6 ms·

Windows 10 spies on your use of System Settings (2021)

155 points by userbinator 1y ago

davydm 1y ago
Considering the domains this is likely a network test, though it may be reporting the results of the connection to bing.com to cxcs, which apparently collects telemetry. On one hand, I get it - a lot of us ping google.com to quickly check the network - doesn't mean we're sending spy data to Google. On the other hand, it would be nice if this was more transparent, perhaps asking if it can perform the test.
userbinator 1y ago
I saw this happening in 11 too, not surprisingly. It's become increasingly difficult to get Windows to stay quiet on the network, although a lot of other software is also guilty of this background noise.
charcircuit 1y ago
It's normal for programs to reach out to the internet for purposes other than spying on the user. Microsoft is a trustworthy company that wouldn't deploy spyware within an app included in the OS.
- eps 1y ago
  That's sarcasm, HN. That's how sarcasm looks like.
- Wobbles42 1y ago
  This is true. It can't be considered spyware as long as the beneficiary is publically traded.
- lurk2 1y ago
  I’m not asking this rhetorically: Are you being sarcastic?
  - charcircuit 1y ago
    No. Deploying spyware would break the trust that consumers and businesses have with Microsoft.
    - mixmastamyk 1y ago
      Funny. https://arstechnica.com/ai/2024/06/windows-recall-demands-an-extraordinary-level-of-trust-that-microsoft-hasnt-earned/ https://arstechnica.com/ai/2024/06/windows-recall-demands-an... I could list another fifty examples if motivated. Reminds me of this other funny comment as well: https://news.ycombinator.com/item?id=31727293 https://news.ycombinator.com/item?id=31727293 Truth is MS had several horrendous unrelated security breaches in the last years. Despite some scolding by senators it’s business as usual, profits up. So no, MS doesn’t care about trust of the little people and maybe never did.
- notrealyme123 1y ago
  I am not sure if this is sarcasm. But personal information leaving my private computer without my knowledge would be very close to to spyware. Edit: Maybe I am to blind for sarcasm.
  - k4rli 1y ago
    Tbf you installed it so you've consented to it. It's like installing a security camera in your own bathroom and then complaining about privacy.
    - fuzzfactor 1y ago
      More like a plumber tasked with "modernizing" your bathroom, who as part of the process installs the camera surreptitiously precisely so you won't complain about compromised privacy. In any event it looks like that bridge is no longer for sale whole-hog. There were some fairly high bidders. A whole lot more people can enjoy the opportunity to participate through timesharing now though than ever before :)
- kekebo 1y ago
  Is this intentional devils advocacy for the sake of balancing an expected narrative? Outside of the rarely normative definition threshold as to what constitutes spyware or not, on what data / references (if any) do you base your impression on? And how does a perception of company trustworthiness correlate with telemetry ethics that don't infringe in some way on 'basic digital human rights' (as defined by GDPR et al, say)?
  - charcircuit 1y ago
    >for the sake of balancing an expected narrative? Yes, because there are many people on this site who also believe a packet being sent to microsoft = spying. A lot of these people grew up with or were influenced by people who grew before the prevelance of the internet when software engineering was still immature when programs typically didn't communicate with the internet on their own. >do you base your impression on? My impression is based off the employees who work there who I would trust wouldn't add things like taking webcam screenshots and sending them back to Microsoft to look at. >how does a perception of company trustworthiness correlate with telemetry ethics Consumers and businesses will lose trust in a business if the telemetry data is not anonymized properly and put under strict privacy controls.
    - userbinator 1y ago
      Consumers and businesses will lose trust in a business I think you're really taking the piss now. Guess how much people trust MS (and the rest of Big Tech) these days.
      - kekebo 1y ago
        Overton window calculation usually starts at a minimum of two inputs without proximity requirements (except technical requirements like linguistics/ functional semantics)* [ * Only because an opinion may appear too far removed from a given perceived spectrum-threshold for 'reasonable reasoning'.. should not necessitate collapsing the contrasting input to some purely sarcastic/humorous telos, especially when this stochastically undermines one's own chances for being afforded the inversely congruent gesture]
- ndsipa_pomu 1y ago
  You must not be aware of the long history of Microsoft being very untrustworthy and lying about how their software behaves. e.g. funding SCO to pursue a campaign against Linux users and threatening to take them to court for using Linux: https://www.cnet.com/tech/tech-industry/fact-and-fiction-in-the-microsoft-sco-relationship/ https://www.cnet.com/tech/tech-industry/fact-and-fiction-in-... e.g. DOS ain't done til Lotus won't run: https://www.proudlyserving.com/archives/2005/08/dos_aint_done_t.html https://www.proudlyserving.com/archives/2005/08/dos_aint_don... and many, many more: https://en.wikipedia.org/wiki/Criticism_of_Microsoft https://en.wikipedia.org/wiki/Criticism_of_Microsoft
  - charcircuit 1y ago
    >DOS ain't fine til Lotus won't run That article debunks that this was ever a thing.
alkonaut 1y ago
