I must not reply. Replying is the mind-killer. Replying is the little-death that brings total obliteration.
I will face the bad take. I will permit it to pass over me and through me. And when it has gone past I will turn the inner eye to see its path. Where the take has gone there will be nothing. Only I will remain.
Michael Catanzaro from #GNOME published yesterday this interesting blog post about binding C libraries and a nice feature of #Vala; at the end there is the convenient solution (you can skip to it if you want ;) blogs.gnome.org/mcatanzaro/202… #ValaLang #GNOME #GTK #GTK4
Useless robots (or useless machines) are devices that, when switched on, exist only to turn themselves back off. They are fun and fairly simple builds that are easy to personify, and really invite …
OpenSSH sshd on musl-based systems is not vulnerable to RCE via CVE-2024-6387 (regreSSHion).
This is because we do not use localtime in log timestamps and do not use dynamic allocation (because it could fail under memory pressure) for printf formatting.
While the sshd bug is UB (AS-unsafe syslog call from signal context), very deliberate decisions we made for other good reasons reduced the potential impact to deadlock taking a lock.
It's bad out there. It looks a lot like last time, but it's worse. Even worse. Ft. the inimitable @alyankovic The track and other goodies- https://www.patre...
“Q: Is GPT-5 faster? A: Its predecessors already produce hundreds or even thousands of words almost instantaneously. Now GPT-5 brings PhD writing skills to the table, meaning it can generate text at a rate of about ten words per day. (This does not include the romance novel it’s writing on the side, online searches for “ADHD self-diagnosis,” or social media posts about not wanting to write.)” mcsweeneys.net/articles/chatgp… #phd #gpt
Via @tedmielczarek @natevw I have learned that the Apple // character set is preserved in Unicode (Except not the Apple logo, which is trademarked— this is in the PUA as , but that is not Unicode. But everything else).
Which means!!! The cute little running guy in the hidden characters!! Is in!!!
🮲🮳
So, if you are on Windows 10 or a modern Apple product, above you see two boxes
But, fricking inexplicably!!! On Linux!!! It actually displays!!!
A friend of mine joked when this came to light the other day that we should start the timer to see how long it would be before some SystemD person came out and said that was expected behavior and you're an idiot for using it wrong. And we laughed to ourselves, wouldn't that would be funny, that really is the reputation they have now isn't it.
Well, jokes on us, because that's the first fucking comment on the bug.
systemd version the issue has been seen with 256 Used distribution Debian Unstable Linux kernel version used 6.8.12-amd64 CPU architectures issue was seen on x86_64 Component systemd-tmpfiles Expec...
@jef Both came out of Barbara Liskov's research group. In 1994, although Scheifler had moved on, Barbara and her group were still there, around the corner and down the hall from me.
The 5th floor of 545 Tech Square was an astonishingly productive place: X, the End-to-End Principle, library operating systems, packet audio and video over wide-area networks, "soft state", RSVP, mesh networks, content-addressable file systems, TCP time-sequence plots, ...
This is an EPIC rant and EVERY WORD OF IT IS TRUE. Seriously, set aside half an hour to read it! (Caution: contains expletives and LLMs.) mastodon.sprawl.club/@ludicity…
Great news everyone! I finally talk about AI hype. Someone finally mentioned LLMs one time too many, and the reckoning is upon us:
https://ludic.mataroa.blog/blog/i-will-fucking-piledrive-you-if-you-mention-ai-again/
My theory is that tech is going through a significant post-COVID downsizing right now and AI hype is a somewhat desperate attempt to keep the cash rolling in.
This line about grifters is <chef's kiss>: "... it turns out that the core competency of smiling and promising people things that you can't actually deliver is highly transferable."
I want to love this blog but to be honest I appreciate the passion and I don't care about profanity but the ultra-violent imagery turns me off. That said, it is very interesting to hear the little boy exposing the Emperor's New Clothes
thanks for making this appear in my feed 👍 nice to see someone else ranting about the same things I rant about internally 😂 I did my undergrad thesis on using machine learning techniques in human activity recognition (over a decade ago). We had some clever things going on then, and put hard graft in, but none of it was truly ready for the masses and ML still isn't, but the genie is out of the bottle and some people are determined to make it work, like crypto currencies all over...
It is fantastic that AI companies can freely scrape copyrighted stuff from the Internet, but downloading of `youtube-dl` is illegal in the whole EU, because Hamburg regional court said so .. 🤦♂️
STASERA ci sarà questo evento per chi abita a Bergamo o intorni. È un corso introduttivo su git che è uno strumento per gestire le varie versione di un gruppo di file.
Mi farebbe piacere che ci andaste, anche perché è organizzato dal @bglug, l'associazione di cui faccio parte
Se sei uno studente, un hobbista, uno sviluppatore o un professionista IT, questo corso è perfetto per te. Git, nato per supportare lo sviluppo del kernel Linux, è ora lo standard per la collaborazione nel mondo open source e aziendale.
Apparently the SORBS DNS blocklist has closed down for good. There was an announcement to that end on the mailop mailinglist recently, and I've seen articles on various tech newstickers today: jort.link/www.mail-archive.com…
(I wasn't aware that SORBS was sponsored directly by Proofpoint.)
If you still have references to dnsbl.sorbs.net anywhere in your mail server or antispam configuration, now is the time to remove them.
Stephen Wolfram explores the broader picture of what's going on inside ChatGPT and why it produces meaningful text. Discusses models, training neural nets, embeddings, tokens, transformers, language syntax.
For those who aren’t aware, Microsoft have decided to bake essentially an infostealer into base Windows OS and enable by default.
From the Microsoft FAQ: “Note that Recall does not perform content moderation. It will not hide information such as passwords or financial account numbers."
Info is stored locally - but rather than something like Redline stealing your local browser password vault, now they can just steal the last 3 months of everything you’ve typed and viewed in one database.
So every unlocked workstation, every compromised device. "Recall show me the last adult material I viewed." I can see printed porn coming back into fashion. Or Linux
Recall uses a bunch of services themed CAP - Core AI Platform. Enabled by default.
It spits constant screenshots (the product brands then “snapshots”, but they’re hooked screenshots) into the current user’s AppData as part of image storage.
The NPU processes them and extracts text, into a database file.
The database is SQLite, and you can access it as the user including programmatically. It 100% does not need physical access and can be stolen.
