3 ms·

I was with you right up until you said you didn't like Windows Defender sending a file to Microsoft. I want my file system to have metadata that (along with th

I was with you right up until you said you didn't like Windows Defender sending a file to Microsoft. I want my file system to have metadata that (along with things like name, last edited, checksum, etc...) puts all files into one of three buckets: 1. Pre-installed 2. User generated 3. External sources (e.g. Downloaded, transferred from network, transferred from device) If a file from an external source becomes executable then starts affecting my pre-installed/user-generated files and it's checksum isn't already on microsoft's whitelist, then I want microsoft to quarantine that executable and look inside it to figure out what the heck it's doing to my computer. Consider this: No one is uploading your personal files, they don't do anything and trying to look into them wouldn't help anyone avoid viruses. Only executables are worth looking at. Every single executable that was generated from an external source has been checked by microsoft. That is how microsoft, apple, google, and every anti-virus provider out there gets new virus definitions added to their virus lists. If those executables weren't sent, then every single virus definition would be empty.

giancarlostoro 2y ago
> If a file from an external source becomes executable then starts affecting my pre-installed/user-generated files and it's checksum isn't already on microsoft's whitelist, then I want microsoft to quarantine that executable and look inside it to figure out what the heck it's doing to my computer. Yes, but I want an audit log of it all. I doubt they'll ever add this, so I'm not going to blindly trust Microsoft. In my case most files are probably not whitelisted anyway. I download some really huge files sometimes, do those get uploaded too? Do they throttle the uploads and if they don't are they just killing my personal network bandwidth? Like there's too many questions that set me off. I'm happy with my choice.
- spartanatreyu 2y ago
  > I download some really huge files sometimes, do those get uploaded too? Again, they're not uploading all files, they're only uploading suspicious executables, which by their very nature of needing to be fully loaded before they can be executed tend to be fairly small. > Yes, but I want an audit log of it all. I doubt they'll ever add this [...] Microsoft already has audit logs to the point where you can even see who's trying to turn off microsoft defender in your organisation and on which devices. Just remember, they're catering to big businesses who are actually getting attacked on the regular, and big businesses need crazy levels of auditing. They're going to have more than you can handle. > so I'm not going to blindly trust Microsoft. All security is based on trust and nothing about what you've said so far is specific to Microsoft. So, why not microsoft?

giancarlostoro 2y ago

> If a file from an external source becomes executable then starts affecting my pre-installed/user-generated files and it's checksum isn't already on microsoft's whitelist, then I want microsoft to quarantine that executable and look inside it to figure out what the heck it's doing to my computer. Yes, but I want an audit log of it all. I doubt they'll ever add this, so I'm not going to blindly trust Microsoft. In my case most files are probably not whitelisted anyway. I download some really huge files sometimes, do those get uploaded too? Do they throttle the uploads and if they don't are they just killing my personal network bandwidth? Like there's too many questions that set me off. I'm happy with my choice.

spartanatreyu 2y ago
> I download some really huge files sometimes, do those get uploaded too? Again, they're not uploading all files, they're only uploading suspicious executables, which by their very nature of needing to be fully loaded before they can be executed tend to be fairly small. > Yes, but I want an audit log of it all. I doubt they'll ever add this [...] Microsoft already has audit logs to the point where you can even see who's trying to turn off microsoft defender in your organisation and on which devices. Just remember, they're catering to big businesses who are actually getting attacked on the regular, and big businesses need crazy levels of auditing. They're going to have more than you can handle. > so I'm not going to blindly trust Microsoft. All security is based on trust and nothing about what you've said so far is specific to Microsoft. So, why not microsoft?