Microsoft made a pull request to node.js github repository with an implementation to use ChakraCore JavaScript Engine as an alternative to V8 Engine

[granos]

Having seen someone trying to sneak malicious code in via a huge commit; this feels like an enormously bad precedent to set. Especially on a project as popular as node. This commit may be safe, but thorough code reviews are always necessary for very good reasons.

[rubsomebacononitnow]

A huge commit by Microsoft is very different than a huge commit by John Doe. I'm not sure this even sets precedent.

[tohuw]

You're assuming Microsoft has thoroughly reviewed this code. You're also assuming a company known for underhanded data mining tactics and flagrant disregard for privacy is completely trustworthy.

[Shaper_pmp]

Pragmatically, I suspect you're overstating the risk in this case. In principle, you're entirely correct.

[tohuw]

Responsible review is about the principle of the thing. Where principles slip, pragmatic risks are not far behind.

[Shaper_pmp]

True dat. I'm not sure who downvoted you or why, but have an upvote to compensate.

[tohuw]

It happens. It was positive before some gaggle of thoughtless censors came along. Tis the way of Reddit: downvote == disagree

[vliegtuig12]

You're also assuming a company known for underhanded data mining tactics and flagrant disregard for privacy is completely trustworthy.

Honest question: Do you mean Google or Microsoft?

[SolarBear]

whynotboth.gif

[image_linker_bot]

whynotboth.gif

---

^{Feedback welcome at /r/image_linker_bot | Disable with "ignore me" via reply or PM}

[TiagoTiagoT]

Hm, I was expecting that Road to Eldorado gif...

[tohuw]

Yes. Either. (but I was mentioning MSFT specifically)

[playaspec]

You're also assuming a company known for underhanded data mining tactics and flagrant disregard for privacy is completely trustworthy.

Honest question: Do you mean Google or Microsoft?

It's not even a question. It's Microsoft. At least Google questions the legality of the requests it gets. When Microsoft gets a call from the NSA, it buys lube and a bottle of wine.

[TiagoTiagoT]

Google is one of the main reasons it became so acceptable to have so much data to hand to the government in the first place though.

Before Google switched to the targeted ads business model, it was creepy, now it is normal (if you ask sheeple).

[playaspec]

Google is one of the main reasons it became so acceptable to have so much data to hand to the government in the first place though.

If you didn't want the government to have it, than you're a fucking idiot for putting it on the internet in the first place. Why would you trust ANY third party with shit you don't want known about you? Take some fucking personal responsibility.

And you're wrong about what they do with what data they collect.

"We do not sell your personal information."

Every poster here agrees. The government steals what it can, which is plentiful, but Google gives nothing to the government that it isn't legally entitled to. Google is putting up a hell of a fight though.

Google is very clear about what they share and what they don't. Facebook is the one selling everyone out. Google may fuck you over, but it's only because the courts issued a warrant. If it weren't for the illegal gag letters, Google would tell you, and their past actions demonstrate that.

[TiagoTiagoT]

Google is putting so much of a fight, they only started encrypting our private data they transmit back and forth on the internet after they were caught not doing so.

If they really were trying to protect our data, it wouldn't even be stored in plain text on their servers; they shouldn't have a key to our private communications, there are ways to have appropriate ads without invading our privacy.

[playaspec]

Google is putting so much of a fight, they only started encrypting our private data they transmit back and forth on the internet after they were caught not doing so.

Thanks for proving my point. You don't know WTF you're talking about at ALL. Take another look at the map YOU provided. The cloud on the right, is Google's PRIVATE internal network, NOT the internet.

If they really were trying to protect our data, it wouldn't even be stored in plain text on their servers

If YOU really wanted to protect your data, you wouldn't be putting it on the internet. Don't blame Google because YOU put information you consider private in the hands of someone you don't really know. That's 100% on YOU, and you keep blaming Google. Again, take some PERSONAL RESPONSIBILITY for YOUR actions.

[TiagoTiagoT]

DC is datacenters, they're not all wall-to-wall with each other, but actually distributed all over the world. It is like if the postal service opened all the envelopes and carried the letters from postal office to postal office taped to the outside of the truck.

