4 ms·

Balena Etcher is spyware. https://github.com/balena-io/etcher/issues/2977 https://github.com/balena-io/etcher/issues/2977

by 34679 5y ago

cucumb3rrelish 5y ago
You should add for context that the two things it collected in the past were IP adress and a timestamp
- cf100clunk 5y ago
  Both of which fall squarely into the sort of analytics that fit the Wikipedia definition of spyware. Why, Balena?
  - ctoth 5y ago
    So all the default configured access.log files for all the Apache and Nginx servers out there are spyware? I'm kinda confused by this point because any time your computer makes a TCP connection to another host, that host knows what time it is, and knows what your IP address is.
    - SahAssar 5y ago
      I think the point is that for an application writing a local file to a local disk that should not be required to run. Even just prompting or asking would be fine.
  - mmda-2 5y ago
    Actually, Wikipedia's definition of spyware makes a point in the intro that this behavior may be present in malware as well as in legitimate software and concludes that because these behaviors are so common, and can have non-harmful uses, providing a precise definition of spyware is a difficult task.
- 34679 5y ago
  You make it sound as though they aren't still collecting data and the only things they've ever collected are IP addresses and timestamps. That's not accurate context.
Stampo00 5y ago
Thank you! I didn't know this and it leaves me feeling conflicted. I haven't used Balena Etcher in a while, but I used to use it all the time. I've been using the official tool from Raspberry Pi lately. I wonder if their tool does this.
legrande 5y ago
> In fact it’s currently writing almost 2 million SD Cards & USB Drives per month! And how do they know that? Correct. Telemetry.
- automato 5y ago
  calculating how many times a person clicks "download" on their website times a guesstiamted number of cards a person would also give a good enough estimate without any telemetry
tinus_hn 5y ago
It has an auto update service. The merits of that are debatable but calling it ‘spyware’ is an overreaction.
marcinzm 5y ago
So are Chrome, Firefox and anything that does auto-updates by that definition. At some point diluting a word enough means it has no meaning left.
reificator 5y ago
If this is the bar for spyware then I've got bad news for anyone browsing the web, even with javascript disabled. I find the intersection of users who monitor network requests like a hawk but download 150mb apps to run dd hilarious. I'm not even anti electron, you can pry vscode from my cold dead hands, but I've always been confused at the popularity of balena etcher in the first place.
- automato 5y ago
  it's way faster than dd, at least with all the settings/cards i've tried, maybe i'm not using it right
- 34679 5y ago
  I still use Win32DiskImager for windows. It doesn't phone home or check for updates because it doesn't need any, it just works.
automato 5y ago
etcher pro is a physical device, so if you don't connect it to the internet, it can't phone home. or does it require internet to work?
automato 5y ago
by that definition, this platform is way worse spyware than etcher. https://www.ycombinator.com/legal/ https://www.ycombinator.com/legal/
- 34679 5y ago
  One is a website. The other is a open source tool for local read/write that's been wrapped to add data collection without explicit user consent.
  - automato 5y ago
    so that means it's ok for the website to collect way more data than etcher? and since it's open source, you can actually remove any home-calling and have a perfectly functional software, but you can't change anything on this website.

Balena Etcher is spyware. https://github.com/balena-io/etcher/issues/2977 https://github.com/balena-io/etcher/issues/2977

by 34679 5y ago

Balena Etcher is spyware. https://github.com/balena-io/etcher/issues/2977 https://github.com/balena-io/etcher/issues/2977

cucumb3rrelish 5y ago

You should add for context that the two things it collected in the past were IP adress and a timestamp

cf100clunk 5y ago
Both of which fall squarely into the sort of analytics that fit the Wikipedia definition of spyware. Why, Balena?
- ctoth 5y ago
  So all the default configured access.log files for all the Apache and Nginx servers out there are spyware? I'm kinda confused by this point because any time your computer makes a TCP connection to another host, that host knows what time it is, and knows what your IP address is.
  - SahAssar 5y ago
    I think the point is that for an application writing a local file to a local disk that should not be required to run. Even just prompting or asking would be fine.
- mmda-2 5y ago
  Actually, Wikipedia's definition of spyware makes a point in the intro that this behavior may be present in malware as well as in legitimate software and concludes that because these behaviors are so common, and can have non-harmful uses, providing a precise definition of spyware is a difficult task.
34679 5y ago
You make it sound as though they aren't still collecting data and the only things they've ever collected are IP addresses and timestamps. That's not accurate context.

Stampo00 5y ago

Thank you! I didn't know this and it leaves me feeling conflicted. I haven't used Balena Etcher in a while, but I used to use it all the time. I've been using the official tool from Raspberry Pi lately. I wonder if their tool does this.

legrande 5y ago

> In fact it’s currently writing almost 2 million SD Cards & USB Drives per month! And how do they know that? Correct. Telemetry.

automato 5y ago
calculating how many times a person clicks "download" on their website times a guesstiamted number of cards a person would also give a good enough estimate without any telemetry

tinus_hn 5y ago

It has an auto update service. The merits of that are debatable but calling it ‘spyware’ is an overreaction.

marcinzm 5y ago

So are Chrome, Firefox and anything that does auto-updates by that definition. At some point diluting a word enough means it has no meaning left.

reificator 5y ago

If this is the bar for spyware then I've got bad news for anyone browsing the web, even with javascript disabled. I find the intersection of users who monitor network requests like a hawk but download 150mb apps to run dd hilarious. I'm not even anti electron, you can pry vscode from my cold dead hands, but I've always been confused at the popularity of balena etcher in the first place.

automato 5y ago
it's way faster than dd, at least with all the settings/cards i've tried, maybe i'm not using it right
34679 5y ago
I still use Win32DiskImager for windows. It doesn't phone home or check for updates because it doesn't need any, it just works.

automato 5y ago

etcher pro is a physical device, so if you don't connect it to the internet, it can't phone home. or does it require internet to work?

automato 5y ago

by that definition, this platform is way worse spyware than etcher. https://www.ycombinator.com/legal/ https://www.ycombinator.com/legal/

34679 5y ago
One is a website. The other is a open source tool for local read/write that's been wrapped to add data collection without explicit user consent.
- automato 5y ago
  so that means it's ok for the website to collect way more data than etcher? and since it's open source, you can actually remove any home-calling and have a perfectly functional software, but you can't change anything on this website.