Reviewing Microsoft's Automatic Insertion of Telemetry into C++ Binaries

The key problem with that is having such a thing enabled by default. Doing so has great potential to harm security, even if the telemetry does not contain any user data. Shipping a development environment where it is enabled by default (which I think is what that article is saying) is inexcusable, in my opinion. Providing remote telemetry as a strictly opt-in development aid, on the other hand, is fine (as long as it is quite obvious when enabled, and the developer is given full disclosure regarding the specifics of the telemetry). It might actually be quite a useful feature for some legitimate development activities.

If an attacker gains access to the telemetry, they have an advantage. The suggestion that it can only be usefully interpreted in the presence of symbol information willingly supplied by the developer is quite likely to be false. Having access to the symbols will make it vastly easier to interpret, but the absence of symbols does not necessarily make it impossible to interpret. Exposing timing information for cryptography functions compromises the integrity and strength of the crypto.

Now, even if there are additional protections present to mitigate the risks, the risk will never be zero while the telemetry is being emitted. It adds entirely unnecessary risk, even if the risks are small or minimal and the information is difficult to use.

Finally, the simple fact that MS fairly rapidly chose to remove the functionality in an update release leads me to conclude that they recognised that there were some fundamental and serious issues with having such a feature enabled by default. Converting it into a safe opt-in feature would not have been difficult for them, complete removal of it is a fairly drastic step.
... even if the telemetry does not contain any user data ...

The toe goes into the water before the foot. That's always the way it's done. IMO - similar but expanded things like this eventually could be used for reasons of copyright/patent enforcement, or for allowing only certain "certified" versions of things. In other words - a "lock down" of application development. Apple already has technology in this realm, although in a significantly different form (I don't think it's telemetry that they use for the lock down, but don't know for sure). Anyway, they've had their toes in the water for a while, in the pond, in the walled garden ...

There's un-nerving stuff going on. The entire Tor board was tossed over (all new). I guess they tossed themselves over. How often does that happen? One of the lead developers left the country. And, there's talk going round in upper circles about the programmers who shouldn't do "what they want" anymore. See the article "government regulation will clip coder's wings" on to get an idea. It's easy to draw conclusions about some of these other (related or not?) happenings.
Last edited: