You have this very backwards, CVEs are about Security and not the other way around.
Consider why we care about security in the first place:
- We don't want our private data stolen
- We don't want a malicious program stealing our electricity and computing resources
- We don't want adware injecting advertising into our browser toolbar, homepage, email client, etc
- We want our family to be able to safely use our computers without having to worry about them falling for scams
- We want peace of mind
Unconsented advertising is absolutely a violation of security in the same way a salesmen breaking into your house to sell you things is. Don't miss the forest for the trees here.
Do not forget that the CVE system is fundamentally just a tool for tracking computer security vulnerabilities, a tool that unfortunately incentivises pedantic security researchers to fill it with garbage to pad their resumes, a tool who's authority is worshiped like a god by corporate IT departments despite it's inadequacies, but a tool nonetheless which just happens to be better than it's alternatives.
The fact that deliberate security violations enforced by the vendor are not tracked by the CVE system, is not evidence of Security, but simply a limitation of the system.
Consider why we care about security in the first place:
- We don't want our private data stolen
- We don't want a malicious program stealing our electricity and computing resources
- We don't want adware injecting advertising into our browser toolbar, homepage, email client, etc
- We want our family to be able to safely use our computers without having to worry about them falling for scams
- We want peace of mind
Almost all those points are basically the same thing repeated differently:
We don't want somebody else mess with our computer, but that "somebody else" almost always is 3rd party - so not you (user) and not Microsoft (vendor).
Ads from vendor aren't considered as a security issue (unless very edge cases).
They are annoying, but in the principle they aren't security defect (unless badly implemented)
Comments
this, just like many other points is not security, sorry.
Security is about (among other) CVEs, not ads.
bullshit
without consent? did onedrive magically figure out your MS credentials?
what?
You have this very backwards, CVEs are about Security and not the other way around.
Consider why we care about security in the first place:
- We don't want our private data stolen
- We don't want a malicious program stealing our electricity and computing resources
- We don't want adware injecting advertising into our browser toolbar, homepage, email client, etc
- We want our family to be able to safely use our computers without having to worry about them falling for scams
- We want peace of mind
Unconsented advertising is absolutely a violation of security in the same way a salesmen breaking into your house to sell you things is. Don't miss the forest for the trees here.
Do not forget that the CVE system is fundamentally just a tool for tracking computer security vulnerabilities, a tool that unfortunately incentivises pedantic security researchers to fill it with garbage to pad their resumes, a tool who's authority is worshiped like a god by corporate IT departments despite it's inadequacies, but a tool nonetheless which just happens to be better than it's alternatives.
The fact that deliberate security violations enforced by the vendor are not tracked by the CVE system, is not evidence of Security, but simply a limitation of the system.
Almost all those points are basically the same thing repeated differently:
We don't want somebody else mess with our computer, but that "somebody else" almost always is 3rd party - so not you (user) and not Microsoft (vendor).
Ads from vendor aren't considered as a security issue (unless very edge cases).
They are annoying, but in the principle they aren't security defect (unless badly implemented)
Please define security in a way that excludes all possible classes of "third party doing things on your machine without your knowledge or consent"
Probably referring to this https://news.ycombinator.com/item?id=38212453
Check the recent headlines. Windows is pushing user files to one drive and stealing email passwords to proxy your email account on Microsoft servers.
Honestly baffled how you can deny this. Windows rebooting on its own is one of the most defining features.
Bullshit.
There's only scenario where I can imagine Windows rebooting ""on its own""
You've scheduled an update or you're delaying update for long peroid of time?
How so? in the principle ads aren't security issues (unless badly implemented)
I've literally googled: "windows stealing email passwords"
and the very first thing is article from 2016 and the other are about Malware/Scam, so how what article are you talking about?