Windows 10: HOSTS file blocking telemetry is now flagged as a risk
bleepingcomputer.com
bleepingcomputer.com
www.microsoft.com
microsoft.com
telemetry.microsoft.com
wns.notify.windows.com.akadns.net
v10-win.vortex.data.microsoft.com.akadns.net
us.vortex-win.data.microsoft.com
us-v10.events.data.microsoft.com
urs.microsoft.com.nsatc.net
watson.telemetry.microsoft.com
watson.ppe.telemetry.microsoft.com
vsgallery.com
watson.live.com
watson.microsoft.com
telemetry.remoteapp.windowsazure.com
telemetry.urs.microsoft.com
Oh well, there's always pihole.
Edit: On second thought, how long before they just start hard coding IP addresses?
[0]: https://blog.malwarebytes.com/cybercrime/2016/09/hosts-file-...
I think it’ll eventually go to DoH with hard to block IPs (ex: Cloudflare IPs are tough to block because you break too much stuff).
I’ve always believed a large part of the push for TLS, DoH, eSNI, etc. is to eliminate our ability to filter network traffic. It’s sold as a freedom thing, but I’m sceptical.
That said TLS and other network security features are fundamental building blocks, but obviously in oppressive regimes where they stand out they have also the potential to bring the most value. And in parts of the world where network censorship is not a problem, there the features might benefit greedy corporations in a quasi-oligopoly a lot more than the users. But that's not necessarily an argument against these features.
This is a crucial point here. I would be curious to see a list of Microsoft sites that you are allowed to redirect in the HOSTS file. Having a more complete list of protected/unprotected domains would give us a better indication if this is an overly aggressive attempt to protect users from legitimate threats or a malicious attempt to protect Microsoft's access to users’ data. Because blocking redirects on microsoft.com certainly seems smart, but blocking redirect of telemetry.remoteapp.windowsazure.com seems suspicious.
Not to say that it going to Microsoft is necessarily that much better, or that they may have deliberately also sabotaged people trying to redirect it to localhost, but still, it's a thing.
What would be the benefit of it? IP addresses are as easy to block as domain names, but the number of IP adresses available to them is much smaller than the number of possible domain names.
Is it? If they wanted to be toxic they could mix the telemetry IPs around with the windows update IPs inside a fairly significant block of IPv6 addresses. It would be hard to block the entire range because you'd hit the update servers.
[Edit] MS may have wised up and consolidated the activity endpoints / vips into another endpoint. You may have to clear cache on the PC and your router, reboot and watch DNS requests as you launch applications to see where they moved.
To stop this behavior requires registry changes unless you are on Enterprise or LTSC in which case you can use GPO. There are some free programs that will do the registry tweaks for you.
Here is a video talking about manually changing some things [1] and they link to free tools that can do the changes as well [2].
My "Diagnostic Data" is set to "Basic" in the normal Settings UI. I'm on the "2004" release of Windows 10.
Anything I have to do to experience this? What kind of applications/apps are causing the freeze?
They may have even further consolidated these endpoints into something else. I went through this exercise last year after network debugging a family members game that was hanging, only to find Akamai was down in my area for the activity endpoint. It is a never-ending arms race of whack-a-mole.
Another thing you can do is clear cache on your windows machine and router, then reboot and watch DNS requests as you launch applications. If they merged activity into a common endpoint, you should still see the requests.
"activity.windows.com" was previously cached at the network resolver (before block/cache clear), but hasn't re-appeared and there's nothing obvious that replaces it during app or application launch.
The machine has been both cleared and rebooked just for good measure (as it could be cached inside the telemetry service itself).
[1]: https://support.microsoft.com/kb/4468227
[2]: https://www.tenforums.com/tutorials/100341-enable-disable-co...
DNS filtering does not work any more as far as I can see. It appears they have wised up and are consolidating endpoints so that you can't block it that way any more.
It seems, at least from my experimentation, that Windows 10 is actually quieter when you put all the privacy stuff up - either that, or the other ones are so inactive that they don't show up in my PiHole.
Current statistics show least popular top permitted domain on my computer to be hit 258 times a day and nothing above it is Microsoft.
Top Blocked Domains from Microsoft include: settings-win.data.microsoft.com ( > 100 ) v10.events.data.microsoft.com ( > 80 )
It's pretty darn quiet. I think Windows 8, after the telemetry updates, was was many times that.
edit: small disclosure: I did work for Microsoft around 7 years ago. I did work in the Windows org, though. These thoughts are my own and I very much hate the tracking that Microsoft does, even at the bare minimum without a toggle switch to turn it all of.
