16 ms·
How does Windows decide whether your computer has full Internet access?
- photoGrant 4y agoDoing this during a Windows 11 install will result in a road block until you fix said connection issues. You literally can't proceed without finding a hidden terminal and disabling the process and restarting. Insane.
- LoganDark 4y agoDoing what? Blocking those domains?
- deleted 4y ago[deleted]
- boneitis 4y agoI am similarly bewildered by everyone going along with it. I am not in on whatever cruel joke is being played on us. My best guess after turning my head 270 degrees, closing one eye, and squinting the other is that the noun is Microsoft/Windows, and the verb is running the ncsi daemon and having it fail the check.
- LoganDark 4y agoThere are people "going along with it"? I'm confused. When did blocking ever come up? Going along with what? Is this some movement?
- throwaway0x7E6 4y agoeven with the cable unplugged and no wifi module?
- cronin101 4y agoYes, can confirm I was installing Win11 on my brother-in-law's new PC that I built last week and there were no default drivers for the USB wifi adapter I had attempted to reuse from his old machine. The entire process was roadblocked wanting me to plug into Ethernet until I researched the secret keyboard combination that allows you to shell out and then restart with the ability to do a network-free install.
- empyrrhicist 4y agoMadness
- throwaway0x7E6 4y ago
- justusw 4y agoI was using a Win 11 Pro installer stick on a Surface 4 the other day paired with a USB Ethernet interface. Aside from the fact that keyboard and mouse don’t work, because Windows doesn’t have drivers for a Microsoft Surface during install, I was able to convince Microsoft that I have no connection by unplugging the Ethernet cable right before the Microsoft account login prompt. Maybe I was lucky? Or really old installer? (Got it from Amazon Japan) It’s definitely not an OS I would like to make my daily driver. I just hope Apple won’t go down that road with macOS.
- lxe 4y agoYup. The full instructions can be found online but in general, When you get to that step, press Shift + F10 to bring up the terminal, then type "OOBE\BYPASSNRO" and press enter. The installer will restart but this time will have a "I don't have Internet" button that you can use to bypass this nonsense.
- banana_giraffe 4y agoThis is also currently the only way to bypass the need for an MS account when setting up a new PC.
- 6510 4y agoit didn't work on my new laptop
- cm2187 4y agoAnd MS accounts make zero sense to anyone who has a private NAS or need to interact with anything non windows with kerberos.
- vladvasiliu 4y agoIt's worse than that. The account it creates is somehow "special". I have not yet figured out a way to connect to a computer with an MS account via RDP (yes, RDP is on and allowed through the firewall, the user is a local admin (the default)). Ditto for accessing that PC's shares.
- database64128 4y agoYou have to delete the PIN it forced you to create during OOBE. This forces the system to apply your MSA's password to the actual account. Without this step, the account has no password. You can still recreate the PIN afterwards and it won't delete the password.
- 4y ago
- TurkishPoptart 4y agoThis is why I refuse to update or upgrade Windows or my iPhone. They just keep over-engineering stuff and somehow it's always worse.
- mixmastamyk 4y agoNot safe, Linux FTW. Not perfect but at least not purposely fucking with you.
- Twisell 4y agoGPT3 gone bad?
- alophawen 4y agoYes Twisell, opinions not yours is a rogue AI.
- TurkishPoptart 4y agoThanks for backing me up on this. Sadly I don’t think anyone agrees with me on this constant “upgrade culture”
- albertopv 4y agoWindows experience is worse and worse. On my Windows 10 company provided PC I found games installed remotely. In a professional PC! A friend of mine found Spotify installed [1]. That's insane. [1] https://www.windowslatest.com/2022/09/28/spotify-app-is-automatically-getting-installed-on-windows-10-windows-11/ https://www.windowslatest.com/2022/09/28/spotify-app-is-auto...
- brirec 4y agoI’m not saying it makes it okay, but the “Professional for Workstations” edition does not have any sort of sponsored start menu items or auto-installs.
- lloydatkinson 4y agoDoes workstation edition have the same dumb properties as LTSC such as "Visual Studio won't install because reasons" or any other restrictions?
- vladvasiliu 4y agoNot that I know of. But it won't install on "normal" PCs, it requires "workstation-level" CPUs. If you install it on a regular PC, it will just revert to regular win 11 pro. I don't know if this changed with the 22h2 upgrade, but it's the behavior I'd noticed before.
