VS 2015 C++ telemetry

You won't like this......

http://news.softpedia.com/news/visu...y-code-into-c-plus-plus-binaries-505113.shtml

 

It used to be enough to keep the near do wells off our systems, now the OS is doing their work for them, and wrapping it up in a neatly documented environment, complete with dev kits.

Here's the MS Azure Cloud version.

MS starts it all off with a Cheery "Get Started" intro, and follows up immediately with a "Add More Telemetry" section...the good stuff starts in the "Construct A Telemetry Client" section.

You'll be happy to know that TelemetryClient is "Thread safe" - to fully use all the CPU cores, with hyper-threading.

Get started with Visual Studio Application Insights
https://azure.microsoft.com/en-us/documentation/articles/app-insights-get-started/

"...TelemetryClient is thread-safe.

We recommend you use an instance of TelemetryClient for each module of your app.

For instance, you may have one TelemetryClient in your web service to report incoming http requests,

and another in a middleware class to report business logic events.

You can set properties such as TelemetryClient.Context.User.Id to track users and sessions,

or TelemetryClient.Context.Device.Id to identify the machine.

This information is attached to all events sent by the instance."

It's nice that Microsoft lets us all plug in to the Telemetry Gravy Train, making their job easier at the same time - we will find all the points of interest in our applications to collect telemetry, and Microsoft just needs to add those new collections to their already installed pipeline of Telemetry.

It's gonna be a real job to stop this leakage from personal computers, corporate computers, and it will only get worse, we are going to need a new Security Department to handle this new threat.

 

Reviewing Microsoft's Automatic Insertion of Telemetry into C++ Binaries
by Jeff Martin on Jun 08, 2016
https://www.infoq.com/news/2016/06/visual-cpp-telemetry

"Recently Reddit user "sammiesdog" posted claims that Visual Studio's C++ compiler was automatically adding function calls to Microsoft's telemetry services. The screenshotaccompanying their post showed how a simple 5 line CPP file produced an assembly language file that included a function call titled “telemetry_main_invoke_trigger”."



Visual Studio adding telemetry function calls to binary?
https://www.reddit.com/r/cpp/comments/4ibauu/visual_studio_adding_telemetry_function_calls_to/

Visual Studio adding telemetry function calls to binary? (/r/cpp)
https://www.reddit.com/r/programmin...al_studio_adding_telemetry_function_calls_to/

spongo2 2 points 1 month ago

Hi everyone, this is Steve the VC dev mgr. We'll be removing this telemetry. More details here:
https://www.reddit.com/r/cpp/commen...io_adding_telemetry_function_calls_to/d30dmvu

" spongo2 63 points 1 month ago

hi everyone. This is Steve Carroll, the dev manager for the Visual C++ team.

Tl;dr: thanks folks for the feedback. Our team will be removing this from our static libs in Update 3.

Our intent was benign – our desire was to build a framework that will help investigate performance problems and improve the quality of our optimizer should we get any reports of slowdowns or endemic perf problems in the field.

We apologize for raising the suspicion levels even further by not including the CRT source, this was just an oversight on our part. Despite that, some of you already investigated how this mechanism works in nice detail. As you have already called out, what the code does is trigger an ETW event which, when it’s turned on, will emit timestamps and module loads events. The event data can only be interpreted if a customer gives us symbol information (i.e. PDBs) so this data is only applicable to customers that are actively seeking help from us and are willing to share these PDBs as part of their investigation. We haven’t actually gone through this full exercise with any customers to date though, and we are so far relying on our established approaches to investigate and address potential problems instead.

We plan to remove these events in Update 3. In the meantime, to remove this dependency in Update 2, you should add notelemetry.obj to your linker command line. If you’re generally concerned about phone-home scenarios, more information about how to configuring Windows 10 appropriately to your needs can be found here: https://technet.microsoft.com/en-us...top-data-flow-to-microsoft#bkmk-priv-feedback

Thanks."

 

It was benign and they just forgot to tell everyone, yeah I trust them!

 

Just like the systems that were upgraded automatically to Windows 10, oops, my bad (classical Microsoft Swiss cheese)

 

Manage connections from Windows operating system components to Microsoft services
Brian Lich|Last Updated: 6/6/2016

https:// technet.microsoft.com/en-us/itpro/windows/manage/manage-connections-from-windows-operating-system-components-to-microsoft-services#bkmk-priv-feedback%5B1%5D

"Applies to

• Windows 10

If you're looking for content on what each telemetry level means and how to configure it in your organization, see Configure Windows telemetry in your organization.

Learn about the network connections that Windows components make to Microsoft and also the privacy settings that affect data that is shared with either Microsoft or apps and how they can be managed by an IT Pro.

If you want to minimize connections from Windows to Microsoft services, or configure particular privacy settings, this article covers the settings that you could consider. You can configure telemetry at the lowest level for your edition of Windows, and also evaluate which other connections Windows makes to Microsoft services you want to turn off in your environment from the list in this article."

^^^^ Written by and hosted at Microsoft ^^^^

 

Anti Telemetry should be built in anti virus programs just like some of them now have PUP detection

 

Getting to the point where it's going to be required to have rooted routers (DD-WRT, et. al.) to try to prevent this sort of garbage...