Welcome to Incremental Social! Learn more about this project here!
Check out lemmyverse to find more communities to join from here!

doublepulsar.com

DirkMcCallahan , to Technology in Stealing everything you’ve ever typed or viewed on your own Windows PC is now possible with two lines of code — inside the Copilot+ Recall disaster.

The full article is well worth reading. It's good to find a lucid, logical deconstruction of why, precisely, this will be a complete disaster.

TexMexBazooka , to Technology in Stealing everything you’ve ever typed or viewed on your own Windows PC is now possible with two lines of code — inside the Copilot+ Recall disaster.

Nah…. Just… just nah. This will never fly in enterprise environments

dustyData ,

Not just enterprise. Some organizations handle extremely sensitive information of victims of crimes, survivors of wars, potential political targets, just to name a few. A feature taking a screenshot and registering all of that data is a nonstarter. MS will have to prove that the feature doesn't run with certain gov clients, the privacy risk is way too high.

deweydecibel , (edited )

On the other end of the spectrum, the vast majority of home users have no idea how to disable this or that it's even activated. There will be folders of Recall shit filling up everywhere, waiting for someone who knows it's there to access it.

If any of them access their work data on the Microsoft 365 web apps, it's now sitting in that folder, and they will not know.

This is honestly the biggest evidence yet of a need for some sort of regulation that certain privacy related things should not be allowed to be activated by default. They should always be opt-in, period.

BearOfaTime ,

It won't.

All the crap from MS only affects ignorant home users. (I say that with no criticism - home users often lack significant expertise in this stuff).

Corporate has an IT team dedicated to image building, based on requirements gathering, which is well documented and well tested before it's deployed to even a small test group (usually us fellow IT geeks get to be Guinea pigs first).

Once it's been certified, then they'll deploy to a second, larger group, test and verify.

Wash, rinse, repeat.

Plus they'll probably start with new hires and anyone with a machine that is falling off lease/aging out. This gives them a little room, in that new hires don't have any local data (no one should have much in the first place), and people with aging machines can hold onto the old machine for a couple weeks as a fallback, just in case.

I've seen it several times, been part of deployment and upgrade teams.

Additionally, they deploy policies to redirect any MS network services to their own internally hosted services - windows is designed to do this, there are specific policies for everything, such us Windows Update services, even the MS App Store. Because no company wants machines pulling random crap from outside the company (they probably even block the access at the network level - I would).

TexMexBazooka ,

Everything you’re describing is how it should be done. Realistically it isn’t done properly, all the time, and that’s why breaches happen.

jordanlund , (edited )
@jordanlund@lemmy.world avatar

Enterprise will love it because it will allow them timestamped access to everything their employees are doing during the day.

They will have it set up to alert on a various things...

"So, Bob, you were playing Minesweeper from 9:45 to 9:53, was that a scheduled break for you?"

"Jane, your screen showed no substantive changes from 1:03 to 4:15, you weren't in a meeting, what were you doing?"

Someonelol ,
@Someonelol@lemmy.dbzer0.com avatar

The surveillance would be a double edged sword. If they were to be hacked, all sensitive information that was going through their PCs could be compromised.

jordanlund ,
@jordanlund@lemmy.world avatar

They will convince themselves it can't be compromised. Never under-estimate the stupidity of middle management.

FlyingSquid ,
@FlyingSquid@lemmy.world avatar

And no one was able to stop the White Star Line executives by saying, "maybe you shouldn't be 100% sure the Titanic is unsinkable?"

capital ,

Just like telemetry, this can be disabled on enterprise version of their OS.

ripcord ,
@ripcord@lemmy.world avatar

This will fly for corporations wanting to use it themselves against their employees.

pyrflie , (edited )

It already exists in the corporate environment. Teams is a keystroke logger, it stores everything you do down to the microsecond in a plain txt on the C drive. This just expands that to everyone that uses Windows.

