Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Microsoft: Require user consent before sending any telemetry

github.com

Post reply on HN
Print view View original

111–120 of 129 posts

Re: Microsoft: Require user consent before sending any telemetry

#111

Post by not_your_vase »

barrysteve wrote: post #90
blueboo wrote: post #76

Earlier quoted context omitted.

The current system highly incentivises sufficiently large corporations to embrace the Nike principles: Break the rules, fight the law The worst case scenario, if you lose a game stacked in your favour several times in a row, you pay a pittance, or performatively correct a now-obsolete injustice. VScode telemetry will remain opt out because it yields very valuable information. Microsoft is not a democracy, and the out…

The current system highly incentivizes pretending not to know. Obtaining power at any cost requires the internal director to pretend he doesn't know, what he's doing. The vast majority of social capital is made by lying to people, pretending to not know you've done it and dropping relationships with anybody who is not pulling in your direction. Silence is vastly underrated, I say ironically, so I shouldn't be typing…

Oh, I find this note quite interesting. I noticed that every time when a BigCo's shenanigans come to light, many people are ready to scream Hanlon's razor!one111!! - and BigCo is very happy to accept this reasoning every single time. It's like they are prepared in advance to use it as a defense, in case their doings come to light. Even if the same thing keeps repeating again and again and again and...

Re: Microsoft: Require user consent before sending any telemetry

#113

Post by jeroenhd »

alkonaut wrote: post #36
jeroenhd wrote: post #11

Earlier quoted context omitted.

Among the telemetry data: > MacAddressHash - Used to identify a user of VS Code. This is hashed once on the client side and then hashed again on the pipeline side to make it impossible to identify a given user. On VS Code for the Web, a UUID is generated for this case. A hash of a hash is about as expansive as a hash and it still uniquely identifies a machine, tying telemetry events to a specific user's machine. Micr…

Unless there is any PII associated with the pseudonym, there is nothing specifically in GDPR that says you can’t or shouldn’t do this so long as it’s not information that can identify a physical person. Note that being able to attribute multiple pieces of data to the same anonymous person does not necessarily identify them (and it’s important to not accidentally do so): It’s important though if you e.g have multiple…

The hash used, at least when Iooked into it last, was a plain sha256 hash, no salt or pepper. That's a unique identifier.

I think the massive amounts of behaviour analysis Microsoft does should be considered PII. They know when you turn in visual studio in the morning, and when you leave. They know when you go to lunch and don't click any buttons for a while, and they can see the colleagues with you in that boring meeting also not clicking any buttons at the same time. This type of behaviour analysis over time can associate you and the people you interact with, even if it's not directly tied to a reversible hardware ID.

This is why pseudonymisation isn't anonymisation, and why pseudonymisation isn't sufficient to comply with laws liker he GDPR.

If the behaviour analysis was done without identifiers at all, you could say they're just counting button clicks, but they intentionally associate this data with your stable personal identifier for analysis over time.

MAC addresses aren't that big of a collision space either, any consumer GPU can generate a list of all hardware MAC addresses in use in a reasonable amount of time. MAC addresses may theoretically be 2^48 in size, but most of the space hasn't been assigned to vendors yet. It takes about 12 minutes to reverse any given MAC address when you rent a single cloud GPU. The double hashing should take about twice that time.

The weird thing is that Microsoft intentionally chose to use a MAC address rather than a UUID like they use on their web version. If this was just a unique user token, they wouldn't need to use any hardware identifiers at all.

Re: Microsoft: Require user consent before sending any telemetry

#114

Post by smarx007 »

blackoil wrote: post #37
smarx007 wrote: post #27

Earlier quoted context omitted.

G.D.P.R., it says so in the thread. And Europe is not a litigious environment, we start with complaints first.

The complaint should come from some authority or a legal backing. The poster assumes that they are breaking GDPR and seeking explanation with some shit talk to make it sound legalese. Companies as a policy and by logic don't reply to such comments/post because the response becomes a legal document. So any expectation of answer is futile.

Articles 16 to 21 provide you, the end user, a range of grounds for a complaint: https://gdpr-info.eu/chapter-3/

Article 12 requires a response in one month. However, you shall not post comments on a repo issue to get a response but write to a DPO instead: https://learn.microsoft.com/en-us/compliance/regulatory/gdpr...

Read more on your GDPR rights and how to exercise them: https://noyb.eu/en/exercise-your-rights

Re: Microsoft: Require user consent before sending any telemetry

#115

Post by smarx007 »

alkonaut wrote: post #41
smarx007 wrote: post #27

Earlier quoted context omitted.