Apart from the reason of ”if they spy on this, who knows what else” and ”I don’t want to waste resources on telemetry” what is the reason to not allow a vendor to see which settings page you visit? Obviously if you opt out (or rather, didn’t opt in) you shouldn’t be sending telemetry. But the line between a necessary network call and an optional one is often blurry.
- userbinator 1y ago
  what is the reason to not allow a vendor to see which settings page you visit? It's all about privacy; and by privacy, I don't mean the "privacy" that often gets thrown around by Big Tech to mean "only we can see what you do". What I do on my computer is none of their business.
  - alkonaut 1y ago
    Anonymous usage statistics means no one stores what _you_ do though. Obviously sending a url you visit or a file you open is way over the line. That’s about what you do. I think there is a difference between that and feature usage as counters only.
    - userbinator 1y ago
      If it can be correlated (e.g. via TLS fingerprinting or other identifying information such as IP address), it's not anonymous.
      - alkonaut 1y ago
        Yes if it can be deanonymized then it’s not anonymous. Almost a tautology that. You can’t send the telemetry over http without revealing an ip, but obviously that ip can’t be stored as part of the telemetry data. That’s PII and not anonymous at all. Important: if I collect anonymous telemetry you better trust me that it’s anonymous when I say it is. Because if you don’t trust me on that then you can’t run the software at all (if it’s a piece of software that relies on web requests in some form at least). Otherwise why would you even trust that my opt in is respected? You have to trust software vendors of software that makes http requests. It’s as simple as that. You can use open source or try to inspect packets. Or firewall the software. But if it does (for example) one update check on startup which is common, then it’s almost impossible to tell whether it contains telemetry data. Because even the bare minimum request “this is FooApp 2.9.1 are there any updates” contains important usage stats: it’s +1 for the use counter and +1 for the v2.9 use counter!
barrkel 1y ago
The usual reason for this kind of telemetry is to figure out which features users are using and which they aren't. That guides decisions about what to invest in, what can more or less safely deprecated, and can even help with promotions.
- axitanull 1y ago
  And with all kinds of telemetry they collected, they managed to create the pinnacle of UI/UX redesign, as shown in the Settings Panels in Windows 11, right?
  - tonyhart7 1y ago
    settings panel is great, its modern and easy to use
    - pathartl 1y ago
      People are weirdly attached to Control Panel. What's better: Control Panel -> Network and Internet -> Network and Sharing Center -> Change Adapter Settings -> Properties on selected NIC -> IPv4 -> Properties to set a static IP or Settings -> Network and Internet -> Ethernet -> IP Assignment People got used to where things were. That does no indicate good UX/UI.
      - tonyhart7 1y ago
        out of touch from reality people that use windows want simplicity (kids, old people, office worker that want get the job done etc) Yeah the new settings is not advance but that's the point
        hulitu 1y ago
        > office worker that want get the job done Then why the fsck gets in my way ? Why 1px borders when i have to resize windows ? Why no place on the titlebar when one can click and drag on second monitor ? Why the stupid taskbar where some windows are hidden and others not. Why the stupid alt-tab where it rearanges the window stack ? Why ?
CommanderData 1y ago
I wish there was a law which mandated update, service and telemetry servers were on different cidrs. There are frequently updates lists Windows telemetry IPs you can block using ipsets. But a Microsoft always seem to mix these IPs with legitimate services.
- djfivyvusn 1y ago
  How to tell if Microsoft has changed their ways or if they're just playing a long game of embrace extend extinguish.
NitpickLawyer 1y ago
I have a similar anecdote about android. I was trying to change some setting, but my android phone has like 3 different places where settings can hide (the settings app, google settings app and vendor settings app). So anyway, I open one, search, open the other and so on. I must have opened and switched about 4 times, went through lots of menus, back and forth until I eventually found what I was looking for and changed the setting. After finishing, like ~10-15 seconds later a "feedback gathering ..." alert popped up, and it was gone in like 5 more seconds. My complete guess is that the constant going back and forth between settings menus and apps triggered something and something got sent to goog. I don't know how I feel about it, but I think I'm mostly fine with that? It sounds like the kind of thing I'd want my products to improve on. In an ideal world I'd get a quick report about what was gathered, and have an option to accept/deny but... Dunno.
globalnode 1y ago
Windows is basically ad/spyware, personally I only use it under sufferance for games and while doing so I remind myself constantly that I'm being watched/recorded and my computer is out of my control. So I play games, then log to Linux if I want to do anything real. Even then, do we know some rogue process isnt vacuuming up your keystrokes? Can still get a lot done without an internet connection I guess if you plan ahead.
- jstanley 1y ago
  > do we know some rogue process isnt vacuuming up your keystrokes? The standard for holding a belief isn't "can you prove it is not so?", but "on the balance of evidence, is it likely to be so?". If you believe everything you can't disprove, you'll hold an awful lot of bizarre and contradictory beliefs. In the past I have spent some time believing some things simply because I couldn't disprove them, it is not good for the soul.
