Microsoft repackages apps with a telemetry .NET wrapper

[madires]

https://twitter.com/WithinRafael/status/1781743054296432772:

The Microsoft Store team has started quietly wrapping apps, like EarTrumpet, with some malware-looking .NET executable wrapper (with my app's name of course) chock full of telemetry and other code. They also target netfx 4.7.2 when my app targets netfx 4.6.2, wtf?

[RoGeorge]

Similar they do with the VScode, the rumor is.  They only add the telemetry in the binaries.

    When we [Microsoft] build Visual Studio Code, we do exactly this. We clone the vscode repository, we lay down a customized product.json that has Microsoft specific functionality (telemetry, gallery, logo, etc.), and then produce a build that we release under our license.

    When you clone and build from the vscode repo, none of these endpoints are configured in the default product.json. Therefore, you generate a “clean” build, without the Microsoft customizations, which is by default licensed under the MIT license

Source:  https://vscodium.com/#why-does-this-exist

[SiliconWizard]

Nice.

[Perkele]

Similar they do with the VScode, the rumor is.  They only add the telemetry in the binaries.

    When we [Microsoft] build Visual Studio Code, we do exactly this. We clone the vscode repository, we lay down a customized product.json that has Microsoft specific functionality (telemetry, gallery, logo, etc.), and then produce a build that we release under our license.

    When you clone and build from the vscode repo, none of these endpoints are configured in the default product.json. Therefore, you generate a “clean” build, without the Microsoft customizations, which is by default licensed under the MIT license

Source:  https://vscodium.com/#why-does-this-exist

Just a heads-up warning - add-ons in VSCodium can't be installed from directly Store, you need to download and install them manually.

[radiolistener]

it turned to malware/spyware manufacturer, so it's better to avoid their new products because it's like Trojan horse...

[RoGeorge]

This is not a surprise from them, remember the keylogger from Microsoft, in Windows 10?
https://www.pcworld.com/article/423165/how-to-turn-off-windows-10s-keylogger-yes-it-still-has-one.html

It was all official, a keylogger and more (speech input spyware) inside Windows, for telemetry and such, and you were agreeing with that in the EULA.  With reassurements that the collected data is anonymous and for your own good, of course.  So, not for spying, only to give you a "better experience" in the future. 

[tooki]

If you scroll down the Twitter thread, you’ll see that it’s clarified that it is NOT modifying the executable, it’s simply the wrapper for Microsoft Store installers. Talk about getting panties in a twist over nothing…

[PlainName]

getting panties in a twist over nothing…

Microsoft forcing telemetry on you is 'getting your panties in a twist'? That only seems innocuous compared to them not limiting it to the Store.

[Karel]

It's interesting to watch how, despite all the complains, people are still addicted to windows.
Reminds me to the apalog of the boiling frog... 

[tooki]

getting panties in a twist over nothing…

Microsoft forcing telemetry on you is 'getting your panties in a twist'? That only seems innocuous compared to them not limiting it to the Store.

Honestly? No, I don’t think it’s a big deal. Software developers use telemetry for a lot of good, legitimate purposes, and by and large Microsoft has proven to be quite good about not using it for nefarious purposes. (I would not extend the same trust to Google or Meta, for example.) I worked in the software industry for a while, and having “seen how the sausage is made”, so to speak, installation telemetry does not give me the heebie jeebies the way a lot of other modern tracking does.

[tooki]

It's interesting to watch how, despite all the complains, people are still addicted to windows.
Reminds me to the apalog of the boiling frog... 

Few people are “addicted” to Windows. People use it because it does what they need, and more specifically, because it runs the applications they need. Tons of applications (including many best-of-breed programs) are sadly Windows-only. That’s what stops me from being a full-time Mac user. I wish application availability were equal across all 3 of the major platforms, but it’s not. Each has strong areas and weak ones in regard to application availability.

[bd139]

Telemetry is fine but Microsoft's approach to telemetry is akin to punching someone in the face and saying afterwards that there's instructions on how to say no in a filing cabinet in the basement of the local library while telling you to accept your face punching, shut up and calling you a peon.

Oh also I reported that the opt-out didn't work in their debian packages a few years back. Guess what? Well they fixed the issue and deleted my ticket and then they deleted by 10 year old github account when I complained about it for a TOS violation.

That's where you stand. Happy Mac owner. At least the cage works properly and is trying to get the asshats out.

[tooki]

Telemetry is fine but Microsoft's approach to telemetry is akin to punching someone in the face and saying afterwards that there's instructions on how to say no in a filing cabinet in the basement of the local library while telling you to accept your face punching, shut up and calling you a peon.

From skimming the Twitter thread, nothing was hidden, the developer just wasn’t paying attention to things when packaging their app for the MS Store.

[radiolistener]

Telemetry is fine

No, it's not fine. It's a big danger and large security hole. There is no good purpose for telemetry, it is needed only for malicious purposes, like collecting your private data, selling it and share to ad spammers, scammers and criminals, all without your consent.

You know how they doing it, first they collecting your private data and convince you that this is completely 100% safe, they said that it will be stored it in a very secure and super duper protected storage facility. Then one day it will be stolen by some anonymous hackers and appears on paid black web database. And they said "oh sorry, shit happens, we will work better to avoid it in future"... So, all your private data appears available for all criminals all around the world and none responsible for that...

Some of them even don't hide that they collecting and share your private data, they just said that this data will be collected and shared anonymously, but they don't tell you that it will include a lot of unique ids which allows to de-anonymize your private data very easily.

[SiliconWizard]

[tooki]

There is no good purpose for telemetry, it is needed only for malicious purposes

What a myopic, hysterical, uninformed, and untrue claim.

