terminalbraid 11 hours ago

Please note this heinous and inexcusable overreach is over five years old and was addressed shortly after being caught:

https://web.archive.org/web/20200307082846/https://community...

Wacom now has an opt-in for data collection.

What should be the real continuing inexcusable outrage is that Windows, even today, grants all applications full access to read the titles of all windows with no way to disable it.

If you run Windows, ask yourself what information that leaks and if you trust everything running on your machine not to exfiltrate that.

  • jfim 11 hours ago

    > What should be the real continuing inexcusable outrage is that Windows, even today, grants all applications full access to read the titles of all windows with no way to disable it.

    That's there because it's been in there forever in the win32 API, and changing that would break applications.

    For example, a long time ago, I wrote a small application that would iterate through a list of executables, launch each one sequentially, and for as long as that executable ran, it would look at the window that had the current focus, enumerate every control, and then send a click message to any control that would contain the words yes, agree, continue, accept, install, ok. Made my life easier to automatically install software on computers unattended.

    There are plenty of other applications that require looking up other windows and sending them messages for all kinds of user workflows, things like autohotkey and so on. Changing that behavior would break all of them.

    • 94b45eb4 10 hours ago

      If the user is prompted to give permission for the application to have access to this information then at least you know which ones are doing it and can avoid using them if you are worried about it.

      • jfim 9 hours ago

        In the case that was mentioned above, hardware frequently has drivers which can run as part of the kernel and can read the memory of other processes, among other things. A user of some hardware would be very likely to install a driver for it, without realizing that a malicious driver can basically do whatever it wants on their system.

        In practice, if the software one wants to use is not trustable, then it shouldn't be run, at least on current mainstream desktop operating systems.

        • harry8 7 hours ago

          In practice, what percentage of windows users does the above translate to "Do not use windows or a computer at all?" What's your estimate?

          > 99% ?

      • LadyCailin 9 hours ago

        This suggestion is not exactly a walled garden, but it moves very suddenly in that direction. Not sure that’s a great direction to head in.

    • Gigachad 8 hours ago

      There’s nothing wrong with a breaking change for good reasons. Locking down the API to protect user privacy and security is one of those good reasons.

      • Wowfunhappy 8 hours ago

        It's okay as long as there is a way to opt out. Windows has a "compatibility mode" which users can enable for any executable. That could restore the old API behavior.

        The single biggest strength of Windows is its ability to run most applications from 30 years ago, and practically all applications from 20 years ago, without a hitch.

        • Gigachad 6 hours ago

          I agree with an opt out but it should be difficult. Like entering recovery mode and enabling a legacy mode from the terminal. That way if you’ve got some industrial application you’ve got a way. But malicious software has a hard time getting users to enable it.

          Something similar to disabling SIP mode on macOS.

    • poisonborz 10 hours ago

      Why? Just disable for all by default and have a permission popup open for each, stating that disabling it may crash that app.

  • concerndc1tizen 11 hours ago

    > the real continuing inexcusable outrage is that Windows, even today, grants all applications full access to read the titles of all windows with no way to disable it.

    IIUC, X11 had the same problem, but Wayland allows sandboxing to prevent this?

    And MacOS has some degree of sandboxing? But many applications require "Accessibility" permission that similarly gives far too many privileges?

    • NekkoDroid 10 hours ago

      > IIUC, X11 had the same problem, but Wayland allows sandboxing to prevent this?

      Wayland to my knowledge is isolated by default, with non-isolation being opt-in by both compositor and application via FD shenanigans, but don't quote me on the specifics.

    • duskwuff 10 hours ago

      > But many applications require "Accessibility" permission that similarly gives far too many privileges?

      I haven't run into too many applications requesting that permission, outside of desktop automation and window management tools (Hammerspoon, Magnet, etc) which need it to do their job.

      • concerndc1tizen 9 hours ago

        Yeah, but any application with that privilege can log all keystrokes and upload it to a third party. Obviously this privilege needs to be far more fine grained and have limitations, i.e. registering a hook on particular key combinations, rather than listening on all key events.

        • duskwuff 5 hours ago

          The accessibility permission isn't just for listening to key events. It's for looking at and manipulating content on screen, e.g. moving windows around, sending synthetic keyboard/mouse events, etc. Registering hooks on a specific key combination is a separate API which doesn't require elevated permissions.

        • jcelerier 7 hours ago

          How do you implement an app that displays all the keys you type on screen then no matter which Wayland compositor? (For when you're making video tutorials of an app)

  • Aerroon 24 minutes ago

    I think applications should not have internet access by default. They should require the user to give them permission either temporary or permanent permission to connect to the internet. Ultimately that's where the security bottleneck is.

    I'm frankly disgusted that drivers for hardware like this need to connect to the internet in the first place. This data is clearly not being used to improve the user experience. If it was, then it wouldn't have been a surprise for Wacom that it was collected. Other companies, like Microsoft, also wouldn't be making such terrible UI/UX decisions time and time again, if this data was actually used for improving the user experience.