You can buy it off the shelf. It's going to set you back $300+ dollars, but it's not hard. https://community.spiceworks.com/topic/2167558-explicit-inst...
It's as if the idea of people putting together their own PCs just never occurs to Microsoft.
MS very explicitly doesn’t target these releases to consumers, it’s entirely possible to do it by adding the 4 x useless products to get over the 5 x volume requirement. It’s sad, but not shocking they didn’t cover the edge case of a custom builder. If you were a firm building machines, you’d again get a special setup and do provisioning and key burning into bios etc.
I cannot help but think that there are a lot of "dark matter" sysadmins plunking away like me, just maintaining machines for friends or tiny businesses, and that we're underserved as a market segment.
You do not need any crazy volume. I was able to get it in place, legitimately, for a metal fabricator that has maybe 20 computers total not including their operational technology (CNC devices) that they wanted LTSC for.
If you were supporting multiple users in a small business environment definitely make sure you buy as many Windows SKUs as you have end users to be compliant, however.
All of this becomes moot once you have >25 clients; then you can transition to using volume licensing and it's essentially unlimited. It still tracks it though and Microsoft can ask to look at it, especially if you change from Open to Select or some other volume pricing agreement, so keep that in mind.
LTSC 2019 is on 1809. I don't believe it's possible to upgrade LTSC 2019 to 1909. Happy to be wrong, though.
[0] https://www.techspot.com/news/84931-microsoft-flight-simulat...
I'm sure the EU is perfectly free to block use of Windows if this is a GDPR violation, given that blocking use of Windows is the only way to ensure the GDPR violations are not continuing, as this is closed-source software.
Can you imagine arguing that American law does not apply to some company operating in the US, because said company was founded in some other country?
I can imagine countries ceasing to operate in the US, yes. Can you?
[1] https://en.wikipedia.org/wiki/Volkswagen_emissions_scandal
[2] https://en.wikipedia.org/wiki/EU_illegal_State_aid_case_agai...
It probably won't, but it has that option.
So this will be a violation of the GDPR only for Windows users in the E.U.
But I'm sure all that tracking is explain in the middle of 100 pages long agreement that you have to agree to install and use Windows.
The GDPR is intentionally written so that you can't just waive your rights based on a paragraph buried in the TOS. Otherwise it would be completely meaningless.
Whether a law applies is dependent on whether the country or countries with that law can enforce it. China recently made it illegal for me to wish Hong Kong was independent. Does that mean I'm going to Chinese prison for saying I wish Hong Kong were independent?
If Microsoft were found in violation of GDPR, they already are in Europe, so there would be all kinds of ways to enforce that law.
Also, I don't know what threat model they're using to make these decisions. If you can edit the hosts file with administrative privileges, you can also add registry entry that adds a file exception in Windows Defender with the same permissions...
The title is:
> Windows 10: HOSTS file blocking telemetry is now flagged as a risk
That seems clear to me about what is being flagged. I don't see any implication that telemetry is being flagged, and I'm not quite sure why anyone would think it would be—although I'd love it if Windows were to start reporting that its own telemetry was a risk, I don't see that in the cards.
Surprise! Windows Defender detected the Jailbreak and helpfully removed the file to keep you safe! This is not a false positive, Windows Defender literally lists "Jailbreak" as the reason the file is dangerous. Never mind that it's a user-initiated jailbreak for an entirely different, non-Microsoft Operating System!
Repeat the same process on macOS—y'know, the OS from a company that actually has an interest in stopping this stuff. Does unc0ver.ipa get deleted by XProtect? Nope! Apple understands that these systems should only ever be used for actual viruses. To do anything else is a severe betrayal of user trust.
IMO, Windows Defender has jumped the shark, and sadly, I've now resorted to disabling it on all personal Windows machines.
Downloading the latest version of unc0ver (v5.3.1) does indeed not receive any trouble from Windows Defender.
Then I decided to try an older version of unc0ver, specifically v3.6.3, because it was released around the time I remembered running into this. Sure enough, Windows Defender deleted it for being a "Jailbreak".
(It wasn't even quarantined, just deleted outright, leaving me with no way to restore the file!)
https://i.ibb.co/DMCNHCs/Screen-Shot-2020-08-04-at-2-41-22-P...
So, the problem was fixed, but not on Microsoft's end. And it was not a false positive, because Windows 10 labeled the "threat" accurately.
The fact that it happened at all, however, seriously doesn't sit right with me.
