[LINK] Vista - the data gatherer

[Scott Howard]

On Mon, Jul 09, 2007 at 12:43:44AM +1000, Karl Auer wrote:
> > To pick one of the more obvious example, the "Plug and Play" system
> > certainly does add value to users
> 
> OK, lets look at that one.
> 
> "PnP-X enabled devices may advertise their presence on the subnet by

PnP-X is not "Plug and Play", it's "Plug and Play Extensions". If you
think of PnP-X as being USB-over-Network you'd be closer to the mark.

> appropriate device drivers. Information sent over the subnet is used to
> identify the device and **enable access to the features offered by the
> device.**" [my emphasis]

Correct. This is referring to the communication between your PC and the
PnP-X device, which is a device sitting on your local network. So this
is them saying that in order to talk to a device on the network we will
send data over the network to that device.

> "There is **no facility for disabling PnP-X or for controlling which
> information is sent by a PnP-X enabled device** once it is accessed
> across a network." [my emphasis]

Correct. Just as there is no way of disabling (say) a USB port, or
controlling what information is sent to a USB port on your system -
that's a function of the driver itself, and almost certainly a
requirement of the device to actually work.
(Yes, you can disable a USB port if you dig deep enough, and you can
also disable PnP-X by stopping the relevant service)

Really this is like saying that a Printer is a privacy risk as it can
be used to print out your tax return. Technically this may be true, but
given that doing that is it's primary function it's hard to argue that
it's Microsofts fault...

> it looks like a security cock-up of the first water. And at least as far

This may or may not be the case, but not you're getting into Security
rather than Privacy/data gathering. If a user chooses to connect to a
PnP-X device on their network that they don't trust, that's hardly an MS
Privacy issue...

  Scott.