15 ms·
Windows OS, Services and Apps: Network Connection Target Hosts (2021)
- mobilio 4y agoI wish to see this also for macOS, iOS and Android.
- fsflover 4y agohttps://news.ycombinator.com/item?id=26639261 https://news.ycombinator.com/item?id=26639261
- dijit 4y agoAside from fsflovers link; there's a fantastic (paid) firewall software called littlesnitch. You can use it to watch every process send network traffic, you can even collect samples of the traffic and plot it on a map: https://www.obdev.at/products/littlesnitch/index.html https://www.obdev.at/products/littlesnitch/index.html (not affiliated, just a happy customer; it's one of the few things I like the mac ecosystem for.. there's attempts to port it to linux with https://github.com/evilsocket/opensnitch https://github.com/evilsocket/opensnitch; but it's not as polished of course)
- beagle3 4y agoLittleSnitch was helpful on Mojave in this regard. However, since Catalina, there are literally hundreds of connections per day from "nsurlsessiond" and "gateway.icloud.com" (and a lot more), with no way to figure out what it is they are uploading/downloading/checking. That happens whether or not you are logged into icloud/facetime/messages at the same time, or not. Anyone aware of a way to figure out what nsurlesssiond is downloading/uploading in the background?
- joekrill 4y agoI've been using this for years and love it, too. But didn't Apple recently make some change to macOS recently that allows many "system" processes to bypass this?
- dijit 4y agoSeems like it: https://news.ycombinator.com/item?id=24838816 https://news.ycombinator.com/item?id=24838816 Concerning.
- Grimburger 4y agoOn Android NetGuard can do the same monitoring, it's a great open source app but I do sometimes wonder what the chance is of some Android system calls bypassing the local vpn firewall it sets up. https://netguard.me/ https://netguard.me/
- schleck8 4y agoThe Linux equivalent is called OpenSnitch, works great. It also does not cost 50 euros
- heresie-dabord 4y agoFriend, your link ends with a semi-colon. https://github.com/evilsocket/opensnitch https://github.com/evilsocket/opensnitch
- dijit 4y agoThat's awful, I'm sorry. Thank you for fixing it, I can't edit the post now.
- stevenjgarner 4y agoand other nix distros like both Ubuntu Desktop and Server.
- zaggynl 4y agoThere's https://github.com/evilsocket/opensnitch https://github.com/evilsocket/opensnitch
- heresie-dabord 4y agoLinux has lsof that can show connexions. Here's a config generator for conky that demonstrates the usage: https://github.com/viviparous/plonky https://github.com/viviparous/plonky
- decasteve 4y agoLast time I used macOS, 2-3 years ago, it was in constant communication with Akamai servers. Blocking some of those hosts to prevent it from doing so would render the system unresponsive when trying to launch an application. Note: this anecdote may no longer be current. I’m not sure what changes Apple might have made since I tested this.
- fsflover 4y agohttps://news.ycombinator.com/item?id=25074959 https://news.ycombinator.com/item?id=25074959
- callmeal 4y agoMacOs: https://sneak.berlin/20210202/macos-11.2-network-privacy/ https://sneak.berlin/20210202/macos-11.2-network-privacy/ The desktop appeared, and the system was connected to a dedicated wi-fi network for the purpose, DeviceUnderTest. 60 seconds or so of “no activity” simply staring at the desktop elapsed, and the system was rebooted, automatically reconnecting to the test network. Wi-Fi was then disabled. ... In this few minutes, the system generated 38 megabytes of network traffic.
- tmdh 4y agoIs there any way to block connection to these sites with DNS or something?
- quaintdev 4y agoAdGuardHome or PiHole should be able to block this.
- naeq 4y agoHenry++ Simplewall https://www.henrypp.org/product/simplewall https://www.henrypp.org/product/simplewall
- terlisimo 4y agoThis looks neat, I'll check it out. I'm currently using Binisoft (now Malware Bytes) Windows Firewall Control to block unwanted traffic. I'm quite happy with it. The amount of traffic that it regularly blocks is insane. Windows and installed apps constantly want to chat with their cloud friends.
