I think there’s some confusion at play here. That argument is about security, not privacy.
Is the concern that Microsoft is ingesting your data and thus your actions aren’t private? Or is it that Windows is not secure and so you don’t think data stored in Windows systems is safe from third party access? That distinction matters, because in both cases the way it’s framed here isn’t really accurate but for different reasons.
And both arguments are valid. However, when discussing privacy with somebody “who has nothing to hide”, the security concerns argument usually holds more ground.
“Fine, you don’t mind microsoft and their 961 partners to know about your computer usage patterns. But how about the criminals which will have your data as well? You may trust microsoft with your data - “because they have it already” - but do you trust each of these 961 partners? Do you trust all their privacy policies? I have read some. They are horrendus and allow sharing with third parties. Do you trust their privacy and security?”
Well, for one, I have no information regarding MS keeping mandatory telemetry of Windows application usage or data (at least outside their own software suite). As far as I know what is there is opt-in and does not extend to keeping any copies of your computer data, which is the point where you’d be worried about something like your medical records. One of the reasons the Recall nonsense drew so much attention is that it was an unusual instance of something approximating that.
But the other side of your argument is a bit confusing, because it seems to be coming from the angle of… proselytism, I suppose? As in, what is more useful to convince somebody who doesn’t care about the privacy side that they should avoid Windows.
And to be clear, that’s not my goal, or at least not a goal I think is worthwhile in absolute or abstract terms, for its own sake. I’m not an OS activist, use whatever the hell you want and works for you. The closest I have is a distaste for Apple’s pricing and ecosystem-focused tactics but, man, that 600 bucks M4 Mac Mini is nice value, I’ll think about it.
On the merits of the argument, I’m not sure it tracks, either. If someone attacks a legitimate holder of your data the part I care about is how secure their data storage is (because, again, nobody is sharing your medical records over Microsoft telemetry gathering, that’s not a real thing).
I trust a third party’s security setup as far as I can throw it, I don’t care if it’s on Azure, Google, Amazon or a self-hosted Linux server. Hell, I may trust the self-hosted Linux server of a provider least of all of those. Not because of Linux, but because of the self-hosting.
Well, for one, I have no information regarding MS keeping mandatory telemetry of Windows application usage or data (at least outside their own software suite). As far as I know what is there is opt-in and does not extend to keeping any copies of your computer data
I’m not gonna start ranting about their mandatory telemetry, but I do gotta note this is a hell of an issue to ignore (considering the windows telemetry “opt-in” during setup boils down to “want us to take ALL your data, or just whatever we want?”). That aside, Microsoft’s setup process is imo designed to make people think exactly what you’ve written - the telemetry is the invasive part, and (*deep huff of copium*) maybe they won’t steal any of my juiciest data. I honestly think they deliberately made their telemetry prompts a little abrasive, so that anyone who gives half a shit about privacy will focus on that part and see it as the privacy violating aspect of a new windows computer or install.
Meanwhile, as soon as you’re logged in to your new windows OS your user folders have been stored in onedrive by default - so that all your documents, desktop, etc get sent straight to Microsoft. You can migrate all your files from your old pc - dump all those medical and tax records right in your documents, where they get sent straight out to Microsoft’s servers without ANY consent or even awareness from most users. Most windows users I talk to don’t even know anything’s up until they start getting warnings about using up all their onedrive storage, and by that point M$ has all their shit and the damage can’t be undone. Sure, you can move the folders back out of the onedrive path (good luck explaining how to anyone who isn’t tech savvy) and onedrive is “””end to end encrypted””” (which is a joke when M$ has the encryption keys), but the reality is they’ve deliberately made windows trick people into allowing their personal files to be stolen. Dark patterns like these are all throughout the OS, and they’re a big part of why the proselytism you mentioned absolutely is a worthwhile goal for its own sake. Using windows is choosing to engage with a manipulative and untrustworthy entity that’s actively hostile to your privacy, and the worst part is most people don’t even realize it IS a choice. Like most choices, it’s got pros and cons - knowing you have other options doesn’t mean you have to choose them, and if someone wants to keep using windows to play their kernel-level anticheat competitive games or something that’s fair enough. I just think they absolutely need to be aware of what their choice is costing them (and the people around them due to network effects) both for their own risk management and because you can’t truly make a choice without information. “OS activism” is the only hope to actually fix or even salvage this situation, lacking any government willing and able to meaningfully regulate tech companies.
Yes, MS embeds OneDrive into its OS in annoying ways. OneDrive sucks and that sucks.
