Microsoft Windows ISO writer documentation (write Kicksecure ISO to USB) / balenaEtcher issues

Patrick · April 19, 2024, 1:59pm

balenaEtcher

For Windows and macOS, we instruct people to use balenaEtcher to copy the USB image onto their USB stick. On top of this, we self-host the downloads of balenaEtcher on our own infrastructure. The tails / etcher-binary · GitLab repository is added as an ikiwiki underlay on our website.

We self-host a copy of balenaEtcher because:

It gives us more predictability on what users end up doing. This is useful in terms of Help Desk.

It prevents 3rd parties from learning a bit more about who uses Tails. Pointing to GitHub from our website would provide direct referrers to GitHub (and maybe Balena too) about who is using balenaEtcher to install Tails.

It prevents GitHub from serving rogue downloads (targeted or not). We might still get a rogue download ourselves but:

We download balenaEtcher several times from different locations to prevent targeted attacks.

We download balenaEtcher in a limited time window, which might save our users some supply chain issues. If our users were to download balenaEtcher every time, a short-time supply chain attack would definitely affect some of them.

balenaEtcher has Telemetry (privacy) issues:

github.com/balena-io/etcher

Telemtery should be opt-in

opened 12:11PM - 13 Jul 22 UTC

closed 09:43AM - 13 Oct 23 UTC

oliversalzburg

- **Etcher version:** 1.7.9 - **Operating system and architecture:** Windows x6…4 - **Image flashed:** irrelevant - **What do you think should have happened:** No information is sent to third-parties without my consent - **What happened:** You require me to discover and opt-out of telemetry myself and happily send everything you want prior to that. - **Do you see any meaningful error information in the DevTools?** No Given that your product is recommended by Canonical as the way to put their images on storage media, I was unpleasantly surprised to find opt-out telemetry in your product. If you want to exfiltrate information from my machine, please ask me before doing so, so that I can then use a different product to flash images onto media.