Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft is phoning home the content of PowerPoint slides

rogermexico.bearblog.dev

Post reply on HN
Print view View original

251–260 of 391 posts

Re: Microsoft is phoning home the content of PowerPoint slides

#251

Post by Springtime »

mixmastamyk wrote: post #223
dagmx wrote: post #178

This post is dubious at best. It makes a “do your own research claim” without sharing anything concrete. Yet, this plays into people’s own confirmation biases so it’s already being taken verbatim by people here.

https://news.ycombinator.com/item?id=31727293

I'd too be interested in further analysis (eg: ruling out false alarms, such as some update check) so that I can say to others with more certainty that something is of potential concern, rather than it being shot down later if someone does a more rigorous analysis.

Just because one could say a company has done controversial things before doesn't mean there's no benefit in verifying claims.

Re: Microsoft is phoning home the content of PowerPoint slides

#252

Post by phpisthebest »

semi-extrinsic wrote: post #35

I've raised this point repeatedly in different orgs. It's met with some combination of indifference and lack of understanding and not-my-responsibility-ism, but I'm sure that this will eventually blow up hard in some company's face - like 9-digit settlement for breach of contract, or worse things like breach of export control laws. Enterprise data security on the "MS Office level" at this point is like driving 60 mph…

I am surprised you believe the vast majority of power point users would be handling information that could even breach export laws, or that even the majority of users are making power points to present to people of other nations...

I bet that is less than .01% of all power points created in the world

Re: Microsoft is phoning home the content of PowerPoint slides

#253

Post by thereddaikon »

real_dogbert wrote: post #60
semi-extrinsic wrote: post #35

I've raised this point repeatedly in different orgs. It's met with some combination of indifference and lack of understanding and not-my-responsibility-ism, but I'm sure that this will eventually blow up hard in some company's face - like 9-digit settlement for breach of contract, or worse things like breach of export control laws. Enterprise data security on the "MS Office level" at this point is like driving 60 mph…

Yeah, I'm surprised every healthcare related business doesn't either ban PowerPoint or block this "feature" somehow. HIPAA is a hell of a drug.

HIPAA is prescriptive, not descriptive. It does not lay out specific standards to reach. Only overly vague and broad guidelines. Because of this the industry has more or less developed its own best practices that should be good enough.

What this means is that healthcare providers have annual audits performed by third parties who check compliance with these "best practices" which may or may not have any relation to what the lawmakers intended. Its ultimately about checking boxes. yada yada security is hard. You can't write a law that describes a security posture and expect to be relevant for more than a year at most.

Re: Microsoft is phoning home the content of PowerPoint slides

#255

Post by mymyairduster »

Someone1234 wrote: post #31
Justin_K wrote: post #24

Earlier quoted context omitted.

This shouldn't be software behavior by default. Why should it be flagged?

The article has a low signal-to-noise ratio. It is just a single paragraph claim that doesn't delve into anything nor inform its audience of anything. Why shouldn't it be flagged? If this claim was posted as a HN comment without citation or further explanation it would likely get flagged, why are submissions held to a LOWER standard?

Yeah..

Re: Microsoft is phoning home the content of PowerPoint slides

#257

Post by mixmastamyk »

Springtime wrote: post #251
mixmastamyk wrote: post #223

Earlier quoted context omitted.

https://news.ycombinator.com/item?id=31727293

I'd too be interested in further analysis (eg: ruling out false alarms, such as some update check) so that I can say to others with more certainty that something is of potential concern, rather than it being shot down later if someone does a more rigorous analysis. Just because one could say a company has done controversial things before doesn't mean there's no benefit in verifying claims.

It’s in their TOS and stated as a feature.

https://news.ycombinator.com/item?id=33509159

There’s an expression, paraphrased as “when someone tells you who they are, believe them.”

Re: Microsoft is phoning home the content of PowerPoint slides

#258

Post by egberts1 »

squarefoot wrote: post #187
user3939382 wrote: post #64

What I want is Little Snitch on steroids built into the OS where every process, including all native ones, including UI apps, are blocked from network connectivity by default, and the user gets an easy monitor of outgoing traffic with TLS/SSL inspection built in (you'd need some OS API to enable that). Kind of like granular oauth permissions, apps should have to declare which outgoing they have, a description/why, an…

On Linux there is OpenSnitch that does its job nicely, although I experienced some occasional desktop slowdowns even after training it to open everything for trusted programs. https://github.com/evilsocket/opensnitch I still recall the old days of Windows when I tried Kerio Personal Firewall and realized how much software already phoned home two decades ago. That was the last wake up call that pushed me into getting…

Keep in mind, OpenSnitch is Linux-based and none of Linux firewalls can filter incoming packets by process ID like macOS/FreeBSD (Lil'Snitch) can.

Re: Microsoft is phoning home the content of PowerPoint slides

#259

Post by Beltalowda »

mixmastamyk wrote: post #244
Beltalowda wrote: post #168

Earlier quoted context omitted.

One possible reason is that the actual data that's being sent is a lot less nefarious than is being implied. I've seen people vehemently argue that merely checking if a new version is available amounts to horrible invasive unethical tracking. You might want to turn that off for the truly paranoid situations, and that's fair, but it's of course completely different than "sends all your data". I don't have a Windows ma…

Many folks are aware MS has been all-in on telemetry for perhaps a decade now. They pioneered activation two decades ago. Explicitly in the TOS. Producing more evidence is left as an exercise at this point. Edit: no more posts allowed for me. Reply below: That’s exactly what telemetry is, today. Grammarly built a whole business on this. Copilot, etc. Refusing to believe that times have changed because you’ve not been…

"Telemetry" is not "sending the contents of your documents" (or at least, not necessarily so). This comment kind of demonstrates my point about the complete lack of nuance in these conversations.

And to reply to your reply:

> That’s exactly what telemetry is

The common understanding of telemetry is sending metadata about how people are using software. That is, things like "this button was clicked", "this feature was used", etc. That is my understanding of the word anyway.

Either way, this is a bit of a boring semantic discussion; my point is just that there is nuance to these things, and that this article doesn't really tell us anything concrete beyond "the network is used". Well, okay ... but for what, exactly? Because that does matter.

Post reply on HN