But that’s not a security issue when you work with a company that uses Windows to handle your sensitive data. If the company you’re working with is using a default Windows image that accidentally stores your sensitive, legally protected records in a default OneDrive that’s not a Windows issue, that’s an issue with giving your medical records to what seems to be an IT department run by somebody’s cousin who knows computers. If they aren’t savvy enough to avoid that issue they’re not savvy enough to keep your data secure in a Linux system either. And, once again, there is definitely no indication that OneDrive is systematically not secure or that data stored in it is being manipulated or accessed by Microsoft for commercial purposes. I mean, it’s widely used professionally, so I imagine if that was the case Microsoft would get sued to hell and back.
Does that mean I like Microsoft’s choice? Nope. I loathe OneDrive. As I kept telling MS in their annoying user surveys when I was forced to use it for work, it is the one piece of software that cost me the most hours of productivity, bar none, and I dropped it like a rock the moment I didn’t have a contractual obligation to use it.
But holy crap, that absolutely isn’t a valid reason why it’d be a security OR privacy problem that a vendor you use is running Windows.
And that’s the thing, you don’t need to equivocate, make up stuff or jumble concepts like this to point out the ways in which Windows’ implementation of things is sub-par. There are plenty of legitimate examples. Granted, may of those examples are definitely not dealbreakers and plenty of Windows users are aware of them and don’t particularly mind. Just like many MacOS users or Linux users don’t mind their own quirks. But the quirks and shortcomings do exist. You don’t need to make them up or be hyperbolic about them.
This just makes you sound paranoid and kind of unreasonable. It makes it easier to dismiss the legitimate arguments because man, a lot of that is clearly not a reasonable argument, so why would you assume some of it is?
To be clear, I’m not talking about the impacts of companies using windows at all - everything I said was meant in the context of an end user environment. Even more specifically, I’m only talking about privacy (never even used the word security) and I was replying only to where you mentioned their telemetry not affecting user data, to point out that they unapologetically steal user data separately from the telemetry. The data may be encrypted, and technically “secure” from other actors, but Microsoft holds the encryption keys so the only thing standing between them and your personal files you might believe are private is “pinkie promise we won’t look”.
Does this mean bill gates is personally browsing any random person’s photos libraries? Obviously not, but the fact that nothing technically prevents M$ from using the encryption keys (that they store for you) to unlock your “secure” data on their servers that you may not even know they’ve taken is absolutely something that anyone in that position should know. That’s putting significant trust in M$ - which again, many people in this position did not do and did not know they were forced to.
Hopefully this clarifies if it seemed like I was mixing up concepts - I’m tired as fuck and probably not as coherent as I’d like to be. Still, I don’t believe I’ve “made up” anything or even been hyperbolic - other than my pet conspiracy theory about their reasoning behind the setup process and telemetry prompt, everything I wrote is imo a verifiable fact and if you disbelieve any part of it I’m happy to provide sources. (Edited to add: later, right now I need sleep lol)
OK, but that’s not what the thread is about. The thread is about the OP arguing that end users shifting away from Windows is not a solution because companies and other users who interact with them are using Windows and that’s a vector that will compromise their data.
Which is not really a thing, as far as I can tell.
Also, no, it’s not “pinkie promise”, their data protection obligations are regulated (differently depending on where you are, but they are) and even in scenarios where you’re solely relying on their terms of service they may be liable if they are negligent about it. I don’t trust MS. I don’t trust any company. I do business with them and if they bone me as a partner or a customer I have whatever recourse my government’s regulations grant me.
I don’t need to be a digital prepper with every single picture of my dog secured by my own hand, personally. And even if I chose to be that guy, as the OP says, it’s a systemic problem. I shouldn’t have to rely on my own tech skills to secure my information, this should be a regulated space where normal people don’t need full end-to-end control to be kept reasonably safe. Yes, even when using Windows, or Android or whatever other service corporations are providing to them.
I disagree with your dismissal of windows’ security implications for companies, but to avoid mixing up concepts I’m focusing only on the end user privacy aspect.
And regulation, while worthwhile and something we should definitely be working on, is still functionally irrelevant in an environment where there’s realistically no way for anyone outside of M$ themselves to detect any violations. The plain facts are that M$ is fully capable of accessing end users’ private data without user consent or awareness (or even awareness that M$ has the data at all, in many cases). With no realistic way for them to be caught doing this, regulations or no this boils down to a matter of trust that they won’t - again, basically a pinkie promise. Sure, if they broke that promise (and you somehow managed to catch them in it) you could sue them, but again this does nothing to change the fact that they are fully capable of accessing the data.