- temac 4y agoYou can probably configure the firewall to block.
- mimotomo 4y agohttps://www.bsi.bund.de/DE/Service-Navi/Publikationen/Studien/SiSyPHuS_Win10/SiSyPHuS_node.html https://www.bsi.bund.de/DE/Service-Navi/Publikationen/Studie... (in German, but some documents are in English). Not at all.
- pierrebarre 4y agoShameless plug: https://github.com/Barre/privaxy https://github.com/Barre/privaxy It can be easily configured to block any host or path.
- jve 4y agoYou don't want to block all of that. CLR checking (else your apps may become slow to start) and windows updates (else you may become vulnerable) should be enabled. Someone else has some suggestions?
- lizardactivist 4y agoAnd they assure you it's all safe, secure, and private.
- hulitu 4y agoThey are protecting your privacy. It's written right there in the start page of Edge.
- 2Gkashmiri 4y agoIs there a pihole list or something ?
- jeroenhd 4y agoThese list contain most MS spyware domains, I think: https://github.com/crazy-max/WindowsSpyBlocker/tree/master/data/hosts https://github.com/crazy-max/WindowsSpyBlocker/tree/master/d... Be careful, though, it's easy to accidentally break Windows Update.
- cpach 4y agoAnyone feeling tempted to play the Devil’s advocate here? :)
- sdflhasjd 4y agoThe numbers on their own are a meaningless metric, most of these are just CDN IPs for windows updates, and CRL IPs.
- Gigachad 4y agoIP address and domain name count mean nothing. Why would you care if windows pinged 1 Microsoft domain vs 20,000. If they are all controlled by the same entity and send the same data, these numbers mean nothing.
- rob_c 4y agoOk so if we all send data to azure it's safe or to ovh that's just fine. It's not terrifying but it does reveal the scale, this isn't a licence check against something like genuine.microsoft.com this is a completely different scale all together
- longcat 4y agoAs someone who works within an operations team, the telemetry that is seen within MEM/365 is extremely useful for detecting issues and providing overall health of the environment. While MS does not help itself with some of the more invasive tactics, some of the telemetry is super valuable in detecting issues with drivers, updates and many other things. Even the episode of MS08-067 https://darknetdiaries.com/episode/57/ https://darknetdiaries.com/episode/57/ has some interest bits on early telemetry.
- nokya 4y agoI will. I am actually glad that the OS interacts with many different hosts. This allows me to set up fine-grained rules to prevent specific communication channels. The real information I am missing here is which ones should be left reachable to ensure proper maintenance of the OS. Having a small number of hosts and smaller number of queries would likely result in a worse situation: queries would be impossible to filter because filtering 1 host would likely break too many things. Also, in terms of telemetry, I consider Microsoft to be the disabled child in the classroom. I am sincerely convinced they have absolutely not the skills nor the vision to turn the data they collect into a process that could be personally harmful to me. Google and Apple, on the other side, specialize in employing engineers and product managers that have absolutely no concern to privacy. Their only constraint is to make sure whatever they do is lawful, which is, in my opinion, the worst way a company should behave. Until today, I haven't seen Microsoft do anything worrying except showing traces of telemetry collection in my router logs.
- nickip 4y agoTyping in https://r.bing.com/ https://r.bing.com/ from the list gives a interesting page.
- HappyVertical 4y agoThat's just one of the default messages from Azure Front Door / Azure CDN.
- mananaysiempre 4y agoThere seems to be some degree of overcounting in the reported figures: the number of “hosts” is the number of unique hostnames in the table, but the number of “IPs” is a straightforward sum of IP address counts that the table segregates by service, and I refuse to believe that (e.g.) the IP address of login.live.com as resolved by OneDrive is always different from same as resolved by Skype. $ curl -fsSL 'https://helgeklein.com/blog/windows-os-services-apps-network-connection-target-hosts/' | pup 'td:nth-child(5)' text{} | sed 's/:.*$//' | sort -u | wc -l 291 $ curl -fsSL 'https://helgeklein.com/blog/windows-os-services-apps-network-connection-target-hosts/' | pup 'td:nth-child(4)' text{} | awk '{ s += $1 } END { print s }' 2764 There’s also a fair amount of infrastructural stuff such as DigiCert’s OCSP service, and every shard(?) in the Windows Update, OneDrive, etc. CDNs is counted as a separate hostname. Not that I’m happy about of any of these connections, but the report looks much less interesting than the totals alone suggest.