Windows is spyware now.

simple , to Technology in Stealing everything you’ve ever typed or viewed on your own Windows PC is now possible with two lines of code — inside the Copilot+ Recall disaster.
@simple@lemm.ee avatar

They OCR the entire screen and store it in plaintext?! There is no way... I know it's Microsoft we're talking about, but are they really this stupid?

WhatAmLemmy ,

They're a surveillance capitalism corp first and foremost. All other considerations, including security, are secondary.

tal , (edited )
@tal@lemmy.today avatar

It's encrypted; the author is pointing out that it has to be decrypted to be used, and then the data can be obtained.

Security and privacy concerns aside, I saw someone commenting on the use case, asking who would ever want something like this.

One problem I hadn't appreciated for a long time was that some people apparently have real problems with dealing with the Windows UI in terms of file access. They don't know where their data is being saved. This, in my opinion, is in significant part a Microsoft UI problem induced by various virtual interfaces being slapped on top of the filesystem ("Desktop", "My Documents", application save directories, etc) to try to patch over the issue that the filesystem layout was kinda organically-designed in a kind of cryptic way back in the day.

But if you can remember a snippet of text in what you were working on, you can find that thing again even if you have no idea where you stored it. Like, it's content-keyed file access.

That's not very useful to a techie. They know how to navigate their system's filesystem, and even if they lose track of a particular thing, they know how to use the system's filesystem search tools to search for filenames or content. They can search for recently-modified files. They know how to generally get ahold of stuff.

But for the people who can't do that, reducing their interface to a single search box might make file access more approachable.

Now, let me reiterate that I think that a whole lot of this is Microsoft repeatedly patching over UI problems they created in the past rather than fixing them. And they've done this before over the decades with stuff other than document access. It's hard to navigate the filesystem to find an installed program a la the MS-DOS era, so they stick stuff in a Start Menu to make it more accessible. That gets too crowded, installers start slapping shortcuts on the desktop. That gets too crowded, installers start adding system tray icons. That gets too crowded, the Start Menu becomes searchable. Each interface just becomes progressively less-usable and the solution each time is to stick a new interface in on top of the old one, which in turn contributes to the complexity of the system as a whole.

But that doesn't mean that they aren't trying to address a real problem.

I think that they'd do better with something like having a rapidly-accessible log of recently-accessed files (like, maybe have the filesystem maintain a time-based doubly-linked list of those) and be able to rapidly search the content of documents based on mod time so that recent stuff gets hit quickly, then trying to make their existing search tools more accessible. That doesn't replicate data across the system and produce some of the problems here. It also permits for fully-searching content, rather than just the stuff that was on a screen when the Recall system grabbed a screenshot and OCRed it. Maybe they've done something like that in recent years; I'm many years out-of-date on Windows.

I'd also add that I think that personal computer systems in general would benefit from giving users better control over where their data is replicated to. It's kind of confusing...you've got swap (well, encrypted swap probably helps somewhat with this). Browser history. Any clipboard manager's retention. Credentials stores. Application-saved copies of in-progress files. Various caches. If you use some kind of cloud-based storage, you're pushing data out to other computers. Backups. Just a lot of state that can be replicated all over the place and is hard to go back and track down and remove. That's even before stuff like issues with doing secure deletion on existing filesystems (which we had a conversation about the other day, everything from log-structured filesystems to wear-leveling on SSDs inducing data replication). If you want something definitely gone, be able to manage your data's lifetime, something that I think that a lot of people -- even non-techies -- would like, you really have to have a lot of technical knowledge of the system's internals as things stand today. This Recall thing is egregious, replicates data all over, but it's far from the first feature that makes it harder for people to understand and control the lifetime of data on their computer.

