Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft to delay release of Recall AI feature on security concerns

reuters.com

Post reply on HN
Print view View original

401–410 of 485 posts

Re: Microsoft to delay release of Recall AI feature on security concerns

#401

Post by bitwize »

simonw wrote: post #90
segasaturn wrote: post #65

Earlier quoted context omitted.

My takeaway is that Microsoft has been trying to boil the frog, but slipped and turned the temperature up too quickly. They're retreating for now, but make no mistake that Recall will slowly trickle back into Windows under another name. Every major power broker wants something like Recall to become the norm - bosses to spy on their employees, governments to spy on their citizens/enemies, and tech CEO's to collect tra…

This is a very cynical take. I've not seen anything to make me think this feature is intended for surveillance as opposed to personal utility. The personal utility benefits are very clear to me - the problem is the ease with which malicious attackers might steal the data (if they can breach the system).

Microsoft is already selling analytics on Microsoft Office employee usage statistics to companies with Office site licenses. Selling analytics based on data gathered from Recall is a very short hop from what they are already doing.

Re: Microsoft to delay release of Recall AI feature on security concerns

#402

Post by k8svet »

HaZeust wrote: post #293
k8svet wrote: post #170

Earlier quoted context omitted.

Give me a break. Its the kernel, drm, mesa, and proton. The distro haw scant all to do with it except a bunch of newbies loudly claiming "new distro" is the best because it includes one single extra package pre-installed or something. I will never stop being annoyed at conversations around distros. Ever.

The conversation started, to which I contributed to, was about what's easiest out of the box for casual users. What are you on about?

"how many clicks does it take to install Nvidia or steam" is not a good measure of a distro. I will stand by that statement strongly, I think. Let imagine a totally-not-real distro that definitely isn't pushed on noobs constantly. Let's imagine that include that said distro has, multiple times, let their SSL cert expire and at least once recommended users roll back their clock. Is that a "good distro" for noobs because it slips the Nvidia package in?

Fuck. No.

I'm sorry but if the way we handle accessibility of Linux to non-Lijux-aware folks is to just push them to the latest flavor that has the most shit crammed in, well, I'm not sure what we expect the outcome to be.

Re: Microsoft to delay release of Recall AI feature on security concerns

#403

Post by Sophira »

jjcm wrote: post #363
plopilop wrote: post #249

Earlier quoted context omitted.

How is this objectively a great feature? This is a spyware that stores screenshots unencrypted (and thus accessible to any other spyware). I am also not convinced that the AI tools would have been offline, thus effectively sharing your whole data with Microsoft (even more than before). From a privacy perspective, this feature is an abomination

I'd caution us to separate out the feature from the implementation. The feature provides the ability to search through all of the previous things you've done and gain context in an instant, in a way that can be queried with natural language. I think we can agree what it aims to achieve is beneficial. The implementation is what you're debating. I see these are two separate things, but they play hand in hand. If you ge…

> This page[1] states "Snapshots are encrypted by Device Encryption or BitLocker".

That sounds like it just means it's encrypted at rest - ie. while you're logged out - but transparently decrypted in much the same way as everything else on the system while you're logged in. That is to say, any running malware would have just as much access as it would do on a system that doesn't use encryption.

From a functional point of view, it can be treated as being equivalent to being unencrypted, with the exception being when you aren't logged in - at which point you're not running any programs anyway.

Re: Microsoft to delay release of Recall AI feature on security concerns

#404

Post by clhodapp »

freeone3000 wrote: post #395
clhodapp wrote: post #214

Earlier quoted context omitted.

For a mobile device, such as a laptop, lots of people other than the device owner will have physical access. The useful use-case of a TPM to me is the ability to encrypt my disk without having to type a decryption password each time I use it.

It does require someone to steal the entire laptop rather than just the hard drive, but… I don’t think that this was an actual worry, and the security result of encrypting to a device with the key stored in the same device is much like not encrypting.

It also makes it a lot harder to bypass the login screen, even if someone takes the whole laptop.