- temac 4y agoIm not completely sure about that given it includes a few additional features like refs.
- brirec 4y agoThat’s not the case at all, and never was. I remember when Microsoft gave out free upgrade licenses for Windows 10 Workstation when it first came out, and it’s just an upgrade. The weird CPU spec thing is that Microsoft doesn’t let you sell a high end desktop computer with “regular” Windows Pro, and requires instead that it comes with Workstation. But you can either version on any grade of CPU as long as it runs Windows in the first place
- deleted 4y ago[deleted]
- YPPH 4y agoGiven the sheer volume of connections to the test servers, wouldn't it make sense to have the content of the text file as minimal as possible? Such as "1" or "OK".
- parhamn 4y ago21 bytes extra at 1T requests a day = 21TB/day. Probably nothing?
- zinekeller 4y agoYou're correct, at global scale it's still peanuts (and of course it's not a single server but redundant clusters of servers). I have a problem at your math though, I'm guessing with the overhead and the pretend-IE headers it could be a whole Ethernet packet (which can be up to 1,500TB/day, but realistically it could be around 500TB).
- parhamn 4y agoMy maths fine, I was comparing it to the comment suggestion of sending "1" instead of "Microsoft Connect Test" as the response body. The headers should be the same. But I guess you could say the content length header would be 1 byte longer in the double digits length contents (which it is).
- imhoguy 4y agoIn the bigger picture: curl -is http://www.msftconnecttest.com/connecttest.txt | wc -c 520 499TB/d vs 520TB/d, would be that a significant difference?
- throwaway22032 4y agoHTTP is also pretty inefficient. I guess if you went for some sort of custom protocol it could be blocked by firewalls or whatever.
- jasonzemos 4y agoIs it a problem that the URL is not HTTPS or is it the blessing required to defeat it?
- sweatypalmer 4y agoThe comments explain why, common web login pages would fail otherwise.
- YPPH 4y agoOne reason for that is explained well in a comment on the article. Note that as with the Windows version, the protocol is HTTP, not HTTPS – because captive portals completely break TLS, but plaintext HTTP will result in a clean redirect to the portal, allowing the network service to detect the presence of the portal and to bring up a browser window to let the user authenticate. (https://devblogs.microsoft.com/oldnewthing/20221115-00/?p=107399#comment-139867 https://devblogs.microsoft.com/oldnewthing/20221115-00/?p=10...) I can see no reason why HTTPS is needed in any event. It's a single purpose domain that serves a static text file which everyone knows the content of.
- rkagerer 4y agoYeah, and there's also no guarantee the computer's certificates are even up to date (eg. first time you connect a PC after a fresh install off older media)
- zinekeller 4y agoThis is why (until very recently) Windows updates are distributed over HTTP - the only benefit of TLS is real-time error checking (and only because there are stateful HTTP proxies that can mangle files).
- deleted 4y ago[deleted]
- moduspol 4y ago
- gerdesj 4y agoThis really gets on my nerves! Some twit of a programmer (probably via a committee) "knows" whether a system has connectivity. For some people Facebook is the internet and for others it is Outlook. Somehow a twiddler at MS has decided that a file on a web server at some wanky location is the internet and that's the final answer. "I cn haz a file" is fine lovely internets! No it bloody well isn't. You should be constructing a response to a challenge from the other end, not a response to a simple GET like it's 1999. I run quite a few systems/sites that have multiple internet connections - deciding whether the internet is available is quite a nuanced thing and that Windows internet detector is bloody stupid, naive and a fucking hindrance. Define "internet" and then have a crack at defining "internet accessibility". Those things are quite specific to individuals. orgs and so on. Connectivity is way too complicated for a simple, naive check.
- romanovcode 4y ago> Somehow a twiddler at MS has decided that a file on a web server at some wanky location is the internet and that's the final answer. Seems like it's the same in many linux distros as well as android and chrome os. It's right there in the article. So it's not really MS specific at all.
- zinekeller 4y agoAnd even Apple (http://captive.apple.com/ http://captive.apple.com/) and Firefox (http://detectportal.firefox.com/success.txt http://detectportal.firefox.com/success.txt or http://detectportal.firefox.com/canonical.html http://detectportal.firefox.com/canonical.html depending on the specific version).
