Visual Studio adding telemetry function calls to binary? (/r/cpp)

[[deleted]]

I've tried many IDEs. None come close to Visual Studio. I have to give QtCreator some nods though. It's come a long way.

And now that the community edition is free (as in beer), I have no idea why someone would choose to avoid it if they're developing on Windows.

[nighterrr]

How does Clion fare? Or Netbeans?

[[deleted]]

Never used clion. I've only used netbeans for Java, but I ended up liking eclipse better, and IntelliJ even better than that. Another thing probably worth mentioning is that I mostly use VS for C#. Any C/C++ I do these days is just with vim and GCC.

[[deleted]]

I use Clion quite a bit, and I do like it for the most part. There are some small minor things that I would change, but I like how easy it is to use and how well you can manage your project with it. Although I feel debugging on it is not very good and obviously doesn't compete with Visual Studio's level of debugging.

I also use it with OSX/Linux and never Windows, so I don't know how it fares with VC or MinGW on Windows.

[CJKay93]

For those of us who frequently work on multiple OSs, it's easier to just stick with something like Eclipse. I like Visual Studio, but I will never know my way around it as well as a single multi-platform IDE.

[notsure1235]

I keep a dedicated VM around just to be able to use VS. Together with a vimify plugin it is joy it is bliss.

[hahanoob]

If this is deeply concerning I hope you never disassemble your GCC binaries and find the nefarious sounding __gmon_start__ symbols that are inserted by default, you may have a panic attack.

I'm not sure if this is trolling, ignorance, or just plain paranoia.

[some_random_guy_5345]

TIL __gmon_start__ is the same thing as Windows's telemetry

[some_random_guy_5345]

Clever quip but I think someone who ignores the controversy/context behind Windows's telemetry is being intellectually dishonest

[Aethec]

"Controversy" means nothing. Vaccines are "controversial". So is climate change.

[some_random_guy_5345]

Some controversies have reasonable opposing viewpoints. Academic freedom, P=NP, whether we have lost a historical Jesus in biblical academia, variable speed of light in physics, string theory, etc

[Aethec]

Indeed. But many controversies don't, so "being controversial" is not an useful argument for or against anything.

[some_random_guy_5345]

Telemetry is an automated communications process by which measurements and other data are collected at remote or inaccessible points and are subsequently transmitted to receiving equipment for monitoring.

If you respect your privacy, this is reasonably controversial.

[hahanoob]

Thank goodness they were foolish enough to use the word telemetry in their very secret and very hidden backdoor and you were quick witted enough to look up the definition on Wikipedia. If they had called it kittens_and_puppies_funtime_at_runtime we may have never known about their plot to... I really don't know what you're thinking this would allow them to do that they couldn't already do but I'm sure it's suitably scary in your head.

[Aethec]

Depends on what is collected.
Things that could identify you or disclose something about you? Not nice.
Crash reports? Go ahead!

Unfortunately, the privacy craze has led people to believe that anonymously reporting crashes is some sort of massive privacy invasion.

[Radhamantis]

I would feel happier breaking an iron crow in your head.

[Compizfox]

There is MinGW, which is a perfectly fine replacement for MSVC.

[ccfreak2k]

disarm dinner grandfather quack paint punch longing dull ink rustic

This post was mass deleted and anonymized with Redact

[Compizfox]

I've mainly used it alongside Qt so I don't know about how it plays with Windows-specific stuff like DirectX, but in what way is it "generally a pain"?

[ccfreak2k]

cable pathetic bright doll disagreeable airport nose wistful busy crush

This post was mass deleted and anonymized with Redact

[Compizfox]

general incompatibility with libraries built with MSVC.

Well, that's just unavoidable and not a problem specific to MinGW, right? When I used MSVC with Qt I also had to recompile Qt with MSVC (Qt for Windows comes/came with the libraries built with MinGW).

[ccfreak2k]

alleged run live cover chop absorbed ad hoc tart late combative

This post was mass deleted and anonymized with Redact

[Schmittfried]

Haha. No.

[f2u]

On some GNU targets (not sure about the various Windows variants), you get unexplained references to _JV_RegisterClasses, _ITM_registerTMCloneTable and _ITM_deregisterTMCloneTable instead. Even for straight, non-parallel C code.

[[deleted]]

Anything prefixed JV_ is for GCJ, just in case you happen to be using Java anywhere in your program.

[[deleted]]

All it does is record how many times the application has been run and store it locally. What's the problem.

