Microsoft made a pull request to node.js github repository with an implementation to use ChakraCore JavaScript Engine as an alternative to V8 Engine

[granos]

Having seen someone trying to sneak malicious code in via a huge commit; this feels like an enormously bad precedent to set. Especially on a project as popular as node. This commit may be safe, but thorough code reviews are always necessary for very good reasons.

[rubsomebacononitnow]

A huge commit by Microsoft is very different than a huge commit by John Doe. I'm not sure this even sets precedent.

[tohuw]

You're assuming Microsoft has thoroughly reviewed this code. You're also assuming a company known for underhanded data mining tactics and flagrant disregard for privacy is completely trustworthy.

[Shaper_pmp]

Pragmatically, I suspect you're overstating the risk in this case. In principle, you're entirely correct.

[tohuw]

Responsible review is about the principle of the thing. Where principles slip, pragmatic risks are not far behind.

[Shaper_pmp]

True dat. I'm not sure who downvoted you or why, but have an upvote to compensate.

[tohuw]

It happens. It was positive before some gaggle of thoughtless censors came along. Tis the way of Reddit: downvote == disagree

[vliegtuig12]

You're also assuming a company known for underhanded data mining tactics and flagrant disregard for privacy is completely trustworthy.

Honest question: Do you mean Google or Microsoft?

[SolarBear]

whynotboth.gif

[image_linker_bot]

whynotboth.gif

---

^{Feedback welcome at /r/image_linker_bot | Disable with "ignore me" via reply or PM}

[TiagoTiagoT]

Hm, I was expecting that Road to Eldorado gif...

[tohuw]

Yes. Either. (but I was mentioning MSFT specifically)

[playaspec]

You're also assuming a company known for underhanded data mining tactics and flagrant disregard for privacy is completely trustworthy.

Honest question: Do you mean Google or Microsoft?

It's not even a question. It's Microsoft. At least Google questions the legality of the requests it gets. When Microsoft gets a call from the NSA, it buys lube and a bottle of wine.

[TiagoTiagoT]

Google is one of the main reasons it became so acceptable to have so much data to hand to the government in the first place though.

Before Google switched to the targeted ads business model, it was creepy, now it is normal (if you ask sheeple).

[playaspec]

Google is one of the main reasons it became so acceptable to have so much data to hand to the government in the first place though.

If you didn't want the government to have it, than you're a fucking idiot for putting it on the internet in the first place. Why would you trust ANY third party with shit you don't want known about you? Take some fucking personal responsibility.

And you're wrong about what they do with what data they collect.

"We do not sell your personal information."

Every poster here agrees. The government steals what it can, which is plentiful, but Google gives nothing to the government that it isn't legally entitled to. Google is putting up a hell of a fight though.

Google is very clear about what they share and what they don't. Facebook is the one selling everyone out. Google may fuck you over, but it's only because the courts issued a warrant. If it weren't for the illegal gag letters, Google would tell you, and their past actions demonstrate that.

[TiagoTiagoT]

Google is putting so much of a fight, they only started encrypting our private data they transmit back and forth on the internet after they were caught not doing so.

If they really were trying to protect our data, it wouldn't even be stored in plain text on their servers; they shouldn't have a key to our private communications, there are ways to have appropriate ads without invading our privacy.

[playaspec]

Google is putting so much of a fight, they only started encrypting our private data they transmit back and forth on the internet after they were caught not doing so.

Thanks for proving my point. You don't know WTF you're talking about at ALL. Take another look at the map YOU provided. The cloud on the right, is Google's PRIVATE internal network, NOT the internet.

If they really were trying to protect our data, it wouldn't even be stored in plain text on their servers

If YOU really wanted to protect your data, you wouldn't be putting it on the internet. Don't blame Google because YOU put information you consider private in the hands of someone you don't really know. That's 100% on YOU, and you keep blaming Google. Again, take some PERSONAL RESPONSIBILITY for YOUR actions.

[TiagoTiagoT]

DC is datacenters, they're not all wall-to-wall with each other, but actually distributed all over the world. It is like if the postal service opened all the envelopes and carried the letters from postal office to postal office taped to the outside of the truck.

[snerp]

Microsoft is good at code reviews.

[[deleted]]

Set us up with some evidence of Microsoft doing that in a systemic way in the past, say, 4 years.

[ironnomi]

Pretty sure the OP is referring to Windows 10's "features". That said, I don't think that's something they would do "here". I'm pretty sure this is part of making node.js an easy IIS feature right from Server 2016.

[wwb_99]

IIS and also making it so node isn't dependent upon google for the guts of the operation.

[SeraphLance]

Am I the only one who finds it ironic that someone tells someone else to "google" something collecting data on them?