- deleted 4y ago[deleted]
- zinekeller 4y ago> Define "internet" and then have a crack at defining "internet accessibility". Those things are quite specific to individuals. orgs and so on. Connectivity is way too complicated for a simple, naive check. This is asking for the true Scotsman. This is designed for the 99% of users where internet access is a ternary "yes, no, needs credentials". The "naive" check is enough for them. Also, as far as I know only Windows has defined settings to disable this check and assume that there's a connection (https://learn.microsoft.com/en-us/troubleshoot/windows-client/networking/internet-explorer-edge-open-connect-corporate-public-network#ncsi-active-probes-and-the-network-status-alert https://learn.microsoft.com/en-us/troubleshoot/windows-clien...). At least you could disable this if you need to, because Android don't have a similar setting.
- meltyness 4y agoThis is sort of a nightmare since, at least on Windows 10, this is determined differently for different facilities. I'm in a situation where I needed to modify my Registry https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-networkadapter https://learn.microsoft.com/en-us/windows/win32/cimwin32prov... in order to convince the Metro UI that I was actually connected, whereas everything else was working fine. I can't remember exactly what I did now, but it's been working great.
- httpz 4y agoI'm not sure if it's still in use but iPhones used to hit http://www.apple.com/library/test/success.html http://www.apple.com/library/test/success.html to test connectivity. I used to use it to test connectivity on my own apps because Apple is probably better at making sure a url reachable than I am.
- woodruffw 4y agoI believe they hit http://captive.apple.com http://captive.apple.com now (and that's what I use).
- bombcar 4y agoThey use more than that, I've seen it on the wire (to prevent DNS caching I believe). http://neverssl.com http://neverssl.com also works And https://1.1.1.1 https://1.1.1.1 breaks people's brains if they know enough
- petesergeant 4y agoI prefer https://1.1.257 https://1.1.257
- askvictor 4y agoEven more fun: https://16843009 https://16843009
- hsbauauvhabzb 4y agoTwo things I’ve always wanted to do is figure out how to cache windows updates on my local network without an enterprise windows install, and how to block windows updates by sinkholing domains and/or ip addresses (I work in IT security). Can anyone give any tips on either of these?
- aoetalks 4y agoWhy do you want to block windows updates?
- hsbauauvhabzb 4y agoBecause working in security sometimes I want to test malware on outdated AV, blocking full internet causes command and control failures, creating a weird spot to analyse traffic. Disabling Defender is not persistent (it seems to switch itself on, etc).
- WolfRazu 4y agoIf you disable defender using group policy, from my experience that's been disabled consistently for a year no problems. Latest version of Windows 10. Note you need to disable tamper protection and reboot first otherwise it silently reenables itself.
- alar44 4y agoIt's standard practice. You don't roll out updates until they are tested.
- videofreedom 4y agoWould you like to describe your standard practice? I am interested in implementing this after windows updates have killed our workstations multiple times. Is there a nice description / workflow / tutorial / script / community where I can learn how to do that? I did not find any recommended workflow for this by Microsoft itself, but maybe I was searching for the wrong things - windows updates are generally a bad thing to research anything related for. I expected to find some standard workflow description plus tools on some MS website, but no success. Does that exist? Thank you very much!
- EricE 4y agoRaymond! StuffIt! is still amazing code and a huge part of my early computer use.
- blacksmith_tb 4y agoBut StuffIt was by Raymond Lau? https://en.wikipedia.org/wiki/StuffIt#Overview https://en.wikipedia.org/wiki/StuffIt#Overview
- jxramos 4y agoit's interesting, when I open http://www.msftncsi.com/ncsi.txt http://www.msftncsi.com/ncsi.txt directly in Chrome it triggers a Translate this Page url bar icon and it prompts to translate between Hungarian and English. All that's in the content of the page is `Microsoft NCSI`
- r1ch 4y agoUnfortunately it's not that simple. On my system with bridges for hyper-v and wireguard tunnels, the NCSI service happily ignores my default route and tries to establish connectivity through one of the other devices when resuming from sleep. It wouldn't be that bad if it was just the status indicator, but several apps refuse to work properly if "internet" isn't detected. The workaround is to disable every other adapter in the system until NCSI is happy. I ended up binary patching the connection test service in memory to get it to always return true.
- qwertywert_ 4y agoCan't you disable NCSI in registry? Or does that not actually help for those other services internally?
- picture 4y agoIf you do so, which I have tried, it will just show permanently no internet
- RedShift1 4y agoLol, the developer who wrote it that way is definitely the "want to watch the world burn" type.