  - lyu07282 1y ago
    I think that was also the common approach to paranoia about your privacy pre-Snowden. But he kind of ended that discussion for many, although denial or ignorance is probably better for your soul indeed.
    - jstanley 1y ago
      He didn't end the discussion, he presented evidence. When you receive updated evidence you should update your beliefs. He presented good evidence that big corporations are co-operating with the NSA, or something, but he didn't present any evidence at all that regular Linux distros are monitoring all your keystrokes. As far as I know.
      - lyu07282 1y ago
        To just wildly speculate about mass surveillance without evidence is just baseless conspiracy theories, you really have nothing to worry about. Hope that helps.
eurekin 1y ago
> it returned 2021.1019.1.0, whatever that means That looks like a version number... Would like to see more of the captured data, because a simple "about" dialog, would also need to call some server to check, if it software is in the latest version. To display the "you have the latest version" label.
- Springtime 1y ago
  This is a reasonable reaction to this. I pause when accusations jump immediately to spying as other explanations can exist without adding to FUD and noise online. It's not always difficult to find the purpose of something either with a bit more digging. I've seen something similar occur for some popular Youtube videos, too. A video author will fire up some arbitrary Windows setup, which can come bundled with third-party software and use Bing for various things including weather in the taskbar and queries in the search bar, then open Wireshark to scaremonger with DNS queries, accusing Microsoft of spying just for requests made by the services/programs/features they have enabled in their install. When often cursory lookups of the domains in search engines show what their purpose is and are contrary to such videos' alleged (and worse, guessed) purpose. It's a problem as there are legitimate concerns with certain aspects of Windows software with non-privacy respecting defaults but for an average user it gets muddled with irrelevant/incomplete info that doesn't lead to high quality actionable results.
- JdeBP 1y ago
  This is United Statians being the victims of their own crazy date writing style again. (-: Michael Horowitz did this on 2021-10-22, and it returned the value 2021.1019.1.0. Today, on 2025-06-07, it is publishing the value 2025.424.19.0. Which would be last April the 24th. It's blazingly obvious that it's the last date that something downloadable got updated, with a version or sequence number of some kind. The zero in the final field is probably there because someone is using a 4-field version datatype. To publish a date.
  - saghm 1y ago
    I wouldn't be surprised if the final zero is actually intentional; it would allow incrementing it if you need to publish more than one version on the same date. It's not likely to be needed, but if something is on fire and you absolutely need to push out a quick fix, having to figure out what version to call it is probably the last thing you want to have to worry about.
butz 1y ago
They will probably use collected telemetry data to build a third "control panel" to go along with already existing "control panels".
qwertox 1y ago
I wouldn't be surprised if they periodically collect a list of all the window titles.
Devasta 1y ago
Just like with IE, Microsoft will lose domination in the OS space for no other reason than it just gave up. It's maddening that they is a really capable OS sitting right underneath the layers of crap we have to deal with.
- keyringlight 1y ago
  I'd love to have the inside insight on how MS see WINE and related products and how that compares to how they saw chromium versus Trident/EdgeHTML. I really wonder if windows by itself is a loss leader to other areas where they do make money and would love to stabilize the desktop side and outsource/"contribute" that to others to maintain, just so long as they could keep money coming in from office, user administration, support contracts, alongside the services side. On a tangent I wonder a similar thing about nvidia/AMD carrying around decades worth of tweaks and fixes for old games within their GPU drivers (and matching that is a cost for entry for intel), could they shed a burden by opening that to projects like DXVK.
callamdelaney 1y ago
Windows 10 spies on everything you do, and presumably windows 11 does to a greater degree. Your windows photos app has over 122 tables [0] of analysis on every picture on your machine. It does facial recognition and more and likely reports a lot of this back to ms. That’s just one app! [0] https://www.reddit.com/r/Windows10/comments/8zk1yy/a_simple_analysis_of_what_local_data_the_photos/ https://www.reddit.com/r/Windows10/comments/8zk1yy/a_simple_...
- Springtime 1y ago
  > Your windows photos app... does facial recognition and more and likely reports a lot of this back to ms. That’s just one app! The link you cite though was careful to avoid making claims that couldn't be substantiated. It lists only what is in the database locally and the telemetry section doesn't include image content/metadata but user interactions with the app itself.
  - callamdelaney 1y ago
    Yep the post is also 7 years old. I suspect there is a lot more going on now, but I haven’t investigated in a while.
- madeofpalk 1y ago