It probably detected some of the techniques they used in the file as things used in exploits (since there's little difference in a jailbreak/security exploit from a technical perspective). The fact that it catches is in that case a good thing. That it doesn't catch it anymore might point towards them getting a report that it's a false positive of their automated binary matching, and making an exception to allow it. Apple not catching it could then indicate that either Apple already allowed it, or Apple's exploit detection is less sophisticated and wasn't able to see the problem.
I don't know if that situation is correct, but it seems just as plausible to me, and in that case, Defender is doing exactly what I would want, responded to a report exactly as I would want and expect, and has multiple mechanisms to bypass the initial problem (add folder that's not scanned, disable entirely, etc), and your experience with Apple points towards them either being a little quicker with the exception or just worse at doing what I would want.
Even if someone at Microsoft got overzealous (or a third party reported it), the software is literally designed to find and quarantine exploits (which a jailbreak is), and there are ways to bypass it even if it wasn't apparently reversed later. The item detected is an exploit, just for a different system. It's exactly the sort of false positive I would expect, and the fact that you can work around it without major issues (whether through a special download folder you create and mark as not scanned immediately or temporarily disabling it) is exactly what I would expect.
It's sort of like if you owned a furniture store, and have a security guard to watch it. One night after hours, some guys in street clothes show up in a truck and loiter for a bit before going in the back and starting to take some furniture to the truck. Sure, these guys are your cousins, and are doing stuff on your behalf, but does the guard know that? Did you tell the guard? Would you rather the security guard go stop everything immediately and call you to confirm what's going on, or just shrug and say "eh, it's probably fine"? You're paying them to stop bad stuff, you should expect them to stop bad stuff, and when they find false positives that look like the real thing, that should be reassuring that they're doing their job, not grounds for dismissal.
I even use it together with the router to have my phone use the DNS and you can see which hosts get connected and so on as you use the phone. It ain't pretty.
[0]: https://mayakron.altervista.org/support/acrylic/Home.htm
I havent investigated yet the possibility of using virtual lan adapter with separate subnet dedicated to DNS and if that can be filtered using Windows firewall.
Bing, Facebook, Windows Web Search and some other sites don't work (unless you use DNS over https in Firefox, which ignores the host files.)
Go through r/pihole for the recommended ones.
https://proprivacy.com/privacy-service/guides/how-to-disable...
As you said people use computers for different things than you.
My point is, people who say their work is only doable on Windows tend to just be scared to move away from the specific tools they know.
If you're not developing a mobile or console game, windows is 95%+ of your market. At some point your going to need to do some development/QA on windows regardless of what hoops you're willing to jump through to develop on Linux.
>"embedded development"
There is a plenty of proprietary windows only software for which there is no viable alternative on Linux. And there are a lot of embedded systems out there in the world running on Windows. Sure if you are a one man shop, you can choose your own stack, and Linux support is one of your top priorities, then you don't need Windows. But many people in the embedded world are on Windows whether they like it or not.
>My point is, people who say their work is only doable on Windows tend to just be scared to move away from the specific tools they know.
And people who say "just use X on Linux instead of Y on Windows or Z on OS X" tend to overestimate the Linux alternative because they don't use it professionally. There are many professional software tools that do not have viable alternatives on Linux, and many more for which the Windows alternative is just much better than their what's available on Linux.
And also I use Win, Linux and OSX.
Windows is basically mandatory for CAD, not only a lot of CAD is not available at all outside windows, often they fail to run on Wine and whatnot, I suspect sometimes this is on purpose.
And a unrelated big offender is Roblox, they consider Linux a "hacking tool" and ban you if it detects you are somehow running it on Linux, no matter what method you used.
Sometimes I'm forced to use OS X as well - not just forced to use Windows - because that's the only thing the iOS toolchains work on and debug with properly. And if I'm targeting mobile, I'm targeting iOS, not just Android - because I'm getting paid too much to ignore that much of the target market.
Console SDKs come in the form of windows-only tooling that tightly integrates with Visual Studio - which last I checked, attempts to verify you're using a geniuine licensed Windows installation. And the platform vendors verify what compilers you're using before they allow you to ship, to make sure you're not using ancient builds filled with codegen bugs. And of course you're firing up Windows to actually test your Windows builds for the PC market, right? Especially to root cause weird configuration, architecture, or driver specific bugs?
Hell, I've helped develop a UWP app at the behest of Microsoft - they were our publisher - targeting Windows 8 before it was even released. What "non-Windows-only alternatives" do you think I had, exactly, for that?
> My point is, people who say their work is only doable on Windows tend to just be scared to move away from the specific tools they know.
Bullshit. Even when you have non-Windows alternatives that are compatible with the Windows alternatives, convincing IT to let you do your weird nonstandard thing, and dealing with the interop bugs for all the external people using Windows software is often a headache that will cost far more than just paying the Windows licensing fees and booting it. That's not fear, that's just practicality.
