3 ms·
pf can block by IP address, so you could just set up an OpenBSD router. Again, technical, but if it ever DID become necessary, I can't think of a good way for M
by thesuitonym 9y ago
pf can block by IP address, so you could just set up an OpenBSD router. Again, technical, but if it ever DID become necessary, I can't think of a good way for MS to address that.
- danarmak 9y agoThere are lots of ways. Think of it from an anti-malware perspective: how can the botnet agent on my PC, which has OS-level privileges, discover and communicate with the daily command-and-control server, if each day the network admin blocks the previous day's CnC server IP address? Any network communications that the OS is allowed (or that a Microsoft program or driver that the OS trusts is allowed) can be used to carry extra data about which IPs to talk to in order to exfiltrate "telemetry" or download updates. DNS and WHOIS queries (where MS can publish arbitrary queryable records), peer to peer DHT-like networks (ditto), Tor (designed not to let your router/firewall know who the OS it talking to), the list is endless.
- __jal 9y agoI'd assumed win10 was already doing some of this. My one VM that runs it is still not getting network access. Doesn't need it, and I don't trust it. But good to know, thanks.