And if you didn’t believe me.. found this on TikTok.
There’s an MSFT employee in the background saying “I don’t know if the team is going to be very happy…”
They should probably be transparent about it, rather than telling BBC News you’d need to be physically at the PC to hack it (not true). Just a thought.
I ponder if Microsoft's engineers are following the SQLite code of ethics, since they're using it in Windows OS with Copilot+ Recall? :D sqlite.org/codeofethics.html
So the code underpinning Copilot+ Recall includes a whole bunch of Azure AI backend code, which has ended up in the Windows OS. It also has a ton of API hooks for user activity monitoring.
Apps themselves can also search and make themselves more searchable.
It opens a lot of attack surface.
The semantic search element is fun.
They really went all in with this and it will have profound negative implications for the safety of people who use Microsoft Windows.
You deal with a sensitive matter on my Windows PC. E.g. an email you delete. Does Copilot Recall still store the deleted email?
Answer: yes. There's no feature to delete screenshots of things you delete while using your PC. You would have to remember to go and purge screenshots that Recall makes every few seconds.
If you or a friend use disappearing messages in WhatsApp, Signal etc, it is recorded regardless.
It comes up a lot as people are rightly confused, but if you wonder what problem Microsoft are trying to solve with Recall:
It isn't them being evil, it's business leaders who are middle aged and can't remember what they're doing driving decision making about which problems to solve.
A huge amount of business leaders are dudes who have no idea what the fuck is happening. This leads to the Recall feature.
Managed to find out how BBC News printed in a headline story that it was not possible to steal Recall data without being physically at the device (which is false) - this is from the journalist:
Just to clarify, I can access it without SYSTEM too. Microsoft are about to set cybersecurity back a decade by empowering cyber criminals via poor AI safety. Feature ships in a few weeks.
Attached: 4 images
Can confirm that Recall data is indeed stored in a SQLite3 database. The folder it's in is fully accessible only by SYSTEM and the Administrators group.
The latest Risky Business episode on Recall is good, but one small correction - it doesn’t need SYSTEM rights.
Here’s a video of two MSFT employees gaining access to the Recall database folder - with SQLite database right there. Watch their hacking skills. (You don’t need to go this length as an attacker, either). Cc @riskybusiness
I’m not being hyperbolic when I say this is the dumbest cybersecurity move in a decade. Good luck to my parents safely using their PC.
this is the out of box experience for Windows 11's new Recall feature on Copilot+ PCs. It's enabled by default during setup and you can't disable it directly here. There is an option to tick "open Settings after setup completes so I can manage my Recall preferences" instead.
You allow BYOD so people can pick up webmail and such. It’s okay, because when they leave you revoke their access, and your MDM removes all business data from the machine ✅
What the employee does: opens Recall, searches their email, files etc and pastes the data elsewhere.
Nothing is removed from Recall, as it is a photographic memory of everything the former employee did.
my only light at the end of the tunnel at this point is that big orgs will still take some time before they have any devices running the software and hopefully Microsoft gets their shit together for a more secure implementation until then.
@marius yeah, I agree - my hope is they rework it substantially before it has widespread adoption. I’m not sure they will. Devices are in the wild in a few weeks.
hey, can you add alt text to the image so I can boost this? It doesn’t need to be a full transcription, just however you’d describe it to somebody on the phone.
@MostlyBlindGamer #ALT4you Screenshot of the output of the script "totalrecall.py" that shows a detected "Windows Recall", and an extraction folder created for extracted Recall contents. Two lists of captured content follow, one containing the captured windows (one with an open Gmail account) and the other one shows all extracted screenshots.
I really dislike Microsoft's wording around this. They throw around terms like "encrypted" and "secure" to placate the lay person, when they know as well as anybody that encrypted data has to be decrypted at runtime, and if the user has access to the unencrypted data, so does any malware running with that user's privileges.
And you just know that it's gonna be on by default, if you turn it off Windows updates will randomly re-enable it, etc. This will be a privacy nightmare.
Recent DHS published report handed to the US President which said it had "identified a series of Microsoft operational and strategic decisions that collectively pointed to a corporate culture that deprioritized enterprise security investments and rigorous risk management"
Microsoft: let’s use AI to screenshot everything users do every 5 seconds, OCR the screenshots, make it searchable and store it in AppData!
@awakecoding It's *fine*. We just need apps to use randomly generated 24 character strings for field labels and mask all inputs with *****, and it'll be nbd.
I went and looked at YouTube for Recall to get out of the echo chamber and I can only find one positive video. Even the people at the event are slating it, including people with media provided Copilot+ PCs.
There’s some content creators who’ve realised it records their credit cards, so they’re making videos of their cards going walkies.
It’s going to be interesting to see how Microsoft get out of this one. They may have contractual commitments to ship Recall with external parties.
I thought they were risking crashing the Copilot brand with this one, but I was wrong looking at the videos and comments on them - I think they’re crashing the Windows consumer brand.
The reaction to photographic memory of what people do at home has - you’ll be surprised to know - not been seen as a reason to buy a device, but a reason why not to.
It sucks because the prospect of good ARM laptops that aren’t made by Apple is finally here, but this puts them in jeopardy if sales tank due to Recall.
Microsoft runs on trust, and our success depends on earning and maintaining it. We have a unique opportunity and responsibility to build the most secure and trusted platform that the world innovates upon.
@never_released oh I agree they will be shipping. Commercially it looks like they’ve made New Coke. There’s gonna be victims in terms of fraud from Recall, which is just going to pile on the problems.
@never_released Fraud? Domestic violence is the event that's going to be disastrous for them. The first time a man beats his wife to death after finding a screenshot of a convo she didn't want him to see?
The Microsoft Murderer Trial would certainly test the aphorism that there's no such thing as bad publicity.
I feel that Windows has been on shaky ground with many for a while. Honestly, the fact that anyone in Microsoft even thought up Recall is horrendously concerning. That it ever got built is terrifying. But right now I'm not convinced that at some point every OS/WM isn't going to end up with dumb shit like this
Global technology giants including Amazon.com Inc., Alphabet Inc.’s Google and Microsoft Corp. are among firms working to ramp up their presence in Saudi Arabia amid pressure from the government, which has said it will stop giving contracts to compan…
Saudi Arabia had been flooding American tech companies with cash since 2018.
Twitter was just one example of anti-democracy oil oligarchs hijacking tech.
