6 ms·

MSVC CRT Sneaks in Telemetry by Default?

130 points by frozenport 10y ago

ryuuchin 10y ago
Just to mirror what's in the reddit thread the quick "fix" for this is to simply link to notelemetry.obj just as you would with the other small obj files included in the CRT lib directory[1]. Oddly notelemetry.obj is missing from their list. [1] https://msdn.microsoft.com/en-us/library/ms235330.aspx https://msdn.microsoft.com/en-us/library/ms235330.aspx
- tacos 10y ago
  https://gist.github.com/aicpp https://gist.github.com/aicpp
_RPM 10y ago
So, MSFT is injecting code into a binary? This probably won't be a popular opinion here, but this does seem like a pretty good definition of malware to me. It doesn't make it okay that just because it's MSFT they can get away with it.
- UnoriginalGuy 10y ago
  So every C++ compiler that allows you to build in the run-time library with a flag is malware? The user in this case used the /MT flag which tells the compiler to inject code by design. The issue here isn't with injecting code, it is with what that code does. I'm sure many would find the lack of informed consent offputting, and I'd agree. This "feature" lacks documentation and or a warning.
- schmichael 10y ago
  You're linking against their C runtime (CRT) standard library, so it's not injecting per se. Standard C libraries often include all kinds of stuff in otherwise "empty" main(){} executables. That being said, I've never heard of a C runtime including telemetry by default, so malware wouldn't be a totally unfounded opinion.
- deleted 10y ago
  [deleted]
- XMPPwocky 10y ago
  The point of a linker is sort of to "inject code into a binary", and the point of a library is sort of to be code that gets injected into a binary. How does any of this relate to malware?
- deleted 10y ago
  [deleted]
- Aelinsaar 10y ago
  I don't know if it's malware, but it's something really close.
  - HillRat 10y ago
    Or, to put it another way, it's Microsoft saying, "Hey, you probably want local event tracing in your application, so we enabled it by default." Been a while since I've done Windows dev (and I'll install VS Beta to check this out), but it might be as simple as the default project skeleton including an instrumentation manifest whose presence adds EWT tracing to the build chain. It's basically Windows' syslog equivalent, so unless Win10 is sending back all EWT eventing as a matter of course -- which, Win10 being a privacy carwreck, it might well be! -- I'm not too alarmed.
    - Aelinsaar 10y ago
      I don't think it's a reason to be alarmed regardless of the intention, it's just one of those "Huh, isn't that funny?" moments IMO.
jrcii 10y ago
So much for "developers developers developers developers developers" https://www.youtube.com/watch?v=Vhh_GeBPOhs https://www.youtube.com/watch?v=Vhh_GeBPOhs
JustSomeNobody 10y ago
Data isn't free for end users; it's capped for a lot of them. While I get that devs can 'fix' this I wonder how many will in practice.
- Sanddancer 10y ago
  The data stays local at most. It's a hook for devs to add telemetry, not telemetry that goes to the mothership or anything like that.
Sanddancer 10y ago
A different post showing exactly what the info is and where it goes (hint: nowhere): https://www.reddit.com/r/cpp/comments/4ibauu/visual_studio_adding_telemetry_function_calls_to/ https://www.reddit.com/r/cpp/comments/4ibauu/visual_studio_a... There is no info going in and out, it just adds hooks to the runtime for you to add telemetry if you want it.
- userbinator 10y ago
  you can link notelemetry.obj and the calls are removed It's still a ridiculous idea to make this the default. Rather, it should be something you opt-in to if you want to debug, more like you can like telemetry.obj and the calls are inserted
  - forrestthewoods 10y ago
    Why is this comment down voted? Is it not a good suggestion? Opt-in to telemetry vs opt-out seems like a pretty reasonable thing to choose? Is that not true?
    - userbinator 10y ago
      Is that not true? Microsoft recently doesn't seem to think so.
- Silhouette 10y ago
  Comments from known VC++ devs in the linked Reddit thread[1] suggest there may be more to it than that, but they haven't followed up with confirmation either way yet. [1] https://www.reddit.com/r/cpp/comments/4hoyzr/msvc_mutex_is_slower_than_you_might_expect/ https://www.reddit.com/r/cpp/comments/4hoyzr/msvc_mutex_is_s...
xpaulbettsx 10y ago
Lots of things inside Windows emit ETW events, which is Windows equivalent of DTrace (basically the entire OS, and .NET), it's super useful for debugging performance related events. It's not "Telemetry" like Google Analytics, it's for _you_ to debug your own programs. The easiest way to view the output of them is via WPA, you can watch some videos about it at https://msdn.microsoft.com/en-us/library/windows/hardware/hh448170.aspx https://msdn.microsoft.com/en-us/library/windows/hardware/hh...