I don't think that the software world has done a great job of letting people control that data lifetime. And I think that it's something that a user should reasonably be able to expect out of their computer.

astrsk , (edited )
@astrsk@piefed.social avatar

Yeah this is why Apple has been slowly peeling away traditional file / folder features from front and center. The user doesn’t care where or how they get their files, they just want them at any given time. Spotlight being the most successful at obfuscating where anything is yet allowing access to everything. Microsoft has started to pick up on that and attempt to solve the same problems.

fartsparkles ,

The bizarre thing is, they have solved it. PowerToys Run is the Spotlight omnibar of everything and they bizarrely haven’t chosen to bake it into Windows proper. I can’t use Windows without it now. Search files and folders everywhere faster than the start menu search, search running processes, execute commands, do maths, calculate hashes, open web pages. It’s fantastic.

Rekorse ,

Do you use windows by choice or for work?

fartsparkles ,

Both. I’m one of those weird people that uses Linux, macOS, Windows, Android, and iOS on a daily basis (Android probably less than daily now as I’m not travelling as much as I used to). My job necessitates it but also I just enjoy having mixed estates at home to stay fresh. I am, however, eager to stop using Windows at home as the overall security health and conscience of Microsoft these days seems to be trending downwards.

Rekorse ,

Windows hasnt quite felt as risky as it does now, that I can remember at least.

Luckily my company outsourced the IT security department to India and have since had a handful of breaches and zero remediation efforts. I'm sure this windows stuff is firmly in the "care later" bin.

jjjalljs ,

There was an article going around a while ago that was arguing most users these days, including the youth we often stereotype as "digital natives" who "get computers", don't understand file systems. They might not even know they exist as a concept.

Which makes sense if you've only ever really used modern UIs. You don't have to know anything about files and folders. I bet a lot of people don't even know they exist in any meaningful way.

Most users are shockingly ignorant, and a lot of them are not really paying enough attention or interested enough to learn much.

Womble ,

I remember reading an article a few years back about physics undergraduates who didnt know how to use a computers file system. They could learn, but these are smart likely at least fairly tech inclined kids and they didnt know how to navigate folders on a computer at 18.

The_Terrible_Humbaba ,

When I studied Computer Engineering, I met several other students who had a lot of trouble using the Windows file system, and navigating a file system through a terminal was a Herculean task for them.

Most people growing up now, and since over a decade ago, are only tech savvy in the sense they know how to use smartphones, tablets, and social media; none of those require any understanding of file systems, and even using desktops doesn't really require it that much for most people.

gravitas_deficiency ,

I’m simply baffled that someone going into a computer engineering major at a university doesn’t understand a hierarchical file system as a matter of course. It’s a tree. The file system is a tree. A tree is one of the most basic computer science logical constructs. How exactly is a filesystem confusing? How is navigating directories from a terminal - any terminal, in any OS - a Herculean task?

Spotlight7573 ,

Someone going into the subject may not have any pre-existing knowledge of the subject (like what a tree is) and may be intending to learn it from their classes. Unless we require everyone to take a class that covers it first, you can't really guarantee that people have that knowledge. While people may have known it by necessity before, computers, for better or worse, have gotten easier to use for the average person and it's no longer essential knowledge. Or they may not have even be using a traditional desktop/laptop OS that has those concepts.

As for how it's confusing, have you seen the default UI for Google Docs/Sheets/Drive or Microsoft Office recently? Google's products default to a file view listed in most recently used order with a search bar at the top, no folders. The Microsoft Office suite defaults to saving to OneDrive without any folders. If this is all people have needed to use when growing up, is it any wonder why they never learned about hierarchical folders in a filesystem?

trolololol ,

I can use file systems on terminal with my eyes closed, as long as it's not windows because every release they change everything around. You're victimising the victims.

KairuByte ,
@KairuByte@lemmy.dbzer0.com avatar

Eh? Nothing significant has changed about the windows file system in over a decade, at least not from a user standpoint.

Most people don’t need to muck about in ProgramData, Program Files vs Program Files (x86) is pretty minimal, though admittedly you may need to check both if you’re unsure which the app you’re using is. I suppose %appdata% has changed, and one could argue it was significant, but in all honesty the concept of local vs remote should get you where you’re going, and worst case you check both.