- jiggawatts 4y ago> DigiCert’s OCSP service A weakness of the OCSP protocol is that it gets sent the certificate hash as an input. This means that to a significant degree, an OCSP provider can track what software you are using, what sites you visit, etc... For the code signing certificates, they could also determine which year (or two) it came from. DigiCert could sell that to marketing companies, and spy agencies / state-sponsored hacking groups could use it to determine if you are running vulnerable versions of software they have hacks for. There would be ways to fix the protocol to be less vulnerable to this, but I'm sure you'll find that any such suggestion would be rejected by the major players like DigiCert in a strangely forceful manner.
- deleted 4y ago[deleted]
- jsiepkes 4y agoOCSP is indeed broken in many ways. On the bright side, with the ca/browser forum limiting the max length of a certificate to about a year it would be pretty easy to just use a single revocation list. A CRL 2.0 so to say. Just like the browser downloads the Google safe browsing list. EDIT: Just to be clear; With CRL 2.0 I don't mean blockchain...
- trlquark 4y ago
- justsomehnguy 4y agoSteps to mitigate: Change Windows Firewall settings to block outbound connections by default [0] Install Unbound [1] so you can actually see the DNS requests (and block them if you want it) your system performs. server: verbosity: 1 extended-statistics: yes logfile: "C:\Shares\Public\Progs\Unbound\unbound.log" server: log-queries: yes log-replies: yes log-servfail: yes val-log-level: 2 [0] https://imgur.com/a/ayq5yiF https://imgur.com/a/ayq5yiF [1] https://www.nlnetlabs.nl/projects/unbound/about/ https://www.nlnetlabs.nl/projects/unbound/about/
- norman784 4y agoI read a lot of comments here wanting to block the connections, but wouldn’t be easier/better to switch to an OS that doesn’t spy you? The answers possibly is no, because they might use X or Y that requires them to use Windows, so a better question is, what holds you back to switch to Linux? (macOS also talks to a lot of servers and collect telemetry as Windows, maybe in a different scale, so isn’t an alternative if you are worried about your data being collected). I personally prefer Linux, but what’s holding me are the streaming services (netflix, amazon, etc), I can only watch SD content if I’m on Linux, so my second opinion is macOS, I can watch at least in a decent resolution and also their notebooks are the best ones out there (the air is amazing between price, performance and battery life) for my use case, that’s also work.
- rob_c 4y ago> I personally prefer Linux, but what’s holding me are the streaming services Yes but then these turn off, drop the content you were watching with little/no warning and are unreliable. Buy physical media while you can at least then you have a licence to watch it when you please until the media degrades. (Or better in the territories which allow for backing up across media formats)
- indymike 4y agoI've never had a problem watching streaming stuff on Linux.
- norman784 4y agoIt might be changed? I remember back in 2020 when I wanted to watch something I was dual booting to windows, because Amazon was streaming at 720p and Netflix 1080p, so the only option to watch in a good resolution UHD was an OS that has a browser with a signed DRM system.
- rob_c 4y agoTrue, it's a problem that money solves. But frankly I'd rather keep the money as I'm content rewatching my favourite shows off disk.
- rob_c 4y agoThat escalated quickly... Being in a developed part of the world thats not getting in the way of the product functioning but I feel sorry for those who don't have a reliable connectivity and/or good bandwidth
- danieldevries 4y agoSending telemetry data at all without real consent (ie not some ultimatum) is scary. Windows is not a daily driver OS.
- grishka 4y agoSoftware isn't immutable. The code that makes these requests has to physically exist somewhere. Which means you can find it and overwrite it with nop's.