There are definitely some uses for telemetry that are absolutely beneficial to the user: crash reports and usability research. Developers use crash reports to figure out what the most common application crashes are, so they can fix them.

Stable software benefits the user.

Some developers use telemetry to figure out how people use their software: which features actually get used the most? How do people access them (toolbars? Menus? Keyboard shortcuts? Right-click menus?) Which commands get used in what combinations? For example, knowing which commands are often followed by “undo” tells you it’s an error-prone feature. Microsoft’s use of usability telemetry has directly resulted in lots of usability improvements, for example the handy little menu that appears after pasting to let you format the pasted data. Knowing which features are used and how can help guide what features get prioritized for development.

Usability benefits the user.

[helius]

Of course corporations want to make believe that their spyware (ahem, "telemetry") is the equivalent of a usability study, but it plainly is nothing of the kind. Collecting statistics—on which buttons are clicked most often—doesn't yield any useful information if there is no experimental control. Data without a control is just worthless junk (see most papers in econ and nutrition for examples).

The UI changes that they justify on the basis of this worthless junk are also, you guessed it, worthless. But everybody already knew that if they are remotely familiar with user interfaces in the pre-2005, and compare to what dreck is pushed out these days. There are other reasons for the widespread UI failure ("responsiveness" and touchscreens are a large component) but reliance on uncontrolled UX data collection is surely a major factor.

[bd139]

Regarding my comment about telemetry being fine, yes it is fine. But if it is constrained properly and the user consents to it.

If someone does a proper analysis then it is a powerful tool for making decisions. That requires some formal framework, proper collection methodology, thinking and statistical analysis around it. And that requires people who are formally qualified to do an analysis in that space (consider RSS / IMA members)

BUT the general approach of the technology industry is to collect everything, hope there is something useful in it and fabricate some official looking outcome from it without publishing your methodology. At the same time, creating a privacy violating dragnet and covering that with marketing. That is NOT ok. And that is Microsoft's approach. In fact their approach seems to be measuring what a completely helpless and powerless set of users will put up with.

It's important to distinguish the two. No absolutes are good for anyone.

[bd139]

Of course corporations want to make believe that their spyware (ahem, "telemetry") is the equivalent of a usability study, but it plainly is nothing of the kind. Collecting statistics—on which buttons are clicked most often—doesn't yield any useful information if there is no experimental control. Data without a control is just worthless junk (see most papers in econ and nutrition for examples).

The UI changes that they justify on the basis of this worthless junk are also, you guessed it, worthless. But everybody already knew that if they are remotely familiar with user interfaces in the pre-2005, and compare to what dreck is pushed out these days. There are other reasons for the widespread UI failure ("responsiveness" and touchscreens are a large component) but reliance on uncontrolled UX data collection is surely a major factor.

That's mostly because the user studies are invalid.

What is considered:

1. If we do change X then outcome Y happens.
2. If we do change P then outcome Q happens.

What should have been considered but is never done is a control option:

1. Leave my shit alone and stop pissing around with it.

This is normally isolated from user studies because people don't consider that as a valuable outcome because it does not generate work and people value work more than leaving shit alone and stop pissing around with it.

[bd139]

There is no good purpose for telemetry, it is needed only for malicious purposes

What a myopic, hysterical, uninformed, and untrue claim.

There are definitely some uses for telemetry that are absolutely beneficial to the user: crash reports and usability research. Developers use crash reports to figure out what the most common application crashes are, so they can fix them.

Stable software benefits the user.

Some developers use telemetry to figure out how people use their software: which features actually get used the most? How do people access them (toolbars? Menus? Keyboard shortcuts? Right-click menus?) Which commands get used in what combinations? For example, knowing which commands are often followed by “undo” tells you it’s an error-prone feature. Microsoft’s use of usability telemetry has directly resulted in lots of usability improvements, for example the handy little menu that appears after pasting to let you format the pasted data. Knowing which features are used and how can help guide what features get prioritized for development.

Usability benefits the user.

Your reasoning is detached from the outcome.

Yes crash reports and usability reports are good data sources.

Do they benefit the user? That depends on the sausage factory in the middle of the process.

I have never seen an outcome that is user beneficial from a usability study. I posit that they are run by people who have no idea what they are doing.

As for the other point, my day job for the last couple of years has been running the reliability engineering team for a very large fintech. If you think that a crash dump results in a viable outcome for end users even 5% of the time then you are naive. Most of the time it is just noise. We get thousands of them an hour. And that is considered normal. Even if we do perform a causal analysis on a statistically common one, finding an engineer who can actually understand or solve the problem in a complex distributed system is an uphill battle as well.


The general theme in the thread above is there aren't a lot of people who know what they are doing. They are all making appropriate looking dances though and people who don't know what they are doing look at those and think they might know what they are doing. It's not turtles, but incompetence from the top to the bottom.

And that's why we shouldn't trust, not because the idea is bad, but the competence is bad.

[PlainName]

Some developers use telemetry to figure out how people use their software

Shouldn't that be done in-house, or at minimum with users that agree to be monitored? Are you happy with your car telling the manufacturer where you went, what speeds you did where, how you used the brakes, your acceleration, where you were looking, how you flash the lights, etc? What time you go to work, the shops, hey - is that the place where Ms Periwinkle's car is parked and it's always 8pm to 10pm?

[bd139]

Some developers use telemetry to figure out how people use their software

Shouldn't that be done in-house, or at minimum with users that agree to be monitored? Are you happy with your car telling the manufacturer where you went, what speeds you did where, how you used the brakes, your acceleration, where you were looking, how you flash the lights, etc? What time you go to work, the shops, hey - is that the place where Ms Periwinkle's car is parked and it's always 8pm to 10pm?