- userbinator 10y ago
  It's not "Telemetry" like Google Analytics, it's for _you_ to debug your own programs. People have been debugging just fine for the past few decades without extra bloating code in their runtime libraries. A good old-fashioned debugger with tracepoints will accomplish the same thing, and doesn't add overhead when it's not in use.
  - xpaulbettsx 10y ago
    Tracepoints are very expensive and will definitely make any performance traces incorrect
    - userbinator 10y ago
      I don't know what you mean exactly by "expensive", but the time spent in profiling code should obviously not be counted, and it is quite simple to do so. The real point I'm trying to make is that tracepoints do not require any changes to the original code. They are entirely opt-in and if you do not choose to use them, your application won't have this extra useless code compiled into it. That said, the few times I've had to use Visual Studio's tracepoints, they were horribly slow. Apparently this is "by design": https://connect.microsoft.com/VisualStudio/feedback/details/934631/tracepoints-feature-is-very-slow https://connect.microsoft.com/VisualStudio/feedback/details/... Being an RE, I've implemented and used simple tracers that were more than 100x faster than VS' on hardware not quite as fast as that today (around a decade ago). Watching variables in memory and CPU registers changing in near-realtime is something I very much miss when I have to work in higher-level languages...
drucken 10y ago
Note this Reddit comment by what appears to be a couple of MS devs: (fourbadcats) Indeed. This sure better be an oversight of something not disabled when transitioning from release candidate to RTM. We will lose credibility with our customers if we claim that our application does not collect any usage data when this is going out over the wire. I noticed that notelemetry.obj is not present with VS 2015 Update 1 so this may have been introduced with Update 2. Let's hope it's gone in Update 3. and this too: (spongo2) Let me gather some details However, this is definitely highly disconcerting.
- deleted 10y ago
  [deleted]
- StephanTLavavej 10y ago
  The first comment, from fourbadcats, is apparently from a customer of MS (I don't know who they are), referring to their customers in turn. The second from spongo2 is VC's dev manager, my double boss. (I know very little about this topic as the STL's senior developer; this stuff is in the vcruntime layer below the STL.)
  - frik 10y ago
    Yes ask your boss. > We will lose credibility with our customers if we claim that our application does not collect any usage data when this is going out over the wire. Microsoft wasted Win10 and Office 2016 already (and sneaked it into newer Win7&8 updates). It would have been such a great chance after the misguided/failed Win8, but then MS decided to add invasive telemetry and other phone home crap incl whitelisting IPs and URLs in kernel mode network layer, with no way to deactivate all of it - don't even think MS respects you as a end consumer (you are their sheep and loose control of your PC) and not even as enterprise customer nor with LTSB (except you request a custom build of the network stack).
chris_wot 10y ago
I was looking at the C Runtime Library the other day and found the following series of article on how to remove msvcrt.lib: https://hero.handmade.network/forums/code-discussion/t/94 https://hero.handmade.network/forums/code-discussion/t/94 Basically, the entrypoint for Win32 isn't actually WinMain, but WinMainCRTStartup. To replace it you need to reimplement a few things, including an implementation of memcpy() and memset(), some allocation routines for 32 bit code under 64 bit systems and some floating point routines. Curious to know what the new universal runtime loads up. I'd love Microsoft to be a bit more open about what their C runtime actually does before a program linked to it loads. Of course, perhaps they are, and I've missed it. Edit: looks like someone was pissed about this lack of documentation in the beta Vususl Studio beta: http://levicki.net/articles/2015/12/03/RANT_Microsoft_Visual_Studio_2015.php http://levicki.net/articles/2015/12/03/RANT_Microsoft_Visual...
- asveikau 10y ago
  > I'd love Microsoft to be a bit more open about what their C runtime actually does before a program linked to it loads. Of course, perhaps they are, and I've missed it. The source code to the CRT ships with Visual Studio. > Basically, the entrypoint for Win32 isn't actually WinMain, but WinMainCRTStartup. The entry point is whatever appears in the PE header and you can name it whatever you want. It just so happens that the default linker settings point it at CRT, which calls into you. You can change this with linker settings.
  - chris_wot 10y ago
    Ya, I didn't explain that as well as I might have. That is correct :-)

