Earlier quoted context omitted.
That is why "firejail" exists.
The attack surface of firejail itself scares me enough to never use it.
Care to elaborate?
Microsoft to delay release of Recall AI feature on security concerns
481–485 of 485 posts
Re: Microsoft to delay release of Recall AI feature on security concerns
#482Earlier quoted context omitted.
>then everyone would love it. I do not think this is at all true. Recall as implemented is an absolutely security and privacy nightmare, and would absolutely become a tool of oppression for abusers. MS deserved to reap the whirlwind here, as would any firm that offered the same sort of feature.
> as would any firm that offered the same sort of feature. I’m reminded of the backlash to Apple’s plan to have on-device scanning for CSAM in (I think) 2021. It blew up badly for them.
Exactly. Backlash rightly ensued, and Apple backed off.
Re: Microsoft to delay release of Recall AI feature on security concerns
#483Earlier quoted context omitted.
This is disgusting. I did not know that Microsoft offers these tools to organizations. I'm honestly shocked that this exists. They'll 100% abuse preview to offer similar features in the future. Over the last years/decade, they worked hard to improve their image in the tech community, and I have to admit, it worked, at least for me. They've just lost all the respect I had for them.
I can't believe I'm saying this, but in Microsoft's defense , those controls are aimed at companies working in regulated industries. They're meant to help those companies prove they they're meeting their legal and/or contractual compliance obligations. For example, if your company works with healthcare information and is a HIPAA "covered entity", your customers will demand to see proof that you're using data loss pre…
Don’t get me wrong, I understand that some industries require this level of action logging. However, does Microsoft check whether a company actually needs this type of logging? I didn’t read all of the documentation, just the sections that were posted, but I didn’t see anything about Microsoft verifying if the companies using these tools are vetted.
Re: Microsoft to delay release of Recall AI feature on security concerns
#484Earlier quoted context omitted.
It's exactly this. Development of a feature like this surely started during the WFH craze, where managers could no longer casually walk behind people who had to have their monitors facing outwards. A market opened up, and this is not the only tool for this sort of corporate surveillance. Certain Software Engineers will probably get some time without it by claiming they need Admin rights and that the system messes up…
Why do you think Recall was designed for this? This seems like a far-fetched assumption to make.
I agree. I believe this project was started in totally good faith. I think one of the managers is on HN here?
I actually want this feature. My memory is awful and I am constantly going to Chrome's History function.
This feature isn't bad, I just want it encrypted locally with no telemetry, which sadly I realize most tech companies love spamming their products these days.
In my times at the MS mothership I never met any managers or developers that were malicious or had bad intent. Sometimes they were overly profit-motivated, but the conversations were always "How much can we price this feature at?" not "How can I make a really evil feature that I can sell?"
Re: Microsoft to delay release of Recall AI feature on security concerns
#485Earlier quoted context omitted.
I work on dev tools at my company. Telemetry really helps a ton to figure out if you're prioritizing the right things and if changes that you made are really for the better
Opt-in, or opt-out?
For the company there’s no opt-anything, its internal tools, of course we need metrics, and presumably you have nothing to hide with your work :)
I’ve become a lot more tolerant of telemetry since starting to work there, because I see the use. If you really care about privacy (as a company/provider), you can anonymize and aggregate the data and still get nearly all the benefits, but I can totally understand why people put telemetry into their product, including opt-out only