Live data from Hacker News

Windows 10 Enterprise ignores various privacy settings

twitter.com

41–50 of 269 posts

Re: Windows 10 Enterprise ignores various privacy settings

#41

MS Support consistently and repeatedly told me that enterprise allowed me to disable this stuff. If I can't control the egress then I can't verify PCI compliance. I've already had to revert a client to Win 7 because they failed a PCI compliance audit using Win 10 Enterprise. Which, by the way, is very expensive for small businesses. Win 10 Enterprise isn't viable for business. I have a bunch of small business clients…

I'm curious what was the biggest issue with whitelisting. Was it about making sure services work, or about standard users' daily work? Did you try to comply on everything, or just have a PCI compliant zone? Also, do you remember what was the specific reason for failing the audit? This all sounds interesting since you've gone though that experience.

Some of this stuff goes via CDNs. Once you start blocking those, a lot of collateral damage will turn up at unexpected times as providers switch CDNs.

Re: Windows 10 Enterprise ignores various privacy settings

#42

Since the first release of W10 several registry keys and policies have changed in very confusing ways. I can't remember what exactly but I had to change my personal scripts several times based on the changelog of other tools. Privacy and settings like default apps were also reverted (reset to default) when you updated. They installed some apps like Candy Crush Saga on Enterprise. I don't see that much of a problem he…

I can't agree with this more. A client straight up failed a PCI compliance audit, replete with daily fines, for using 10 Enterprise. They decided to pursue legal measures against MS for false claims. I really hope this gets elevated because reverting to win 7 is a solution with a short life span. The other solution is to rebuild infrastructure on top of a different platform but that's prohibitively expensive.

> The other solution is to rebuild infrastructure on top of a different platform but that's prohibitively expensive.

The more Microsoft degrades their viability for enterprise computing, the more market pressure will build (I think) for a different platform infrastructure.

If / when the market reaches that tipping point, the schadenfreude will be overwhelming.

Re: Windows 10 Enterprise ignores various privacy settings

#43

Another year of another decade; Microsoft as dishonorable as ever.

But look, then allow you to run their database on Linux now!! It's proven time and time again that if the entire org isn't behind something, the good deeds of some get vastly overshadowed by these kind of games.

I really wish that the company that makes .net and azure could be split off from the rest of msft.

Re: Windows 10 Enterprise ignores various privacy settings

#44

Earlier quoted context omitted.

I'm curious what was the biggest issue with whitelisting. Was it about making sure services work, or about standard users' daily work? Did you try to comply on everything, or just have a PCI compliant zone? Also, do you remember what was the specific reason for failing the audit? This all sounds interesting since you've gone though that experience.

Some of this stuff goes via CDNs. Once you start blocking those, a lot of collateral damage will turn up at unexpected times as providers switch CDNs.

All of the first-party connections seem to have proper DNS names, even on CDN (microsoft.com, microsoft.com.akadns.net). The ad networks are obvious third party that could be dropped. I mean, there could be more stuff I didn't see, but from the screenshots, dns blackholing seems viable.

Re: Windows 10 Enterprise ignores various privacy settings

#45
Frankly, I am fed up trying to block the "phone-home" connections between our PCs and Microsoft and we're still only using Windows 7. There is absolutely no way we would ever use Windows 10 unless we could guarantee that we could totally sever all such connections permanently and not have to worry about them again.

Moreover, for some years now we have considered our Windows operating systems as 'hostile' privacy-busting code on our PCs and if there was some easy way we could get rid of them then we would do so in an instant (please don't come at me with the Linux bumph/argument because in many instances it's not a possible option).

This really is tiresome, why can't we just buy Windows/Microsoft busting routers that have a big red button on them that says: "Stop all Phone-home to Microsoft" or alternatively ones that have easily updatable blocking lists/text files that we can easily administer/download to them?

This ought to be an easy no-brainer but it isn't! Why is it that router manufacturers, etc. aren't falling all over themselves to provide such devices? I'm amazed that they're not, one would think there'd be dozens of available by now; are manufactures that timid and afraid of Microsoft that they're not game to make them?

Furthermore, it is not only a Microsoft Windows O/S problem, as these days just about all software talks home without seeking the user's permission to do so beforehand, and none of them tell you exactly what information is being transmitting home. It seems to me that we users will never solve this "talk home" problem until we have easy to use gateways that are external to our PCs, phones etc. that automatically block all "phone-home" addresses.