But the base directory structure has been pretty static for a long while now.

trolololol ,

Makes sense, I haven't booted windows since 2013 and couldn't be happier

I still stand by my statement: windows filesystem changes too often.

Kushan ,
@Kushan@lemmy.world avatar

I don't think any of the UX problems you're describing have been solved on any platform. If anything Windows is one of the better examples here, because I'll be fucked if I can ever find a file on Android and don't get me started with Linux.

Miaou ,

You think this is easier to use than grep?

Kushan ,
@Kushan@lemmy.world avatar

No, neither is easy to use. The second you have to use a terminal or command line you have completely lost the vast majority of people.

Miaou ,

I agree, but are you then implying that the windows explorer file search is good? Have you ever used anything else?

Kushan ,
@Kushan@lemmy.world avatar

I didn't say it was good, but it is easy to use compared to a terminal. It won't help you find your file, but it's somewhat intuitive to a novice user - you click around and open folders until you find something that looks like what you're after. It's not efficient, it's downright tedious, but it's at least easy to do.

It's all about the barrier to entry to novice users. Most users are novices, they're the majority of the market so they'll decide what the market leader is.

Spotlight7573 ,

With the tab-completion in Powershell, for someone who doesn't know all the grep flags by heart, it might be easier to stumble through the options to find the ones you want without looking it up.

Miaou ,

But it doesn't list them does it? With e.g. zsh I can have the list of flags alongside their explanation, which is not the case with PS I think? I think even bash has it on more recent distros (not entirely sure)

Spotlight7573 ,

Looks like you can use Ctrl+Spacebar to open the "MenuComplete" function that should show you the different available options. I don't think you can get a direct list of the parameters that have explanations without using something like Get-Help though.

More info here:

https://learn.microsoft.com/en-us/powershell/scripting/learn/shell/using-keyhandlers?view=powershell-7.4

FlyingSquid ,
@FlyingSquid@lemmy.world avatar

My daughter certainly doesn't have a good understanding of file systems even though I've been trying to teach it to her.

aphlamingphoenix ,

We recently went through a nuke-n-pave on my kids desktops. I plugged in an external drive for them to do backups, and we walked through the process. This was in Fedora with pretty much default Gnome tools. They came away understanding the process and how to track it, but I think they still don't really understand file organization.

FlyingSquid ,
@FlyingSquid@lemmy.world avatar

These kids grew up with tablets and smartphones where they don't even see the file system, so I'm not shocked.

sorter_plainview ,

I completely agree with this. I work as a User Experience researcher and I have been noticing this for some time. I'm not a traditional UX person, but work more at the intersection of UX and Programming. I think the core problem when it comes to discussion about any software product is the people talking about it, kind of assuming everyone else functions the same.

What you mentioned here as a techie, in simple terms is a person who uses or has to use the computer and file system everyday. They spend a huge amount of time with a computer and slowly they organise stuff. And most of the time they want more control over their stuff, and some of them end up in Linux based systems, and some find alternative ways.

There are two other kinds of people. One is a person who uses the computer everyday but is completely limited to their enterprise software. Even though they spend countless hours on the computer, they really don't end up using the OS most of the time. A huge part of the service industry belongs to this group. Most of the time they have a dedicated IT department who will take care of any issue.

The third category is people who rarely use computers. Means they use it once or twice in a few days. Almost all the people with non-white collar jobs belong to this category. This category mainly uses phones to get daily stuff done.

If you look at the customer base of Microsoft, it's never been the first. Microsoft tried really hard with .NET in the Balmer era, and even created a strong base at that time, but I am of the opinion that a huge shift happened with wide adoption of the Internet. In some forum I recently saw someone saying, TypeScript gave Microsoft some recognition and kept them relevant. They made some good contributions also.