Kushner's $2 billion in Saudi sovereign funds isn't buying beach-front condos in Gaza, it's being spent on torpedoing tech brands like Microsoft.
Google, Apple, Oracle, Amazon, Microsoft, all had MBS visit in 2018. The investments continued after the Khassoghi murder & its accelerated in recent months. vox.com/technology/2023/5/1/23…
Sure, and it's an coincidence that the WaPo ousted it's editor in favor of someone who wants TuckerKarlson op-eds.
I suppose you believe it was pure incompetence that drove Musk's management of Twitter into the shitter.
Rupert Murdoch marries his ruZZian handler, nothing to see here.
But co-pilot's creation has nothing to do with the billions of autocratic petro-dollars being pumped into Microsoft. Your not trying nearly hard enough to stick your head in the sand.
I mostly hear about issues for company laptops and data that could be stolen by 'Hackers' (both valid arguments) but has anybody considered that this is like your browserhistory 2.0 and what it means to let other people (family and friends) use your computer?
I know at least one person (and not just in in the little bubble here) that this was actually the last drop and he wiped his windows partition and is now Mac and Debian only.
Windows Central, about the only outlet giving Recall positive coverage and having articles tweeted by Microsoft staff - have updated their take after being hands on with a device. windowscentral.com/software-ap…
they still say finding Recall data scrappers is unlikely... it might be right now, but as you say it won't be in the future if MS doesn't correct this App Data plain text SQLite database fiasco.
@jt_rebelo yeah, they’re wrong about that. They’re talking to Microsoft people about it and unfortunately Microsoft people don’t seem to understand what happens outside their world.
is there a way to make AV companies ID if Recall is enabled? I ask this because, for example, Bitdefender Total Security has a Vulnerability Scan that identifies misconfigurations in Windows, other software, and even in network equipment, as a security risk and helps automate their correction/elimination. Seeing how bad this is, it'd be awesome if AV companies treated Recall as what it is: a Windows vulnerability.
Microsoft has been declining to comment on criticism of Recall for a week - but they have apparently told a journalist off the record at Future that changes will be made before Copilot+ devices drop in the coming days.
This may include an attempt to invalidate researcher criticism, we’ll see.
the option not to will be at the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying "Beware of the Leopard"...
that's the way to sell a shit sandwich. Tease it out on stale Wonderbread, upgrade it to artisinal organic whole-wheat sesame rolls, and people will feel like "you really listened to their input". But they're still eating shit.
This tool extracts and displays data from the Recall feature in Windows 11, providing an easy way to access information about your PC's activity snapshots. - xaitax/TotalRecall
Right, and if you go to this article, there's a link on the sidebar to an article about a sex machine. Which is either really good or really bad, depending.
I hadn’t been aware until today of the external reaction to Recall. Holy shit. Tim Apple must be pleased.
Everything from media coverage to YouTube to TikTok is largely negative. All the comments are negative.
These videos have tens of millions of views and hundreds of thousands of comments.
I knew it would be bad but.. it’s worse. I’ve spent hours looking at the sentiment and.. well, they probably would have got better coverage from launching an NFT of pregnant Clippy.
@davep even the videos before I noticed it are negative. The people who went to the press events were largely negative. It’s not a surprise as Recall is very very much a Microsoft bubble feature, but it is heart warming to see so many people got the wider picture.
Does anyone know if there's a way to pre-emptively edit the registry or use group policy to disable Recall so that if they push it to Windows 11 generally it is automatically disabled? I am worried about it.
It's one of the signature features of the next-generation Microsoft Copilot+ PCs, and at first glance it acts like the worst kind of spyware. But it's getting a bad rap.
@cstross I struggle to even understand the utility of the Recall feature, ignoring the privacy issues for a moment. I can't think of really any occasion when I would have found it useful. Given an incremental backup system like Apple's Time Machine, macOS's built-in document versioning feature, browser histories, etc. when would you even use Recall if you had it? It seems a lot of trouble, resources and AI bullshit for extremely niche use cases.
@dshan I can see Recall being useful in VERY SPECIFIC situations—e.g. incrementally updating a non-erasable journal on a secure device like an EPOS terminal or an ATM, to ensure nobody's fucking with it, OR in a care facility to help users with advancing dementia (and no access to credit cards). For most people it'd be an unmitigated security disaster with no upsides, though.
@dshan @cstross I had the same thought. My spouse disagrees, and says he can totally see the use for a tool that lets you find document x about topic y, that somebody sent you. (As product managers this does happen regularly.) But even he would not want to use it, because of the privacy nightmare this is.
@rlcw @dshan Tools for finding document X about subject Y that somebody sent you are ALREADY baked into your operating system, and have been for decades! (On macOS, it's Spotlight; Windows has an equivalent search facility. UNIX has had text searching via grep since the early 1970s.) This new thing isn't about search and retrieval, it’s a comprehensive log of everything you ever do on your computer. Which we normally call "spyware".
@cstross @dshan When people send us things they are not necessarily on the computer anymore, or in the browser, they can be in one of the 5 other tools used at work. This tool does get around this limitation - in a bad way. Don't get me wrong, we all agree it's not worth it, because it's a privacy nightmare, for you and people around you.
@cstross @rlcw @dshan similar to $HISTFILE - a powerful tool, but needs a lot of care to avoid having secrets stored in plaintext. For a corporate PC your web history and email inbox aren't private anyway.
@smallgreencloud @rlcw @dshan Yes, but now your sent-in-confidence emails and texts could be indexed in someone else's Recall db, and subject to discovery during litigation or searching by hackers.
The general mood everywhere in "the industry" is that you're either using "AI" or just not ready for it (or at best: it's not ready for your use case) yet. The "This is not, ever, a good use case for it" is completely beyond their mental capabilities to grasp as an idea.
Grab the GN Foil CyberSkeleton V2 shirt! https://store.gamersnexus.net/products/limited-edition-foil-cyberskeleton2-cotton-tshirtWith ASUS' issues now spanni...
Three Copilot+ Recall questions that keep coming up.
Q. Can you alter the Recall history?
A. Yes. You can change the OCR database and change the screenshots as the logged in user or as software running as the local user. There is no audit log of changes.