BTW, anyone thinking of developing such a device needs to keep in mind that for years Microsoft has hard-coded within Windows certain IP address that bypass the hosts file irrespective of how it is set so that it is impossible to block Windows completely from talking home. Thus, there is no other option other than to block these addresses by means that are external to the PC/device!

A final point: Microsoft could claim that as it has provided the upgrade to Windows 10 free and that entitles it to sap the private life info out of its users. I would counter that by saying that if alternatively I actually buy/pay for the operating system then I'm entitled to have complete control over it—and that means no talkback to Microsoft by the OS.

Of course, none of this would be a problem now if the Microsoft monopoly had been busted years ago (i.e. if our fearful democracies had been game enough to use already existing law to thwart the monopoly early on).

Re: Windows 10 Enterprise ignores various privacy settings

#46

MS Support consistently and repeatedly told me that enterprise allowed me to disable this stuff. If I can't control the egress then I can't verify PCI compliance. I've already had to revert a client to Win 7 because they failed a PCI compliance audit using Win 10 Enterprise. Which, by the way, is very expensive for small businesses. Win 10 Enterprise isn't viable for business. I have a bunch of small business clients…

Did they complain to MS? I imagine that MS would care a lot about losing enterprise sales.

Re: Windows 10 Enterprise ignores various privacy settings

#47
The switch to Linux or other free operating systems is long overdue. If your excuse is hardware support, then (1) your hardware is probably supported these days and (2) you should not buy hardware that is incompatible with the operating system you plan to use. If your excuse is editing MS Office files, LibreOffice supports the formats and works great, and MS Office on Wine is an option. If your excuse is games, then know that with Steam and Wine combined your potential gaming library is HUGE. If your excuse is laziness or resistance to change, then I thank you for being honest, and urge you to overcome it.

Proprietary operating systems work against your interests. Stop using them.

Re: Windows 10 Enterprise ignores various privacy settings

#48

MS Support consistently and repeatedly told me that enterprise allowed me to disable this stuff. If I can't control the egress then I can't verify PCI compliance. I've already had to revert a client to Win 7 because they failed a PCI compliance audit using Win 10 Enterprise. Which, by the way, is very expensive for small businesses. Win 10 Enterprise isn't viable for business. I have a bunch of small business clients…

I went through the same thing last year. I spent two months trying to plug all the holes in the enterprise version, for a medium sized healthcare client, and eventually gave up.

The LTSB edition looks promising but I haven't put it under the microscope yet.

Re: Windows 10 Enterprise ignores various privacy settings

#49

Earlier quoted context omitted.

Some of this stuff goes via CDNs. Once you start blocking those, a lot of collateral damage will turn up at unexpected times as providers switch CDNs.

All of the first-party connections seem to have proper DNS names, even on CDN (microsoft.com, microsoft.com.akadns.net). The ad networks are obvious third party that could be dropped. I mean, there could be more stuff I didn't see, but from the screenshots, dns blackholing seems viable.

DNS blackholing is playing whack-a-mole. I can blackhole scontent.xx.fbcdn.net today, and I have no assurance or confidence that they won't use scontent.xx.fbcdn2.net tomorrow.

DNS/FW whitelist is the only way to have even a little confidence that egress is controlled at this point.

Re: Windows 10 Enterprise ignores various privacy settings

#50

Earlier quoted context omitted.

I don't think they do it on purpose. I think Windows is just a patchwork of cruft at this point. I'm sure the Enterprise version shares all the code with the non Enterprise versions which have all the spying ... analytics... enabled, so bugs are bound to happen that let this escape into the Enterprise version.

Whether it's incompetence or malice, it's wholly unprofessional. My confidence was already shaken with MS through their entire Win 10 Campaign and it's now completely gone. Their paid support services are hit and miss and if I'm going to end up supporting things that my client is paying MS to support then they're out and my client gets a smaller TCO overall. I'll have to work with some of them so their business remai…

Agreed. Their forced Windows 10 upgrade "mistake" and my experience last year trying to plug all the holes in enterprise just to watch them re-install Candy Crush Saga with the next update vaporized any confidence or trust I had.

I've always been an MS person but am running Ubuntu on all of my devices now. I feel it hurts my productivity as lots of things I did in Windows just don't work in Ubuntu, but it's better than the alternative. I have a Windows 10 VM that I use every once in a while for those things that are completely impossible on Ubuntu.

And I'm not even sure I can trust Canonical.

Post reply on HN