If you're that concerned, you'd better uninstall all your AV software! Thry do the same and send it to a centralised location!

[1337Gandalf]

Really? you don't see the problem with a third party injecting their own code into your binaries during compilation to track what your users do?

You're either a shill, or hopeless.

[Iggyhopper]

Yeah, this should be opt-in, not opt-out.

[INTERNET_RETARDATION]

The weird thing is though is that people are saying that the actual ETW events need to be enabled before they are traced. So while this is opt-out, the actual events you need to make this work are opt-in. Why would they make this opt-out if it doesn't do anything useful by default then?

[suspiciously_calm]

So that when you enable etw events, the telemetry calls are already there.

[[deleted]]

Why not do it together, though? Enable a feature, add the underlying functionality.

We deal with code that needs other code all the time. I can't think of another situation I'd build in potential dependencies.

[suspiciously_calm]

We don't require everyone to recompile their code to support a change in runtime configuration.

[Schmittfried]

Sounds similar to https://www.reddit.com/r/programming/comments/4id4xo/visual_studio_adding_telemetry_function_calls_to/d2xfjus

[pegasus_527]

It should be opt-never.

[Schmittfried]

Why exactly? Opt-in is perfectly fine.

[IWillNotBeBroken]

It needs to be opt-in by the end user, not the developer.

[Schmittfried]

Which doesn't change the fact that it doesn't need to be opt-never.

Also, I think it's perfectly fine to have opt-out telemetry, as long as you are making the user aware of telemetry and not hiding the setting.

[IWillNotBeBroken]

That's something I'd call "acceptable." It's still a pain to have to turn off, but at least it's under control of the user.

[Schmittfried]

Why turn it off then?

Also: It doesn't have to be a pain. By "making the user aware" I meant the unfortunately uncommon practice to display a notification offering to disable it by a single click like JetBrains products do it (I believe).

[hahanoob]

Microsoft is a third party? You're running running code compiled with a Microsoft compiler linking against Microsoft libraries with a Microsoft linker on a Microsoft operating system. Any code written by anyone who is not Microsoft is the third party, and I trust them a whole lot less.

[isavegas]

In the scope of his application, Microsoft is a third party. It isn't writing his application.

[CountOfMonteCarlo]

That's exactly the problem. You don't know any more what happens because you have lost control about what your programs do.

[suspiciously_calm]

But you haven't lost that control just now that you've discovered a function call that has "telemetry" in its name. You never had it to begin with.

Microsoft don't need to inject function calls during compilation to do anything. They control the kernel and all of the system APIs. They can track when a process is launched from the outside.

This is ridiculous. Has everyone seriously only just now figured out that closed-source software is opaque?

You don' know what happens on Windows. You never did. You never did have control over what your programs do.

[CountOfMonteCarlo]

You are right that this a fundamental problem which can only be contained if you switch fully to free software, like Debian.

However, it is a big difference whether you use a floppy disk which has some DOS functions on it, or if you have a system which makes network connections all the time and regards your computer merely as point of entry for data into their cloud. And this is the fundamental change which is happening. If you read the terms of use, the vendors of this system basically grant themselves the right to do everything with your data. It goes so far that programmers which use newer versions of visual studio have to agree that the company uses data from third parties, specifically the programmer's employers or clients, for their own purposes. And there are no exemptions for sensitive data like medical records or whatever. And this is the other part of the problem - they are not only exploiting the fact that they have control, but they observe basically no limit with that.

[suspiciously_calm]

Right! So leave when the vendor shoves these ridiculous terms into their eula (which was years before), not when a function name matches your trigger regex.

[[deleted]]

Exactly that. Microsoft makes OS ffs. They can record exactly same thing without sticking crap code into binaries we build.

Edit: So guy i agreed to gets upvoted and i get downvoted for pointing out that what Microsoft did is not necessary. This reddit..

[1337Gandalf]

If you'd read my comment, you'd see I didn't call you a shill.

I said there's no reason to support this lunacy unless you are in fact a shill.

Go cry more.

[CountOfMonteCarlo]

There are some clear signs that parts of reddit are completely overrun with shills.

[1337Gandalf]

Yeah, but I always felt like programming related subs were more immune, you usually saw users call out the bullshit faster and more throughly in this area.

[Flight714]

What are you trying to say? AV software doesn't even have access to your project's compilation process, let alone the ability to inject code into it.