That's a bad straw man. You can't draw similarities between different topical studies.

Most operational telemetry in the IT space is classified as "VALE" - Volume, Availability, Latency, Errors. That does not apply well to cars as you can probably imagine 

[tooki]

Of course corporations want to make believe that their spyware (ahem, "telemetry") is the equivalent of a usability study, but it plainly is nothing of the kind. Collecting statistics—on which buttons are clicked most often—doesn't yield any useful information if there is no experimental control. Data without a control is just worthless junk (see most papers in econ and nutrition for examples).

I worked in usability for years.

No, telemetry is not a substitute for usability studies, it is complementary to them, because they show real-world usage, which is often quite different from the studies. As for the statistical significance, it isn’t perfect since some users (which are likely to be more tech-savvy ones) opt out, but due to the sheer scale, it still produces tons of useful information.

I don’t know how you would make a control group for this; it’s not comparative analysis. It’s simple quantitative data: what gets used the most, and what sequences get used.

[tooki]

Your reasoning is detached from the outcome.

That’s a rather lofty accusation.

I worked in the software industry for years, and at a usability agency. I have relevant, real-world experience with this, and am not the deluded simpleton you essentially accuse me of being.

Yes crash reports and usability reports are good data sources.

Do they benefit the user? That depends on the sausage factory in the middle of the process.

Sure, that’s fair.

I have never seen an outcome that is user beneficial from a usability study.

Hold on, we aren’t talking about usability studies. We are talking about usage data, which is used to inform subsequent usability design.

I literally gave a real-world example: the post-pasting popup menu in Microsoft software (Office, etc). Usage telemetry had shown that the “paste” command is very frequently followed by “undo”, because the result was not as intended. Then people would either use a Paste Special command, or paste it normally and follow it by manual reformatting. So they added the little popup that lets you change the pasted formatting in situ. I think this is a fantastic feature, and well-implemented: it makes it easy to recover from an unexpected result, yet doesn’t force any change to one’s workflow at all: you can also simply ignore it and fix the problem in the old ways.

I posit that they are run by people who have no idea what they are doing.

Every industry and specialty has people who are incompetent and people who are competent. You can’t just dismiss all usability research as “run by people with no idea what they’re doing”.

As for the other point, my day job for the last couple of years has been running the reliability engineering team for a very large fintech. If you think that a crash dump results in a viable outcome for end users even 5% of the time then you are naive. Most of the time it is just noise. We get thousands of them an hour. And that is considered normal. Even if we do perform a causal analysis on a statistically common one, finding an engineer who can actually understand or solve the problem in a complex distributed system is an uphill battle as well.

The ratio depends entirely on the product, of course. At the small software company I worked at, where the software could generate a crash report as a precomposed email (user still had to actively send it), the trace went straight to the dev team, which knew exactly what it meant and could take action if necessary.

I don’t doubt for a second that in complex, larger systems the ratio of useful reports is smaller. But if you ask me, even if just 5% result in a bug being fixed, that is a good thing. I fail to see how it’s better than nothing.

The general theme in the thread above is there aren't a lot of people who know what they are doing. They are all making appropriate looking dances though and people who don't know what they are doing look at those and think they might know what they are doing. It's not turtles, but incompetence from the top to the bottom.

And that's why we shouldn't trust, not because the idea is bad, but the competence is bad.

I don’t disagree in principle with that statement, but maybe I’m just not quite as jaded as you.

[tooki]

Some developers use telemetry to figure out how people use their software

Shouldn't that be done in-house, or at minimum with users that agree to be monitored?

But users do agree to it. That’s why software installers literally ask you whether you agree to share usage data or not. Any legitimate vendor makes it clear what is and isn’t collected. (For example, that your data itself won’t be shared.)

Are you happy with your car telling the manufacturer where you went, what speeds you did where, how you used the brakes, your acceleration, where you were looking, how you flash the lights, etc? What time you go to work, the shops, hey - is that the place where Ms Periwinkle's car is parked and it's always 8pm to 10pm?

Completely different from usage statistics.

A correct analogy would be that it shares things like: what percentage of the time is your foot on the gas pedal? How many times do you use the brake on a typical drive? What’s the average length of your drives, in km and in minutes? What’s your acceleration style (jackrabbit starts or slow off the line)? How long is the car idle between drives?

The stuff you list is more like if Word was sending not only that, but also uploading your documents and a live keyboard log.

I am absolutely aware that some companies, like Google and Meta (and the essentially scammers who make “free” phone apps whose main raison d’être is to collect user data), do collect and upload all kinds of sensitive personal data, like location logs, to use for commercial purposes. But not all software companies do, and it’s unfair to extrapolate the true offenders into being typical of the entire industry.

[PlainName]

Some developers use telemetry to figure out how people use their software

Shouldn't that be done in-house, or at minimum with users that agree to be monitored?

But users do agree to it. That’s why software installers literally ask you whether you agree to share usage data or not.

No problem with those that do that, but those aren't what's under discussion here. With many apps you get told they will use telemetry and that's your lot. Others will offer you the option to opt out of some telelmetry but not all. And it should be opt in.

Any legitimate vendor makes it clear what is and isn’t collected. (For example, that your data itself won’t be shared.)

Unless 'anonymised'. Or shared with trusted partners. Or similar wishy-washy things.

Are you happy with your car telling the manufacturer where you went, what speeds you did where, how you used the brakes, your acceleration, where you were looking, how you flash the lights, etc? What time you go to work, the shops, hey - is that the place where Ms Periwinkle's car is parked and it's always 8pm to 10pm?

Completely different from usage statistics.