Choosing to use windows and onedrive anyway despite knowing this, like I said before, is a valid choice as long as and only if it’s a choice that you knowingly make for yourself. It’s the wrong choice imo, especially when plenty of other services that do the same thing without the ability to access your shit exist, but as long as people are making that choice for themselves I don’t have a problem with it. Its acting like it’s unreasonable to push people to be aware of these facts and make their own informed choices is unreasonable that I disagree with.
Ah, if privacy was violated and nobody heard it, did it make a noise and all that.
Again, you’re off topic on this one, so this is a bit of a non sequitur to the objections I proposed earlier. I’ll say that I don’t typically assume major illegal behavior unless I have at least a hint that it’s at play, or at least a reason to attempt it. And yes, there are plenty of ways to “catch them” in that companies don’t steal data to bask in the glory of data, they take it to sell or otherwise profit from it.
I feel like the implications of “privacy” have gotten entirely out of proportion or any practical application, to where it’s become less a concern about being profiled or annoyingly targeted for marketing and it’s become more a matter of abstract principle. Not of whether the data is somewhere or being used for something, but about whether it could have been in some parallel reality, where nothing short of making the data physically impossible to access is a valid outcome.
I suppose that’s why every now and then you get a thread along the lines of “can you believe people used to dox themselves and put their name, addresses and phone numbers in a book they sent out for free?” and so on.
It’s a weird conversation to have in these terms, because yeah, no, I agree with you in principle: you should know what data is going to be collected and be able to make an informed decision about it with opt-out as a default. Agreed there. But there’s a magnificent leap from there to “Microsoft is probably secretly accessing your cloud stored data for shits and giggles, and even if they aren’t you wouldn’t know if they did, so they’re probably lying about it”, which is… not a thing, not how this works and would lead to the mother of all fines, immediately followed by the mother of all lawsuits.
You don’t need that scenario to take issue with the choices and policies MS actually deploys. Like, out in the open. They tell you about it. You don’t need the conspiracy theory to have a stance on that. They are not particularly subtle.
Most normal people will sign off all of that if asked nicely and given the lightest of dark patterns on a consent form. Pretty sure Microsoft legal would at least lightly discourage colluding to perform the largest violation of data privacy regulations in human history when a simple settings toggle buried in the privacy section would achieve pretty much the same result. I don’t know what they do at Microsoft, but I assure you with no doubt or ambiguity that the average software company won’t leave the toilet seat up without first asking legal if it’s a GDPR violation.
I think there’s some confusion at play here. That argument is about security, not privacy.
Is the concern that Microsoft is ingesting your data and thus your actions aren’t private? Or is it that Windows is not secure and so you don’t think data stored in Windows systems is safe from third party access? That distinction matters, because in both cases the way it’s framed here isn’t really accurate but for different reasons.
And both arguments are valid. However, when discussing privacy with somebody “who has nothing to hide”, the security concerns argument usually holds more ground.
“Fine, you don’t mind microsoft and their 961 partners to know about your computer usage patterns. But how about the criminals which will have your data as well? You may trust microsoft with your data - “because they have it already” - but do you trust each of these 961 partners? Do you trust all their privacy policies? I have read some. They are horrendus and allow sharing with third parties. Do you trust their privacy and security?”
Well, for one, I have no information regarding MS keeping mandatory telemetry of Windows application usage or data (at least outside their own software suite). As far as I know what is there is opt-in and does not extend to keeping any copies of your computer data, which is the point where you’d be worried about something like your medical records. One of the reasons the Recall nonsense drew so much attention is that it was an unusual instance of something approximating that.
But the other side of your argument is a bit confusing, because it seems to be coming from the angle of… proselytism, I suppose? As in, what is more useful to convince somebody who doesn’t care about the privacy side that they should avoid Windows.
And to be clear, that’s not my goal, or at least not a goal I think is worthwhile in absolute or abstract terms, for its own sake. I’m not an OS activist, use whatever the hell you want and works for you. The closest I have is a distaste for Apple’s pricing and ecosystem-focused tactics but, man, that 600 bucks M4 Mac Mini is nice value, I’ll think about it.
On the merits of the argument, I’m not sure it tracks, either. If someone attacks a legitimate holder of your data the part I care about is how secure their data storage is (because, again, nobody is sharing your medical records over Microsoft telemetry gathering, that’s not a real thing).
I trust a third party’s security setup as far as I can throw it, I don’t care if it’s on Azure, Google, Amazon or a self-hosted Linux server. Hell, I may trust the self-hosted Linux server of a provider least of all of those. Not because of Linux, but because of the self-hosting.