- justsomehnguy 4y agoYou configured it wrong - Not Jobs I had my share of troubles with it, but most of the times I found a way to force it work as I need.
- pkulak 4y agoI assume you’ve at least tried one of the other two popular operating systems? I would be desperate to not put up with that kinda thing anymore.
- jeroenhd 4y agoWhy not point NCSI to a host that's always reachable, like a local web server? There's a lot of configuration you can do to the connection check service that won't get your antivirus all anxious (i.e. https://www.ghacks.net/2014/02/07/disable-customize-windows-internet-connection-test-improve-privacy/ https://www.ghacks.net/2014/02/07/disable-customize-windows-...)
- tech234a 4y agoI believe Nintendo uses http://conntest.nintendowifi.net/ http://conntest.nintendowifi.net/ for their consoles. Edit: an update (3.0.0) to the Switch changed it to http://ctest.cdn.nintendo.net/ http://ctest.cdn.nintendo.net/ but I can't seem to access it from a web browser.
- GlitchMr 4y agoFor ctest to work, it's necessary to start your User-Agent string with "NX NIFM/" (the console itself sends "NX NIFM/00" as an User-Agent string).
- mrjin 4y agoNot sure when Micro$oft can stop such abusive moves. Why the user have to be able connect to your endpoint to prove they are connected? Why keep nagging me to set active hours coz I regularly use my computer 8am to 6pm? Anyway, won't be my problem much longer.
- qwertywert_ 4y agoWhat server do you suggest they use? Android uses Google servers is that also abusive?
- mrjin 4y agoI don't want that sh*t to be there in the first place. No one knows better than the end user. And also, if the user could not reach some M$ server does not mean users' network was not connected to the internet. Anyway, won't be a trouble for me much longer. Retiring all my Windows instances, had enough.
- mymyairduster 4y agoIt's crazy, everyone else is just letting M$ control the narriative and falling for it. Micro$oft is trying to define what is and is not 'internet' access, eg. they turn the definition of 'internet' to mean unfettered access to the micro$oft servers is and you're ability to send personal information over to them.
- thakoppno 4y ago`http://www.msftconnecttest.com/connecttest.txt http://www.msftconnecttest.com/connecttest.txt` Wonder what kind of uptime this service has and what sort of footprint is needed?
- mike_d 4y agoIt is hosted on the Azure CDN, which is partially Azure datacenters and backed up by Akamai. msftncsi.com is completely on Akamai. Here is a list of Azure operated locations: https://learn.microsoft.com/en-us/azure/cdn/microsoft-pop-abbreviations https://learn.microsoft.com/en-us/azure/cdn/microsoft-pop-ab...
- thakoppno 4y agothank you - any guess on the requests/second? and what about the origin behind the cdn? seems like that it’s still rather critical and would have migrated multiple physical hosts over the past 30 years. This sort of thing is fascinating and I do something similar at a much smaller scale at day job, keeping a simple service running that enables the rest of the stack to survive.
- mike_d 4y agoNo clue on QPS, but it can't be terribly high. It is a single request, compared to the 200+ requests served when someone loads something like CNN.com. I doubt there is any origin at all. Since the response is so small and never changes it is likely hard coded into the config. Maybe it is a file on a shared object storage.
- saagarjha 4y agoWhy does Microsoft always seem to pick domain names that are indistinguishable from phishing scams?
- chrisseaton 4y agoThey do seem deliberately designed to be suspicious. Almost couldn’t be any worse even if they tried.
- NotYourLawyer 4y agomicrosoft-internet-security.com
- cm2187 4y agoParticularly for unimportant things like authentication. There must be at least a dozen redirects when you login with your ms account online, none of which is a microsoft.com domain.
- encryptluks2 4y agoBecause Microsoft isn't a reputable company and engages in nefarious activities across the web to maintain a positive reputation?
- b0ner_t0ner 4y agoaka.ms
- bombcar 4y agoEvery time I get an email from my health insurance, or sign in, I see so many domains that look like abject phishing domains. It's insane.
- lzooz 4y agoBecause it's easier for a particular department to buy a domain than it is to tell whomever manages the microsoft.com domain to create a subdomain.
- password4321 4y agoAnyone here who can explain how to force Hyper-V to use a specific network adapter for the default switch? I like that one because it provides NAT + DHCP, creating another switch doesn't.