G.D.P.R., it says so in the thread. And Europe is not a litigious environment, we start with complaints first.

There is a suggestion that some data sent is in violation with the GDPR. There is no specifics about what it would be that is in violation however. I think 90% of sites with cookie banners are blatantly violating the GDPR - but whether I'm correct in that assessment is anyones guess. It would depend on court processes that hasn't happened yet. It's based on my understanding and interpretation of the regulation, nothi…

Yup, there are lots of violations: https://noyb.eu/en

And I do think Microsoft has good lawyers and believe they reviewed any activity prior to receiving consent quite carefully.

Re: Microsoft: Require user consent before sending any telemetry

#116

Post by smarx007 »

alkonaut wrote: post #43
mjburgess wrote: post #19

Earlier quoted context omitted.

I suspect they are dating it to trigger some terms of the GDPR, eg., reasonable response lengths when notified of infraction

That opens another question: which means of communication would count for that? Does commenting on a GitHub issue really count? Wouldn't you have some sort of contact details specifically for that in a license agreement or similar?

Of course not. You have to go through a Data Protection Officer (DPO): https://learn.microsoft.com/en-us/compliance/regulatory/gdpr...

Re: Microsoft: Require user consent before sending any telemetry

#117

Post by smarx007 »

bogantech wrote: post #65
falqun wrote: post #63

Earlier quoted context omitted.

Well, we are talking about GDPR. Setting a date to comply by is part of the enforcement of the GDPR afaik. I bet someone is setting points of a legal case, e.g. MS can say "oh no one explicitly stated a set date and GDPR" - now they cant use that excuse.

I don't see anything here[1] that mentions that made up karen legalese is any part of the process [1] https://commission.europa.eu/law/law-topic/data-protection/r...

I always mention in my GDPR requests/complaints that I would kindly like to get a response within a month, in line with Art. 12 GDPR. Not because it's a "karen legalese" but to let the company know that I am exercising a specific right, not just asking for something random out of the blue.

Re: Microsoft: Require user consent before sending any telemetry

#118

Post by mappu »

cowl wrote: post #38
mappu wrote: post #30

Earlier quoted context omitted.

With that argument - would it hypothetically be legal for anonymised telemetry to be submitted over Tor?

no, the IP should not be exposed to any third party not only to the final destination. Tor would hide the IP from the final destination but still expose it to the first relaying party.

The first relaying party would see the IP address, but none of the telemetry data. I think it's only the combination of the two that is legally a problem,

Re: Microsoft: Require user consent before sending any telemetry

#119

Post by iudqnolq »

cowl wrote: post #50
sirius87 wrote: post #39

Earlier quoted context omitted.

Question is whether Google Fonts CDN/server was storing the IP address or not. Linking to a user is secondary. If a server does not log or store raw IPs in the first place, where's the fault?

My man you are arguing with an established case verdict. https://rewis.io/urteile/urteil/lhm-20-01-2022-3-o-1749320/ The wording that is irrelevant what Google does with the IP (just the theoretical possibility of misuse is enough) is in the case verdict.

Per Wikipedia Germany's legal system doesn't have the concept of binding precedent. (And even if it did in no country is the decision of a trial court binding precedent).

Re: Microsoft: Require user consent before sending any telemetry

#120

Post by weikju »

charcircuit wrote: post #103
weikju wrote: post #84

Earlier quoted context omitted.

Disingenous take IMO > If a user asks for the software to nag people and then the developers make the software start nagging proper then it is the fault of the user for suggesting that behaviour be implemented. People are not asking for software to nag. They're asking for the software to NOT send telemetry at all unless the user agrees to it. As it stands now, vscode sends out telemetry before the user has a chance t…

>People are not asking for software to nag. This issue literally is and describes what the popup should include. >hostile behavior Telemetry is not hostile. It is a standard feature for understanding how a product operations or is being used.

> This issue literally is and describes what the popup should include. > Telemetry is not hostile. It is a standard feature for understanding how a product operations or is being used.

Except there already is a welcome screen that gives a "choice" (between quotes) about sending telemetry or not, if I remember correctly.

This however does not prevent sending telemetry. In fact, telemetry is sent to MS before the user has a choice about sending telemetry.

So whether you agree that telemetry is useful for understanding a product and so on (a whole separate discussion), the fact that the user does not have a real choice IS user hostile.

The user should have a real choice here.

Post reply on HN