I’m not gonna start ranting about their mandatory telemetry, but I do gotta note this is a hell of an issue to ignore (considering the windows telemetry “opt-in” during setup boils down to “want us to take ALL your data, or just whatever we want?”). That aside, Microsoft’s setup process is imo designed to make people think exactly what you’ve written - the telemetry is the invasive part, and (*deep huff of copium*) maybe they won’t steal any of my juiciest data. I honestly think they deliberately made their telemetry prompts a little abrasive, so that anyone who gives half a shit about privacy will focus on that part and see it as the privacy violating aspect of a new windows computer or install.
Meanwhile, as soon as you’re logged in to your new windows OS your user folders have been stored in onedrive by default - so that all your documents, desktop, etc get sent straight to Microsoft. You can migrate all your files from your old pc - dump all those medical and tax records right in your documents, where they get sent straight out to Microsoft’s servers without ANY consent or even awareness from most users. Most windows users I talk to don’t even know anything’s up until they start getting warnings about using up all their onedrive storage, and by that point M$ has all their shit and the damage can’t be undone. Sure, you can move the folders back out of the onedrive path (good luck explaining how to anyone who isn’t tech savvy) and onedrive is “””end to end encrypted””” (which is a joke when M$ has the encryption keys), but the reality is they’ve deliberately made windows trick people into allowing their personal files to be stolen. Dark patterns like these are all throughout the OS, and they’re a big part of why the proselytism you mentioned absolutely is a worthwhile goal for its own sake. Using windows is choosing to engage with a manipulative and untrustworthy entity that’s actively hostile to your privacy, and the worst part is most people don’t even realize it IS a choice. Like most choices, it’s got pros and cons - knowing you have other options doesn’t mean you have to choose them, and if someone wants to keep using windows to play their kernel-level anticheat competitive games or something that’s fair enough. I just think they absolutely need to be aware of what their choice is costing them (and the people around them due to network effects) both for their own risk management and because you can’t truly make a choice without information. “OS activism” is the only hope to actually fix or even salvage this situation, lacking any government willing and able to meaningfully regulate tech companies.
You keep mixing up concepts, though.
Yes, MS embeds OneDrive into its OS in annoying ways. OneDrive sucks and that sucks.
But that’s not a security issue when you work with a company that uses Windows to handle your sensitive data. If the company you’re working with is using a default Windows image that accidentally stores your sensitive, legally protected records in a default OneDrive that’s not a Windows issue, that’s an issue with giving your medical records to what seems to be an IT department run by somebody’s cousin who knows computers. If they aren’t savvy enough to avoid that issue they’re not savvy enough to keep your data secure in a Linux system either. And, once again, there is definitely no indication that OneDrive is systematically not secure or that data stored in it is being manipulated or accessed by Microsoft for commercial purposes. I mean, it’s widely used professionally, so I imagine if that was the case Microsoft would get sued to hell and back.
Does that mean I like Microsoft’s choice? Nope. I loathe OneDrive. As I kept telling MS in their annoying user surveys when I was forced to use it for work, it is the one piece of software that cost me the most hours of productivity, bar none, and I dropped it like a rock the moment I didn’t have a contractual obligation to use it.
But holy crap, that absolutely isn’t a valid reason why it’d be a security OR privacy problem that a vendor you use is running Windows.
And that’s the thing, you don’t need to equivocate, make up stuff or jumble concepts like this to point out the ways in which Windows’ implementation of things is sub-par. There are plenty of legitimate examples. Granted, may of those examples are definitely not dealbreakers and plenty of Windows users are aware of them and don’t particularly mind. Just like many MacOS users or Linux users don’t mind their own quirks. But the quirks and shortcomings do exist. You don’t need to make them up or be hyperbolic about them.
This just makes you sound paranoid and kind of unreasonable. It makes it easier to dismiss the legitimate arguments because man, a lot of that is clearly not a reasonable argument, so why would you assume some of it is?
To be clear, I’m not talking about the impacts of companies using windows at all - everything I said was meant in the context of an end user environment. Even more specifically, I’m only talking about privacy (never even used the word security) and I was replying only to where you mentioned their telemetry not affecting user data, to point out that they unapologetically steal user data separately from the telemetry. The data may be encrypted, and technically “secure” from other actors, but Microsoft holds the encryption keys so the only thing standing between them and your personal files you might believe are private is “pinkie promise we won’t look”.
Does this mean bill gates is personally browsing any random person’s photos libraries? Obviously not, but the fact that nothing technically prevents M$ from using the encryption keys (that they store for you) to unlock your “secure” data on their servers that you may not even know they’ve taken is absolutely something that anyone in that position should know. That’s putting significant trust in M$ - which again, many people in this position did not do and did not know they were forced to.
