Hacker News Reader

Comment by 34679 | Hacker News Reader

Balena Etcher is spyware.

https://github.com/balena-io/etcher/issues/2977

Thank you! I didn't know this and it leaves me feeling conflicted. I haven't used Balena Etcher in a while, but I used to use it all the time. I've been using the official tool from Raspberry Pi lately. I wonder if their tool does this.

You should add for context that the two things it collected in the past were IP adress and a timestamp

Both of which fall squarely into the sort of analytics that fit the Wikipedia definition of spyware. Why, Balena?

So all the default configured access.log files for all the Apache and Nginx servers out there are spyware? I'm kinda confused by this point because any time your computer makes a TCP connection to another host, that host knows what time it is, and knows what your IP address is.

I think the point is that for an application writing a local file to a local disk that should not be required to run. Even just prompting or asking would be fine.

Actually, Wikipedia's definition of spyware makes a point in the intro that this behavior may be present in malware as well as in legitimate software and concludes that because these behaviors are so common, and can have non-harmful uses, providing a precise definition of spyware is a difficult task.

You make it sound as though they aren't still collecting data and the only things they've ever collected are IP addresses and timestamps. That's not accurate context.

If this is the bar for spyware then I've got bad news for anyone browsing the web, even with javascript disabled.

I find the intersection of users who monitor network requests like a hawk but download 150mb apps to run dd hilarious.

I'm not even anti electron, you can pry vscode from my cold dead hands, but I've always been confused at the popularity of balena etcher in the first place.

it's way faster than dd, at least with all the settings/cards i've tried, maybe i'm not using it right

I still use Win32DiskImager for windows. It doesn't phone home or check for updates because it doesn't need any, it just works.

> In fact it’s currently writing almost 2 million SD Cards & USB Drives per month!

And how do they know that? Correct. Telemetry.

calculating how many times a person clicks "download" on their website times a guesstiamted number of cards a person would also give a good enough estimate without any telemetry

So are Chrome, Firefox and anything that does auto-updates by that definition. At some point diluting a word enough means it has no meaning left.

It has an auto update service. The merits of that are debatable but calling it ‘spyware’ is an overreaction.

by that definition, this platform is way worse spyware than etcher. https://www.ycombinator.com/legal/

One is a website. The other is a open source tool for local read/write that's been wrapped to add data collection without explicit user consent.

so that means it's ok for the website to collect way more data than etcher?

and since it's open source, you can actually remove any home-calling and have a perfectly functional software, but you can't change anything on this website.

etcher pro is a physical device, so if you don't connect it to the internet, it can't phone home. or does it require internet to work?

Reply on news.ycombinator.com