Purism should not use/recommend Etcher for installs

pum · April 20, 2021, 4:06am

The PureOS installation says to use Etcher for installs: https://pureos.net/download/

This means handing complete trust of both your old and new system to a third-party for-profit company which collects usage data etc. This goes against the Purism ethos of privacy, security, and trust.

Most users could just use cp or dd or diskutil (mac) to accomplish the same thing.

Freedom_Right · April 20, 2021, 8:33am

This tool is free software since it has Apache License 2.0

github.com

balena-io/etcher/blob/master/LICENSE


                              Apache License
                        Version 2.0, January 2004
                     http://www.apache.org/licenses/

TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION

1. Definitions.

   "License" shall mean the terms and conditions for use, reproduction,
   and distribution as defined by Sections 1 through 9 of this document.

   "Licensor" shall mean the copyright owner or entity authorized by
   the copyright owner that is granting the License.

   "Legal Entity" shall mean the union of the acting entity and all
   other entities that control, are controlled by, or are under common
   control with that entity. For the purposes of this definition,
   "control" means (i) the power, direct or indirect, to cause the
   direction or management of such entity, whether by contract or

This file has been truncated. show original

Gavaudan · April 20, 2021, 11:20am

…which means @pum can point out what data they collect.

tracy · April 20, 2021, 11:54am

What else is there? A simple search with DDG on “write iso linux” turns up the other than Etcher the following and I’m sure there are more:

DD
UNetbootin
Rufus
Balena
Ventoy

(linux added to the search string to weed out windoze results.)

My guess is the minimum data they collect is the number of installs. Like the Counting Count.

1 install, ha, ha, ha …
2 installs, ha, ha, ha …
3 installs, ha, ha, ha …

dcz · April 20, 2021, 12:53pm

To those who don’t get the reference: https://en.wikipedia.org/wiki/Count_von_Count . Don’t watch the censored song.

pum · April 21, 2021, 1:45am

Well it’s not like it has a great history of earning user trust:

etc…

Seems weird that Librem wouldn’t recommend an alternative, given that complete control and authority of your “secure” “trusted” PureOS system will be given to this third-party, if you follow PureOS’ install instructions. They could at least mention / link to some alternatives. Right?

reC · April 21, 2021, 9:31pm

i’ll just drop this here in case anybody is in a mood for a TL;DR :

OP has a point. the Apache License is a permissive license. this means that the ‘legal-team’ wanted the possibility of ‘a-way-out’ … nuttin’ wrong with that. it’s the freedom to choose but it ain’t as ‘decided’ as the GPL license for example …

everybody is free to choose in ‘the-spectrum’ but i would urge people to not FORCE anybody into anything …