Yup, even on a slow machine with a mechanical drive you could blind type the first 3 letters of a program name and slam the enter key. The search filtering was so quick it would have completed the operation in time for your enter key-press to be registered.
Try the same thing on 10 or 11 and you're probably going to end up with a new edge window running a Bing search.
Heck, it's bad even on reasonably fast machines like my surface pro. I've recently found that if I "blind type" a search query at my normal (very fast) input speed, it actually enters the keypresses _before_ loading fully, blinks the correct app up for about 1 frame, then resets the input field to nothing!
Former MSFT employee here. Not every keystroke, but a surprising amount, yes. A startling amount. (Disclaimer: I was on Azure platform, so I can't speak directly to Windows.)
You can disable it (there are lots of articles all over) but the sheer scale of the problem makes these mitigations rather unreliable.
On the other side of the one-way mirror, there's this thing called Kusto which lets you sort of surf through someone's sessions, at least for the web apps. Someone brilliant in my unit hooked it up with emojis, which you could read in columns; it was very nearly like those columns of green figures in _the Matrix_, but, you know, with emojis. Just scan down from top to bottom; dude opens file... dude renames file... dude copies file... dude wanders away for 15 min... etc
Because EU regs, we can't see PII, but frankly if you named your folder 'Bob Bobberson's Bobfiles' whoever is on DRI is seeing your name. "Don't name your folder your name," we always said, to our customers. They always did anyway.
This was always uncomfortable but since the political breakdown has progressed, I've started to worry that these reams of data will either (a) be seen by some True Believer for one side or another or (b) quietly collected by the usual (legal) means, by a federal agency that is itself compromised.
This is in the context where there are literally states with bounty programmes for e.g. people seeking (or helping) women get abortions. How long is it until $10K sounds good enough to a disgruntled layoff-rattled rank-and-file? What happens if those programmes are expanded to include other things? What if you had a folder named, say, "Getting my wife TF out of TX?" What if you did five years ago? Think it through.
The worst part is I'm sure it's no different anywhere else, in 2023, at least so far as commercial apps go. Even some FOSS stuff like Audacity.
That's why I run OpenBSD and NixOS, and have even managed to wean myself off VSC.
I definitely did not enjoy seeing the sausage be made.