  • jaoane 10 hours ago

    >What should be the real continuing inexcusable outrage is that Windows, even today, grants all applications full access to read the titles of all windows with no way to disable it.

    No thank you, I want to keep my OS with apps that are powerful and that doesn't show me a useless permission prompt every five minutes.

    • poisonborz 10 hours ago

      Why useless? Permission prompts were the best inventions of mobile OSes, there should be much more of them actually.

      On desktop there could be ways added to sidestep them, eg. defined in bulk in a processname.permissions file somewhere protected.

      • MyPasswordSucks 8 hours ago

        > Why useless?

        "This program is asking for extended permissions. It's asking:

        File permissions: Read, write, and modify"

        Now, is this because it allows me to select a custom avatar from the files on my device and save it after cropping it in the app? Or is it because it's going to check all my files and upload the really juicy ones to Scary Hacker Doods and change my name in all my documents to "Ima Dichwied"? I dunno! I have no way of knowing! Gosh, I guess I'll just figure out if I trust the app or not and click "sure" if I do, which means I'm in the exact same boat I'd be in before the permission prompt addicts came into vogue, except with the added annoyance of a popup (and occasionally an app which then needs to be restarted because the initial lack of access threw it into an unexpected state). This does not benefit me. It does not make my device safer. It does not make me feel safer. It does not make my experience more pleasurable. It will never do any of those things. It only serves to slightly raise my baseline level of annoyance.

        And I'm someone who (sometimes) knows what I'm doing! It's even worse for people who aren't tech-savvy! The Joe Sixpack user class has split into two camps, one of which is mindlessly clicking "YES I want to run it, YES it can make changes, YES I'm sure, YES the .msi called by the .exe can also run and make changes, YES I want the free 30-day trial of Pro Premium Plus edition, YES I consent to automatic billing on day 31, YES install the browser toolbar, YES let's play Global Thermonuclear War!" because they're, surprise surprise, completely desensitized to warning prompts thanks to the over-proliferation of nattering popup nonsense, and the other of which is thrown into a state of catatonic call-a-geek terror because their GPS app is asking for permission to view their location.

        • poisonborz an hour ago

          What would be the alternative? Overcensored app stores and corps insisting on them?

          It's more of a question of computer literacy and will be better with time.

        • yjftsjthsd-h 7 hours ago

          I think I agree with your general point, but I have to point out that the correct solution - implemented by Flatpak, Android, and I believe macOS and iOS - is that selecting an avatar should use a file picker that only hands the app access to what it needs, and a request for full filesystem access is a red flag.

      • userbinator 8 hours ago

        No... besides the concerns about creating a proprietary walled garden, that just causes prompt fatigue and they will allow anyway, creating the same problem again and further irritating users.

    • incangold 10 hours ago

      You should be able to choose to switch off security as you wish. You should also be able to choose to leave it on.

  • perching_aix 11 hours ago

    I asked myself and the answer is no. Now what? I have dealbreaker problems with Linux and Mac. I'm also not going to pull a Terry Davis and make my own OS, and I'm not willing to participate in the circus that is open source either.

    With these in mind, what am I supposed to do, move to the mountains and live the life of a hermit? Once again, not happening. It'd appear that I'm between a rock and a hard place - exactly as designed. This is what an ecosystem grip is like.

    • Buttons840 10 hours ago

      "What option do I have left after rejecting every other option?"

      I guess the answer, for you, is that you have no other option.

      For others, I'll say that I've had 3 Wacom tablets (I keep upgrading), including one with a screen and they have all worked well enough with open-source drivers. They're popular enough that you can do some research to know how they will work on Linux.

      • perching_aix 10 hours ago

        > I guess the answer for you, is that you have no other options.

        Yes, which is exactly what I was getting at. I'm not in the situation where if only I spent some time on introspection and "asked myself", I'd all of a sudden have this lightbulb moment that hey, what if I just switched to Linux or bought a Mac instead, despite what people like GP might like to think.

        This is a lot like when people try to - sometimes kindly, sometimes not - invite people's attention to the fact that e.g. they're fat. As if somehow this key piece of realization was the only thing keeping them from starting on a lifestyle change and taking ownership of their diet. It's juvenile there, and it's juvenile here too. Except in this case, I'd argue it goes even further: it's willfully dishonest. As if it was normal that the only way out were the options listed. As if all these options were playing on an equal field.

    • Liftyee 9 hours ago

      I'd say that in these cases, when there really is no viable option (including just not using...) then the optimal course of action is to choose the "least worst". Compromises work where ultimatums fail.

userbinator 10 hours ago

(2020)

I have an old unbranded Chinese tablet that came with a CD-ROM containing the driver, configuration utility, their source code, and even a datasheet for the MCU it used. A huge contrast between merely selling a product, and trying to control the whole "experience". IMHO we need more of the former, but corporate attitudes strongly encourage the latter.