A correct analogy would be that it shares things like: what percentage of the time is your foot on the gas pedal? How many times do you use the brake on a typical drive? What’s the average length of your drives, in km and in minutes? What’s your acceleration style (jackrabbit starts or slow off the line)? How long is the car idle between drives?

Not sure I want anyone to know any of that! It's just a matter of degree, isn't it? Where one draws the line. And don't forget we are on about those not asking permission but just gobbling the stuff, because.

The stuff you list is more like if Word was sending not only that, but also uploading your documents and a live keyboard log.

I am absolutely aware that some companies, like Google and Meta (and the essentially scammers who make “free” phone apps whose main raison d’être is to collect user data), do collect and upload all kinds of sensitive personal data, like location logs, to use for commercial purposes.

Check up a little bit and you'll see that this is about those 'some companies'. Microsoft is definitely not an innocent in this.

[Marco]

Microsoft forcing telemetry on you is 'getting your panties in a twist'? That only seems innocuous compared to them not limiting it to the Store.

Could be worse, they could insert an online certificate check into your application (even though a certificate revocation list is easily possible and inherently superior for both privacy and security).

[madires]

From an EU point of view (GDPR) the rules for telemetry are quite clear. Telemetry can't be forced upon the user, i.e. the application has to run also when users deny the collection of telemetry data. Users have to be informed about all the details (what, why, how long stored, and so on).

[tooki]

Any legitimate vendor makes it clear what is and isn’t collected. (For example, that your data itself won’t be shared.)

Unless 'anonymised'. Or shared with trusted partners. Or similar wishy-washy things.

Sorry, I see the way my statement was ambiguous.

I didn’t mean “share with others”, I meant “the user sharing the data with the developer”, not the developer sharing it with third parties. And by “data itself” I mean things like your documents, as opposed to usage data.

So what I mean is that a proper opt-in system makes it clear that the software isn’t, for example, uploading your document to them.

[radiolistener]

What a myopic, hysterical, uninformed, and untrue claim.

There are definitely some uses for telemetry that are absolutely beneficial to the user: crash reports and usability research. Developers use crash reports to figure out what the most common application crashes are, so they can fix them.

We had telemetry system which was used for the system state monitoring (distributed machines and devices), but as developer I don't remember even one case where I worked with the bug or crash report obtained with telemetry. All this is usually done with usual logging and issue tracker. I remember that we had some experimental telemetry to collect logs, but it was never used in production due to security reason.

I don't see telemetry use case for bug fix and crash report analysis, especially if its not about private system, but about collecting data all around the world. It just will be flooded with false positive and not relevant data for bug fixing.

As operating system user I don't need that someone research usability on my machine. Such an attempt to justify telemetry looks like grant unlimited permission to some random unknown student to allow him to access your private home at any time and examine your genitals while you sleep. Just to research your usability...   

Telemetry is the way how criminals can buy all info about you and use it to make harm to you. So when you share your data through telemetry to some "very safe and secure" company, you're needs to be ready that all that data will be available for criminals and they will use it to make money and they will be absolutely indifferent if it causes you financial or health harm

[radiolistener]

Not sure I want anyone to know any of that! It's just a matter of degree, isn't it? Where one draws the line. And don't forget we are on about those not asking permission but just gobbling the stuff, because.

This is really going much more deep. What will protect you from some criminal who decide to use online access to your electric car computer to make some "small mistake in the firmware code" which leads to failure of brake and gas pedal and take remote control over the steering... and you get into a traffic accident. And there is no way to check what happens, because computer will have some seconds to clean all tails and log events. That is the price to allow internet access for your car computer...

So what I mean is that a proper opt-in system makes it clear that the software isn’t, for example, uploading your document to them.

What will prevent to collect the data independently on that opt-in setting?
The same as it happens with MS?

[tooki]

So what I mean is that a proper opt-in system makes it clear that the software isn’t, for example, uploading your document to them.

What will prevent to collect the data independently on that opt-in setting?

Not sure what you mean.

Point is, a well written opt-in makes it CLEAR to the user who is reading it what will and will not be collected and uploaded, and what happens to it once uploaded, so that the user can make an informed decision on whether to click “allow” or “decline”.

The same as it happens with MS?

Meaning what? MS has multiple different telemetry systems with separate opt-ins, some for the user, some for the developer to see. This thread is about one where a developer wasn’t paying attention and got their panties in a twist over something they didn’t read when setting up their installer.

[radiolistener]

Not sure what you mean.

I mean the case when

a well written opt-in makes it CLEAR to the user who is reading it what will and will not be collected and uploaded, and what happens to it once uploaded, so that the user can make an informed decision on whether to click “allow” or “decline”.

But when user click on "decline", it still sends telemetry, just encrypted it and use more rare connections to hide telemetry activity from user.

[bd139]

Your reasoning is detached from the outcome.

That’s a rather lofty accusation.

I worked in the software industry for years, and at a usability agency. I have relevant, real-world experience with this, and am not the deluded simpleton you essentially accuse me of being.

I'm not making an accusation. I'm just stating that the data and the intent do not always end in the conclusion that people think that they do. That is mostly because people don't know how to do a proper analysis of anything really. This is not specific to this but the claims of a tangible outcome are vastly overstated.

I would suggest that the "usability agency" is a considerable bias as well based on my other comment. Literally there is no business if you tell the client not to touch something, so the default state is that a change must be made otherwise there is no report to make.

The reason that we stopped hiring agencies to run user studies for us is that at no point did anyone run a baseline analysis against a null hypothesis i.e. no change. I got into a hefty argument with a consultant over this who said that a change is 100% necessary, without providing any evidence and before the study was run. That is a complete lack of objectivity, intellectual and professional integrity in the industry.