- jeroenhd 4y agoYou can manually configure the network adapters from the Hyper-V UI. I don't know if you can set a priority order, but you can definitely configure the interface Hyper-V uses for VM network connectivity.
- password4321 4y agoThanks for your reply. In my experience it is a selectable option when creating a new virtual switch but is not modifiable for the default. I have my machine directly connected to my underpowered Remote Desktop client via ethernet, and it always picks that connection instead of the WiFi that actually has internet until I disable ethernet (or maybe the virtual adapter created on top of ethernet, I forget every month) and reboot.
- jeroenhd 4y agoI don't know if it solves your entire use case, but in PowerShell you can change the interface metric number to rearrange connection priorities (https://learn.microsoft.com/en-US/windows-server/networking/technologies/network-subsystem/net-sub-interface-metric https://learn.microsoft.com/en-US/windows-server/networking/...). You have to watch out to pick the right interface (Hyper-V takes over packet routing from your real network adapter in many cases) but it may be worth looking into. Higher metric number means lower priority, so setting the bad connection to a metric of 100 and the real uplink to a metric of 5 may resolve your problem. In Windows 2000-8.1 the control panel GUI was the standard way of accomplishing this, but in modern Windows 10/11 I doubt Microsoft has the setting still accessible. There are still guides out there with screenshots, though: https://www.windowscentral.com/how-change-priority-order-network-adapters-windows-10 https://www.windowscentral.com/how-change-priority-order-net... The automatic metric detection system bases its decision on network speed (https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/automatic-metric-for-ipv4-routes?source=recommendations https://learn.microsoft.com/en-us/troubleshoot/windows-serve...) so virtual 10gbps adapters can cause problems if you use a common network adapter and the custom settings for Hyper-V and such get messed up.
- sammy2255 4y agoWhy don’t they make this configurable? I want to hit 1.1.1.1 not microsoft. Also, sucks how Spotify wont even try to play songs when Windows displays no internet
- pxeboot 4y agoIt is configurable via a registry setting, ActiveWebProbeHost [1]. But you have to point it at a server with the right file present. It doesn't just do a ping. [1] https://www.ghacks.net/2014/02/07/disable-customize-windows-internet-connection-test-improve-privacy/ https://www.ghacks.net/2014/02/07/disable-customize-windows-...
- miyuru 4y agoyou might want to use one.one.one.one for dualstack not 1.1.1.1. for spotify, offline playback is premium feature.
- emsign 4y agoCool, I always thought Windows decided my status at random.
- 4992444886 4y ago
- divbzero 4y agoI suppose you could spoof having full Internet access by hosting nsci.txt or connecttest.txt locally and editing your hosts file to direct www.msftncsi.com or www.msftconnecttest.com to 127.0.0.1? Conversely, if those Microsoft websites ever failed, countless Windows machines would determine that they have limited or no Internet access.
- number6 4y agoBest hosting company: localhost
- deleted 4y ago[deleted]
- vgb2k18 4y agoIn the linked comment section, Raymond Chen replied somewhat abrasively to a comment similar to this (the comment was "wouldn't this be easy to spoof?"). A bit harsh I thought!
- pkulak 4y agoHe just had to say that this is for convenience, not security.
- c0nsumer 4y agoYep, exactly. Because another part of this is NCSI is used for captive portal detection, so Windows can/will notify the user that they need to do something more to keep using the network. Android and Chrome do the same sort of thing to detect internet access; this is how Android pops the notification to sign in to the network. Then, at least on Windows, the results of NCSI flow down into WinHTTP and a ton of other things so apps can know the status of the network. It's also possible, via Group Policy, to configure a different URL for NCSI. This is useful in enterprises which may not have the NCSI URL available to unauthenticated things (eg: the OS) but still has internet access via proxies. It's also possible to disable NCSI, captive portal detection, etc, which is useful on some closed network boxes (eg: some enterprises) but this will cause problems if the machines are ever used on public/walled garden/captive portal networks. The biggest problem I've seen with this comes about where captive portal detection is disabled, a user ends up on a captive portal, tries to hit a website to satisfy the portal, but due to most sites that normal users will try being https these days can't get their session redirected in order to display the portal, so they think "the internet is broken". The NCSI/captive portal detection makes a point of using HTTP so captive portal redirection can work properly.