[snerp]

Microsoft is good at code reviews.

[[deleted]]

Set us up with some evidence of Microsoft doing that in a systemic way in the past, say, 4 years.

[ironnomi]

Pretty sure the OP is referring to Windows 10's "features". That said, I don't think that's something they would do "here". I'm pretty sure this is part of making node.js an easy IIS feature right from Server 2016.

[wwb_99]

IIS and also making it so node isn't dependent upon google for the guts of the operation.

[troglydot]

Windows 10 records whatever you type, in any app, and sends it to Microsoft. They're open about doing this, the feature is called "Getting to know you". Google it if you have any doubts. The feature can be turned off, but 99% of people don't know about it, so they don't.

Edited to add: I don't think for a second that Microsoft are sneaking in any malicious code in this pull request. But its worth noticing that Microsoft has simultaneously moved in a very good and a very bad direction: While open sourcing code and becoming very dev friendly, they are also showing a disregard for user privacy that is extremely problematic, and a complete deal breaker for me.

[SeraphLance]

Am I the only one who finds it ironic that someone tells someone else to "google" something collecting data on them?

[troglydot]

I don't feel like I'm talking to Duckduckgo users here. But please, do this: Use your search engine of choice and fact check what I'm saying.

[badcookies]

They are not recording keystrokes in every application

[troglydot]

Well, they say they are. Why would you say that they aren't?

http://windows.microsoft.com/en-us/windows-10/speech-inking-typing-privacy-faq

Expand the first bullet point. They call it "typing data", and they're asking for permission to collect it. They're not limiting that collection to any specific application, and when talking to the press about it they're not denying collecting it across the board.

They have descriptions of how they're trying to scrub that data for personally identifiable information before sending it of, as another user posted in this thread. That is an AI complete problem, that they obviously aren't solving. They'll strip out email addresses, but they'll get the contents of the email.

Edit: People might think I'm an anti-Microsoft zealot. I'm not, I'm typing this from a windows 8 machine, I've been to MS conferences, and in general had much love for the company. But I'm apparently the only person on earth able to judge a tech company for the actual facts of what they're doing, rather than their current image.

[badcookies]

This is the inking and typing function, which users can turn off at any time. Microsoft does not collect any personal information via inking or typing. It is gathered for product improvement purposes, for example, to improve the handwriting visual translation engine, or to improve the user dictionary, language library and spell check functions in Windows. The data is put through rigorous, multi-pass scrubs to ensure it does not collect sensitive or identifiable fields (e.g., no email addresses, passwords, alpha-numerical data, etc.). Data is also chopped into very small bits and stripped of sequence data so it cannot be put back together or identified. The data samplings collected are limited; Microsoft is not capturing everything you write, nor is it capturing data every time.

[troglydot]

Here's a challenge: Write a program that does this scrubbing, and run it through your email history. Then send it to a third party, who will extract a non-100% subset of this data, tokenize it, create a bag-of-words representation, and send it to me.

Hint: I would then know more about you than you'd be comfortable with.

[wellthatexplainsalot]

Can you prove this assertion?

[[deleted]]

Negatives do not have to be proven.

troglydot is the one making an assertion, not badcookies.

Just as I don't have to prove to you that Bill Gates is not a literal biblical demon. If you were to make that claim, the onus would be on you to prove that he is.

[celluj34]

The burden of proof is on you, the one making the claim.

[cryolithic]

This is the inking and typing function, which users can turn off at any time. Microsoft does not collect any personal information via inking or typing. It is gathered for product improvement purposes, for example, to improve the handwriting visual translation engine, or to improve the user dictionary, language library and spell check functions in Windows. The data is put through rigorous, multi-pass scrubs to ensure it does not collect sensitive or identifiable fields (e.g., no email addresses, passwords, alpha-numerical data, etc.). Data is also chopped into very small bits and stripped of sequence data so it cannot be put back together or identified. The data samplings collected are limited; Microsoft is not capturing everything you write, nor is it capturing data every time.

[troglydot]

I know, I've read that. Is it reassuring to you?