  • dylan604 10 hours ago

    I have an old Wacom tablet on the larger size that I got for free from a company getting rid of stuff. I can plug it in today to my Mac and it just works. No driver software needs to be installed. This blew me away that it was that easy to use. I thought for sure I'd have to surf some hellish landscape of sketchy websites offering software for long since deprecated hardware. Maybe I don't have all the functionality of some of the buttons on the tablet, but I've never found myself needing them. As long as the pen on the tablet moves the cursor, I'm happy. The fact that it even detects pressure was just icing on the cake. I find that to be better than having the source code available. Old source code can still be a nightmare to compile on modern systems.

landl0rd 11 hours ago

I am not surprised. We've known for a while old OS design can't fix this. Not in a comprehensive way. We can patch over specific cases but the basic design is wrong. Capability-based OSes like mobile ones tend to work better here.

We can't keep assuming code run on-device is trustworthy. Not just in the "not malware" sense. In that of "does what the user wants and nothing more, nothing less."

orbital-decay 11 hours ago

Just like all other drawing tablet manufacturers like Huion, for that matter. Block it in your firewall unless you want it to siphon your data.

I feel like this post is from a couple decades old time capsule. 99% of corporate software is just data exfiltration endpoints now, especially the kind of software that hardware manufacturers tend to make for Windows, which is bloated panels with a couple toggles that are only here to collect your data. The privacy policy is simply a cover-up in most cases. It's not like you have a choice either, because other manufacturers are the same. This stuff needs active countermeasures that treat it as hostile, but since it's hardware it often has low-level access.

marcodiego 10 hours ago

Not the first time something like this is shown here. And it is very important to say that such a thing is a anti-feature of the driver and that something like this would probably never be acceptable on Linux, where such devices work beautifully just after plugging.

The operating system where these things happen should also be blamed.

GuestFAUniverse 11 hours ago

"We apologize for any confusion regarding data collection being done by the Wacom software driver and the unclarity about the actual information collected."

Again and again: any PR containing "confusion" seems BS to me.

Stop gaslighting! Take responsibility!

  • Henchman21 11 hours ago

    I agree, but realize we’re in a moment in time where accountability and responsibility have gone out of fashion. What a time to be alive!!

amelius 9 hours ago

Doesn't a MacBook do the same thing?

babuloseo 11 hours ago

oldie but goodie, also I think OSU players wrote their own drivers for this.

  • stepupmakeup 10 hours ago

    Ironically, osu! had it's own built-in spyware until 2016, automatically uploading window and process names as well as manual commands to take full monitor screenshots in the name of preventing cheaters (both software-wise e.g Cheat Engine.exe is running, and sharing/boosting accounts, by checking if someone is logged into the same Skype account).

  • rushiiMachine 10 hours ago

    Indeed, the osu! community wrote their own drivers for Wacom and many other drawing tablets: https://github.com/OpenTabletDriver/OpenTabletDriver

    They're much more configurable than Wacoms proprietary drivers and also telemetry-free. It's so widely used that they've even been directly integrated into the new osu! lazer client.

johnea 10 hours ago

In spite of the article being 5 years old, I still found it interesting and relevant.

The details of how the data was captured was helpful.

The things I found most interesting fall into 3 parts:

Part 1) It's heartening to see people enjoying their kids:

> I told my son to clear my schedule. He bashed two wooden blocks together in understanding, encouragement, and sheer admiration.

Go Dad! Enjoy it while you can!

If you have an experience like mine: as a 57yo at the time, and well aware of what was coming. When I went from daily interacting with my son, who was finally old enough to speak with as a adult, he suddenly moved away to college over a weekend and I almost never see him any more 8-(

I never expected the fully anticipated experience of empty-nest to affect me so strongly 8-/

Part 2)

> I care about this for two reasons.

> The first is a principled fuck you.

I had to laugh 8-) This somehow reminded me of a line in one of my favorite movies: The Live Aquatic.

Bill Murray's character is asked: This leopard shark is an endangered species. What would be the scientific purpose of killing it?

To which he replies: Revenge...

Part 3) The obligatory proprietary OS bashing:

Several times, the author states: "A device that is essentially a mouse..."

It should be pointed out, that a mouse is a USB class device. That is to say, it is a standard USB device that requires no proprietary driver (except for the purpose of exfiltrating data that the mouse maker has no functional need of, or other "value added" purposes)

Pretty much any special feature of the device can be implemented as a user space library.

The author is working on a Mac, the situation is even worse on windoze, where even a actual mouse will ask you to install a custom device driver.

This is why linux, with a broad support of standard USB class devices, is now significantly superior to windows in USB device support. For almost any typical type device, when you plug it into a linux computer, it just works. No driver install or other configuration needed.

Even if you need a driver to support your tablet on some version of an OS that doesn't provide support, there is a GPL waycom driver:

https://github.com/linuxwacom/input-wacom

tl;dr: linux good, windoze sux, mac getting worse...

In the current world, every computer company in any way associated with h/w or s/w or online activity is now also in the data borker business.

This is similar to the way the car dealership industry is now basically a subdivision of retail loan banking. Try buying a car with cash, versus a lease or loan. But, of course, it's not just milking the idiot herd for all it can, its "maximizing efficiency", for somebody...

So much for the glowing future brought to you by unbridled capitalism...

That's it. Try not to use Waycom, or at least not on Mac or windoze...