  > more and likely reports a lot of this back to ms Isn’t this the literal definition of FUD? Fear, Uncertainty, and Doubt. I would like to hope the orange site approaches this topic with more substance. Do the analysis of network traffic to see what gets sent home. Decompile the binary to check it out for these sorts of things. Don’t just write your anti-MS fanfic and pretend that it’s something meaningful. People and object detection are pretty baseline features for a photo management app these days IMHO. I like that my photos app automatically finds all the photos of my dog.
  - callamdelaney 1y ago
    Why would it need to be performing facial analysis and have over 120 tables of information in the first place?
red_admiral 1y ago
This sounds like standard telemetry to me, probably only ever studied on aggregate and so fairly anonymised data. I'm not saying this is good, and I hope the EU mandates an effective OFF switch. But I don't see how Microsoft cares that you personally adjusted your screen brightness out of all the billions or so of data points they collect each day. Maybe the NSA's permanent record programme has some use for this?
nmeofthestate 1y ago
There's a potentially interesting article here where the content of the network requests and responses is investigated to find out what's happening, but this article isn't that - it just knee-jerks into cranky allegations of sPyiNg.
RubyRev 1y ago
[dead]
globular-toast 1y ago
I ditched Windoze 15 years ago and never looked back. There's never been an easier time to do it than now. Even if you can't do something on Linux, whatever it is isn't worth it. There's so much to do in life that it's more about choosing what not to do. Wherever possible choose love and generosity over hatred and greed.
- leakycap 1y ago
  I use my secured guest network for Windows and entertainment devices. Unfortunately there is still a lot that isn't convenient to do on Linux or even macOS if you work in a niche with custom drivers or development hardware involved.
JdeBP 1y ago
Has no-one figured this out in three years? It's not telemetry. You just have to look at the junk that gets put in that huge banner across the top of the system settings to figure out what this is. It's not reporting you to Microsoft. It's reporting stuff from Microsoft to you. 2021.1019.1.0 is, as I pointed out at https://news.ycombinator.com/item?id=44209402 https://news.ycombinator.com/item?id=44209402, a date. It's publishing a date from earlier this year now, in 2025. It's the date that something downloadable from Microsoft changed to a newer version. And in fact there are several things that got updated on April the 24th that are likely candidates here. There were update candidates for what this could be on October the 19th of 2021. The most likely is updates to Windows Update itself. As for Bing: Well in M. Horowitz's screenshot one can see that it's showing the prompt to have the "full customer experience". On other machines, you'll find that that area contains little icons about the statuses of Microsoft Rewards, Microsoft Edge, Microsoft OneDrive, Windows Update, and others. It's fairly obvious that the System Settings program has to make HTTP(S) queries to on-line services to show all of this stuff, including asking Bing how many Microsoft Rewards the user has earned. I wouldn't be surprised if it simply always did that, even if it never displayed the icon. And those queries involve DNS lookups. System Settings is querying various WWW services for the little icons at the top of its window, and the very prompt to run through the "full customer experience" dance that we can see right there in the screenshot.
- userbinator 1y ago
  Doesn't matter what you call it. It's unexpected and unsolicited network traffic, which can be used to determine what you were doing at that time.
  - JdeBP 1y ago
    Microsoft doesn't learn any more from the DNS lookup and HTTPS request than from you going to Bing.COM in a WWW browser on the very same machine and the Bing.COM site showing your Microsoft Account status, as it in fact does. Microsoft does not have the information to unambiguously know that you have opened System Settings. It just knows that something from your IP address has asked it about your account's Microsoft Rewards.
cosmotic 1y ago
I remember when buttons in the control panel did what the labels said they would do along with help buttons that opened local help documentation that was accurate, concise, clean, interlinked, organized, searchable, and instant. Now the buttons in Settings open bing search results page in Edge (even when not the default browser) that have 0 results.
Sophira 1y ago
On the topic of blocking host names using the hosts file: > The nslookup command returned valid IP addresses for both sub-domains, rather than the dummy IP addresses I put into the hosts file. Beats me why. DNS logging showed that nslookup queried my router for the IP addresses. The reason for this, as I understand it, is that nslookup queries the configured nameserver directly instead of using the getaddrinfo (or similar) function. (This is why the tool is named as it is - "nslookup" stands for "name server lookup". It was never a general purpose resolver tool.) Yes, this means that programs can simply bypass the hosts file if they want. However, it's worth noting that, even if you do use a pihole as the article suggests, programs can also bypass that by simply querying against a public DNS server like Google's 8.8.8.8. And if you block DNS to those, programs can use DNS-over-HTTPS. Of course, a large company like Microsoft probably has a lot of static IP addresses at their disposal, so they could just hardcode those instead and just bypass DNS altogether, at which point, basically your only recourse is to add a firewall rule to block that IP address. It's very difficult to ensure no connectivity short of denying Internet access entirely.
- TiredOfLife 1y ago
  It's not like windows has built in firewall or anything.