The end game of two large, well known agencies being hired was that we had to roll ALL the changes back because it crippled clients.

This cost us a LOT of money. Try writing off a couple of million GBP and you'll see where the ROI is.

I literally gave a real-world example: the post-pasting popup menu in Microsoft software (Office, etc). Usage telemetry had shown that the “paste” command is very frequently followed by “undo”, because the result was not as intended. Then people would either use a Paste Special command, or paste it normally and follow it by manual reformatting. So they added the little popup that lets you change the pasted formatting in situ. I think this is a fantastic feature, and well-implemented: it makes it easy to recover from an unexpected result, yet doesn’t force any change to one’s workflow at all: you can also simply ignore it and fix the problem in the old ways.

Personally I think that's a shitty feature because it doesn't work like anything else in the rest of the OS or any other software. It's literally an edge case coded into the office UI runtime.

Compare to "Paste and Match Style" on macOS which is system wide.

I don’t disagree in principle with that statement, but maybe I’m just not quite as jaded as you.

It's not really jaded, but experienced.

Put it this way, who's the last person you go to for financial advice? Actually a financial advisor. Why? Well it turns out that they have two principal objectives (a) earning commission and (b) reaching sales targets. That gets you a mediocre outcome. What gets you the best outcome is developing an understanding of the domain and the problem and that comes from a proper study and analysis, not witchcraft and hope for a fixed price.

[Monkeh]

From an EU point of view (GDPR) the rules for telemetry are quite clear. Telemetry can't be forced upon the user, i.e. the application has to run also when users deny the collection of telemetry data. Users have to be informed about all the details (what, why, how long stored, and so on).

And yet you cannot use Windows without telemetry.

[madires]

Unfortunately the GDPR enforcement is slow, especially when the Irish DPC is involved.

[bd139]

From an EU point of view (GDPR) the rules for telemetry are quite clear. Telemetry can't be forced upon the user, i.e. the application has to run also when users deny the collection of telemetry data. Users have to be informed about all the details (what, why, how long stored, and so on).

And yet you cannot use Windows without telemetry.

Actually you can. If you have Windows 2021 LTSC IoT Enterprise Edition with a specific carefully configured GPO, the blessing of three wizards, cast some runes upon a dead chicken, you will get no telemetry until the next time you run windows update.

[Infraviolet]

"Actually you can..."
There might be a simpler way, Windows locked away inside a VM, with some very strict firewalling of any potential telemetry which was trying to escape the VM performed by a trustworthy Linux host OS. That would be a solution for anyone needing to run a program on Windows which wasn;t Wine compatible (unfortunately not that great a fraction of Windows exe programs are Wine compatible, I'm lucky with the few legacy Windows programs I use).

[radiolistener]

Actually you can.

Unfortunately Windows has a lot of different telemetry subsystems and some of them are hardcoded into kernel DLL's and cannot be removed or disabled. It has a bunch of hardcoded IP's and DNS addresses to collect the data, so it even hard to configure firewall to block them all.

I would say that Windows is a great modular spyware system which supports some operating system functions 

But you can still run it without telemetry if you turn off ethernet cable and wifi adapter   

[SiliconWizard]

I would say that Windows is a great modular spyware system which supports some operating system functions 

Yes! This is probably an hyperbole though! MS is only doing this to improve your user experience. Don't you want your experience to be improved?

[Karel]

I would say that Windows is a great modular spyware system which supports some operating system functions 

Yes! This is probably an hyperbole though! MS is only doing this to improve your user experience. Don't you want your experience to be improved?

Yes, I want my experience to be improved. That's why I moved away from ms windows.
Not just at home, also at work (including some colleagues).

[bd139]

"Actually you can..."
There might be a simpler way, Windows locked away inside a VM, with some very strict firewalling of any potential telemetry which was trying to escape the VM performed by a trustworthy Linux host OS. That would be a solution for anyone needing to run a program on Windows which wasn;t Wine compatible (unfortunately not that great a fraction of Windows exe programs are Wine compatible, I'm lucky with the few legacy Windows programs I use).

That is literally what I'm doing. I have an EC2 instance in AWS running windows server. There is a SG configured so it can only service RDP. Software is pushed to it over remote folders.

[tooki]

Your reasoning is detached from the outcome.

That’s a rather lofty accusation.

I worked in the software industry for years, and at a usability agency. I have relevant, real-world experience with this, and am not the deluded simpleton you essentially accuse me of being.

I'm not making an accusation. I'm just stating that the data and the intent do not always end in the conclusion that people think that they do. That is mostly because people don't know how to do a proper analysis of anything really. This is not specific to this but the claims of a tangible outcome are vastly overstated.

You didn’t say “people”, you said me, so it’s hard to not see this as you basically calling me incompetent or stupid.

I would suggest that the "usability agency" is a considerable bias as well based on my other comment. Literally there is no business if you tell the client not to touch something, so the default state is that a change must be made otherwise there is no report to make.

That’s on you. If a client wants to test the existing state, an agency will do it. If you weren’t getting this, it’s because you neglected to ask for it — or more likely didn’t want to pay for it when offered.

The reason that we stopped hiring agencies to run user studies for us is that at no point did anyone run a baseline analysis against a null hypothesis i.e. no change. I got into a hefty argument with a consultant over this who said that a change is 100% necessary, without providing any evidence and before the study was run. That is a complete lack of objectivity, intellectual and professional integrity in the industry.

Then you were dealing with a REALLY shitty agency. The one I worked at absolutely did not work like that.

