Ask HN: Could Win10 data leaks be managed by some kind of firewall or parental-control software? I mean, if we know what sites are being accessed, just block those sites.
Yes, but the lists I've seen look huge [1]. It also requires 3rd party software/hardware to block since the name resolution for many of the endpoints seems to be hardcoded into dnsapi.dll. There's also no guarantee that some security update will add additional server names that Windows can talk to. Basically you end up in a security arms race with your OS provider - which is hard if not impossible to win. [1] http://…
Decompile dnsapi.dll, remove all hardcoded hosts, replace and protect to a nonexistent group so that windows can’t even override it during an upgrade.