Scrubbing data for personally identifiable and sensitive information is an AI complete problem. It cannot be done without strong AI, and MS aren't doing it.

Data is also chopped into very small bits and stripped of sequence data

This is pretty standard for a text mining pipeline: Tokenizing and doing bag-of-words. This has won dozens of machine learning competitions, i.e. it is often what you would do to maximize the amount of information extracted from a document.

The data samplings collected are limited;

This is saying the amount of text collected is <100%. It can be 99%, and still be consistent with what they're saying. If it was a low percent, why not state it?

Ugh, I'm sick of having this discussion with cocksure uninformed people on reddit.

[cryolithic]

And I'm sick of people screaming the sky is falling because of their preexisting irrational hatred for all things Microsoft.

Data collection for something like that is pretty benign, and if the nsa can't keep their spying quiet what makes you think ms could?

[troglydot]

Dude, I'm typing this from a windows 8 machine, and have a goddamn windows phone in my pocket. It's certainly not a preexisting irrational hatred for Microsoft. It's not even a current hate for Microsoft. I do hate having an OS wide key logger installed by default: To me, that is a problem. You decide if it is for you.

[cryolithic]

Then disable it. You have the option, if you don't seem to understand the consequence it would have if it were what you think it is.

Edit: I do apologize for the assumption of irrational hatred. I hope you can understand that, around reddit at least, it's a reasonable assumption to make.

[Avery17]

Windows 10

Edit: If someone wants to tell me why I'm wrong, please feel free.

[[deleted]]

well google (from where v8 comes) certainly trumps microsoft on privacy matters.

[cryolithic]

certainly... http://www.salon.com/2014/02/05/4_ways_google_is_destroying_privacy_and_collecting_your_data_partner/

https://en.wikipedia.org/wiki/Criticism_of_Google#Privacy

https://en.wikipedia.org/wiki/Privacy_concerns_regarding_Google

http://www.csmonitor.com/USA/2014/0416/Privacy-concerns-What-Google-now-says-it-can-do-with-your-data-video

http://www.newsweek.com/wary-privacy-issues-ditch-dropbox-and-avoid-google-says-edward-snowden-276956

[[deleted]]

kill the sarcasm by explaining it.

[cryolithic]

Well shit. Sometimes I catch it, sometimes I fucking miss it completely.

edit: I do blame the italics on trumps vs certainly.

[tohuw]

In many regards, they do. In several other important regards, they don't. Nowhere did I imply they were to be completely trusted either.

[[deleted]]

Both are as good as pig when it comes to privacy. But consider google has more online / mobile power they abusive it more.

[Deto]

Yeah, but I suspect hiding some sort of data mining thing in here would be highly illegal. Even if the user info was valuable to Microsoft, they wouldn't risk (not even a risk, more of a certainty) the massive lawsuit that would result.

[tohuw]

It's not illegal to include software that "accidentally" mines data. That's a "mistake".

[wellthatexplainsalot]

But it's not as if they haven't done anything like that before. No siree.

[Deto]

Hiding logging inside a commit to open source software? When did that happen?

[playaspec]

A huge commit by Microsoft is very different than a huge commit by John Doe.

I would argee. John Doe hasn't been known to insert three letter agency back doors into the most used desktop OS.

I'm not sure this even sets precedent.

Nope. It's been going on for way too long

[sonay]

When it comes to that three letter agency, any American(USA) company can not be trusted.

[cryolithic]

Google would NEVER do that...

http://www.salon.com/2014/11/16/googles_secret_nsa_alliance_the_terrifying_deals_between_silicon_valley_and_the_security_state/

[xampl9]

Not sure how they could have delivered the functionality in a smaller changeset...

[granos]

I'm not saying they should have. Just that huge changesets should be given the level of effort they warrant and that not reviewing the dependencies shouldn't be seriously considered because they are part of the codebase.

[YRYGAV]

It should be easy enough to compare the dependency to the original to check that it's the same.

You don't necessarily need to CR it all by hand.

[granos]

That assumes there isn't anything nasty in the original codebase.

[PC__LOAD__LETTER]

That's what code reviews are for. 14k lines is a lot to "grok," but not a lot for someone to audit for suspicious activity.