155 points by userbinator 1y ago

Considering the domains this is likely a network test, though it may be reporting the results of the connection to bing.com to cxcs, which apparently collects telemetry. On one hand, I get it - a lot of us ping google.com to quickly check the network - doesn't mean we're sending spy data to Google. On the other hand, it would be nice if this was more transparent, perhaps asking if it can perform the test.

userbinator 1y ago

I saw this happening in 11 too, not surprisingly. It's become increasingly difficult to get Windows to stay quiet on the network, although a lot of other software is also guilty of this background noise.

charcircuit 1y ago

It's normal for programs to reach out to the internet for purposes other than spying on the user. Microsoft is a trustworthy company that wouldn't deploy spyware within an app included in the OS.

eps 1y ago
That's sarcasm, HN. That's how sarcasm looks like.
Wobbles42 1y ago
This is true. It can't be considered spyware as long as the beneficiary is publically traded.
lurk2 1y ago
I’m not asking this rhetorically: Are you being sarcastic?
- charcircuit 1y ago
  No. Deploying spyware would break the trust that consumers and businesses have with Microsoft.
  - mixmastamyk 1y ago
    Funny. https://arstechnica.com/ai/2024/06/windows-recall-demands-an-extraordinary-level-of-trust-that-microsoft-hasnt-earned/ https://arstechnica.com/ai/2024/06/windows-recall-demands-an... I could list another fifty examples if motivated. Reminds me of this other funny comment as well: https://news.ycombinator.com/item?id=31727293 https://news.ycombinator.com/item?id=31727293 Truth is MS had several horrendous unrelated security breaches in the last years. Despite some scolding by senators it’s business as usual, profits up. So no, MS doesn’t care about trust of the little people and maybe never did.
notrealyme123 1y ago
I am not sure if this is sarcasm. But personal information leaving my private computer without my knowledge would be very close to to spyware. Edit: Maybe I am to blind for sarcasm.
- k4rli 1y ago
  Tbf you installed it so you've consented to it. It's like installing a security camera in your own bathroom and then complaining about privacy.
  - fuzzfactor 1y ago
    More like a plumber tasked with "modernizing" your bathroom, who as part of the process installs the camera surreptitiously precisely so you won't complain about compromised privacy. In any event it looks like that bridge is no longer for sale whole-hog. There were some fairly high bidders. A whole lot more people can enjoy the opportunity to participate through timesharing now though than ever before :)
kekebo 1y ago
Is this intentional devils advocacy for the sake of balancing an expected narrative? Outside of the rarely normative definition threshold as to what constitutes spyware or not, on what data / references (if any) do you base your impression on? And how does a perception of company trustworthiness correlate with telemetry ethics that don't infringe in some way on 'basic digital human rights' (as defined by GDPR et al, say)?
- charcircuit 1y ago
  >for the sake of balancing an expected narrative? Yes, because there are many people on this site who also believe a packet being sent to microsoft = spying. A lot of these people grew up with or were influenced by people who grew before the prevelance of the internet when software engineering was still immature when programs typically didn't communicate with the internet on their own. >do you base your impression on? My impression is based off the employees who work there who I would trust wouldn't add things like taking webcam screenshots and sending them back to Microsoft to look at. >how does a perception of company trustworthiness correlate with telemetry ethics Consumers and businesses will lose trust in a business if the telemetry data is not anonymized properly and put under strict privacy controls.
  - userbinator 1y ago
    Consumers and businesses will lose trust in a business I think you're really taking the piss now. Guess how much people trust MS (and the rest of Big Tech) these days.
    - kekebo 1y ago
      Overton window calculation usually starts at a minimum of two inputs without proximity requirements (except technical requirements like linguistics/ functional semantics)* [ * Only because an opinion may appear too far removed from a given perceived spectrum-threshold for 'reasonable reasoning'.. should not necessitate collapsing the contrasting input to some purely sarcastic/humorous telos, especially when this stochastically undermines one's own chances for being afforded the inversely congruent gesture]
ndsipa_pomu 1y ago
You must not be aware of the long history of Microsoft being very untrustworthy and lying about how their software behaves. e.g. funding SCO to pursue a campaign against Linux users and threatening to take them to court for using Linux: https://www.cnet.com/tech/tech-industry/fact-and-fiction-in-the-microsoft-sco-relationship/ https://www.cnet.com/tech/tech-industry/fact-and-fiction-in-... e.g. DOS ain't done til Lotus won't run: https://www.proudlyserving.com/archives/2005/08/dos_aint_done_t.html https://www.proudlyserving.com/archives/2005/08/dos_aint_don... and many, many more: https://en.wikipedia.org/wiki/Criticism_of_Microsoft https://en.wikipedia.org/wiki/Criticism_of_Microsoft
- charcircuit 1y ago
  >DOS ain't fine til Lotus won't run That article debunks that this was ever a thing.