People who say there are non-Windows alternatives tend to not realize just how miserable an experience that can be, on the occasions where they're actually technically right, when they're not working alone in an isolated silo with all the free time in the world.
Like, sure, I could try and debug msbuild issues my coworkers are having by trying to run it via wine on linux. Or I could ship windows PC games by cross compiling to windows with clang and praying there are no OS specific bugs. OpenGL drivers on windows aren't as bad as they once were, I suppose. But I challenge you to find a single professional gamedev foolish enough to go through that pain in the ass, just to avoid firing up Windows. Surely you can find at least one?
I can't find anyone in the thread saying that. I see people suggesting, perhaps disingenuously or based on anecdata, that it's no big deal not to use Windows, but I don't see anyone questioning why someone would use it.
> I don't understand this "have to reboot to do something windows related"
> > I don't understand this "have to reboot to do something windows related"
Ah, I see. Right now that comment https://news.ycombinator.com/item?id=24051085 says:
> Of course Windows-only things are only on Windows. But a lot of Windows-only things have non-Windows-only alternatives.
, which seems less inflammatory. EDIT: Oh, wait, I see—I think you're going a couple more levels up, to https://news.ycombinator.com/item?id=24050905 :
> I've used linux on my desktop for 20 years, I don't understand this "have to reboot to do something windows related", I guess I just use computers for very different things to you.
I read this more charitably, not as saying "why would someone need to use Windows?" but more "I don't need to use Windows, so I don't regard it as a universal need". (That, in turn, came from mmm_grayons's post https://news.ycombinator.com/item?id=24050677 :
> And use what instead? I generally use linux on my desktop but have to reboot fairly often to do something windows-related. Libreoffice botches document formatting every time I use it on something above "hello, world." Lots of stuff still only works on windows, though wine compatibility is getting better.
which I read, again perhaps unfairly, as suggesting that it is unrealistic for people to consider a computer workflow that doesn't involve Windows.)
Perhaps still more charity (or clarity) would have been appropriate, but the explicit acknowledgement that there are different purposes for which different people need computers seems to me to defuse much of what one might perceive as hostility or dismissiveness there.
That's extremely charitable, because the comment implies they cannot at all understand how someone would need to use Windows, and they offer 20 years of personal experience to reinforce that. Even in the most charitable case it denies the existence of Windows-only software simply by not ever personally having a need for it.
> which I read, again perhaps unfairly, as suggesting that it is unrealistic for people to consider a computer workflow that doesn't involve Windows.)
I think so too that your read is a bit unfair, as the OP even says they're desktop Linux users but need Windows in some cases. Myself I've used Linux as my main desktop OS for 15+ years, and I still had times I needed to use Windows. I've definitely run into issues with e.g. LibreOffice myself, as they mentioned.
> Perhaps still more charity (or clarity) would have been appropriate, but the explicit acknowledgement that there are different purposes for which different people need computers seems to me to defuse much of what one might perceive as hostility or dismissiveness there.
Even if "I don't understand..." and "I guess I just use computers for very different things to you" isn't intended to be snarky, the commenter doesn't even attempt to understand why anyone would need Windows to do something. They couldn't think of a single thing? Visual Studio development or use? DirectX? Working on drivers for Windows? Some appliance that comes with software not supported by wine? Adobe software? AutoCAD?
I've switched to Linux 12 years ago, it requires sacrifices. I had to switch profession from Symbian Developer to Web Developer, desktop experience was not great, Wine has not helped. I've ended with light DM, shell, browser and vim.
And it was worth it.
There are so many wonderful aspects, the most relevant here is "for open source community I am not a product". It is blessing and curse - a lot of applications are not that polished, but they are sincere, they do what their authors want for themselves.
So CAD then.
For single-player gaming it's OK to disable network on guest windows completely. ISO images with games can be just mounted via virt-manager GUI.
I set out building this thing as a Linux workstation, but I guess 1-1.5 generations old hardware was still too cutting-edge. Drivers exist, but X & Wayland (tried both) crashing or permanently artifacting multiple times a day was no fun. Zero crashes since wrapping Linux in Win10 with Virtualbox. Frankly, I should have just paid double for a worse MacOS machine, given the time I've sunk into this. Win10 is spy/adware garbage but it's what I'm stuck with now to have a usable machine.
[EDIT] Oh and, surprisingly, RDP to Windows then fullscreening Virtualbox Linux is less painful, better performing, and easier to configure (as in, was no work) than similar on Linux, aside from X-forwarding.
dose this only happen on nvidia, or amd as well?
which VM software are you using? can you recommend any resources?