130 points by frozenport 10y ago

Just to mirror what's in the reddit thread the quick "fix" for this is to simply link to notelemetry.obj just as you would with the other small obj files included in the CRT lib directory[1]. Oddly notelemetry.obj is missing from their list. [1] https://msdn.microsoft.com/en-us/library/ms235330.aspx https://msdn.microsoft.com/en-us/library/ms235330.aspx

tacos 10y ago
https://gist.github.com/aicpp https://gist.github.com/aicpp

_RPM 10y ago

So, MSFT is injecting code into a binary? This probably won't be a popular opinion here, but this does seem like a pretty good definition of malware to me. It doesn't make it okay that just because it's MSFT they can get away with it.

UnoriginalGuy 10y ago
So every C++ compiler that allows you to build in the run-time library with a flag is malware? The user in this case used the /MT flag which tells the compiler to inject code by design. The issue here isn't with injecting code, it is with what that code does. I'm sure many would find the lack of informed consent offputting, and I'd agree. This "feature" lacks documentation and or a warning.
schmichael 10y ago
You're linking against their C runtime (CRT) standard library, so it's not injecting per se. Standard C libraries often include all kinds of stuff in otherwise "empty" main(){} executables. That being said, I've never heard of a C runtime including telemetry by default, so malware wouldn't be a totally unfounded opinion.
deleted 10y ago
[deleted]
XMPPwocky 10y ago
The point of a linker is sort of to "inject code into a binary", and the point of a library is sort of to be code that gets injected into a binary. How does any of this relate to malware?
deleted 10y ago
[deleted]
Aelinsaar 10y ago
I don't know if it's malware, but it's something really close.
- HillRat 10y ago
  Or, to put it another way, it's Microsoft saying, "Hey, you probably want local event tracing in your application, so we enabled it by default." Been a while since I've done Windows dev (and I'll install VS Beta to check this out), but it might be as simple as the default project skeleton including an instrumentation manifest whose presence adds EWT tracing to the build chain. It's basically Windows' syslog equivalent, so unless Win10 is sending back all EWT eventing as a matter of course -- which, Win10 being a privacy carwreck, it might well be! -- I'm not too alarmed.
  - Aelinsaar 10y ago
    I don't think it's a reason to be alarmed regardless of the intention, it's just one of those "Huh, isn't that funny?" moments IMO.

jrcii 10y ago

So much for "developers developers developers developers developers" https://www.youtube.com/watch?v=Vhh_GeBPOhs https://www.youtube.com/watch?v=Vhh_GeBPOhs

JustSomeNobody 10y ago

Data isn't free for end users; it's capped for a lot of them. While I get that devs can 'fix' this I wonder how many will in practice.

Sanddancer 10y ago
The data stays local at most. It's a hook for devs to add telemetry, not telemetry that goes to the mothership or anything like that.

Sanddancer 10y ago

A different post showing exactly what the info is and where it goes (hint: nowhere): https://www.reddit.com/r/cpp/comments/4ibauu/visual_studio_adding_telemetry_function_calls_to/ https://www.reddit.com/r/cpp/comments/4ibauu/visual_studio_a... There is no info going in and out, it just adds hooks to the runtime for you to add telemetry if you want it.

userbinator 10y ago
you can link notelemetry.obj and the calls are removed It's still a ridiculous idea to make this the default. Rather, it should be something you opt-in to if you want to debug, more like you can like telemetry.obj and the calls are inserted
- forrestthewoods 10y ago
  Why is this comment down voted? Is it not a good suggestion? Opt-in to telemetry vs opt-out seems like a pretty reasonable thing to choose? Is that not true?
  - userbinator 10y ago
    Is that not true? Microsoft recently doesn't seem to think so.
Silhouette 10y ago
Comments from known VC++ devs in the linked Reddit thread[1] suggest there may be more to it than that, but they haven't followed up with confirmation either way yet. [1] https://www.reddit.com/r/cpp/comments/4hoyzr/msvc_mutex_is_slower_than_you_might_expect/ https://www.reddit.com/r/cpp/comments/4hoyzr/msvc_mutex_is_s...

