home the content of PowerPoint slides
#157Earlier quoted context omitted.
> with TLS/SSL inspection built in (you'd need some OS API to enable that). I'm not sure of that. Provided you can add a cert to your OS, you should be able to get away with a piece of protocol downgrade network gear that you can then pipe to a different (ideally, offline other than UDP receive) computer for analysis. You'd need to disable HSTS, but other than that I think it should be the solution you're looking for…
Any application that uses certificate pinning would fail in this situation as that's specifically what it is trying to prevent.
You "just" need the key to the encrypted traffic. You don't have to change the handshake/negotiation, you just want a copy of the key so you can decrypt the traffic.
In TLS, the client authenticates server, then they both agree to use a key for the session; the OS can get a hold of this key (this is usually a bad move because then any captured traffic frames could be later decrypted).
Re: Microsoft is phoning home the content of PowerPoint slides
#158I've raised this point repeatedly in different orgs. It's met with some combination of indifference and lack of understanding and not-my-responsibility-ism, but I'm sure that this will eventually blow up hard in some company's face - like 9-digit settlement for breach of contract, or worse things like breach of export control laws. Enterprise data security on the "MS Office level" at this point is like driving 60 mph…
This kind of thing in particular should make banks' compliance departments more nervous than usual - Powerpoint is a really key tool for deal teams, and the behaviour is here might just be obscure enough to be missed by people tasked with stopping price-sensitive information slipping out the door.
Re: Microsoft is phoning home the content of PowerPoint slides
#159Earlier quoted context omitted.
What I want is Little Snitch on steroids built into the OS where every process, You cannot trust an OS you cannot build yourself. That's why I see Linux as the only option for professionals and privacy minded people.
How do you know there are no outside efforts to log linux activities? There's a lot of source code to go through and is it possible there are callbacks even within OSS that most people are not aware of?
At least its possible _in principal_ and many people out there can at least look at the code even if you can't dig through yourself. With Windows or OSX you're just out of luck.
Re: Microsoft is phoning home the content of PowerPoint slides
#160Earlier quoted context omitted.
> worse things like breach of export control laws The entire Department of Defense runs on PowerPoint, along with all of their contractors. It is not at all uncommon to produce slide decks that are either classified or covered by ITAR; this is a disaster waiting to happen.
Do they run on the same infrastructure as the rest of us?
No. DOD/Gov projects can be hosted in completely secure locations, and Azure for Government follows all the required standards. Office365/Sharepoint supports FedRAMP High. Most agencies are in the process of finishing migrations so that both their desktop and online apps use the same data in secure cloud installations.