Q. Are they snapshots, as Microsoft says, or screenshots?
A. They are just screenshots, jpegs.
Q. What is to stop apps on your machine accessing your Recall covertly? A. Nothing. There is no audit log of access.
Well, I think I see how they *could* use that as an excuse for saying, …
“Look, there's nothing stopping you from making/using 3rd party tools to eliminate any of the data you do not want in there. *So it's not our problem!*”
🙄
.
(But if sensitive data is in there for even a short time, it's a risk!)
@gangrif @hacks4pancakes That's actually a really good idea. Just run a PowerShell script or something to delete the database and have it run every minute or so. Considering what Recall looks like right now, I doubt Microsoft has anything in place to prevent something like this.
@hacks4pancakes A long time ago, I saw a movie called "The Net", where multiple people's lives were ruined (including what was effectively an assassination) by surreptitious modification of digital records.
When this is being pushed to my work computer, I'm going to replace all screenshots will stills from spongebob the movie so it looks like I've been watching spongebob 24/7. Except they will know its tampered as Patrick Star will not appear without DRM protection.
@hacks4pancakes injecting something illegal without the user knowing which could them be viewed later by authorities during an investigation could be a real problem. Or maybe what's more likely to happen.... adverts appearing in recall.
If anybody is wondering what Microsoft's reaction to any of the Copilot+ Recall concerns are, they're continuing to decline comment to every media outlet.
I've seen comments MS staff have been given for enterprise customers, which are nonsense handwaving.
I do hope they understand that this strategy does not work with governments. You know, organizations that, believe it or not, really do have more money and more attorneys than Microsoft.
I'm wondering if this is going to be an every-generation thing where MS has to get slapped down HARD by people with the sole monopoly on legitimate use of force, only to slowly forget the lesson over the next two decades.
Or they could spend a tiny amount on due dilligence, but that's boring.
the fact they're standing behind it so adamantly shows that there's some major value that they're extracting from Recall. I can't think of an answer aside from collecting the data.
@kcarruthers Wait, I assumed Recall was something that was a year or two down the line? It was that fucking stupid and ill thought through I assumed it had to be just a concept at most?
It's actually going live to public this month? WTAF?
That's even worse than AI LLM's going public as prematurely as they have.
How did MS's lawyers approve this? How did nobody realise just how horrible it is before the public reaction?
This tool extracts and displays data from the Recall feature in Windows 11, providing an easy way to access information about your PC's activity snapshots. - xaitax/TotalRecall
Gets all users Recall folders and dumps them, then renames screenshots to include .jpg (unnecessary but helpful).
I cherry-picked the download_folder functionality from #320 and then improved it du...
Microsoft are making significant changes to Recall, including making it specifically opt in, requiring Windows Hello face scanning to activate and use it, and actually encrypting the database.
There are obviously going to be devils in the details - potentially big ones.
Microsoft needs to commit to not trying to sneak users to enable it in the future, and it needs turning off by default in Group Policy and Intune for enterprise orgs.
Microsoft is making its controversial AI-powered Recall feature optional. The changes come after security experts warned the feature could be a disaster for cybersecurity.
and then they can use the telemetry you can't completely turn off to see no one uses it and fire all the junior people who implemented it under directions from senior execs.
Sounds like they finally ran this plan past legal, and after having to administer enough sedatives to drop a herd of elephants, the attorneys managed to stop screaming long enough to put put a basic list of Things That Must Happen.
FWIW, policy analysts cost about 1/10th what an attorney charges per-hour. That's actually a pretty standard FAFO tax, if you think about it.
Using the modern encrypted and attested VMs would be a massive step. I feel like that would require too much engineering effort for them to implement though.
This might be the only page in Windows setup where there’s no primary blue button for the user to mindlessly click. I don’t know if MS can say “off by default” when there’s no default.
Better than nothing but why not make it even more explicit, like "remember this" and "remember next 5 minutes" button at taskbar, require explicit action from person to use that? Or even broadly, why that Recall feature has been pushed into people mouth at first place? Anyway, I will move to Linux soon.
Obviously, I recommend you do not enable Recall, and you tell your family not to enable it too.
It’s still labelled Preview, and I’ll believe it is encrypted when I see it.
There are obviously serious governance and security failures at Microsoft around how this played out that need to be investigated, and suggests they are not serious about AI safety.
this whole thing will remain a gold mine of data for everyone wanting to breach you... Storing this amount of data anywhere is a terrible idea on it's own, let alone the security Microsoft can offer.
I should be transparent btw that I took Satya and Charlie’s commitment to security at face value too - I even published a blog on it backing that up - and I have concerns (it isn’t just me).
They’re now going to have to win trust back about winning trust back.
@gsuberland Suicide Squad Kill The Justice League was an absolutely massive flop, as they made a product customers didn’t ask for nor want. Which.. well…
about the same here in norway from what I gathered. Less than 1000 sold so far (no idea if this was across the chain, region or that store specifically)
I really want to know how they're going to square this new and improved concept with the fact that it's going to literally be used in abusive situations to get a better hold on the victims.
I realize this isn't a solvable problem, but the fact that it never even apparently showed up on their radar as a potential abuse is...upsetting to say the least.
@namlaz so Copilot+ Recall isn’t Copilot (the branding sucks btw), and M365 Copilot is sold in EU. The European Comission and most of the EU regulators use M365, which is fun..
A reminder that a few weeks ago at RSA, Microsoft signed CISA's Secure By Design pledge... and then shipped an enabled by design keylogger that OCRs your screen constantly into AppData.
Edit: I should say that's less a reflection on Microsoft and more a reflection on CISA's Secure By Design pledge.. it's a good idea, but the scope is extremely limited.
showing the problems of very big organizations. Different incentives within, top-down alignment finds practical limitations, conflicting criteria (like ‚be innovative‘ vs respect privacy etc). Sometimes they would have to give up one for another but that means some teams in the org are „cancelled“
if you ask people whether they’ll design their products to be secure, they’ll say “of course!”. And mean it! Until…. Investors or customers want that feature.
I think MS are a way off extracting themselves from Recall situation they've got themselves into.
This is just one YouTube comments section on a video since the not-enabled-by-default change - 500k views - but there's loads more, similar on TikTok.
I imagine it's going to continue through week and into next week when the laptops ship.
I have heard rumblings MS are discussing trying to take action against me over the whole thing, which a) good luck and b) would be pouring petrol on the flames.
Trying to push garbage down people's throats, coating the garbage in sugar when people call it garbage, and then getting upset when people still don't want to eat it.