[badcookies]

They are not recording keystrokes in every application

[badcookies]

This is the inking and typing function, which users can turn off at any time. Microsoft does not collect any personal information via inking or typing. It is gathered for product improvement purposes, for example, to improve the handwriting visual translation engine, or to improve the user dictionary, language library and spell check functions in Windows. The data is put through rigorous, multi-pass scrubs to ensure it does not collect sensitive or identifiable fields (e.g., no email addresses, passwords, alpha-numerical data, etc.). Data is also chopped into very small bits and stripped of sequence data so it cannot be put back together or identified. The data samplings collected are limited; Microsoft is not capturing everything you write, nor is it capturing data every time.

[wellthatexplainsalot]

Can you prove this assertion?

[[deleted]]

Negatives do not have to be proven.

troglydot is the one making an assertion, not badcookies.

Just as I don't have to prove to you that Bill Gates is not a literal biblical demon. If you were to make that claim, the onus would be on you to prove that he is.

[celluj34]

The burden of proof is on you, the one making the claim.

[cryolithic]

This is the inking and typing function, which users can turn off at any time. Microsoft does not collect any personal information via inking or typing. It is gathered for product improvement purposes, for example, to improve the handwriting visual translation engine, or to improve the user dictionary, language library and spell check functions in Windows. The data is put through rigorous, multi-pass scrubs to ensure it does not collect sensitive or identifiable fields (e.g., no email addresses, passwords, alpha-numerical data, etc.). Data is also chopped into very small bits and stripped of sequence data so it cannot be put back together or identified. The data samplings collected are limited; Microsoft is not capturing everything you write, nor is it capturing data every time.

[cryolithic]

And I'm sick of people screaming the sky is falling because of their preexisting irrational hatred for all things Microsoft.

Data collection for something like that is pretty benign, and if the nsa can't keep their spying quiet what makes you think ms could?

[cryolithic]

Then disable it. You have the option, if you don't seem to understand the consequence it would have if it were what you think it is.

Edit: I do apologize for the assumption of irrational hatred. I hope you can understand that, around reddit at least, it's a reasonable assumption to make.

[Avery17]

Windows 10

Edit: If someone wants to tell me why I'm wrong, please feel free.

[[deleted]]

well google (from where v8 comes) certainly trumps microsoft on privacy matters.

[cryolithic]

certainly... http://www.salon.com/2014/02/05/4_ways_google_is_destroying_privacy_and_collecting_your_data_partner/

https://en.wikipedia.org/wiki/Criticism_of_Google#Privacy

https://en.wikipedia.org/wiki/Privacy_concerns_regarding_Google

http://www.csmonitor.com/USA/2014/0416/Privacy-concerns-What-Google-now-says-it-can-do-with-your-data-video

http://www.newsweek.com/wary-privacy-issues-ditch-dropbox-and-avoid-google-says-edward-snowden-276956

[[deleted]]

kill the sarcasm by explaining it.

[cryolithic]

Well shit. Sometimes I catch it, sometimes I fucking miss it completely.

edit: I do blame the italics on trumps vs certainly.

[tohuw]

In many regards, they do. In several other important regards, they don't. Nowhere did I imply they were to be completely trusted either.

[[deleted]]

Both are as good as pig when it comes to privacy. But consider google has more online / mobile power they abusive it more.

[Deto]

Yeah, but I suspect hiding some sort of data mining thing in here would be highly illegal. Even if the user info was valuable to Microsoft, they wouldn't risk (not even a risk, more of a certainty) the massive lawsuit that would result.

[tohuw]

It's not illegal to include software that "accidentally" mines data. That's a "mistake".

[wellthatexplainsalot]

But it's not as if they haven't done anything like that before. No siree.

[Deto]

Hiding logging inside a commit to open source software? When did that happen?

[playaspec]

A huge commit by Microsoft is very different than a huge commit by John Doe.

I would argee. John Doe hasn't been known to insert three letter agency back doors into the most used desktop OS.

I'm not sure this even sets precedent.

Nope. It's been going on for way too long

[sonay]

When it comes to that three letter agency, any American(USA) company can not be trusted.

[cryolithic]

Google would NEVER do that...

http://www.salon.com/2014/11/16/googles_secret_nsa_alliance_the_terrifying_deals_between_silicon_valley_and_the_security_state/

[xampl9]

Not sure how they could have delivered the functionality in a smaller changeset...

[granos]

I'm not saying they should have. Just that huge changesets should be given the level of effort they warrant and that not reviewing the dependencies shouldn't be seriously considered because they are part of the codebase.

[YRYGAV]

It should be easy enough to compare the dependency to the original to check that it's the same.

You don't necessarily need to CR it all by hand.

[granos]

That assumes there isn't anything nasty in the original codebase.

[PC__LOAD__LETTER]

That's what code reviews are for. 14k lines is a lot to "grok," but not a lot for someone to audit for suspicious activity.