alkonaut 1y ago

Apart from the reason of ”if they spy on this, who knows what else” and ”I don’t want to waste resources on telemetry” what is the reason to not allow a vendor to see which settings page you visit? Obviously if you opt out (or rather, didn’t opt in) you shouldn’t be sending telemetry. But the line between a necessary network call and an optional one is often blurry.

userbinator 1y ago
what is the reason to not allow a vendor to see which settings page you visit? It's all about privacy; and by privacy, I don't mean the "privacy" that often gets thrown around by Big Tech to mean "only we can see what you do". What I do on my computer is none of their business.
- alkonaut 1y ago
  Anonymous usage statistics means no one stores what _you_ do though. Obviously sending a url you visit or a file you open is way over the line. That’s about what you do. I think there is a difference between that and feature usage as counters only.
  - userbinator 1y ago
    If it can be correlated (e.g. via TLS fingerprinting or other identifying information such as IP address), it's not anonymous.
    - alkonaut 1y ago
      Yes if it can be deanonymized then it’s not anonymous. Almost a tautology that. You can’t send the telemetry over http without revealing an ip, but obviously that ip can’t be stored as part of the telemetry data. That’s PII and not anonymous at all. Important: if I collect anonymous telemetry you better trust me that it’s anonymous when I say it is. Because if you don’t trust me on that then you can’t run the software at all (if it’s a piece of software that relies on web requests in some form at least). Otherwise why would you even trust that my opt in is respected? You have to trust software vendors of software that makes http requests. It’s as simple as that. You can use open source or try to inspect packets. Or firewall the software. But if it does (for example) one update check on startup which is common, then it’s almost impossible to tell whether it contains telemetry data. Because even the bare minimum request “this is FooApp 2.9.1 are there any updates” contains important usage stats: it’s +1 for the use counter and +1 for the v2.9 use counter!

barrkel 1y ago

The usual reason for this kind of telemetry is to figure out which features users are using and which they aren't. That guides decisions about what to invest in, what can more or less safely deprecated, and can even help with promotions.

axitanull 1y ago
And with all kinds of telemetry they collected, they managed to create the pinnacle of UI/UX redesign, as shown in the Settings Panels in Windows 11, right?
- tonyhart7 1y ago
  settings panel is great, its modern and easy to use
  - pathartl 1y ago
    People are weirdly attached to Control Panel. What's better: Control Panel -> Network and Internet -> Network and Sharing Center -> Change Adapter Settings -> Properties on selected NIC -> IPv4 -> Properties to set a static IP or Settings -> Network and Internet -> Ethernet -> IP Assignment People got used to where things were. That does no indicate good UX/UI.
    - tonyhart7 1y ago
      out of touch from reality people that use windows want simplicity (kids, old people, office worker that want get the job done etc) Yeah the new settings is not advance but that's the point
      - hulitu 1y ago
        > office worker that want get the job done Then why the fsck gets in my way ? Why 1px borders when i have to resize windows ? Why no place on the titlebar when one can click and drag on second monitor ? Why the stupid taskbar where some windows are hidden and others not. Why the stupid alt-tab where it rearanges the window stack ? Why ?

CommanderData 1y ago

I wish there was a law which mandated update, service and telemetry servers were on different cidrs. There are frequently updates lists Windows telemetry IPs you can block using ipsets. But a Microsoft always seem to mix these IPs with legitimate services.

djfivyvusn 1y ago
How to tell if Microsoft has changed their ways or if they're just playing a long game of embrace extend extinguish.

NitpickLawyer 1y ago

I have a similar anecdote about android. I was trying to change some setting, but my android phone has like 3 different places where settings can hide (the settings app, google settings app and vendor settings app). So anyway, I open one, search, open the other and so on. I must have opened and switched about 4 times, went through lots of menus, back and forth until I eventually found what I was looking for and changed the setting. After finishing, like ~10-15 seconds later a "feedback gathering ..." alert popped up, and it was gone in like 5 more seconds. My complete guess is that the constant going back and forth between settings menus and apps triggered something and something got sent to goog. I don't know how I feel about it, but I think I'm mostly fine with that? It sounds like the kind of thing I'd want my products to improve on. In an ideal world I'd get a quick report about what was gathered, and have an option to accept/deny but... Dunno.

globalnode 1y ago

Windows is basically ad/spyware, personally I only use it under sufferance for games and while doing so I remind myself constantly that I'm being watched/recorded and my computer is out of my control. So I play games, then log to Linux if I want to do anything real. Even then, do we know some rogue process isnt vacuuming up your keystrokes? Can still get a lot done without an internet connection I guess if you plan ahead.