Many of our projects began with testing the status quo to figure out where the problems are. (One memorable example was a health insurance company’s enrollment forms: an old lady was doing the test and got to the question “have you consumed cannabis products within the past 60 days?” to which she said out loud “no, but I could use some right about now!” 😂)

Don’t extrapolate to the entire industry; there ARE honest players. Just avoid the ones in any way affiliated with big management consulting companies!

I will also add that a LOT of the usability experience I got was at the software company, where it was all being done for the benefit of our own end users.

Personally I think that's a shitty feature because it doesn't work like anything else in the rest of the OS or any other software. It's literally an edge case coded into the office UI runtime.

Jeez Louise you’re rigid!

TONS of software uses custom controls to do useful things. Done well — like here — they are unobtrusive and doesn’t interfere with existing workflows.

On Windows, the basic UI widgets are MUCH dumber than those on macOS, so Windows developers are more or less forced to use custom widget extensions or third-party widget libraries to get more advanced behavior.

Compare to "Paste and Match Style" on macOS which is system wide.

Yep, it’s a great feature. But it can’t work everywhere. The document object models of the Office apps are WAY more complex than even macOS’s basic widgets. macOS and windows both use RTF as their basic formatted text format. Word, for example, does not. It’s a stylesheet-based system with nested stylesheets which apply to different levels of document structure, so merging them requires intimate knowledge of said structure. An OS-level command can’t do that.

I don’t disagree in principle with that statement, but maybe I’m just not quite as jaded as you.

It's not really jaded, but experienced.

I’m experienced, too.

You’re jaded from negative experiences. You accuse me of having bias, but so do you. I’m sorry you had very bad experiences with agencies, but not all are like that. Some are comprised of good, honest people who do good work that truly benefits their clients.

FWIW one reason I left the computer and usability industry entirely is because I got jaded — about clients. Too many times, after properly studying the problem, we’d design and test a really good solution, but the client would then not implement it as designed (often because they didn’t want to put in the effort on their backend systems to actually support the interaction design they’d been seeking). The half-baked implementation then would introduce new problems, which the client would tolerate for a few years before undertaking another website redesign, throwing out all prior work and starting over again rather than improving the implementation. So as a usability engineer, I rarely got to see my actual designs implemented, just pale, unsatisfying ghosts of them.

Put it this way, who's the last person you go to for financial advice? Actually a financial advisor. Why? Well it turns out that they have two principal objectives (a) earning commission and (b) reaching sales targets. That gets you a mediocre outcome. What gets you the best outcome is developing an understanding of the domain and the problem and that comes from a proper study and analysis, not witchcraft and hope for a fixed price.

Well what you’re describing isn’t a financial advisor, it’s a broker or salesperson, who at a big financial firm may well have the title of “financial advisor”.  But there exist independent financial advisors, and their advice, as I understand it, can be quite good precisely because they aren’t selling you any of the products they advise you to buy (or not). The flip side is that their services aren’t free.

You get what you pay for: a free financial analysis or free usability review is basically a way to get you in the door so money can be made on you some other way. It sounds to me like you may not have a good feel for this.

[radiolistener]

Too many times, after properly studying the problem, we’d design and test a really good solution, but the client would then not implement it as designed

That is not because your clients are stupid, on the contrary they are not implemented your ideas because they have experience and knowledge in their business area, which allows them to apply proper decision and this is why their business is still alive. 

You can say that your solution is really good when it was accepted and implemented by someone and its result shows the real improvement.

But when many of your solutions are rejected and not implemented, you can't say that these are "really good solution", because there is no evidence for that. It's just your personal subjective opinion.

Theory without practice is empty and practice without theory is blind.

[tooki]

Too many times, after properly studying the problem, we’d design and test a really good solution, but the client would then not implement it as designed

That is not because your clients are stupid, on the contrary they are not implemented your ideas because they have experience and knowledge in their business area, which allows them to apply proper decision and this is why their business is still alive. 

You can say that your solution is really good when it was accepted and implemented by someone and its result shows the real improvement.

But when many of your solutions are rejected and not implemented, you can't say that these are "really good solution", because there is no evidence for that. It's just your personal subjective opinion.

Theory without practice is empty and practice without theory is blind.

Another undeservedly cocky reply from you…

I’m not hypothesizing about why they didn’t implement it; they told us. (Usually, the people pushing the usability initiatives aren’t the development teams. They are equally disappointed by the outcome.)

 And we weren’t guessing about it being a good solution, we tested them. (Normal practice for good usability engineering is to do tests with “prototypes” made in special software to do quick mock-ups.)

[radiolistener]

Another undeservedly cocky reply from you…

There is nothing cocky, I just tell you what I think. It's pretty clear from my point of view. I don't see the reason to claim that your solution which is rejected by experienced clients (with a deep knowledge in their business area) is "really good solution" for these clients.

It looks like cheap marketing spam like "Believe me bro, our product is really good product and you're very needs it!" from the manufacturer of useless junk-goods. They usually also showing some useless colorful pictures with nice graphs and numbers, trying to hypnotize you with that. Or showing you prototypes hastily generated in some cheap form builder or Photoshop, for the same goal... I also notice that such marketing guys very like Apple products for some unknown reason, they're just crazy about it.

I’m not hypothesizing about why they didn’t implement it; they told us. (Usually, the people pushing the usability initiatives aren’t the development teams. They are equally disappointed by the outcome.)

Looks like you're just fooling yourself and don't notice it. Usually companies have policy to never criticize products from other companies. Instead, they just use some soft language that allows them to politely refuse the offer.

But it doesn't means that your rejected solution is really good for them. Really good solutions are accepted, not rejected...

Just don't fool yourself...  Sorry if it hurts you, but it should be pretty obvious...