- muppetman 4y agoI'd love to know how Apple decides if a Wifi network is usable or not. For some reason my home network is flagged as a "Mobile" network and people connected to it can't update to the latest version of iOS etc. Is it because I've also created a Mobile Hotspot with the same SSID on a spare mobile phone I have, so my family can use their iPads out and about without having to connect to a new Wifi network? (i.e. I just works) Is it because for some devices on my network, I DHCP them a different DNS server so they get adblocking via AdGuard home? Who knows. It's so annoying. The fix if you want to update iOS on my home network is to connect to the Wifi Network called "F*kApple" which is exactly the same network as normal, but with a different SSID. Because that works just fine. Also, F*k Apple. PS: Also F Google because trying to search this problem just gives me the most infuriatingly childish "How to fix!" articles.
- bombcar 4y agoIt's probably because of the hotspot with the same SSID. You should be able to set wifi network priority so "home network" is first but if not available it automatically goes to "phone network".
- muppetman 4y agoThe way I've fixed it is to reset the Network Settings on the iPad. Brutal, but it works. I hate that this stuff is hidden with no way to change it.
- c0nsumer 4y agoDHCP option 43 is often used to indicate if a mobile network is metered. (May be other ways, this is the one I'm most familiar with.) I'm guessing your "spare mobile phone" is Android? Apple caches a lot of info about networks it connects to. So it's probably caching that it received this option and "knows" that network to be metered. Best solution for this is to have either more control over your mobile network so it's not sending that option, or more easily, name the mobile network something else from your home one.
- 4y ago
- trustingtrust 4y agoWhat if your ISP hijacks your DNS (pretty common) and someone was to poison it and instead downloads a malware ? That would mean thousands of windows pcs download this malware by just connecting to the internet.
- jeroenhd 4y agoThen the string compare would fail and the little icon in the bottom right would show an exclamation mark. This can be a problem if there's some kind of critical vulnerability in the Microsoft HTTP stack, but I don't think this attack vector is all that relevant. Same with other captive portal detection endpoints, there's very little actual parsing going on with these requests.
- alophawen 4y agoYep, that's how viruses spread kids. Better install some McAffee.
- c0nsumer 4y agoWindows Updates are downloaded via HTTP but signed in the package themselves. This is why Delivery Optimization (peer to peer distribution) can be used. HTTP downloads for WU are also good because it allows upstream proxies to cache the content reducing overall network load. Thus: Hijacking WU to download malicious content takes far, far more than just DNS hijacking. You'd also need to subvert the WU signing system. (This is more nation-state level stuff.)
- fulafel 4y agoReally unfortunate terminology that molds peoples ideas of the internet, being able to access a website is pretty far from having full internet access. Calculated or not, it was also in MS interests to lead people to think this way. It should check if you are behind NAT and then say "Your computer doesn't have full Internet access but can reach some services via a gateway"
- AnotherGoodName 4y agoEveryone with a home router is behind NAT.
- fulafel 4y agoI was referring to when this was built, ages ago, and the reality this helped come about. Today most home networks have NAT for for v4, and then NATless IPv6 (or no IPv6 as the case may be). Trivia: NAT is not routing, the normative router requirements RFC actually specifically forbids tampering with the IP source or destination address fields.
- bigmattystyles 4y agoAnd to my parents that will mean nothing
- fulafel 4y agoBut they still unknowingly suffer from the harm it did to network effects and ability to deploy new types of internet apps.
- iggldiggl 4y agoEven without NAT I don't necessarily want any old program to be immediately immediately reachable from the outside, so I still want a default-deny inbound firewall, and as long as it happens under your control, there's not much of a difference between having to configure my router's NAT and having to configure its firewall (in the case of my home router it's literally the same settings page). I.e. no big deal for me, and still a bit of a struggle for non-techies (but with sufficient motivation some will still manage it). (And if you want something like UPnP to let programs automatically punch holes themselves anyway, again it doesn't matter much whether we're talking about NAT or "just" a plain firewall.) The true evilness of NAT only really comes in when it's done by some third party outside of your control (CGNAT and friends), but I think that compared to home routers doing NAT the latter is a slightly more recent phenomenon that only got widespread traction when the IPv4 shortage became more acute.
- Vanit 4y agoThis is the kind of thing that comes up whenever I've worked on an app and the client asks us to report as server connectivity to the user. Despite what the OS tells you, you basically don't know anything until you actually try to use the network, so not surprised at all this is what Windows does.