jstanley 1y ago
> do we know some rogue process isnt vacuuming up your keystrokes? The standard for holding a belief isn't "can you prove it is not so?", but "on the balance of evidence, is it likely to be so?". If you believe everything you can't disprove, you'll hold an awful lot of bizarre and contradictory beliefs. In the past I have spent some time believing some things simply because I couldn't disprove them, it is not good for the soul.
- lyu07282 1y ago
  I think that was also the common approach to paranoia about your privacy pre-Snowden. But he kind of ended that discussion for many, although denial or ignorance is probably better for your soul indeed.
  - jstanley 1y ago
    He didn't end the discussion, he presented evidence. When you receive updated evidence you should update your beliefs. He presented good evidence that big corporations are co-operating with the NSA, or something, but he didn't present any evidence at all that regular Linux distros are monitoring all your keystrokes. As far as I know.
    - lyu07282 1y ago
      To just wildly speculate about mass surveillance without evidence is just baseless conspiracy theories, you really have nothing to worry about. Hope that helps.

eurekin 1y ago

> it returned 2021.1019.1.0, whatever that means That looks like a version number... Would like to see more of the captured data, because a simple "about" dialog, would also need to call some server to check, if it software is in the latest version. To display the "you have the latest version" label.

Springtime 1y ago
This is a reasonable reaction to this. I pause when accusations jump immediately to spying as other explanations can exist without adding to FUD and noise online. It's not always difficult to find the purpose of something either with a bit more digging. I've seen something similar occur for some popular Youtube videos, too. A video author will fire up some arbitrary Windows setup, which can come bundled with third-party software and use Bing for various things including weather in the taskbar and queries in the search bar, then open Wireshark to scaremonger with DNS queries, accusing Microsoft of spying just for requests made by the services/programs/features they have enabled in their install. When often cursory lookups of the domains in search engines show what their purpose is and are contrary to such videos' alleged (and worse, guessed) purpose. It's a problem as there are legitimate concerns with certain aspects of Windows software with non-privacy respecting defaults but for an average user it gets muddled with irrelevant/incomplete info that doesn't lead to high quality actionable results.
JdeBP 1y ago
This is United Statians being the victims of their own crazy date writing style again. (-: Michael Horowitz did this on 2021-10-22, and it returned the value 2021.1019.1.0. Today, on 2025-06-07, it is publishing the value 2025.424.19.0. Which would be last April the 24th. It's blazingly obvious that it's the last date that something downloadable got updated, with a version or sequence number of some kind. The zero in the final field is probably there because someone is using a 4-field version datatype. To publish a date.
- saghm 1y ago
  I wouldn't be surprised if the final zero is actually intentional; it would allow incrementing it if you need to publish more than one version on the same date. It's not likely to be needed, but if something is on fire and you absolutely need to push out a quick fix, having to figure out what version to call it is probably the last thing you want to have to worry about.

butz 1y ago

They will probably use collected telemetry data to build a third "control panel" to go along with already existing "control panels".

qwertox 1y ago

I wouldn't be surprised if they periodically collect a list of all the window titles.

Devasta 1y ago

Just like with IE, Microsoft will lose domination in the OS space for no other reason than it just gave up. It's maddening that they is a really capable OS sitting right underneath the layers of crap we have to deal with.

keyringlight 1y ago
I'd love to have the inside insight on how MS see WINE and related products and how that compares to how they saw chromium versus Trident/EdgeHTML. I really wonder if windows by itself is a loss leader to other areas where they do make money and would love to stabilize the desktop side and outsource/"contribute" that to others to maintain, just so long as they could keep money coming in from office, user administration, support contracts, alongside the services side. On a tangent I wonder a similar thing about nvidia/AMD carrying around decades worth of tweaks and fixes for old games within their GPU drivers (and matching that is a cost for entry for intel), could they shed a burden by opening that to projects like DXVK.

callamdelaney 1y ago

Windows 10 spies on everything you do, and presumably windows 11 does to a greater degree. Your windows photos app has over 122 tables [0] of analysis on every picture on your machine. It does facial recognition and more and likely reports a lot of this back to ms. That’s just one app! [0] https://www.reddit.com/r/Windows10/comments/8zk1yy/a_simple_analysis_of_what_local_data_the_photos/ https://www.reddit.com/r/Windows10/comments/8zk1yy/a_simple_...

