Depends on your definition I suppose. The fact that it is sitting there to be accessed by any program is a problem for some but I agree, sending it over the network is what most people worry about. Most evtx logs are not sent to the "mothership" but other telmetry and security logs like defender logs might be by default. There is also cloud submission which sends MS random suspect files for analysis.

Also, closed source means it is hard for me to be sure which of those logs are sent to MS.

I'd have to check, but I'm pretty sure particular logs are NOT accessible by Builtin\Users. Particularly Security log.

But comparing logging to spyware is nuts.

Event logs are just one of endpoints for event tracing mechanism and event viewer is just one crappy UI for that. You can turn on/off various logging to your hearts desire, including various diagnostic/tracing info. You can go all the way to capture stack traces, cpu context switches and whatnot. Windows is pretty configurable in this regard.

Also telemetry is well documented and configurable: https://docs.microsoft.com/en-us/windows/privacy/configure-w...

Defender doesn't hide option for cloud based scanning and it is up-front in settings. I dunno if it is enabled by default or not, but in our org, we had to explicitly rollout changes to enable it (we are pretty locked down by default)

First, I never said any of this was hidden or in secret. Second, event logs are just one of many places where activity is tracked. Most of them are harmless but many will keep a record of what is being done on the system in a way that isn't obvious to the user of the system. Lastly, installed programs don't need to be builtin\users they can run elevated or in any group, you are assuming only accidentally opened programs are risky?

The subject here is personal use, not corporate use. For example you might torrent a movie and then uninstall the torrent application, files and downloaded content. If you get sued and (i know it is rare) your windows install is submitted as evidence it can be proven that you executed the torrent program, the torrent program transferred so many bytes and that you opened the folder of the torrented content without looking at any file directly related to the torrent app or windows event logs. Or let's say you downloaded content from a site but then cleared your browing history and uninstalled your browser. Thanks to motw the downloaded files on your pc show the sites frol where you downloaded them and the referrer that lead to you visiting the download link. These are only some examples.

Most operating systems log things —- it’s a feature. Most consumer software collects telemetry —- irrespective of platform.

Have a look at what a typical Android phone sends out! Including your GPS location! Apple isn’t immune either because the Facebook SDK that’s included with everything would make the NSA blush. TikTok even tracks your phone motion sensor.

IMHO raging about 30-year old diagnostic features is misplaced anger. Be angry about how every piece of software now goes through these stages:

1) Opt-out telemetry only collecting the important stuff, we promise!

2) Okay, collecting it synchronously was a mistake and it slowed down everything for everyone that’s not sitting in our head office. We fixed it though, don’t worry!

3) Umm.. apparently some people are behind corporate web proxies which makes the async code leak threads and melt CPUs. We fixed it though!

4) Some people have used the newly added proxy support to inspect the encrypted blob. We promise that it was an honest mistake collecting every single point of information we possibly could about your system including mouse movements and key presses. Don’t worry, we fixed it! We now “anonymise” the information. Don’t worry about why that’s in quotes.

5) Those socialist Europeans sued us when we said we deleted their data but it was still there when they reactivated their accounts. Oopsie! Our bad. We promise to “wipe” your data including telemetry when you request this form. Fill it out in triplicate and fax it to this Cayman Islands number please.

6) We can no longer sell our software in some jurisdictions. Don’t ask why or what that implies about how we treat our customers in other jurisdictions with weaker legal protections.

I was not raging. Doesn't matter what the reasons are (hard to prove either way), foe the unassuming user there are serious and even fatal implications if removing specific files or clearing history or logs does not have the expected effect. I am aware (I hope everyone else is) that mobile operating systems are magnitudes of order worse.

Your list of complaints is whataboutism and is not directly related to OS privacy expectations and reality.

Linux is better at this because it gives you more control over what is logged and the code is open source.