- BiteCode_dev 4y agoFor now. Modern chips will make it harder and harder, until one day we will have almost no control over the machine we are running. For our own good, of course. Plus nobody will care appart from us. And not all of us. Not the us that are working on this techs at least.
- grishka 4y agoAs long as signature enforcement in BIOS can be disabled, everything is possible. And it will always be possible to disable it because otherwise someone would sue the hell out of Microsoft, OEM, or both, for not being able to run Linux or other competing OS on a PC they bought.
- BiteCode_dev 4y agoGiven we have one win for a 1000 fails with big companies, and that they clearly don't pay much consequences for their bad actions but benefit a lot from it, I doubt it. Espacially if this becomes state mendated for national security reasons. Indeed, have you seen anyone been sued for the PRISM program? In fact, it's already happening: have you seen a lot of things modified in iOS lately? It's super hard, so few people even attempt now.
- grishka 4y ago> have you seen a lot of things modified in iOS lately? There's an unpatchable bootrom exploit in all devices up to and including the iPhone X. But yes, I agree with your sentiment. Though one thing to keep in mind: phones and tablets are content-consumption devices and they have historically been locked down for about as long as they existed. Computers are productivity devices. You may want to multi-boot 10 different operating systems for very practical reasons and no one should prevent you from doing that. Manufacturers understand this. Even the Apple M1 is capable of booting arbitrary, unsigned OSes, despite being a direct descendant of the same line of locked-down SoCs used in iPhones and iPads.
- larodi 4y agoenter the cloud-operation system. next release will be contacting twice the amount of IPs and that'd be fine.
- luckylittle 4y agoWhy didn't they release it in a better format, like CSV? We could then easily turn it into a C:\Windows\System32\drivers\etc\hosts file.
- not1ofU 4y agoyeah but windows defender will wipe it clean evertime it updates. Plus if you have a massive (>3MB) hosts file it causes other issues during bootup, which requiers disabling another service (dont remember which one off the top of my head, as I am using Pi-Hole these days)
- peter_retief 4y agoWhy do people still use Microsoft is a great mystery to me.
- neilalexander 4y agoThat's obvious. It's much less expensive to buy a Windows PC than a Mac. Linux on the desktop is still quite terrible in a number of ways (particularly if you are ever unfortunate enough to deal with drivers and kernel modules for your slightly uncommon hardware). Chromebooks still don't rate that highly and haven't really entered the public consciousness as a result. Not to mention that many people are using Windows at work, in education or in plenty of other places where they ultimately don't get to choose.
- ace_hunter 4y agoI am surprised people on hackernews are still regurgitating talking points from 20 years ago - Linux on Desktop is quite terrible ? When was the last time you used Linux .. I have been using Linux systems from the past 10-15 years and they have been my daily driver for almost everything - and I live on my computer. Never have I faced any issue that can't easily be solved. (If at all there were issues)
- neoberg 4y ago> When was the last time you used Linux Yesterday and it was terrible. > Never have I faced any issue that can't easily be solved. (If at all there were issues) Good luck viewing hdr content.
- pmoriarty 4y agoWhat was so terrible about it?
- neoberg 4y agoOff the top of my mind; mouse & trackpad, sound stack, bluetooth stack, hd/4k content streaming, no hdr at all, using multiple displays with different dpis... I tried every recommended driver&setting for mouse&trackpad. They are all terrible compared to Macos. The whole story of using multiple displays with xrandr, xinerama etc. is a joke. Agreed; you get a better experience with Wayland regarding that but then you lose the ability to do screenshare for the most part (without doing hacky stuff instead of doing work).
- feintruled 4y agoI recently helped a friend de-cruft their slow as molasses laptop, and as ever was struck how Windows is always freaking DOING shit. It's sitting there seemingly idle, but the start bar takes 5 seconds to open. You open task manager and it's grinding away at network, grinding away at CPU, grinding away at disc, all via opaquely named processes. The bloody thing is relentless.
