Who controls your machine?

At a meeting a while back someone said a sentence that bothered me for the rest of the day: "you can't check telemetry anyway, it's a black box." I left that room already building the test bench in my head, because "you can't check it" almost always turns out to mean "nobody felt like checking it." Everything that leaves a computer goes through the network card. And if it goes through the network card, it can be counted.

I trained as an electronics engineer and I have spent the last dozen years working with data — first as a BI analyst, later building machine learning models. It is a profession where you do not argue about whether something is happening. You set up a measurement and look at the numbers. So that is what I did in my workshop: two identical computers, the same router, the same cable, one running Windows, the other Linux Mint. No clicking, no browser, nobody touching either of them.

This text is not about Microsoft being evil. It is about something narrower: who actually decides about your machine. When it stops being safe to use, what runs on it, and who knows what you do with it. Three questions you can answer without ideology — by measuring.

The hardware is yours. The decisions are not

Most people carry a simple model of ownership: I paid for it, so the computer is mine. In terms of property law — correct. In terms of what actually happens on that hardware, it looks more like a lease.

The clearest illustration is a date. On 14 October 2025 Microsoft ended support for Windows 10. Not because computers stopped working that morning. Because that was the release plan. To move to Windows 11 a machine needs TPM 2.0, Secure Boot and roughly an 8th-generation Intel processor or newer. The Dell OptiPlex 7040 I refurbish every week has a 6th-generation chip. It runs, it is quiet, it has an M.2 drive — and it officially "does not qualify".

Let us stay with that word for a second. Does not qualify for what? That computer handles a spreadsheet, email, a browser with twenty tabs and a video call without breaking a sweat. I know, because those are the machines I work on. "Does not qualify" is not a description of the hardware here. It is a description of a vendor's decision.

Which brings us to the actual point. Control over a computer is not a question of whose name is on the invoice. It is three other questions:

• Who decides when this hardware stops being safe to use?
• Who decides what runs on it, and when it updates?
• Who knows what you do on it?

The answer to all three is the same: whoever controls the code. Not whoever holds the receipt.

And let us be fair here, because unfairness would weaken the argument. Telemetry is not a conspiracy. I collect metrics in the systems I build myself — without logs you cannot fix a bug nobody reported. A crash report is an ordinary engineering tool. The problem is not that data is collected. The problem is the asymmetry: the vendor sees everything, you see nothing, and switching it off completely is not among the options. A contract one side cannot read is not really a contract.

One more observation, this time from the other side of the counter. When I started selling refurbished hardware I expected questions about performance. They come up rarely. The most common question is a different one: "how do I know this works, and that nobody left something behind on it?" That is the same question about control, just phrased in human terms. The answer "you have to trust me" is worth nothing. The answer "here is the SMART report from the drive, and here is the list of what is installed" works. People are not afraid of old hardware. They are afraid of hardware they know nothing about.

Instead of arguing — measure

Back to that meeting. Rather than argue, I built a test bench, because a test bench is cheaper than a disagreement.

Two Dell OptiPlex 7040 machines in identical configuration: 16 GB of RAM, a 256 GB M.2 drive. A clean Windows install on one, Linux Mint on the other. Both wired to the same router. The key element sits in the middle: my own DNS server on the network — the component that translates website names into addresses. Every "where is server X?" question has to pass through it, and every one of them gets logged.

That is the whole trick. You do not need to decrypt anything or break any encryption. You only need to count what the computer asks about while nobody is sitting in front of it.

Why DNS rather than capturing all the traffic? Because almost everything is encrypted today, so the contents would be unreadable anyway. But in order to send anything at all, a computer has to ask for an address first. The metadata is enough: I do not need to know what it is saying — it is enough to know who it is calling and how often. That is the same logic traffic analysis has used for years, and it is exactly why metadata is never "just" metadata.

The procedure was deliberately boring:

• Install the system, walk through the setup wizard, apply every update.
• Log in to the desktop and stop there. No browser, no applications, nothing.
• Leave both machines powered on for twenty-four hours.
• Compare the DNS logs.

I ran it twice, because the first pass is misleading. Right after installation both systems download updates, so both of them talk a lot — that is expected and healthy. The interesting window opens on the second day, once everything is patched and the machine has nothing left to do. Silence is a result too. If a system has genuinely finished its work, the log should go quiet.

What should you expect from a measurement like this? First, that neither system stays silent — and that is worth internalising before you start. Linux asks too: about update servers, about the time, about whether the network actually reaches the internet. The difference visible in the logs is qualitative. Once the updates finish, the Mint machine settles down and speaks rarely, in a predictable rhythm. The other machine keeps in touch with the vendor's back end even when literally nobody is touching it.

You do not have to take my word for any of this, and that is the entire point of the article. You can repeat this measurement in one afternoon. You need a router that lets you point at your own DNS, and any small computer on the network to run it — in my case that job belongs to the NAS. That is the difference between believing and knowing: believing requires trusting a vendor, knowing requires one evening.

