File headers, magic bits, all sorts of stuff. Plus you can (and they do) try to load common file types, so if a PNG isn't loading correctly, it fails the test.
"Hey there customer, if you want internet access on our network (the only one available in your area), you have to install our intermediary certificate on your machine!"
What happens when their customers aren't their users but instead are government or other corporate entities - or themselves?
Windows recall stores the data locally, but what telemetrically is it sending back? Or if its sending nothing today, what will they change it to send tomorrow? Fodder for AI training data? Sensitive secret or proprietary information?
The worst part about all of this is even if they are being absolutely and completely honest, there is no verifiable way for us to prove this because all of their code is closed source and I imagine to some capacity obfuscated.
So the natural assumption here is that, similar to free-as-in-beer products, we are the product and Windows is the platform by which we are being served.
True programmers know that novice code is a rite of passage. Every programmer worth their salt looks at their own older code and cringes at it. Most people who do this for a living are more likely to give helpful pointers rather than tear you down, if anything.
If someone is being a jerk to you about your code, stop listening to them immediately and walk away or block them.
We use one of these at work! There are a couple of companies offering these solutions such as PaloAlto, Zscaler, etc. and they are typically of the "Next-Gen Firewall" variety (I.e. they scan the content of the packets rather than just routes and ports and such).
The way they work is basically that you establish VPN connections to their endpoints, and they scan the traffic as it passes through. Like a VPN, you get a new IP address that is shared with other customers, but there is a way to pin your original IP in the packet headers if you need.
These connections can be handled via one of a few ways:
Software on the workstation (best option as it allows deeper traffic routing and control, as long as your workstations are locked down)
IPSec tunnels configured on the building's router service's endpoints/datacenters
GRE tunnels configured on the building's router to the service's endpoints/datacenters
A physical firewall box that sits in front of your other hardware that does any of the above OR something bespoke
Note that unless you have option 4, none of these replace traditional "dumb" firewalls. If you're still using IPv4, you still need a NAT firewall.