- schleck8 4y agoSame here. I installed the manual firewall SimpleWall and a bunch of Windows processes I haven't used in months + telemetry are constantly trying to connect to the internet (things like xbox game bar and widgets)
- jpalomaki 4y agoBased on my experience, I blame the 3rd party stuff. All kinds of software and devices just love to add background processes to the system. I guess this is the price you pay for system where everything is possible.
- feintruled 4y agoI'm sure it doesn't help, but even with all that stuff disabled it's bad. svchost.exe's mysterious machinations, windows updates, superfetch (or whatever they call it now), one drive syncing, malware checking, app updates, it's like 'everything everywhere all at once' for Windows. You can make a case for all those things, of course. Just why does it have to launch into them all immediately upon startup? On a beefier machine it's probably not noticeable but it's sad to see on older PCs when Windows 10 at launch was quite reasonable when it came to lower specs.
- GraemeMeyer 4y agoRecent versions of Win10 still perform quite well on old hardware for me - could be that you just need a clean install?
- 4y ago
- hsnewman 4y agoSeems like there was some project creep in the Windows OS. I was always taught an OS "manages computer hardware, software resources, and provides common services for computer programs". For example, games are not anything that could be in the above definition (from Wikipedia).
- rhplus 4y agoI’m surprised by the number of requests to port 80, especially for requests to PKI certificate related domains. I assume there’s an element of chicken-and-egg somewhere that means they can’t use TLS in certain cases. Can anyone offer insight into why this is OK and not subject to MITM attacks on the certificate validation/supply chain?
- josteink 4y agoX509 cert retrievals is predominantly done over HTTP, because otherwise you’d need X509 to implement X509. It may sound “insecure”, but if you can’t trust X509 without HTTPS, you effectively can’t trust either X509 or HTTPS. This is why we have layers in software. We trust X509 because of fundamental math. Therefore we trust HTTPS built on X509. Therefore we trust systems built on HTTPS. Everything is perfectly fine.
- meatsauce 4y agoAre there any connecting to china?
- josteink 4y agoModern OSes (and not just Windows) are getting overly bloated and complicated. Talking to all those hosts and IPs is just a symptome of that nobody seems to care about such things anymore. My main work-laptop, my server and work workstation are running Ubuntu (because of support, yadda yadda), but I've recently tried Arch linux on my personal laptop. I'm not yet an Arch fanatic, and find the installation procedure particularly baroque (having to manually hunt down which firmware packages to install to get basic hardware like Wifi working, had to explicitly install a network-manager, or else no networking at all)... But what I did find immensely refreshing, was working on a minimal system which only had the components I had asked for and nothing else. I knew why everything was there, and how it was supposed to work. I'm really coming to appreciate that more and more, especially after a botched server-upgrade and having to wait for apt to reinstall 1000+ packages I have no idea if I need or not. So yeah. Windows, Mac, Linux, or whatever. Keep it minimal, please :)
- lbriner 4y agoIsn't the issue that these are a paid product and the supplier has to keep adding "value" (or pretending they are) to keep selling new software? Some things get better over time like better graphics cards and 64 bit but MS wouldn't keep making money if they said, "yeah just keep Windows 98, it basically does everything you need". Instead they add fluff, search that no-one wants, messaging that not everyone uses etc. Maybe they should do Windows Lite which would only include the desktop and windows update and nothing else. Sell it for $10 inc updates for the first year. You then pay a subscription if you care about more updates and nothing if you don't.
- EVa5I7bHFq9mnYK 4y agoAt least with Windows, you can install something like w10privacy and easily quash most of the phone home staff. No such thing for Android and iOS.
- gigel82 4y agoWe need a crowd-sourced solution for documenting and keeping up with Microsoft's bullshit. After every "cumulative update" I fire up WireShark and find new connections popping up from unexpected places. It's too much of a hassle and I'm just about ready to give up. That said, Linux is not an alternative for me; I use Office daily, OneDrive, and Xbox Game Pass for gaming. With a dedicated community we could distribute the work of reverse-engineering the purpose of each of these connections and classify URL endpoints by that (Ads / impressions / telemetry can just get blocked immediately; the rest can be documented based on what functionality is disabled / broken by blocking).