The thing that surprised me the first time I ran it: the interesting part was not the server names at all. It was the rhythm. Telemetry traffic has a pulse — regular, repeating intervals, completely independent of what the user is doing. Once you have seen that chart, you cannot unsee it.

Three tests, run honestly

Let us take those three questions from earlier and answer them properly for both systems, including the places where Linux comes off worse.

Who decides when the hardware stops being safe? On Windows, a date announced by the vendor, tied to the specification of your processor. On Linux Mint, an LTS release supported for years — and when that support ends, you move to the next LTS on the same machine. Notice where the difference actually sits: in one case the hardware drops out of the game, in the other only a version of the system does. My OptiPlex 7040 will be running long after the discussion about 8th-generation processors is forgotten.

Who decides what runs and when it updates? Here the honest answer cuts both ways. On Linux the package manager asks before it does anything, and you pick the moment — which also means nobody will force you to patch, and a machine left alone for a year will be just as vulnerable as any other. Freedom includes the freedom to neglect it. On the machines I hand over I set updates up so they do not require remembering, precisely because I know how that ends.

Who knows what you do? This is the one you measured above. And here the asymmetry is not a matter of opinion: on one side you can read the source and count the queries, on the other you can only count the queries. Half the answer is still better than none, which is exactly why the measurement is worth doing on both.

What this means if you are not an engineer

Let us translate it into something concrete. A small company with five computers that "do not qualify" for Windows 11 has three options. Buy five new machines. Pay for extended support and push the problem out by a year. Or change the system and keep the hardware that already works.

The third option is the cheapest and the least obvious, because it costs an afternoon of work rather than a bank transfer. In practice it looks like this: the data drive stays, the system gets replaced, LibreOffice opens the old spreadsheets, the browser is the same browser, the email is the same email. For someone who uses a computer for office work, the biggest change is the shape of the icons.

What the switch actually looks like

I will describe a real one, because abstractions help nobody. A three-person office, four OptiPlex machines, all of them rejected by the Windows 11 check. Before: Windows 10 with support already expired, two machines taking over a minute to reach a usable desktop, one of them with a fan that had been screaming for a year because nobody had opened the case.

The work itself is dull, and that is the good news. First an inventory of what those people actually open during a day — it came down to a browser, email, spreadsheets and a printer. Then a physical pass: open the case, blow the dust out, replace the thermal paste, check the drive's SMART report, add memory where it was short. Only then the system, and a home folder restored from the copy made beforehand.

After: the same four machines boot to a working desktop in seconds rather than minutes, the printer prints, the spreadsheets open. The single genuine friction point was one document with a complicated macro that LibreOffice rendered differently. We rewrote it. It took an hour and it was the only real cost of the whole operation.

Notice that half of that work had nothing to do with the operating system. The dust, the thermal paste, the failing drive — those are the things that actually make a computer feel old. A machine is rarely slow because of its processor. It is slow because it has been overheating for two years and nobody checked.

What genuinely changes:

• The hardware loses its imposed expiry date. You replace a machine when it gets slow, not when a vendor changes the requirements.
• Updates stop being an ambush. They do not install themselves in the middle of your presentation.
• The electricity bill drops a little, because older hardware running a lighter system simply does less work.

And now the part you will not find in a sales brochure. Linux is not the answer to everything, and pretending otherwise would be exactly the kind of thinking I am arguing against. If your accounting runs on software published for Windows only — stay on Windows. If you work in CAD with a hardware licence dongle, if you play titles with aggressive anti-cheat, if you have a label printer with a driver from a decade ago — check all of it before you change anything.

My rule is simple: first the list of software you actually must have, then the decision. Not the other way round. On most of the office workstations I have prepared, that list fits inside a browser, an office suite and a mail client. On the rest, Windows stays — and that is also a good answer.

There is a second reason I care about this, and it is not technical. A computer declared obsolete usually goes one of two places: a drawer, or electronic waste. Manufacturing a new machine costs far more carbon than running an old one for another three years. When a vendor moves the requirements, that is not only a bill for the customer — it is a pile of working hardware pushed towards the bin. I refurbish those machines for a living, so I am hardly neutral here. But the arithmetic holds regardless of who is doing it: the greenest computer is the one that already exists.

What I actually take from this

Control over a computer is not a matter of worldview. It is a matter of how much you can verify yourself, and how many decisions stay on your side of the table.

I am not claiming Linux is "better" — that depends entirely on what you need to get done. I am claiming something narrower and much easier to defend: when something happens on a machine running open code, I can find out why. I can read the source, go through the logs, count the queries. When it happens on closed code, I can ask the vendor and wait for an answer.

For someone who works with data for a living, that difference settles the matter. It is why every computer and every server that leaves my workshop runs Linux. Not for ideological reasons. Because I can open it up and look inside.

One last thing, because that sentence from the meeting still nags at me. Next time somebody tells you that something "cannot be checked", treat it as an invitation. Usually it just means nobody has been willing to spend an afternoon on it yet.