Springtime 1y ago
> Your windows photos app... does facial recognition and more and likely reports a lot of this back to ms. That’s just one app! The link you cite though was careful to avoid making claims that couldn't be substantiated. It lists only what is in the database locally and the telemetry section doesn't include image content/metadata but user interactions with the app itself.
- callamdelaney 1y ago
  Yep the post is also 7 years old. I suspect there is a lot more going on now, but I haven’t investigated in a while.
madeofpalk 1y ago
> more and likely reports a lot of this back to ms Isn’t this the literal definition of FUD? Fear, Uncertainty, and Doubt. I would like to hope the orange site approaches this topic with more substance. Do the analysis of network traffic to see what gets sent home. Decompile the binary to check it out for these sorts of things. Don’t just write your anti-MS fanfic and pretend that it’s something meaningful. People and object detection are pretty baseline features for a photo management app these days IMHO. I like that my photos app automatically finds all the photos of my dog.
- callamdelaney 1y ago
  Why would it need to be performing facial analysis and have over 120 tables of information in the first place?

red_admiral 1y ago

This sounds like standard telemetry to me, probably only ever studied on aggregate and so fairly anonymised data. I'm not saying this is good, and I hope the EU mandates an effective OFF switch. But I don't see how Microsoft cares that you personally adjusted your screen brightness out of all the billions or so of data points they collect each day. Maybe the NSA's permanent record programme has some use for this?

nmeofthestate 1y ago

There's a potentially interesting article here where the content of the network requests and responses is investigated to find out what's happening, but this article isn't that - it just knee-jerks into cranky allegations of sPyiNg.

RubyRev 1y ago

[dead]

globular-toast 1y ago

I ditched Windoze 15 years ago and never looked back. There's never been an easier time to do it than now. Even if you can't do something on Linux, whatever it is isn't worth it. There's so much to do in life that it's more about choosing what not to do. Wherever possible choose love and generosity over hatred and greed.

leakycap 1y ago
I use my secured guest network for Windows and entertainment devices. Unfortunately there is still a lot that isn't convenient to do on Linux or even macOS if you work in a niche with custom drivers or development hardware involved.

JdeBP 1y ago

Has no-one figured this out in three years? It's not telemetry. You just have to look at the junk that gets put in that huge banner across the top of the system settings to figure out what this is. It's not reporting you to Microsoft. It's reporting stuff from Microsoft to you. 2021.1019.1.0 is, as I pointed out at https://news.ycombinator.com/item?id=44209402 https://news.ycombinator.com/item?id=44209402, a date. It's publishing a date from earlier this year now, in 2025. It's the date that something downloadable from Microsoft changed to a newer version. And in fact there are several things that got updated on April the 24th that are likely candidates here. There were update candidates for what this could be on October the 19th of 2021. The most likely is updates to Windows Update itself. As for Bing: Well in M. Horowitz's screenshot one can see that it's showing the prompt to have the "full customer experience". On other machines, you'll find that that area contains little icons about the statuses of Microsoft Rewards, Microsoft Edge, Microsoft OneDrive, Windows Update, and others. It's fairly obvious that the System Settings program has to make HTTP(S) queries to on-line services to show all of this stuff, including asking Bing how many Microsoft Rewards the user has earned. I wouldn't be surprised if it simply always did that, even if it never displayed the icon. And those queries involve DNS lookups. System Settings is querying various WWW services for the little icons at the top of its window, and the very prompt to run through the "full customer experience" dance that we can see right there in the screenshot.

userbinator 1y ago
Doesn't matter what you call it. It's unexpected and unsolicited network traffic, which can be used to determine what you were doing at that time.
- JdeBP 1y ago
  Microsoft doesn't learn any more from the DNS lookup and HTTPS request than from you going to Bing.COM in a WWW browser on the very same machine and the Bing.COM site showing your Microsoft Account status, as it in fact does. Microsoft does not have the information to unambiguously know that you have opened System Settings. It just knows that something from your IP address has asked it about your account's Microsoft Rewards.

cosmotic 1y ago

I remember when buttons in the control panel did what the labels said they would do along with help buttons that opened local help documentation that was accurate, concise, clean, interlinked, organized, searchable, and instant. Now the buttons in Settings open bing search results page in Edge (even when not the default browser) that have 0 results.

Sophira 1y ago

On the topic of blocking host names using the hosts file: > The nslookup command returned valid IP addresses for both sub-domains, rather than the dummy IP addresses I put into the hosts file. Beats me why. DNS logging showed that nslookup queried my router for the IP addresses. The reason for this, as I understand it, is that nslookup queries the configured nameserver directly instead of using the getaddrinfo (or similar) function. (This is why the tool is named as it is - "nslookup" stands for "name server lookup". It was never a general purpose resolver tool.) Yes, this means that programs can simply bypass the hosts file if they want. However, it's worth noting that, even if you do use a pihole as the article suggests, programs can also bypass that by simply querying against a public DNS server like Google's 8.8.8.8. And if you block DNS to those, programs can use DNS-over-HTTPS. Of course, a large company like Microsoft probably has a lot of static IP addresses at their disposal, so they could just hardcode those instead and just bypass DNS altogether, at which point, basically your only recourse is to add a firewall rule to block that IP address. It's very difficult to ensure no connectivity short of denying Internet access entirely.

TiredOfLife 1y ago
It's not like windows has built in firewall or anything.