So as I mentioned the customer base was always the second and third category. People in these categories focus only on getting stuff done. Bare minimum maintenance and get results by doing as little as possible. Most of them don't really care about organising their files or even finding them. Many people just redownload stuff from email, message apps, or drives, whenever they need a file. Microsoft tried to address this by indexed search inside the OS, but it didn't work out well because of the resource requirements and many bugs. For them a feature like Recall or Spotlight of Apple is really useful.

The way Apple and even Android are going forward is in this direction. Restricting the user to the surface of the product and making things easy to find and use through aggregating applications. The Gallery app is a good example. Microsoft knew this a long back. 'Pictures', 'Documents' and all other folders were just an example. They never 'enforced' it. In earlier days people used to have separate drives for their documents because, Windows did get corrupted easily and when reinstalling only the 'C:' drive needs to be formatted. Only after Microsoft started selling pre-installed Windows through OEMs, they were able to change this trend.

Windows is also pushing in this same direction. Limiting users to the surface, because the two categories I mentioned don't really 'maintain' their system. Just like in the case of a car, some people like to maintain their own car, and many others let paid services to take care of it. But when it comes to 'personal' computers, with 'personal' files, a 'paid' service is not an option. So this lands on the shoulders of the OS companies as an opportunity. Whoever gives a better solution people will adopt it more.

Microsoft is going to land in many contradictions soon, because of their early widespread adoption of AI. Their net zero global emission target is a straightforward example of this.

nifty , (edited )
@nifty@lemmy.world avatar

Do you really need screen snapshot to do fine grained search though? It sounds like you’re describing Spotlight in some way https://en.m.wikipedia.org/wiki/Spotlight_(Apple)

FarceOfWill ,

With recall you can search for a website you saw once, a link in a discord channel, an email all at once in one place.

rottingleaf ,

I don’t think that the software world has done a great job of letting people control that data lifetime. And I think that it’s something that a user should reasonably be able to expect out of their computer.

That's true.

I once thought about this, that maybe it's a good idea to use a tagged and maybe log-style filesystem, where 1) every directory name in file path becomes a tag for it, other than the user-added tags (which can be searched separately), 2) there are temporary and permanent files, where temporary ones are deleted once their lifetime passes or that plus once the space is required, while permanent ones are stored indefinitely, 3) with hardlink functionality transparently available to the user, from the GUI, 4) the GUI itself should drop the bullshit and return to DOS times in the sense of control - with this thing I describe it may well be that the casual user won't feel as lost as they do now.

Maybe (again, transparent and user-accessible) filesystem overlays for every application are a good idea too here, like with Docker, chroots, MacOS DMG images, etc.

In addition to that indexing file contents may make sense too, like you said.

Frankly there are so many good things one can do which haven't been done, before just OCR`ing everything on the screen and storing it.

About "why MS chose this" - because they consistently choose the dumbest and ugliest way to deal with any problem. The heaviest artillery available, to look relevant.

Offtopic - the searchable start menu problem is what scares me off Gnome every time I try it. You just get that tablet-like one-level place with a search field and icons. A frigging lot of fscking icons for every dot-desktop file Gnome found. Then I panic and get back to FVWM.

Cosmicomical ,

As a species we have invented something called "indexes" that solve exactly that kind of problem. We actually have an entire field of science called information retrieval, that doesn't require screenshotting your whole life to produce the same result.

Opafi , to Technology in Stealing everything you’ve ever typed or viewed on your own Windows PC is now possible with two lines of code — inside the Copilot+ Recall disaster.

As much as I lean to hate this despite it not even affecting me as a Linux user...

I’m going to structure this as a Q&A with myself now, based on comments online

What is that? "I'm going to pretend to ask questions that I'll then answer myself the way I think it'll outrage that most people do I'll get a lot of clicks on this shitty article"? What crappy excuse for content creation is this? I hate it.

Spuddlesv2 ,

I follow Kevin on Mastodon. He’s the real deal and is absolutely not interested in the clicks or outrage. He’s trying to make it accessible.

tal ,
@tal@lemmy.today avatar

Yeah, I gotta say that I read the article and it seemed pretty reasonable in terms of content. The fake-Q-and-A thing wasn't quite my cup of tea either, but eh, I don't think it was all that problematic.

