News for hackers. Stuff that matters.
Re:Reviewing Microsoft's Automatic Insertion of Telemetry in... by yuhong on Thursday June 09, 2016 @10:10PM (#11873836)
I think it is not true in this case. The thing that does telemetry in Windows is called SQM AFAIK. I think it might use ETW sometimes, but this is only one thing ETW can be used for.
Re:Reviewing Microsoft's Automatic Insertion of Telemetry in... by acqq on Friday June 10, 2016 @03:04AM (#11874726)
I'm quite sure Windows uses ETW on various places: searching for etl files, I find 136 on my C: disk, and all are generated by the system, and not due to my debugging actions. E.g.

    C:\ProgramData\Microsoft\Diagnosis\ETLLogs\AutoLogger\AutoLogger-Diagtrack-Listener.etl
    C:\Users\myname\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog.etl
    C:\Users\myname\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl
    C:\Users\myname\AppData\Local\Microsoft\Windows\SkyDrive\logs\app\SkyDriveApp-2015-08-30.2157.4952-1.etl
    C:\Users\myname\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\LiveComm.etl
    C:\Users\myname\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\LiveCommLast.etl
    C:\Users\myname\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\Microsoft.WindowsLive.Mail.etl
    C:\Users\myname\AppData\Local\Packages\microsoft.windowscommunicationsapps_8wekyb3d8bbwe\LocalState\Microsoft.WindowsLive.People.etl
    C:\Users\myname\AppData\Local\Packages\Microsoft.WindowsReadingList_8wekyb3d8bbwe\LocalState\StashApp.etl
    C:\Users\myname\AppData\Local\Packages\Microsoft.WindowsReadingList_8wekyb3d8bbwe\LocalState\StashShare.etl
    C:\Windows\Inf\netcfgx.4.etl
    C:\Windows\Logs\PBR\RjvTrace_Configure.etl
    C:\Windows\Logs\SystemRestore\restore.0.etl
    C:\Windows\System32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{fef283f0-94cd-4a98-a8e7-4fd5e3eca941}\snapshot.etl
    C:\Windows\System32\wdi\LogFiles\BootCKCL.etl
    C:\Windows\System32\wdi\LogFiles\SecondaryLogonCKCL.etl
    C:\Windows\System32\wdi\LogFiles\ShutdownCKCL.etl
    C:\Windows\System32\wfp\wfpdiag.etl
If we would track everything that their different telemetries uploads, I'm quite sure .etl files would be somewhere inside. Or that their number rises with the installation of the KB updates that mention telemetry (e.g. everything related to "prepare your system for Windows 10," for example). Or that they really planned to use .etl files too fro these purposes but just haven't yet. But the .etl are widely used, they are simply system-level provided effective logs.

Everybody can check for himself too.

Re:Reviewing Microsoft's Automatic Insertion of Telemetry in... by yuhong on Friday June 10, 2016 @09:28AM (#11876182)
The point is that the particular ETW logs in question in this case are unlikely to be in the list.
Re:Reviewing Microsoft's Automatic Insertion of Telemetry in... by acqq on Friday June 10, 2016 @10:32AM (#11876605)
Personally I don't see that they invade privacy more than they can with other their information gathering methods, I however do belive that the names weren't given randomly but really related to some telemetry they planned, even when unfinished.