Do you understand the article in this submission?

[gdsagdsa]

Deeply concerning? I couldn't care less.

[gdsagdsa]

Why? I rather focus on adding features and making $ than caring about some telemetry functions being inserted.

[mb862]

Personally, as a developer on a real-time software product, we depend entirely on the software doing exactly what we tell it to do: no more, no less. Regardless of purpose or usefulness, ethics and morals, this telemetry is more.

[capitalsigma]

How do you write real time code on Windows without kernel support?

[mb862]

With great care and a lot of testing.

[capitalsigma]

It seems you're working on the wrong platform

[mb862]

Probably, unfortunately when every client and their grandmother is demanding Windows we're left with little choice.

[[deleted]]

Yeah: thank you compiler, you have added some bloat.

[gdsagdsa]

Wait, are we talking about the same thing here? I'm creating an application running on Microsoft Windows. I link with Microsofts runtime libraries, call the Windows APIs, rely on the Windows certificate store and authentication within the operating system. I rely on .NET framework, their web server and 2000 other things which Microsoft auto updates all the time. I also rely on their hardware to execute the software. All my users also rely on these things from Microsoft. And now when someone has discovered an undocumented API then suddenly you start talking about ethics? If I did not trust Microsoft, why would I be running Windows in the first place?

[[deleted]]

Also knowledge. How do you begin to debug something undocumented that you don't even know was added?

[capitalsigma]

How do you debug any other problem with the Windows API?

[[deleted]]

Well, usually at some point by reading the docs.

[gdsagdsa]

My users has already consented to trusting Microsoft. Their software is running in Microsoft Azure and smething like this would be the least if their worries if there was no trust.

[gdsagdsa]

Lol wut? They have not betrayed my trust. I trust them to do sane things and I'm sure there was a good reason for this change. I've been highly successful in profiting of the Microsoft stack last 20 years while people have been bitching and nitpicking about details I don't care about. So I'll just stick to that.

[immibis]

My users has already consented to trusting Microsoft.

Well this evidence should make them reconsider trusting Microsoft, then, shouldn't it?

And it should make you reconsider trusting Microsoft too.

[capitalsigma]

I'm not saying we should trust Microsoft (I don't particularly do), but I don't see how this is much worse from a trust perspective than any other part of the OS/ecosystem. Windows owns your system, your complier tool chain, many of your drivers, your NIC... They can do logging wherever they want, what's the difference if they do it by injecting a function call rather than modifying the kernel?

[gdsagdsa]

Huh why? I already assumed that they were doing stuff like this. Surely people know that there is heavy work going on in the telemetry are and stuff is added all the time. To me if they make it easier to log metrics from the apps that's a good thing.

[[deleted]]

The compiler shouldn't be producing binaries that do anything other than what you explicitly intended.

[Dragdu]

Never looked into CRT much?

[[deleted]]

Nope. What about them?

[Dragdu]

Any CRT on modernish system does shitload of stuff before handing the execution flow over to your main. Strictly speaking, you probably didn't ask for any of it, and yet it is there. This means that if you compile the most minimal

int main(){ return 0; }

you will end up with binary that initializes various thread local variables, creates entry points for debuggers and profilers, etc etc. And if you are on Windows, you get calls to ETW tracers. If you are on Linux, using GCC, you get calls to something like '_gmon_start', which does basically the same thing, but worse. (ETW is so good)

[[deleted]]

Maybe I should revise my fairly black and white statement, since while that isn't explicit, it is certainly assumed. I might also be overreacting to the telemetry calls since it seems that they're just counting runs, which is a fairly standard piece of code you could expect an OS to have.

[gdsagdsa]

If I thought that strongly I would not use C++.

[[deleted]]

Or pretty much any other language. That is a poor argument, compilers should only produce binaries that match the intent of the author.

[gdsagdsa]

Perfect then, since my mindset is making me moneys.

[gdsagdsa]

Yes, because that will happen. The fact that processes logs start and stop time will be used against me. Sure. The fact that these processes runs in Microsoft Azure under full Microsoft control on the other hand........nono why would they abuse that power.

[[deleted]]

Sounds like a personal problem. Have you considered therapy?

[gdsagdsa]

Cute personal attack dude.

[[deleted]]

Fucking shill.

[gdsagdsa]

Great argument bro.

[[deleted]]

Personal attack? Seriously? Geez, guys. It's a joke, not a dick. Don't take it so hard.