Some backstory - it's being reported Microsoft developed Recall in secret to try to avoid scrutiny. windowscentral.com/software-ap…
I'm hearing that various MSFT people are furious about how this played out over the past few weeks, which IMHO represents a serious lack of introspection.
From that article "Had Apple announced a feature like Recall, there would have been much less backlash [...]", yet when Apple announced a much less aggressive feature (it only scanned files which were going to be sent to someone else, instead of everything you ever worked on that device), the backlash was severe enough that it forced them to drop that bad idea.
I felt the feature was a stupid one, just from the amount of disk space I didn't want it to take up with useless screenshots I wouldn't ever be asking it to reference. But the security and privacy aspects should have made Microsoft cause some internal heads to roll.
That article isn't even good propaganda, I give it a C-.
But yeah, I suspect that this was kept secret from their policy and legal teams as well, because I'm going to assume that the people working on those teams are competent.
I also really, really, really want to know the gender makeup of the supersekrit skunkworks team that tested this. I mean, I feel confident in my hypothesis, but best to await confirmatory evidence.
If anybody is wondering, with a Copilot+ PC, you can still programmatically access the Recall database as of today with a few commands. Launch is a few days away.
In this bit he talks about Recall (not named), where he pats himself and Microsoft on the back for “a feature change” and job well done.
Given it has been a complete cybersecurity and privacy car crash - and as of today the changes (plural) they’re referring to haven’t even been implemented - it seems like Microsoft fails to grasp customer needs: safety.
One other thing - Microsoft's written testimony to the US House says, quoting, bolded by MS:
"Before I say anything else, I think it’s especially important for me to say that Microsoft accepts responsibility for each and every one of the issues cited in the CSRB’s report. Without equivocation or hesitation. And without any sense of defensiveness."
I should say that if Brad is asked about Recall tomorrow, the answers may raise some.. uh... eyebrows here.
I don't know what MS SLT have been told, but expect fun when the feature drops on consumer laptops in a few days.
As I mentioned in my blog, there is some more security hardening there on Copilot+ PCs (this was before MS put out their blog)... but it's still easily bypassable.
Microsoft President Brad Smith just testified to the US House that Recall is a good example of Secure By Design, and that they have the time to get it right (it’s supposed to launch in 3 working days).
Brad Smith just said Recall was designed to be disabled by default. That is not true. Microsoft’s own documentation said it would be enabled by default - they only backtracked after outcry.
He has somehow got almost every detail about Recall wrong while testifying.
I've been back and rewatched the Recall footage at the US House hearing and I just don't get it, Brad Smith representing Microsoft basically did this about Recall's security.. he had no challenge from the Senators as they didn't know any details.
I’m being told Microsoft are prepping to fully recall Recall. Another announcement is being prepped for tomorrow afternoon saying the feature will not ship on Copilot+ devices at launch as it is not secure.
Obviously, I’ll wait to see the announcement but it sounds like they’ve finally realised they need to take the time and get the feature right (and frankly consider the target audience - most home users, it ain’t).
They should have announced this before or during the US House hearing.
I can’t imagine how they got Legal to sign off on this, unless they *want* to give the EU another couple of hundred million in fines. I mean the theoretical maximum now is 12billion 🤷♀️
I have played with Ubuntu (really like DDE) and the second they retire Windows 10 and I have to have a Windows with recall, Windows is going in the bin and I'm full on Linux.
New features that are not connected to security should be off by default. If users want it they will turn it on, if they don't then that says it all. @0xThylacine
he won't be, he's the CEO and the chairman at the same time for one thing, and he's led something like a 500% share price increase since he took over. Plus, he likely didn't decide everything along the way.
Nobody needs to be fired, just maybe don't try to ship stuff like this enabled by default in the future, where it's clearly risky.
a man can dream. Nearly all enshittification of windows, office, and microsoft accounts are his doing. (I don’t work with Azure so I have no idea what’s going down there). He is the wizard of oz of pulling profit from users while abusing them.
But if this becomes a threshold moment, an infected wound where everything that’s shit about microsoft now turns people away, and keeps people away, valuation will freefall, Azure-AI or not.
@Kierkegaanks he definitely has a problem to manage now as they've just eroded customer so much over the past 5 years in search of inorganic growth.
I had a popup just now to change my search engine to Bing, where the options were basically 'change now' or 'change later'. It just all feels.. cheap and seedy.
the only comment I disagree with is the "Hey, I don't remember what I was looking at".
I think everyone eventually has a senior moment and thinks of a similar solution, but within seconds we dismiss such an idea as idiotic madness... like Microsoft should have!
Well, they Aren't suing you in Seattle (King County, WA) because we have Anti SLAPP. I'm reasonably certain you're not in East Texas (though they have a presence I'm sure) but you get that tossed for "Wrong Fucking Venue".
They made an aircraft with no fuselage and you pointed it out ... wah.
Who trusts them? They're idiots. Any upgrade might turn it on. And everyone - not just Microsoft users - is impacted by it. None of this is cast in iron. They'll turn it on if the FBI asks them to. There will be hackers figuring out how to turn it on. It adds to the waste of CPU cycles by their bloated operating system. It's garbage, as is management at Microsoft. They thought people were stupid to add it in the first place. They still do.
While that might be a nice partial interim success, #MicroSoft will certainly not stop sneaking on users - it s their business concept, and you dont need graphical snapshots to track a user. There s telemetry you cant turn off. Try run a #Windows PC without net connection (or blocking connections to the overlords), and you will know.
If I was strategic team at MS, I would have every possible statistic I could get on Linux adoption at the personal level.
I wouldn't know how to look into this, but I would bet a solid five internets that downloads of Ubuntu and other Linux desktops skyrocketed in the last week
Not necessarily installs, yet, but there's a pattern now set, where capitalists overstep a bit, and it triggers interest in alternatives (Hey Twi-umm, X, hey buddy...), and they will be aware of that too.
"Thanks for updating to Windows 11 Anniversary Edition [as if you had a choice]! Let's get your computer set up. Would you like to turn off 'disable the blocking of deactivating Windows Recall'?"
Can't imagine that crap ever being welcomed or enabled by corporates. I work for an FCA-regulated company, and privacy/security is paramount. If the techies can't turn that crap off, they'll start migrating from Win to Linux.
