Hacker News Reader

Comment by SargeZT | Hacker News Reader

I did some reading through the code to understand what was going on here. After a brief read, it appears that most of this telemetry code is only enabled when ETW (Event Tracing for Windows) is enabled.

https://github.com/microsoft/terminal/blob/2b202ce6d99340401...

ETW is explicitly opt-in on windows and is almost exclusively used for debugging, not to mention it requires a kernel mode driver to be loaded.

https://nasbench.medium.com/a-primer-on-event-tracing-for-wi...

I have not read all the code, but from a brief overview this tracing behavior and telemetry wouldn't be automatically activated anywhere except on Azure.

View on HN

Maybe, maybe not:

1. It looks like ETW is enabled by default since Vista.

2. The code deletes the username due to "PII issues," suggesting that something is being sent back (line 295)

3. An oblique reference to a 5% sampling rate (line 284) suggests you may not be able to tell what it's sending based on network monitoring.

Apparently they are considering stopping collecting the list of processes due to "community consternation" but have not yet: https://github.com/microsoft/terminal/issues/6103

They could at least document what they collect so we aren't left guessing. https://github.com/MicrosoftDocs/terminal/issues/139

All that said, it is legitimately great that the source code and these issues are available publicly.

I fully admit I could be wrong, and I didn't explain myself adequately re: ETM. ETM has been enabled since Vista, but you can get a full list of all ETS logs very easily (via `logman query -ets`). The question is what's consuming it, and as far as I can tell the basic telemetry settings won't send anything remotely beyond some incredibly basic information.

This issue seems to fully explain the issue with the telemetry: https://github.com/microsoft/terminal/issues/5331

The biggest takeaway to me here (besides the explanation of the telemetry levels) is that the processes in question are cmd, powershell, bash, etc, and not what you are running in them. Even if you have enhanced telemetry enabled it wouldn't bubble up what you're running underneath the console process as a process name.

Reply on news.ycombinator.com