PS: But I can understand your point of view very well, that collecting telemetry is very useful for the user, if you're working for some secret services from three letters or something like that... In this case I won't argue with you   


For me, telemetry is a showstopper issue. If I see that application sends telemetry, I don't want to use it. And it doesn't matters what is the reason for that telemetry.

[tooki]

Another undeservedly cocky reply from you…

There is nothing cocky, I just tell you what I think. It's pretty clear from my point of view. I don't see the reason to claim that your solution which is rejected by experienced clients (with a deep knowledge in their business area) is "really good solution" for these clients.

It looks like cheap marketing spam like "Believe me bro, our product is really good product and you're very needs it!" from the manufacturer of useless junk-goods. They usually also showing some useless colorful pictures with nice graphs and numbers, trying to hypnotize you with that. Or showing you prototypes hastily generated in some cheap form builder or Photoshop, for the same goal... I also notice that such marketing guys very like Apple products for some unknown reason, they're just crazy about it.

I’m not hypothesizing about why they didn’t implement it; they told us. (Usually, the people pushing the usability initiatives aren’t the development teams. They are equally disappointed by the outcome.)

Looks like you're just fooling yourself and don't notice it. Usually companies have policy to never criticize products from other companies. Instead, they just use some soft language that allows them to politely refuse the offer.

But it doesn't means that your rejected solution is really good for them. Really good solutions are accepted, not rejected...

Just don't fool yourself...  Sorry if it hurts you, but it should be pretty obvious...

Please stop. I’m not the idiot you and bd139 seem to think I am. You don’t know the process, and you don’t know the industry. The explanations here are only super-simplified, and it’s not my job to spell out every damned detail of the process. At some point, just accept that I was a competent industry professional who knows what he is talking about.

Anyhow, the clients didn’t reject the solutions. They (typically the customer experience team at the client company, who we worked with closely) accept the solution and then gives it to their developers to implement, and then the development team doesn’t implement it as designed. Sometimes this is because the customer experience team did not involve the development team early enough. Other times, the dev team was involved and cooperative but then couldn’t complete it for some reason. Reject ≠ not implement properly. As I said from the beginning, the issue was poor implementations.

And also, you say “experienced clients” — well, no, they came to us because they needed our expertise in usability engineering. They are experts in their own business, not in ours. So we worked closely to design good solutions for their customers. These days it’s mostly website and app design, of course.

Prototypes are not “hasty”, they’re carefully designed to work like the real thing, despite not having the real back-end systems behind them. These are interactive prototypes, not photoshop images. At this stage, it’s not about pixel perfection, it’s about interaction design, so they may not match the graphic design completely. (Sometimes, you deliberately make them very visually unpolished precisely to stop people from worrying about pixel perfection; the software lets you output it in “sketch” mode that looks hand-drawn. Still clickable interactive, though.)

[radiolistener]

And also, you say “experienced clients” — well, no, they came to us because they needed our expertise in usability engineering. They are experts in their own business, not in ours. So we worked closely to design good solutions for their customers. These days it’s mostly website and app design, of course.

I see it differently. They just interested what your company can propose them. Then when they realize that your solution cannot help them, they decided to not implement it. I'm sure they analyzed it very carefully and some experienced personnel make that decision. Simply saying they decided that this solution is not good for them.

I know how it is implemented in large well known companies. Believe me, their decision is not based on random thought of one person.

[PlainName]

decision is not based on random thought of one person

'Musk'

 

[tooki]

And also, you say “experienced clients” — well, no, they came to us because they needed our expertise in usability engineering. They are experts in their own business, not in ours. So we worked closely to design good solutions for their customers. These days it’s mostly website and app design, of course.

I see it differently. They just interested what your company can propose them. Then when they realize that your solution cannot help them, they decided to not implement it. I'm sure they analyzed it very carefully and some experienced personnel make that decision. Simply saying they decided that this solution is not good for them.

I know how it is implemented in large well known companies. Believe me, their decision is not based on random thought of one person.

You aren’t listening (again): the situations I am talking about is where they did choose to implement it.

They just then end up implementing it poorly because the people doing the implementing aren’t the same ones making the decision.

[bd139]

Your reasoning is detached from the outcome.

That’s a rather lofty accusation.

I worked in the software industry for years, and at a usability agency. I have relevant, real-world experience with this, and am not the deluded simpleton you essentially accuse me of being.

I'm not making an accusation. I'm just stating that the data and the intent do not always end in the conclusion that people think that they do. That is mostly because people don't know how to do a proper analysis of anything really. This is not specific to this but the claims of a tangible outcome are vastly overstated.

You didn’t say “people”, you said me, so it’s hard to not see this as you basically calling me incompetent or stupid.

This is your extrapolation of my point. Perhaps I should define it better rather than let you talk yourself into thinking someone called you stupid or incompetent.

Your reasoning is accurate and fine. But external concerns, aka engineering teams tasked with implementing change, tend to shape the outcome away from the intent. You end up with something half way between where you are and where you intended to be most of the time. Which is sometimes worse than either.

And on top of that the analysis being done needs to be done without bias and when there is a sales and continuity bias or commission involved, this affects outcomes.

Fundamentally it would be better to hire you in house to slowly shape the product than it would be to advise and leave. Which is where we ended up. Well we didn't hire you but probably would have if you were there at the right time with the right portfolio.

I would suggest that the "usability agency" is a considerable bias as well based on my other comment. Literally there is no business if you tell the client not to touch something, so the default state is that a change must be made otherwise there is no report to make.

That’s on you. If a client wants to test the existing state, an agency will do it. If you weren’t getting this, it’s because you neglected to ask for it — or more likely didn’t want to pay for it when offered.

We paid for it and did not get it. Twice.