Hopefully this clarifies if it seemed like I was mixing up concepts - I’m tired as fuck and probably not as coherent as I’d like to be. Still, I don’t believe I’ve “made up” anything or even been hyperbolic - other than my pet conspiracy theory about their reasoning behind the setup process and telemetry prompt, everything I wrote is imo a verifiable fact and if you disbelieve any part of it I’m happy to provide sources. (Edited to add: later, right now I need sleep lol)
OK, but that’s not what the thread is about. The thread is about the OP arguing that end users shifting away from Windows is not a solution because companies and other users who interact with them are using Windows and that’s a vector that will compromise their data.
Which is not really a thing, as far as I can tell.
Also, no, it’s not “pinkie promise”, their data protection obligations are regulated (differently depending on where you are, but they are) and even in scenarios where you’re solely relying on their terms of service they may be liable if they are negligent about it. I don’t trust MS. I don’t trust any company. I do business with them and if they bone me as a partner or a customer I have whatever recourse my government’s regulations grant me.
I don’t need to be a digital prepper with every single picture of my dog secured by my own hand, personally. And even if I chose to be that guy, as the OP says, it’s a systemic problem. I shouldn’t have to rely on my own tech skills to secure my information, this should be a regulated space where normal people don’t need full end-to-end control to be kept reasonably safe. Yes, even when using Windows, or Android or whatever other service corporations are providing to them.
I disagree with your dismissal of windows’ security implications for companies, but to avoid mixing up concepts I’m focusing only on the end user privacy aspect.
And regulation, while worthwhile and something we should definitely be working on, is still functionally irrelevant in an environment where there’s realistically no way for anyone outside of M$ themselves to detect any violations. The plain facts are that M$ is fully capable of accessing end users’ private data without user consent or awareness (or even awareness that M$ has the data at all, in many cases). With no realistic way for them to be caught doing this, regulations or no this boils down to a matter of trust that they won’t - again, basically a pinkie promise. Sure, if they broke that promise (and you somehow managed to catch them in it) you could sue them, but again this does nothing to change the fact that they are fully capable of accessing the data.
Choosing to use windows and onedrive anyway despite knowing this, like I said before, is a valid choice as long as and only if it’s a choice that you knowingly make for yourself. It’s the wrong choice imo, especially when plenty of other services that do the same thing without the ability to access your shit exist, but as long as people are making that choice for themselves I don’t have a problem with it. Its acting like it’s unreasonable to push people to be aware of these facts and make their own informed choices is unreasonable that I disagree with.
Ah, if privacy was violated and nobody heard it, did it make a noise and all that.
Again, you’re off topic on this one, so this is a bit of a non sequitur to the objections I proposed earlier. I’ll say that I don’t typically assume major illegal behavior unless I have at least a hint that it’s at play, or at least a reason to attempt it. And yes, there are plenty of ways to “catch them” in that companies don’t steal data to bask in the glory of data, they take it to sell or otherwise profit from it.
I feel like the implications of “privacy” have gotten entirely out of proportion or any practical application, to where it’s become less a concern about being profiled or annoyingly targeted for marketing and it’s become more a matter of abstract principle. Not of whether the data is somewhere or being used for something, but about whether it could have been in some parallel reality, where nothing short of making the data physically impossible to access is a valid outcome.
I suppose that’s why every now and then you get a thread along the lines of “can you believe people used to dox themselves and put their name, addresses and phone numbers in a book they sent out for free?” and so on.
It’s a weird conversation to have in these terms, because yeah, no, I agree with you in principle: you should know what data is going to be collected and be able to make an informed decision about it with opt-out as a default. Agreed there. But there’s a magnificent leap from there to “Microsoft is probably secretly accessing your cloud stored data for shits and giggles, and even if they aren’t you wouldn’t know if they did, so they’re probably lying about it”, which is… not a thing, not how this works and would lead to the mother of all fines, immediately followed by the mother of all lawsuits.
You don’t need that scenario to take issue with the choices and policies MS actually deploys. Like, out in the open. They tell you about it. You don’t need the conspiracy theory to have a stance on that. They are not particularly subtle.
Most normal people will sign off all of that if asked nicely and given the lightest of dark patterns on a consent form. Pretty sure Microsoft legal would at least lightly discourage colluding to perform the largest violation of data privacy regulations in human history when a simple settings toggle buried in the privacy section would achieve pretty much the same result. I don’t know what they do at Microsoft, but I assure you with no doubt or ambiguity that the average software company won’t leave the toilet seat up without first asking legal if it’s a GDPR violation.
Still off topic for the thread, though.