this post was submitted on 27 May 2026
733 points (99.1% liked)
Technology
84965 readers
3579 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related news or articles.
- Be excellent to each other!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
- Check for duplicates before posting, duplicates may be removed
- Accounts 7 days and younger will have their posts automatically removed.
Approved Bots
founded 3 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Man, Microsoft just keeps footgunning this one.
Every new exploit, they clearly have a meeting and convince themselves "that's gotta be the last of it, right?"
So the next day-after-patch-tuesday rolls around and lo and behold, this guy drops some more nukes on their reputation as far as their most important customer demographic are concerned (corporate IT)
Given this genuinely does seem to stem from Microsoft mishandling this guy, why the fuck do they keep escalating
Puts a lot of evidence towards his claims that Microsoft was behaving badly from the outset and the reason why he started doing this. They keep escalating. Its a war they started.
Very little seems to be beyond the incredulity of MS meetings, remember they had a meeting where someone suggested the OS take a screenshot every ten seconds of whatever the user was doing and upload it to MS servers and rather than everyone laughing they agreed to move it into development.
You misspelled "firing the authoritarian nutjob for cause," which would've been the bare minimum of reasonable reactions.
if that's bare minimum, what is the upper limit for reasonable reactions? Hang him?
Publicly shame, actively blacklist them from ever working in any of their companies, and making sure everybody in the IT space knows this, would ruin this person's ability to do any more damage and might be the upper limit? Well that or doing a Boeing... Take your pick.
Considering the thread we're talking in, it's up to you if you trust MS to implement this well, but they are not uploading the screenshots to the cloud.
Personally I think the idea of Recall is great if it works to help you and only you. The problem isn't the idea, it's the trust. If a reputable open source project or Linux distro made a feature like this I think it would be cool, because I know my privacy is going to be respected and the feature is designed solely to help me and nothing more. However, when MS suggests this I'm immediately cautious, skeptical, and concerned about how it could be used against me.
The statement you quoted is itself a lie. It talks about snapshots, when that's not at all what Recall is about. It takes snapshots, true. But it does not matter to MS whether the snapshots themselves are saved, or where. "Recall does not share snapshots or associated data" is a reference solely to the snapshot itself, not the data Recall creates from it.
Here's what really happens. Once a snapshot is taken, it is analyzed with AI as well as converted into text (if text is present) and all that content (including passwords, banking details, medical records, whatever passes the desktop when a snapshot is taken) plus its local AI analysis is kept in a local database. That shrinks its size to almost nothing, making it much easier for MS to collect. This secretive local database itself is inaccessible to you (even as admin), one you have zero rights to control or delete or edit or even view, one over which you are never given any permissions, and at regular intervals that database is scraped and sent back to MS to use in data aggregation and resale and AI training and whatever the fuck else they want to do with it. Sure, you can turn off Recall in the AI settings, but it has now been proven that any Windows update just turns it all back on again.
Knowing this, go back and reread their statement in regard to snapshots. The entire thing is a misdirection and never once addresses the real payload of Recall and why MS, even after they pinky swore they had dropped it, they continued partnering with hardware makers to deliver "Recall-ready" PCs that already have the requisite NPU on the motherboard, which are needed to do all that local data OCR and analysis on the snapshots that don't even matter to MS once they've been scraped for content.
It's also a big attack surface. Just like how a lot of malware looks for the browser password cache now, it doesn't take much for a malware developer to just go for the recall store. The malware doesn't need to pack in software to take screenshots, if the OS serves it up for them on a platter.
The location is known, and I seem to remember it being fairly simple to view the contents in the right system viewer with a bit of work, so yeah. I never considered that but you're quite right: MS is packaging that shit up all nice and handy for whoever can grab it by whatever means.
you know, since this little saga began I've had this tiny voice in my head hoping this one vindictive dude is, eventually, directly responsible for Microsoft going out of business/doing severe restructuring or downsizing as a consequence of businesses losing faith in the company's products. Lots of people already raise an eyebrow at Windows 11's issues, things like "all our shit is fundamentally insecure because microslop left a backdoor in [insert critical thing here], and has been for [weeks/months/years/???]" tend to have an adverse effect on sales, especially to risk-averse business customers. It's not impossible to imagine that continued "holy fuck what 0day exploit just dropped?" incidents, on the level of YellowKey, happening every month, could result in businesses deciding to drop their enterprise licensing of MS products; and that's going to hurt. That's where a big chunk, if not the biggest chunk iirc, of their revenue comes from. It's unlikely, it's a longshot, but I'm allowed to have hope.
I'm especially now wondering, if YellowKey was the teaser -- you know, just casually revealing a backdoor in BitLocker, like nbd -- what the actual fuck are they going to drop in July? If that's the appetizer, how juicy's the entree gonna be?
Although I wonder if they could. Microsoft seems like one of those "too big to fail" companies, where they'd never be allowed to fall on their face, since Azure and Exchange prop up so many things. It's not like there's a major second option for an OS if you just buy a computer off the shelf like a lot of people do. You either get a Windows or a Mac.
At the risk of going on a tangent, isn't the entrée the appetiser? You don't have an appetiser, an entrée, and then the main course.
I think as long as nothing actually happens, other companies wont care. No one is capable of thinking about the future anymore, there is only next quartal and short term profits.
It might actually be needed for something big to go down first, like those 0day exploits actually get exploited and some client company or few loses a lot of money because of it. Considering how unsecure windows is, i'm a bit perplexed how nothing hasn't happened already.
Some of the other 0days this guy released are already being actively exploited in the wild, but no reports of big losses as a result of them yet. Having said that, the entire point of BitLocker was that it was full disk encryption that you didn't have to think too much about; and now I bet every corporate IT department out there is looking at it with suspicion. If this guy can keep delivering on "things that keep sysadmins awake at night", like "oh god every hard drive we've had stolen in the last few years can be fully decrypted now", eventually a lot of them will decide it is less harrowing and less work to move their entire stack away from Microsoft than it is to live with them.
They'd better not be overselling this bomb they're gonna drop in July. I'm already moved over to Linux fully now, to quote photonicinduction: I want flames. I don't just want to see it all over the tech news, I'm hoping he screws with them hard enough the story makes it to actual TV news channels.
"Footgunning"?
A colloquial term equivalent to “shooting oneself in the foot”
A very clear answer
An explanatory sequence of words
Over-complication of 'sentence'
https://en.wiktionary.org/wiki/footgun
https://en.wiktionary.org/wiki/shoot_oneself_in_the_foot
AI loves to use the word. I never heard it regularly until AI started helping popularize it.
FWIW I've proudly been using it for years
Prove you haven't been an Ai for years
You're very right! There's a lot of reasons to believe I might be an AI, such as:
The verdict? I may in fact be an AI
Did this one achieve some intense introspection just now?
Shit
Then you did not speak with programmers regularly, I learned this term probably back in 2008ish
I guess so. I’ve learned lots of words from the ones I know, but not this one.