The reason that we stopped hiring agencies to run user studies for us is that at no point did anyone run a baseline analysis against a null hypothesis i.e. no change. I got into a hefty argument with a consultant over this who said that a change is 100% necessary, without providing any evidence and before the study was run. That is a complete lack of objectivity, intellectual and professional integrity in the industry.

Then you were dealing with a REALLY shitty agency. The one I worked at absolutely did not work like that.

Many of our projects began with testing the status quo to figure out where the problems are. (One memorable example was a health insurance company’s enrollment forms: an old lady was doing the test and got to the question “have you consumed cannabis products within the past 60 days?” to which she said out loud “no, but I could use some right about now!” 😂)

Don’t extrapolate to the entire industry; there ARE honest players. Just avoid the ones in any way affiliated with big management consulting companies!

I will also add that a LOT of the usability experience I got was at the software company, where it was all being done for the benefit of our own end users.

We dealt with multiple agencies. In the end we hired our own people and do the work internally which is the point. The motivation and outcomes are different. As you say where your experience came from.

Personally I think that's a shitty feature because it doesn't work like anything else in the rest of the OS or any other software. It's literally an edge case coded into the office UI runtime.

Jeez Louise you’re rigid!

TONS of software uses custom controls to do useful things. Done well — like here — they are unobtrusive and doesn’t interfere with existing workflows.

On Windows, the basic UI widgets are MUCH dumber than those on macOS, so Windows developers are more or less forced to use custom widget extensions or third-party widget libraries to get more advanced behavior.

Well it depends which layer of windows UI you pull in? win32 / MFC / ATL / WPF / probably some other layers I've forgotten...

But yeah I agree there to some degree. But the clipboard itself will always paste the lowest common denominator of representation of the contents of the clipboard that is supported by the destination.

Compare to "Paste and Match Style" on macOS which is system wide.

Yep, it’s a great feature. But it can’t work everywhere. The document object models of the Office apps are WAY more complex than even macOS’s basic widgets. macOS and windows both use RTF as their basic formatted text format. Word, for example, does not. It’s a stylesheet-based system with nested stylesheets which apply to different levels of document structure, so merging them requires intimate knowledge of said structure. An OS-level command can’t do that.

I know intimately how Word works. I wrote a very comprehensive document authoring system a few years back that was a Word add-in and server-side generator that used OOXML. As for the clipboard, check winuser.h - you can register your own clipboard formats which is how it works when you copy structured data from one instance of winword.exe to another. Actually it's a serialized chunk of the internal COM model still for compatibility reasons (say you want to cut and past into Minitab or something horrible and windowsy). The default formats are indeed plain text and RTF but you have to ask a question here:

What has that got to do with things?

The point is there is a standard on macOS and there is not on Windows. It's literally a UI standards issue. And because it wasn't specified then the Office UI team decided to go their own way as always.

Consistency and discoverability is an important part of usability, no? Leaving things in the same place is a very simple way to make them discoverable.

I don’t disagree in principle with that statement, but maybe I’m just not quite as jaded as you.

It's not really jaded, but experienced.

I’m experienced, too.

You’re jaded from negative experiences. You accuse me of having bias, but so do you. I’m sorry you had very bad experiences with agencies, but not all are like that. Some are comprised of good, honest people who do good work that truly benefits their clients.

FWIW one reason I left the computer and usability industry entirely is because I got jaded — about clients. Too many times, after properly studying the problem, we’d design and test a really good solution, but the client would then not implement it as designed (often because they didn’t want to put in the effort on their backend systems to actually support the interaction design they’d been seeking). The half-baked implementation then would introduce new problems, which the client would tolerate for a few years before undertaking another website redesign, throwing out all prior work and starting over again rather than improving the implementation. So as a usability engineer, I rarely got to see my actual designs implemented, just pale, unsatisfying ghosts of them.

QED on the first point I was trying to make. "Pale unsatisfying ghosts of what you designed".

You have to operate in the constraints of reality which is run by cheap, incompetent idiots.

It's better to be embedded in the org and move chess pieces slowly than try and use a consultancy to get the issues you needed sorted.

Put it this way, who's the last person you go to for financial advice? Actually a financial advisor. Why? Well it turns out that they have two principal objectives (a) earning commission and (b) reaching sales targets. That gets you a mediocre outcome. What gets you the best outcome is developing an understanding of the domain and the problem and that comes from a proper study and analysis, not witchcraft and hope for a fixed price.

Well what you’re describing isn’t a financial advisor, it’s a broker or salesperson, who at a big financial firm may well have the title of “financial advisor”.  But there exist independent financial advisors, and their advice, as I understand it, can be quite good precisely because they aren’t selling you any of the products they advise you to buy (or not). The flip side is that their services aren’t free.

You get what you pay for: a free financial analysis or free usability review is basically a way to get you in the door so money can be made on you some other way. It sounds to me like you may not have a good feel for this.

As you understand it is completely wrong. I wouldn't have made the comment if I didn't understand it. Firstly an IFA is a broker - they offer advice and sell financial products. They literally had to introduce RDR and FAMR a few years back here because the IFA market was unregulated and chock full of cowboys building advice firms just to get a quick management buy out riding on sales commission promises and dragnetting customers at any cost. This control was mostly ineffective, pushing growth by acquisition as the principal method of obtaining capital. And this is even worse in Europe which has somewhat dubious union-wide legislation and local legislation is not enforced by regulatory agencies. Even the standardised T&C coaching process which is a light touch "don't be naughty again" system is actively gamed by most advisers.

In realistic terms the market is a Ferengi death match.

I won't go too far into my credentials in this space publicly but I have over 15 years working in that sector...