Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft: Require user consent before sending any telemetry

github.com

Post reply on HN
Print view View original

11–20 of 129 posts

Re: Microsoft: Require user consent before sending any telemetry

#11

Post by jeroenhd »

fhub wrote: post #6

Truly anonymous data is not subject to the GDPR. So the question is whether the data they are collecting is truly anonymous. They seem to be claiming or suggesting "Yes it is" https://code.visualstudio.com/docs/getstarted/telemetry#_gdp... .

Among the telemetry data:

> MacAddressHash - Used to identify a user of VS Code. This is hashed once on the client side and then hashed again on the pipeline side to make it impossible to identify a given user. On VS Code for the Web, a UUID is generated for this case.

A hash of a hash is about as expansive as a hash and it still uniquely identifies a machine, tying telemetry events to a specific user's machine. Microsoft's own telemetry description generator calls the field "EndUserPseudonymizedInformation". Pseudonymisation is inherently not anonymisation.

This bullshit is why I keep my PiHole on for my dev environment.

Re: Microsoft: Require user consent before sending any telemetry

#12

Post by chx »

jiggawatts wrote: post #3

No answer is forthcoming from the VS Code team, because they know you won't like the answer. Microsoft trawls their[1] endpoints mercilessly for every bit of telemetry that they possibly can, and they go out of their way to prevent customers from disabling this. Windows 10 or 11 with Office requires something like 200+ individual forms of Microsoft telemetry to be disabled! Notably: - They keep changing the name of t…

this is why o&o shutup is invaluable

Re: Microsoft: Require user consent before sending any telemetry

#13

Post by alkonaut »

jiggawatts wrote: post #3

No answer is forthcoming from the VS Code team, because they know you won't like the answer. Microsoft trawls their[1] endpoints mercilessly for every bit of telemetry that they possibly can, and they go out of their way to prevent customers from disabling this. Windows 10 or 11 with Office requires something like 200+ individual forms of Microsoft telemetry to be disabled! Notably: - They keep changing the name of t…

Microsoft’s own telemetry solutions (AppInsights/LogAnalytics) seem perfectly capable of handing async/buffering/backoff etc.

I agree there should be a single place, at least in Windows to control Microsoft telemetry on a per app basis. It should be very easy to accomplish. On other platforms less so.

In a desktop product I do for work we had the dilemma of opt in/out and showing the query clearly and hiding it in settings. We ended up with the middle ground of showing it but having the checkbox checked (so uncheck to opt out). We were still worried this would leave too few opting in but it meant over 95% did.

For command line I’d be 100% happy with a note on first use describing that telemetry is enabled and how it is disabled. Leaving it disabled by default and requiring user action to enable is not realistic in such a situation.

Re: Microsoft: Require user consent before sending any telemetry

#14

Post by rkagerer »

chx wrote: post #12
jiggawatts wrote: post #3

No answer is forthcoming from the VS Code team, because they know you won't like the answer. Microsoft trawls their[1] endpoints mercilessly for every bit of telemetry that they possibly can, and they go out of their way to prevent customers from disabling this. Windows 10 or 11 with Office requires something like 200+ individual forms of Microsoft telemetry to be disabled! Notably: - They keep changing the name of t…

this is why o&o shutup is invaluable

Is it fairly effective these days?

Re: Microsoft: Require user consent before sending any telemetry

#15

Post by osigurdson »

A user should be able to configure a program (or all programs) such that outgoing communication is not possible, logged or both. It really shouldn't be up to the program to decide what it wants to send as it could easily scan the entire hard drive on the users behalf.

Re: Microsoft: Require user consent before sending any telemetry

#16

Post by rkagerer »

jiggawatts wrote: post #3

No answer is forthcoming from the VS Code team, because they know you won't like the answer. Microsoft trawls their[1] endpoints mercilessly for every bit of telemetry that they possibly can, and they go out of their way to prevent customers from disabling this. Windows 10 or 11 with Office requires something like 200+ individual forms of Microsoft telemetry to be disabled! Notably: - They keep changing the name of t…

We need a "just say no" campaign that boycotts companies employing these slimy behaviours.

Re: Microsoft: Require user consent before sending any telemetry

#17

Post by fsckboy »

fhub wrote: post #6

Truly anonymous data is not subject to the GDPR. So the question is whether the data they are collecting is truly anonymous. They seem to be claiming or suggesting "Yes it is" https://code.visualstudio.com/docs/getstarted/telemetry#_gdp... .

what's the definition of truly anonymous? they don't know your name? or there isn't enough data to identify you? I've heard that in the US, birthday and postal zip code is enough to identify you in most of the country, but that could be considered anonymous.

if data of multiple users is aggregated, that is I think more of what people are thinking when they think "anonymous"

Re: Microsoft: Require user consent before sending any telemetry

#18

Post by gettodachoppa »

bogantech wrote: post #4

To be fair if someone comments to me with things like: > Please give an answer within the next week until the 16th of June. I wouldn't respond to them either out of spite

The requested deadline is likely done ahead of filing a complaint in Europe, to show they gave ample warning.

Also remember he's not talking to a human, but to a soulless corporation. He was as cordial as could be given the circumstances.

And finally, remember that it doesn't matter if a product Microsoft develops to increase their control over developers (via vendor lock-in, mindshare, and forced telemetry) happens to result in a decent free text editor for the user. No one owes them gratitude. This isn't charity.

P.S. Did you know VSCode lets extensions not respect the user's "no telemetry" choice? It's been an open ticket for like 4 years now, that MS have no intention to ever fix, even though all it would take is a simple VSCode Extension Store EULA change.

Re: Microsoft: Require user consent before sending any telemetry

#19

Post by mjburgess »

bogantech wrote: post #4

To be fair if someone comments to me with things like: > Please give an answer within the next week until the 16th of June. I wouldn't respond to them either out of spite

I suspect they are dating it to trigger some terms of the GDPR, eg., reasonable response lengths when notified of infraction

Re: Microsoft: Require user consent before sending any telemetry

#20

Post by cowl »

fhub wrote: post #6

Truly anonymous data is not subject to the GDPR. So the question is whether the data they are collecting is truly anonymous. They seem to be claiming or suggesting "Yes it is" https://code.visualstudio.com/docs/getstarted/telemetry#_gdp... .

There is no such thing as truly anonymous. in order to send any data you need to connect to a server. at that moment you are in violatation of GDPR because you are exposing the users's IP which is protected by GDPR. See the case where even linking to a CDN requires GDPR consent. https://www.cpomagazine.com/data-protection/leak-of-ip-addre...

And before the army of those who don't understand GDPR comes up with "but then the whole internet can not work"; the crucial distinction comes in the answer to the question: "can this tool fulfill its purpose without this connection? if no, then it's essential to it's functioning and does not require consent, if the tool can fullfll it's purpose without this conection it's optional and does require consent.

GDPR makes a disticntion for connection that are required to fullfill the purpose of the tool and connections that are not essential. So VS code connection to a microsoft Server to let's say update download an extension is allowed and does not require consent becasue without that connection VSCode cannot fullfil its purpose of providing functionality.

Telemetry is not functionaliy and VSCode can execute it's purpose without this connection so that makes it subject to user consent requirement.

Post reply on HN