JackFrostNCola ,

Agreed. The way i took it was "i am going to write 'questions' based on the concerns people are commenting online and give the answers to those things people are interested/worried about"

SzethFriendOfNimi ,

You may not but the customer support rep at a company that had your info uses windows. Same for the insurance companies, various government agencies local with limited it experience as well as national.

thesmokingman ,

Do you mind calling out the questions you think are inappropriate or exist for rage clicks? What constitutes a good article for you if this is a shitty one?

Ephera ,

Eh, they could have written it differently, each time hypothesizing that someone might wonder XYZ, but I appreciate the brevity of this format. And I do not think that the questions or answers are unreasonable.

ColeSloth ,

I rather liked it. I mean he was just re-phrasing questions he's seen without having to bother with direct quotes and making sure the questions were articulate.

It's pretty important to get this info out there and make sure everyone and their 2nd cousin knows about it. If Microsoft can't make this absolutely infallible on a security front it will almost be laughable at how many people could get completely fucked over by this. Every hacker and country in the world are going to be poking at the security of this feature. It would be the holy grail of infosec penetration.

admin , (edited )
@admin@lemmy.my-box.dev avatar

Stopthatgirl7 and inflammatory headlines, name a more iconic duo.

Edit: Reminder to self: do you really want these kinds of posters in your media feed?

capital ,

I saw that as anticipating the questions they'll get regarding this article and pre-answering them.

TalesOfTrees , to Technology in Stealing everything you’ve ever typed or viewed on your own Windows PC is now possible with two lines of code — inside the Copilot+ Recall disaster.

As reasonable the concerns are... it seems like there's quite a bit of fearmongering over software and hardware that haven't even really gotten into the mainstream yet.

exanime , (edited )

Agreed that there is a bit of exgaerated dread.. but honestly this has all the hallmarks of a monkey knife fight in an elevator, it's hard to imagine how this won't end in disaster

Badeendje ,
@Badeendje@lemmy.world avatar

I'm just imagining a monkey knife fight in an elevator now... They are cartoon monkeys btw.

j4k3 ,
@j4k3@lemmy.world avatar

I have no idea what a monkey knife is. Monkeys with knives... knives made of monkeys... pejorative... metaphorical...

Whirling_Cloudburst ,

AI monkeys with knives and their fingers are truly scary to behold.

jabathekek ,
@jabathekek@sopuli.xyz avatar

And you can't tell where the knife ends and the fingers^3^ begin.

billiam0202 ,

And they have the wrong number of fingers and knives.

Spuddlesv2 ,

Do you think it would be a better idea to wait until it’s installed and active on every Windows computer before we start a discussion on how bad Copilot is?

Blaster_M ,

Only computers that can run it.... are pretty much none of the computers running 11 today. The CPU needs to have an NPU, as the AI functionality is run locally on the PC.

dfeldman ,
@dfeldman@hachyderm.io avatar

@Blaster_M @Spuddlesv2 Apparently you can run it in an Azure ARM windows VM. Wanna try?

Spuddlesv2 ,

Go look at all the Windows PCs announced in the last few months and you will see they have NPUs. So again, why would we wait until it is too late to try to stop this nonsense?

Also the “AI” may run locally but it saves the info into an easily accessible and readable SQLite database in the users AppData. It will be trivial for malicious actors to access.

Someonelol ,
@Someonelol@lemmy.dbzer0.com avatar

I heard this same argument from people all the time. Until it affects you in a meaningful way to change your mind, it'll be too late.

vext01 ,
@vext01@lemmy.sdf.org avatar

The writing style is a bit weird, but I think the concerns are valid. That sqlite file is a treasure trove for hackers/scammers.

  • All
  • Subscribed
  • Moderated
  • Favorites
  • random
  • incremental_games
  • meta
  • All magazines