monitoring the presence of disk and network activity in general was a lot more useful when computers only did things when you told them to and only made connections to remote hosts when you explicitly requested it. Never knowing what your devices are doing or who/what they are communicating with without having to launch a full scale investigation was nice.