Microsoft, Google, Slack et.al. are basically shifting the overton window:
“we’re moving towards complete surveillance to train AI for you”
And after a public outcry:
“ok, we’ll only do partial surveillance but it’s set to default opt-in”
I can still predicted some phishing attacks will mention that they got all your dirty secrets using Windows Recall and if you don't pay Bitcoin they will sent it to youe family, thanks Microsoft.
@evacide I’m not sure if that’s true, honestly, as the public reaction to the feature was overwhelmingly negative.
The other thing is I couldn’t speak to the privacy implications as I just didn’t know enough about that - so I’m glad you and others did.
Microsoft will have known the problems with this one and they just.. tried to do it anyway. It’s really worrying I think as it signifies a feeling of a blank cheque with AI.
@evacide I think that's absolutely the attitude. The starting shot of this technology was that they assumed a blank cheque for ignoring millions of people's copyright and/or licenses.
@Kensan @evacide there is constant internal dissent at Microsoft, directed into Yammer. One problem here it didn’t stop it being rolled out at Build to the world’s press, by which point laptops were in boxes.
That’s not a healthy security or privacy culture. This was Microsoft execs queuing up to score own goals and high five themselves, at the expense of their own customers.
My bio on Twitter is literally “portable toilet cleaner” and I had to publicly unpick things with others.
@evacide That’s what I suspected… How this whole thing came about reflects on the company culture is what I find more disconcerting than the actual feature itself.
@mjausson@mastodon.design @hacks4pancakes@infosec.exchange That is what I find alarming: Microsoft has very smart and capable people but somehow concerns were pushed aside and the product was implemented and approved as it is being dissected by exter…
@Kensan @evacide Managers and investor types are infatuated with AI right now; it’s the only question that gets asked of any new product, service or feature proposal. I know nothing about MS but I can see how security/privacy concerns were overruled.
This is ask for a penny, settle for a half penny strategy. Recall is still in there so they got the thing they wanted by promising it is only on if you turn it on. I mean, they wouldn't lie to us would they?
Reply auf einen Boost mit Kontext: Nein, ich glaube nicht, dass Microsoft nun total super ist und wir uns alle bedenkenlos Windows 11 holen sollen. Mein Vertrauen ist weg und bleibt weg. Aber da ich die ganze Sache mitverfolge und regelmäßig dazu was teile, teile ich der Vollständigkeit halber auch diese Neuigkeiten. Microsoft rudert zumindest teilweise zurück, weil genug Leute geschimpft haben
And because they are useless morons they will enable it again next week without telling anyone. Trusting Microsoft to do anything but screw users or companies over is ... similarly moronic.
So months/years in development and we're asked to accept that mere days/weeks after it was announce Microsoft have re-engineered it to make it safer and more secure?
Or, and hear me out, did MS always intend this as the end-result but have made it more palatable by giving us the shittest possible implementation first? The ol' Ask for Lots, Settle for Less philosophy.
"Hurrah Microsoft have Listened!"
Have they fuck. Don't fall for this. We've been played.
@R0B0_G0D oh there’s definitely some of that going on.
Some of the features they’re talking about were in the product before the blog - I haven’t got into that yet as said features don’t actually work properly, I don’t think they realise. The launch will be a car crash still. But at least it’s not on by default.
They also need to make it possible not to install it at all.
Functionality which is installed but turned off is too easy to get accidentally or maliciously enabled, and non experts have no way of determining if that has happened. Same issue as always connected microphones. You don't make a software switch to fix that. You make a hard switch or a separate disconnectable component.
I hate to be that guy but this is a known Microsoft playbook...
1. Advertise something awful that people hate 2. People spread the hate online 3. Microsoft acts as a good guy and tones it down a little bit so people can say that they changed and they are the good guys even if the new way is still awful 4. In a couple of updates return to the original proposal silently
@gloopsies I don't think they're going to be able to return to the original intent for various reasons still in motion, Microsoft have set themselves on fire with this one on multiple fronts.
What I’m anticipating are the scammers who infiltrate data INTO the Recall database, or claim to, then try to extort the user. “Hi, my bot infected your computer and now I see the nasty stuff you did at Recall timestamp yy:mm:dd hh:mm. Send me BTC and I’ll forget, else I tell your employer.” Or any number of extortion possibilities. Seems more and more like Recall was conceived by AI.
Copilot will watch you use a computer. It will learn how you use your computer. Then Microsoft will offer your company a license deal, replacing labor. That ignites a rebellion, and in the process we kill both Microsoft and Capitalism. We invent a better world to replace it. Because we finally saw what greed does to us and we don’t want to look at the reflection of that any longer.
Don't worry, it will be fixed on Patch Tuesday. Besides, there's no chance that a malicious actor would be able to leverage this exploit. It's all cool.
I love the time line on this 1. MS: this is gonna be sooo great. 2. Everbody: Nah man, that's creepy GTFO 3. The hacker sceen: this gonna be great. We gonna rip this to shreds. 4. MS: no, no, this all super secure and private and local only. Trust me bro. 5. Hackers continue to rip into the thing like it's butter.
is it really established that this database won't be somehow better protected on official release? Like having the complete engine running in another VM implying that from now on windows will run as a VM on a hypervisor. For me that's the only way to have it at least a little protected.
I saw on bighard's website that they're rolling this Copilot out to Win10 as well but it's not clear if Recall will be on there? Have you been able to find anything on that aspects of this? Thanks again!
Windows is the first PC platform to provide centralized AI assistance for customers. Together, with Microsoft Copilot, Copilot in Windows helps you bring your ideas to life.
How much space does the whole thing waste? I get it that the SQL database with the texts is small - but what about the screenshots? If they are taken every 5 seconds, they probably waste an enormous amount of space...
@bontchev it uses at least 50gb of space. On a 512GB SSD, the default storage allocation will be 75GB, and if you have a 1TB SSD, the default space allocation will be 150GB.
@bontchev it's quite funny as it scales up too - so say with a 1tb drive, it's on by default and allocates 150gb - which is enough space for well over 6 months of screenshots. So, like, a lot of machines are going to have a lot of history.
My favourite part about the whole thing is that it is apparently still not enough to provoke an xz-like "immediately stop using computers until further notice" advisory.
"Yes. You can change the OCR database and change the screenshots as the logged in user or as software running as the local user. There is no audit log of changes."
One of the very first tasks I had to do at Microsoft was implement an audit log for a service that was used by maybe 200 different people (or groups). It was considered important!