I use conventional Linux KVM virtualization ("libvirtd" + "virt-manager" GUI) on Fedora 32 (previously used Debian).
Most valuable resource is Arch Wiki: https://wiki.archlinux.org/index.php/PCI_passthrough_via_OVM...
I've never used Arch Linux, however I always refer to Arch Wiki - it's extremely useful even for other distros.
i was mostly worried about demanding games needing graphics features that would not work in a VM. (and usb support for the bank dongle)
i am also
When I need Windows, I boot up that machine and RDP into it.
Over time, I need to do that less and less.
I’m still a gamer though, and I refuse to pay exorbitant console prices for games and online play in a walled garden, so I keep one Windows machine around just for that. But I only take it out of sleep when I need it.
Edit: so this doesn't work for muxless laptops (I've looked into it before and forgot). The discrete card runs through the Intel iGPU regardless if hybrid graphics is enabled or disabled.
The vBIOS can't be accessed directly, so it will result in an error. Some people got this working anyway, but it seems that it's unstable and/or results in low performance.
Without details, I don't believe you.
For those times when I really just want to play a specific game that's Windows-only, dual-boot works great. I couldn't care less if telemetry tells Microsoft I start my PC every few months to play a few games ;)
I'm pretty skeptical that there are many real cases where eliminating Windows as a primary OS is a matter of "can't" and not "don't care enough to tolerate an occasional minor inconvenience". The latter case gets little sympathy when they complain about Microsoft's bad behavior.
And in the end you will always have to make a choice what games to play, since not everyone owns every console ever (which have exclusive titles) or the latest and greatest hardware to play the very latest AAA titles (quite a few of which have native linux ports by now)
Now if Steam had productivity applications [1] and they had Proton version (not yet).
It's a high enough percentage that I don't really consider what OS it was built for before buying almost any game.
Most people aren't your average HN user. Most people wouldn't be able to really figure out dual-boot, much less shared folders, Wine and Valve's Proton. It's still just too complicated compared to Windows. For these people, any use of Windows-only software makes the decision for them. They will use Windows because its easier and it 'just works' as far as they're concerned.
Dual-boot is scary — it can ruin the only computer user has — but live USB is super simple. Shared folders? Put shared data on FAT USB. Start with browser, that's 99% usage. Windows-only software? There would never be 100% parity. Same story opposite way - a lot of programming languages do not work that well on Windows.
Windows is easier because it is familiar, it has a lot of quirks
* why do I need disks? I'd better put everything in personal folder
* right click on desktop to setup display?
* "my computer" on the desktop of my computer?
* File > Exit?
Most of the Windows users would not switch to Linux even if it was as polished as Mac. We know because they don't switch to Mac.
on one laptop i managed to get hibernation to work such that i could hibernate one OS while i woke up the other. this way i could switch back and forth between linux and windows without loosing state. but it was still annoying that my linux system was not accessible when i needed it. like to check email or respond to messages while the game is running.
i try to keep personal data away from windows as much as i can. i use windows only for things that don't work any other way. the only exception is games,some games run on linux or wine too, but all of them run on windows, so i currently have all games on windows just to have them all in one place and keep games away from where i do real work.
apart from that i treat the windows laptop as a replaceable dumb terminal that i don't care about if it gets destroyed or hacked. anything important is on a trusted device running linux.
also, having linux around is what makes using windows bearable. the most important window is the ssh/mosh terminal to my linux machine. the less i have to interact with windows, the better.
finally i switched from dos to linux before win95 came out and i haven't used windows for more than a decade until tax and banking software forced me to. then i added games because the device was already there.
But I suppose it's easier to pirate Windows and cry in online forums.
So what is to be gained from this?
I, as user, should have the power, to definitely, unquestionably block MS to track my computer.
You might actually be accepting some GDPR processing agreement when setting up Windows nowadays.
And there's a whole thing in GDPR about grandfathering consent. Which they might fall back on.
But like I said, I'm not a lawyer. I'm not qualified enough to know for sure.
Wouldn't that apply, if at all, only to users who started before GDPR?
But GDPR can be a bit vague, both in definition and enforcement.
I'm not sure how Microsoft implements GDPR agreements. But I'm not sure if you'd have to agree to their policies on a Microsoft account level, or if it's per installation of Windows.
If you don't know if you "accepted" an agreement, you didnt.
I haven't done a Windows install in a while, so I just don't know if they do a privacy agreement in the installation.
As I mentioned in another comment. I wonder if they would try to extend Microsoft account privacy agreements to the installation of Windows where that account is logged into.