xpaulbettsx 10y ago

Lots of things inside Windows emit ETW events, which is Windows equivalent of DTrace (basically the entire OS, and .NET), it's super useful for debugging performance related events. It's not "Telemetry" like Google Analytics, it's for _you_ to debug your own programs. The easiest way to view the output of them is via WPA, you can watch some videos about it at https://msdn.microsoft.com/en-us/library/windows/hardware/hh448170.aspx https://msdn.microsoft.com/en-us/library/windows/hardware/hh...

userbinator 10y ago
It's not "Telemetry" like Google Analytics, it's for _you_ to debug your own programs. People have been debugging just fine for the past few decades without extra bloating code in their runtime libraries. A good old-fashioned debugger with tracepoints will accomplish the same thing, and doesn't add overhead when it's not in use.
- xpaulbettsx 10y ago
  Tracepoints are very expensive and will definitely make any performance traces incorrect
  - userbinator 10y ago
    I don't know what you mean exactly by "expensive", but the time spent in profiling code should obviously not be counted, and it is quite simple to do so. The real point I'm trying to make is that tracepoints do not require any changes to the original code. They are entirely opt-in and if you do not choose to use them, your application won't have this extra useless code compiled into it. That said, the few times I've had to use Visual Studio's tracepoints, they were horribly slow. Apparently this is "by design": https://connect.microsoft.com/VisualStudio/feedback/details/934631/tracepoints-feature-is-very-slow https://connect.microsoft.com/VisualStudio/feedback/details/... Being an RE, I've implemented and used simple tracers that were more than 100x faster than VS' on hardware not quite as fast as that today (around a decade ago). Watching variables in memory and CPU registers changing in near-realtime is something I very much miss when I have to work in higher-level languages...

drucken 10y ago

Note this Reddit comment by what appears to be a couple of MS devs: (fourbadcats) Indeed. This sure better be an oversight of something not disabled when transitioning from release candidate to RTM. We will lose credibility with our customers if we claim that our application does not collect any usage data when this is going out over the wire. I noticed that notelemetry.obj is not present with VS 2015 Update 1 so this may have been introduced with Update 2. Let's hope it's gone in Update 3. and this too: (spongo2) Let me gather some details However, this is definitely highly disconcerting.

deleted 10y ago
[deleted]
StephanTLavavej 10y ago
The first comment, from fourbadcats, is apparently from a customer of MS (I don't know who they are), referring to their customers in turn. The second from spongo2 is VC's dev manager, my double boss. (I know very little about this topic as the STL's senior developer; this stuff is in the vcruntime layer below the STL.)
- frik 10y ago
  Yes ask your boss. > We will lose credibility with our customers if we claim that our application does not collect any usage data when this is going out over the wire. Microsoft wasted Win10 and Office 2016 already (and sneaked it into newer Win7&8 updates). It would have been such a great chance after the misguided/failed Win8, but then MS decided to add invasive telemetry and other phone home crap incl whitelisting IPs and URLs in kernel mode network layer, with no way to deactivate all of it - don't even think MS respects you as a end consumer (you are their sheep and loose control of your PC) and not even as enterprise customer nor with LTSB (except you request a custom build of the network stack).

chris_wot 10y ago

I was looking at the C Runtime Library the other day and found the following series of article on how to remove msvcrt.lib: https://hero.handmade.network/forums/code-discussion/t/94 https://hero.handmade.network/forums/code-discussion/t/94 Basically, the entrypoint for Win32 isn't actually WinMain, but WinMainCRTStartup. To replace it you need to reimplement a few things, including an implementation of memcpy() and memset(), some allocation routines for 32 bit code under 64 bit systems and some floating point routines. Curious to know what the new universal runtime loads up. I'd love Microsoft to be a bit more open about what their C runtime actually does before a program linked to it loads. Of course, perhaps they are, and I've missed it. Edit: looks like someone was pissed about this lack of documentation in the beta Vususl Studio beta: http://levicki.net/articles/2015/12/03/RANT_Microsoft_Visual_Studio_2015.php http://levicki.net/articles/2015/12/03/RANT_Microsoft_Visual...

asveikau 10y ago
> I'd love Microsoft to be a bit more open about what their C runtime actually does before a program linked to it loads. Of course, perhaps they are, and I've missed it. The source code to the CRT ships with Visual Studio. > Basically, the entrypoint for Win32 isn't actually WinMain, but WinMainCRTStartup. The entry point is whatever appears in the PE header and you can name it whatever you want. It just so happens that the default linker settings point it at CRT, which calls into you. You can change this with linker settings.
- chris_wot 10y ago
  Ya, I didn't explain that as well as I might have. That is correct :-)