Good thing Windows isn't used by more than 200 people, or
@maswan snälla säg att hela det här debaclet går att använda för att puckla på ITS om UmUs Microsoftberoende. Det är väl ändå uppenbart att de inte går att lita på för fem öre åtminstone när det gäller dataskydd?
"FakeMemoryRecall is a handy Rust application that alters the Windows Recall history, inserting screenshots that show Tor Browser being used to access CP sites. Have fun & use responsibly!"
This tool extracts and displays data from the Recall feature in Windows 11, providing an easy way to access information about your PC's activity snapshots. - xaitax/TotalRecall
I love how they thought that a "disable collection" setting should also unintuitively "delete all collected data". They really didn't think this through at all, did they?
* "... says admin access to the system isn’t required to read another user’s Recall database. "
* "Another user with an admin account can easily grab any other user’s Recall database and all the Recall screenshots by clicking through a simple UAC prompt. "
Next to each other. I get they want clicks through sensationalism, but wtf, this needs correcting.
Holy crap how does it keep getting worse? I feel like next week someone's gonna be like "oh, by the way, it autouploads all the screenshots to your instagram"
As many others have said, isn't this how the permissions model in Windows works? Of course admin/root can access any user's files by going through the proper process. That part is no different from reading another user's browser cookies. Moreover, other than secure enclave/TPM/etc, an adversary who has root/admin can break the security of any lower privileged application. I still think Recall is a bad idea.
@iampytest1 that's great but don't tell me, tell Microsoft. They're insisting to customers it is encrypted per device and per user, and nobody but the user can access 'their' Recall.
when Android uses on-device storage with AI computing (eg., Now Playing) Google says it doesn't need to have anything appear on your PrivacyDashboard ... or even display the MIC indicator any more 😬
* something-something private compute core, and "privacy-preserving analytics"
Not to be a mindless conspiracist, but this debacle can hardly be accidental. What are the chances that this was a siloed development for increasing the MS market where interest in AI and repressive authoritarianism go hand in hand, ie the Gulf states? Clearly it was kept secret from the security teams etc, but got all the way through to RTM.
Off topic, but as a casual user of Windows (pretty much exclusively for games) is there a current best tool for removing/blocking all the existing telemetry?
It's been a while since I did the research and I'm getting the "let's set up your computer [ad preferences]" popups again.
I'd be interested if anyone in thread has recommendations
it's the first time I can genuinely say that I'd rather switch OS for the first time in my life, rather than buy anything that includes this steaming pile. Absolutely embarrassing for Microsoft to vandalise their own brand like this.
What are the (so far) considered countermeasures to Recall?
e.g. if you have an addon showing a 1x1 drm in all browser pages (wildvine demo or similar) does Recall still record the entire browser page (for “not-Edge” browsers)?
e.g. if you deliberately mangle the sqlite database file does recall stop adding to it?
I am curious what countermeasures are already considered by others.
They are absolutely crashing the Windows brand. I'd already been planning that my next computer was going to be Linux just to save a little money, but now it's just not even a question. Linux isn't just cheaper and easier to install, now it's the only OS I trust not to record private intimate discussions, much less PHI.
After I left Twitter, I hadn't seen much from Paul anymore. Now that's he was in my Threads, it seemed like he'd gone the MAGA way with what he writes.
Oh well. Unfollow & thanks for all the years of funny #Microsoft keynote shitposts.👋
Nice discussion in this thread, but I just wanted to say those are some great screenshots: nice cropping, great quotes in the visible subs and dense with information. With alt text this would've been 10/10
Gonna be a laugh riot* when bad actors figure out that you can also remotely plant evidence in Recall that someone did something they didn't, eg view CSAM.
*it will not, as this will further erode public trust in anything and only help awful people, even low-tech CSAM traders who will have plausible deniability
I really wonder what is going on right now inside the cyber risk divisions of insurance compagnies. At first I guessed they would impose disabling Recall for all cyber insurance policies, but it seems it is not enough. If they decide not to cover incident using Recall in any way, their policies will become mostly useless; if they don't, they will be either too expensive or ruin them. I don't see a good way this can end, and we don't need insurance companies go burst right now.
I have no knowledge of $COUNTRYs regulations for stealing data. But this seems like one could argue under certain circumstances that MS was complicit in such acts if they occur and can be traced to this feature. And in the most clandestine way.
Also, the line 'Windows is a personal experience.' took me some time to comprehend. I'd very much disagree. Completely off topic here but that statement confused me.
@paezha @WizardBear Tech journalism wasn't always stenography: but Craigslist and then Google's advertising business killed the business model the magazines depended on, so the owners cut back the spending on editorial overheads until all they could afford to do was cut and paste press releases instead of actual journalism. (I got out of computer journalism in 2006; the writing was already on the wall.)
My personal guess as to why they're doing it is not to help their users. Windows 11 makes its money by showing ads, which can be targeted by data-mining user activity. I honestly think that the entire "it can help you do X" thing is an excuse to sell targeted ads.
Also hardware makers pushing for more new features in Windows that mean you need new hardware for it to run on, so they can profit form the upgrade sales.
So … I'm easily gleeful to hate on recall for a host of reasons.
But – I really like the idea, as a feature, in principle. Or at least, something pretty adjacent.
I want to be able to look back through what I've done and I want to be able to search through that. I love even the dumb page history in Safari and I wish it worked better helping me find fuzzily from page content.
I love knowing the music I've heard recently.
I'd love much more of this.
But there seems to have been so little thought to safety put in the Recall.
And while "yeah – wang an AI in there" makes it kind of work from screen grabs, I feel like a real solution that had some semantic understanding of my history could be far more powerful.
I'm happy with my, properly secured personal machine, to keep intimate history of what I've done with it and help me search that. I'd have a system wide and very apparent incognito mode as necessary. But a feature like that needs _a_lot_ of care.
Yeah, I suppose there are a lot of ignorant people in Carpetland, but I could explain this to a five year old - you could, too. Once they get the gist of what MSFT is doing, they will shriek like little girls.
so, ... your image analysis technology and your NPU HW are now so efficient that you don't even notice the power impact of doing this continuously in the background, and this is the only use case you could come up with?
Which means, I suppose, this is something they always wanted to do but was prevented because sending those images to the cloud for processing is clearly much worse.