In case you weren't aware, the ability to do a passwordless unseal can be tied to not tampering with the bootchain. It's not entirely bulletproof, but it's beyond the abilities of most thieves to bypass this (versus just popping the drive in another machine).

Re: Microsoft to delay release of Recall AI feature on security concerns

#405

Post by k8svet »

creata wrote: post #175
k8svet wrote: post #170

Earlier quoted context omitted.

Give me a break. Its the kernel, drm, mesa, and proton. The distro haw scant all to do with it except a bunch of newbies loudly claiming "new distro" is the best because it includes one single extra package pre-installed or something. I will never stop being annoyed at conversations around distros. Ever.

I get what you're saying, and I don't know much about "ZorinOS", but the discussion is about people who might struggle to install Linux at all, so having the right packages preinstalled is important.

Okay. Now they have a distro from someone that doesn't care to respect licensing terms. And an end user who apparently can't be trained to click a few times in an app store...

Yeah, let's imagine how they react to their entire system being broken and some rumblings of "well maybe if you change time". Yeah, sure, okay, I'm sure a user that can't install a package will be able to handle that. /s

Maybe it's simply because I AM a distro maintainer, that I just roll my eyes at all of this. What's pre-installed is so trivial it's almost nothing to me when I think about why I chose my distro. How fast can they react to security reports? Are they abreast of developments in the Linux ecosystem and adjusting and experimenting with defaults? Really truly? Because even in (my distro) where I can tell you the names of owners of specific areas, there's still some gaps we could cover better.

The curse of knowing too much. Or maybe my empathy meter is way off tonight. Idk.

Re: Microsoft to delay release of Recall AI feature on security concerns

#406

Post by Everdred2dx »

jjcm wrote: post #363
plopilop wrote: post #249

Earlier quoted context omitted.

How is this objectively a great feature? This is a spyware that stores screenshots unencrypted (and thus accessible to any other spyware). I am also not convinced that the AI tools would have been offline, thus effectively sharing your whole data with Microsoft (even more than before). From a privacy perspective, this feature is an abomination

I'd caution us to separate out the feature from the implementation. The feature provides the ability to search through all of the previous things you've done and gain context in an instant, in a way that can be queried with natural language. I think we can agree what it aims to achieve is beneficial. The implementation is what you're debating. I see these are two separate things, but they play hand in hand. If you ge…

While the claim that Bitlocker is used to encrypt them is true, it’s really not good enough here. The files are unencrypted during a live session, which makes them an easy target for malware.

Re: Microsoft to delay release of Recall AI feature on security concerns

#407

Post by bitwize »

devjab wrote: post #344
simonw wrote: post #90

Earlier quoted context omitted.

This is a very cynical take. I've not seen anything to make me think this feature is intended for surveillance as opposed to personal utility. The personal utility benefits are very clear to me - the problem is the ease with which malicious attackers might steal the data (if they can breach the system).

I think you’re a little naive if you don’t think this will become handy tools for management. We view its potential as two-fold from a strictly non-employee-friendly side. The monitoring abilities will be better than what is currently available. But it’s not really something a lot of organisations is going to be too interested in. Everyone already knows you’re spending a few hours each week doing internet things, may…

> This would help you gather information on poor performers and maybe help them get better.

Poor performers can get better on their own time, after they've been separated from the company. PIPs are a formality to provide documentation that ensures wrongful-termination lawsuits don't stick.

Re: Microsoft to delay release of Recall AI feature on security concerns

#408

Post by k8svet »

kergonath wrote: post #298
HaZeust wrote: post #165

Earlier quoted context omitted.

ZorinOS is catching up FAST and QUICK with out-of-the-box gaming support, many thanks to Valve's bankroll into the problem with Proton (primarily) and Wine (secondarily) for the Steam Deck. I look forward to see where developments can go from here, but Zorin is pretty good for a solid amount of games... Maybe not most.

