Technology

The damage is mitigated by the fact it only recalls last 3 days by default

No major corp I'm aware of is excited about these changes. Legal especially would like there to be the minimum records retention required by law, and a months long AI searchable database of individual user actions on a PC is a nightmare scenario for them.

It's encrypted; the author is pointing out that it has to be decrypted to be used, and then the data can be obtained.

Security and privacy concerns aside, I saw someone commenting on the use case, asking who would ever want something like this.

One problem I hadn't appreciated for a long time was that some people apparently have real problems with dealing with the Windows UI in terms of file access. They don't know where their data is being saved. This, in my opinion, is in significant part a Microsoft UI problem induced by various virtual interfaces being slapped on top of the filesystem ("Desktop", "My Documents", application save directories, etc) to try to patch over the issue that the filesystem layout was kinda organically-designed in a kind of cryptic way back in the day.

But if you can remember a snippet of text in what you were working on, you can find that thing again even if you have no idea where you stored it. Like, it's content-keyed file access.

That's not very useful to a techie. They know how to navigate their system's filesystem, and even if they lose track of a particular thing, they know how to use the system's filesystem search tools to search for filenames or content. They can search for recently-modified files. They know how to generally get ahold of stuff.

But for the people who can't do that, reducing their interface to a single search box might make file access more approachable.

Now, let me reiterate that I think that a whole lot of this is Microsoft repeatedly patching over UI problems they created in the past rather than fixing them. And they've done this before over the decades with stuff other than document access. It's hard to navigate the filesystem to find an installed program a la the MS-DOS era, so they stick stuff in a Start Menu to make it more accessible. That gets too crowded, installers start slapping shortcuts on the desktop. That gets too crowded, installers start adding system tray icons. That gets too crowded, the Start Menu becomes searchable. Each interface just becomes progressively less-usable and the solution each time is to stick a new interface in on top of the old one, which in turn contributes to the complexity of the system as a whole.

But that doesn't mean that they aren't trying to address a real problem.

I think that they'd do better with something like having a rapidly-accessible log of recently-accessed files (like, maybe have the filesystem maintain a time-based doubly-linked list of those) and be able to rapidly search the content of documents based on mod time so that recent stuff gets hit quickly, then trying to make their existing search tools more accessible. That doesn't replicate data across the system and produce some of the problems here. It also permits for fully-searching content, rather than just the stuff that was on a screen when the Recall system grabbed a screenshot and OCRed it. Maybe they've done something like that in recent years; I'm many years out-of-date on Windows.

I'd also add that I think that personal computer systems in general would benefit from giving users better control over where their data is replicated to. It's kind of confusing...you've got swap (well, encrypted swap probably helps somewhat with this). Browser history. Any clipboard manager's retention. Credentials stores. Application-saved copies of in-progress files. Various caches. If you use some kind of cloud-based storage, you're pushing data out to other computers. Backups. Just a lot of state that can be replicated all over the place and is hard to go back and track down and remove. That's even before stuff like issues with doing secure deletion on existing filesystems (which we had a conversation about the other day, everything from log-structured filesystems to wear-leveling on SSDs inducing data replication). If you want something definitely gone, be able to manage your data's lifetime, something that I think that a lot of people -- even non-techies -- would like, you really have to have a lot of technical knowledge of the system's internals as things stand today. This Recall thing is egregious, replicates data all over, but it's far from the first feature that makes it harder for people to understand and control the lifetime of data on their computer.

I don't think that the software world has done a great job of letting people control that data lifetime. And I think that it's something that a user should reasonably be able to expect out of their computer.

Are you... Are you saying EVERYTHING can be hacked with one line of code?

I did an interview where the candidate said that if it's one line, it runs in constant time. And they were completely serious. And this was in the context of Python list comprehensions.

They claimed this ran in constant time:

new_list = [value for value in my_list]

Whereas this ran in linear time:

new_list = []
for value in my_list:
    new_list.append(value)

We asked clarifying questions, like what happens to the runtime if the list gets really large, and they doubled down.

And this was for a senior Python dev position... No, they didn't get the job.

Being super smart and super evil are NOT mutually exclusive. Intelligence =|= morality.

There cant be.

It literally screenshots what you're doing every few seconds, and builds a plain text database of any and all text it captures.

Incognito mode is not having it installed.

Maybe in the future it can be used by managers to keep an eye on what their underlings are doing at all times. I suggest calling the manager's remote version Microsoft Panopticon.

Ultimately privacy is part of security so, if anything, everything you mentioned is just more reinforcements that this is a major security concern.

As someone that has been obsessed with tech since being a kid in the 90s I think the tech side of this is super cool and very exciting stuff. As a user, though, I only like this if I'm the one implementing and using it. I do not trust a mega corporation (or really any company) to "leave it locally on my computer and totally not use that data for other purposes". Right now it's supposed to be (as far as I last heard) only on your machine but we've seen EULAs and TOS' etc change many times over the years but especially over more recent years as data continues to be king and data like this is a literal bottomless diamond mine.

I know this isn't your point but it's just worries I have in addition to your points. And let's not even start about what this means for law enforcement abuse. No thanks, I'll wait for a FOSS equivalent that at least gives me and the community the opportunity to evaluate how it works.

I follow Kevin on Mastodon. He’s the real deal and is absolutely not interested in the clicks or outrage. He’s trying to make it accessible.

Did you read the article?

This system basically do a character recognition on EVERYTHING the user is displaying and save the results in a very small file not that well protected.

The data is very small (I guess because it's basically text?), seems easy to find. That means the history of all you did on your computer (apparently only for the last three feays by default,but well...) can be stolen at once, in a minuscule file.

I'm not an IT specialist, but I don't see in which world this can remotely be a good idea...

Are you braindead? Yes yes taking regular screenshots of the desktop can't possibly be a security risk, right?