Perhaps, when their privacy/security teams told them that it was a bad idea to process user screenshot images in the cloud, designers of these features assumed it would be OK to do it locally. And when they overcame this largest objection, other concerns must have seemed ... fine, in comparison.
Security/privacy teams are rarely in a position to kill off entire features, so this was most likely some kind of a compromise.
On a related note, a lesson I had to learn the hard way is to not push hard on the biggest security/privacy issue to the exclusion of others. If/when it somehow gets resolved, you look like you are trying to make excuses when you bring up the remaining concerns "but ... but ... domestic abuse".
WHY Aren't The Corporate Lawyers Lined The Fuck Up in 56th St. with Belt Sanders?!? I usually occupy a "Director of IT" role and I would be dragging my company's legal team with pitchforks and plasma cutters to Redmond (if I didn't live here and it wasn't a short walk and I actually worked for someone else that I oddly allowed to have Windows machines on my network).
this all broke just as I was about to upgrade an end user’s computer who is living and working with neurological complications and something to help her with basic computer operation would have been fantastic . When she gets in a bad place she either goes down 20 blind alleys, gets mad and pto’s out, or calls me. And the calls end up being an hour minimum as her comprehension either clicks in or not . A constant coach would have been great for her
In addition to security concerns, do you know if there are any study in term of cost of energy driven by Recall ?
Just imagine the ecological price of 1.4Giga (billion )computer burning, let say 10watt for recall... And it will be active during activity. Let say 3000h per day per computer.
14 GigaWatt worldwide × 3kh ... 52 GWh... This is an ecological nightmare.
A general comment on corporate nature--they will abuse this info (even if by some fluke it doesn't leak like a sieve). It's only a matter of time. It's in their nature to abuse any collection of personal data. Any corporation that doesn't loses profit.
The OCR thing isn't new, of course--years ago I searched my Google Drive for "fish" and the first hit it found was a photo I took on my phone, not tagged or renamed, of a shop sign "WEIRD FISH".
unbelievable that they did this before shipping a good clipboard buffer. Almost everything Recall is supposed to do would work just as well, if not better, if it only collected data from the clipboard, with blocklists for apps like password managers.
Maybe there's more going on behind the scenes, but other than the OCR, what part of this has anything to do with "AI?" Or is that Microsoft's way of trying to put an already questionable color of lipstick that its shareholders like on a really ugly and dangerous pig?
OMG - I expected it, but still I'm shocked. If I assume negligence, I can be fined up to 250000 CHF - just by having client data on my screen. Somehow I'm hesitating seeing this as a desirable feature.
Why can't they just make an improved version of searching in/with the browser history ... argh...
Porcodio Aruba se fai schifo al cazzo. La verifica in due passaggi solo sulla tua app di merda e l'assistenza online che alla prima domanda sparisce e non si fa più sentire. Dovete morire male 😡
È vero che la pec costa poco, ma il servizio fa schifo in modo assurdo.
@d10c4n3 no, mi dispiace, usare i metodi da squadraccia e piagnucolare dopo che ti han preso fa di te un fascista. Puoi usare le parole quanto vuoi, il duck typing fascista risalta
Domenica 19 maggio (questa, per capirci) a Trezzo si terrà il concerto Adunata Feudalesimo e Libertà dei #BardoMagno. Dal momento che è stato hackerato il loro account su YouTube, hanno diramato - sempre su social brutti - l'appello a spargere la voce e seguirli comunque, sostenendoli per quanto possibile. Nell'attesa che si decidano a usare social decenti, io posto questo toot e vi rimando a quello da cui ho appreso la notizia, con tutti i dettagli livellosegreto.it/@Spazio/1124… #musica #storia
Per chi non usa social brutti condivido gli screen della pagina instagram del gruppo musicale #BardoMagno a cui hanno hackerato il sitoYoutube. Sperano di riuscire a recuperarlo perché il video della canzone che hanno dedicato al professor #Barbero aveva più di un milione di visualizzazioni. Spammate al grido di "andiamo a bruciargli la casa"
Do I understand correctly that you are using Gstreamer for encoding? In that case it might be worth checking out gitlab.freedesktop.org/gstream… which implements HW encoding. Getting that over the line could be a big deal here - and for other apps like Snapshot or Dino as well.
This is a working prototype of V4L2 stateless VP8 and H.264 encoder support. This has been prototyped on an Hantro H1 encoder. Note that none of this work...
@rmader that is the idea yes, gstreamer will make integrating the HW encoders a lot easier.
For the pinephone I need cedrus though, not hantro. Looks like there's a bit more work happening on the hantro side so thats good for the PPP at least.
Also the librem5 if I'm not mistaken. I also hope it will just be compatible with cedrus though - the h264 decoder seem to work somewhat well here, even though we'll need to support more tiling modes / drm modifiers in Gst to make it really fast. Don't know about the kernel side of the encoder though - do you know if it generally works?
@rmader as far as I know for cedrus there's only some support for decoding H264. And not all H264 profiles even. It has been a while since I looked it up though.
Thanks for the writeup . There's still more work to do, frames are being dropped in the C code on my pinephone way too often. That needs to be solved before we know what kind of performance is possible.
@pavel I wonder if it's possible to skip disk I/O between the megapixels and the movie postprocessor altogether by just feeding the frames over stdin. A lot of small things still to optimize :)
If we really wanted to optimize it, we should make dmabufs cacheable and then pass those around. But I'm afraid that would mean less nice code . Cacheability would help a _lot_, passing memory around would be theoretically nice but not that much of a win I believe.
@pavel If I wanted to have nice code it would be way slower already. In theory it would even be possible to hook up the CSI block of the A64 to the cedrus block directly to have the video encoder work without using cpu at all. but that would be very platform dependent and that's also very undocumented.
All I can say is thankyou, thankyou thankyou for your work on this and helping to galvanize and co-ordinate a burgeoning community around getting mainline mobile Linux photography moving forward.
Questo sito utilizza cookie per riconosce gli utenti loggati e quelli che tornano a visitare. Proseguendo la navigazione su questo sito, accetti l'utilizzo di questi cookie.
infosec.exchange/@malwarejake/…
. There's still more work to do, frames are being dropped in the C code on my pinephone way too often. That needs to be solved before we know what kind of performance is possible.
. Cacheability would help a _lot_, passing memory around would be theoretically nice but not that much of a win I believe.