> ZorinOS is catching up FAST and QUICK This is a perfect example of a frustrating problem with Linux on the desktop. There is always a perfect distro that my aunt can just use and that never breaks. The problem is that once it was Mandrake, then Ubuntu, then Manjaro, then Pop_OS!, and many others. Most of them fade into obscurity after a couple of years, to be replaced by $shiny_distro that this time will be perfect…

I can't decide a tone for this comment. But comments like yours make me want to go make a new "distro" that is just triggered when nixos updates and publishes an iso with Nvidia pre-installed. Lol maybe even do it for every major distribution. Nvubuntu, fedoria, etc. And then we can be done with this? Idk.

Like you, I find the "hopping" nature of Linux enthusiasts to be exhausting. it's almost always nearly the same fucking bits at the end of the day. Great, you know how to use the package manager? Everything you like about NewShinyDistro's defaults can probably be hadon the distro you're on already.

Christ maybe the better approach is my other idea - customnixos.org. You always get nixos, but you get to pre-pick the desktop environment, theme, background, etc, and then it slips you an iso with those options set.

Re: Microsoft to delay release of Recall AI feature on security concerns

#409

Post by Rinzler89 »

yakz wrote: post #72
Rinzler89 wrote: post #61

What a dumb feature. They had to get all that backlash to understand why everyone wouldn't want it. Is someone at Microsoft taking crazy pills to think consumers would be into that? They pulled the exact same shit 11 years ago when they launched the Xbox One as a "home media center" instead of a gaming console and it came with mandatory always-on internet connection, disc games DRM tied to a single console unable to…

Adobe just forced through a EULA update (for creative software tools) that was at least somewhat widely interpreted as practically granting Adobe ownership of the work product of their users and their stock is (/checks notes) up 14% today.

Wallstreet rewards rent seeking.

Re: Microsoft to delay release of Recall AI feature on security concerns

#410

Post by kergonath »

k8svet wrote: post #408
kergonath wrote: post #298

Earlier quoted context omitted.

> ZorinOS is catching up FAST and QUICK This is a perfect example of a frustrating problem with Linux on the desktop. There is always a perfect distro that my aunt can just use and that never breaks. The problem is that once it was Mandrake, then Ubuntu, then Manjaro, then Pop_OS!, and many others. Most of them fade into obscurity after a couple of years, to be replaced by $shiny_distro that this time will be perfect…

I can't decide a tone for this comment. But comments like yours make me want to go make a new "distro" that is just triggered when nixos updates and publishes an iso with Nvidia pre-installed. Lol maybe even do it for every major distribution. Nvubuntu, fedoria, etc. And then we can be done with this? Idk. Like you, I find the "hopping" nature of Linux enthusiasts to be exhausting. it's almost always nearly the same…

> I can't decide a tone for this comment.

Frustration, mostly. I really like Linux and I think it should be more accessible, but the community keep shooting themselves in their metaphorical feet.

> Lol maybe even do it for every major distribution. Nvubuntu, fedoria, etc. And then we can be done with this? Idk.

That would help. NVidia drivers are a major pain point even for more experienced users, and yet are critical for something that can be used for gaming.

> Great, you know how to use the package manager? Everything you like about NewShinyDistro's defaults can probably be hadon the distro you're on already.

I know that, and I am very happy with Tumbleweed, but that’s not really something we can say to the general public.

> Christ maybe the better approach is my other idea - customnixos.org. You always get nixos, but you get to pre-pick the desktop environment, theme, background, etc, and then it slips you an iso with those options set.

A huge part would still be missing: the integration of all these pieces and setup so that they look like something that works and not a Rube Goldberg OS. Something that at least Ubuntu is doing, for all their faults.

Look at game controllers for example. That’s another major pain point for gaming on Linux. You can use all of them (the various generations of xBox and PlayStation gamepads that work over Bluetooth, not sure about the Switch ones) with quite a bit of fiddling. OTOH, on a Mac, iPhone or iPad you just pair them and they work, and can then be used with whatever game you want. No fiddling with the package manager, no config file wrangling. This integration work is important for an OS we want everyone to use.

Post reply on HN