- majkinetor 4y agoToo bad it almost never works correctly. Even now it says I have no Internet while I do and can access those txt files. I used thousadands of Windows machines in last decade, this is typical. You can ignore this "feature" almost entirelly. If you introduce proxy in your system, then you can be certain that it will not work, including Windows updates. You have to masssage your system with net commands and learn about WinHTTP proxy (that nobody heard about) sfor it to sometimes work. To deal with this and other nuisances I made 2 functions in PowerShell: Update-Proxy https://github.com/majkinetor/posh/blob/master/MM_Network/Update-Proxy.ps1 https://github.com/majkinetor/posh/blob/master/MM_Network/Up... Update-CLIProxy https://github.com/majkinetor/posh/blob/master/MM_Network/Update-CLIProxy.ps1 https://github.com/majkinetor/posh/blob/master/MM_Network/Up...
- borissk 4y agoIt works perfectly well for 99.9999% of the users. The few exceptions are people with proxy servers, virtual machines and other exotic network configs.
- majkinetor 4y agoThat is not my experience and you can't just imagine number like that. I am currently on basic OS install without anything in between and it doesn't work. I just switched from home router to my phone's hotspot and its the same. It seems its not only Windows problem. Viber desktop has exclamation icon and it will persist until it is restarted, Mattermost works, Signal works etc. Check it out: https://i.imgur.com/Oi5gmw4.png https://i.imgur.com/Oi5gmw4.png BTW, didnt know proxy is exotic, its literrary the norm in the company.
- lzooz 4y agoWhat happens when you try to load http://www.msftncsi.com/ncsi.txt http://www.msftncsi.com/ncsi.txt or http://www.msftconnecttest.com/connecttest.txt http://www.msftconnecttest.com/connecttest.txt ? If they don't load for you you probably modified your install with shutup10, block microsoft domains using your firewall or /etc/hosts or something else and you're out of support.
- nanis 4y agoYou can use your own domain and string as well[1]. [1]: https://news.ycombinator.com/item?id=28512149 https://news.ycombinator.com/item?id=28512149
- pluc 4y agoA: It calls home
- rightbyte 4y agoWhy do I get the feeling Raymond is the only human at Microsoft? Does he have some kind of special deal to be able to be one? Writing all these cozie Windows trivia blog posts. That I like. Why is he not smashed by some manager? Could everyone else do this if they liked?
- sour-taste 4y agoHe's been around a long time and likely built up a lot of good will. I strongly suspect that he does these blog posts as a side project and is encouraged by management because they are popular and people like them. It would be foolish of a manager to kill something that people like.
- DoctorOW 4y agoI'd argue Microsoft management has been perfectly fine killing off things people like.
- twerkmonsta 4y agoGenuinely curious what Microsoft products people actually like? VS code might be the only one I’ve ever heard of.
- still_grokking 4y agoNot really "products". But the stuff coming out of MS Research is mostly great! But granted, MS Research is not M$…
- agency 4y agoTypeScript
- still_grokking 4y agoTS is more in the "mixed feelings" department, imho. I would take Scala.js anytime instead. (If I would need to do front-end ever again). https://www.scala-js.org/ https://www.scala-js.org/
- ElfinTrousers 4y agoYes, that certainly sounds like a very Microsoft way to do that.
- loginatnine 4y agoWhy did they change the domain after Windows 8? The domain name is more verbose but it doesn't seem like a valid reason for me to invest time in this. Anyone know?
- Macha 4y agoProbably too many support questions from enterprise sysadmins "Why is Windows connecting to this domain? Is this CSI thing exfiltrating my data?"
- m-p-3 4y agoGoogle (ChromeOS, Android) does a similar thing by checking http://connectivitycheck.gstatic.com/generate_204 http://connectivitycheck.gstatic.com/generate_204 and expecting an HTTP Response Status 204, or else it assume there's a captive portal or something blocking Internet access. Apple (iOS, MacOS) checks for https://captive.apple.com/hotspot-detect.html https://captive.apple.com/hotspot-detect.html and expects a basic HTML page with the body containing "Success".
- jakub_g 4y agoThe annoying thing is that some MS programs detect internet connectivity in their own ways (or do networking via some custom network stack), that do not work properly. Each time I had a proxy like Fiddler running, Outlook would think I'm offline. Everything else worked fine.