There seems to be some concern brewing amongst users regarding an aspect of Umbrel’s code, specifically a section that regularly sends a ping to check for updates.
Citadel, a node implementation that focuses less on the user experience and more on security pointed out the code snippet on twitter.
Some users have interpreted this as a veiled attempt to harvest their IP addresses, speculating that this “hourly ping” serves no real purpose besides surreptitiously collecting users’ data. This perception has stoked concerns about privacy among the user community. Luke Childs, related to the company, has since clarified the company’s stance on the matter, assuring users that their privacy remains uncompromised.
He lauded the users for their vigilance in privacy matters but disagreed with the interpretation of the code snippet, which he clarified as part of a phased transition towards a new update system. The objective behind this section of the code is to regularly ping the update server, verifying if a new update to umbrelOS is available. This is not an uncommon practice, as it mirrors the functioning of most operating systems.
Childs strongly downplayed the allegations of Umbrel “harvesting IP addresses”. He reiterated that the sharing of IP addresses is an inherent part of using any online service. To illustrate, he offered examples such as Docker Hub and GitHub, services that would also be privy to your IP when you download from them. He emphatically confirmed that Umbrel adheres to strict privacy protocols, ensuring that IP addresses are not retained or stored beyond the connection period, and there is no IP harvesting.
He responded directly to the proposed alternative of using Tor. While acknowledging Tor’s usefulness in ensuring anonymity, he was keen to point out its limitations. Tor could be slow, unreliable, and in some instances completely unusable due to consistent DoS attacks that have been observed of late. These concerns would seemingly undermine the suggestion to incorporate it into Umbrel’s framework.
Childs also highlighted that the phased transition being currently executed was a direct response to feedback from users who found it difficult to be updated about new changes to the umbrelOS. To solve this issue, Umbrel is putting efforts into creating a new update system that emphasizes improved reliability. This ambitious project involves a complete rewrite of the source code, focusing on stability, which needs comprehensive testing before full implementation. Childs stated that the controversial code plays a fundamental role in enabling a smooth transition to this new system.
In conclusion, Childs underscored that the company’s foremost responsibility is towards the safety and education of their users. He underscored his hopes that these clarifications would dispel any existing confusion over the matter. Furthermore, he committed that ready communication on changes that might potentially affect users would be a priority for Umbrel in the future.
The clarification offered by Luke Childs hinges on the importance of context and understanding, painting a clear picture of why certain systems within Umbrel function as they do, and firmly denying any ulterior motives of data harvesting. His explanations underscore the fact that to make well-informed judgments and healthy speculation, it is crucial to have a good understanding of how technologies and systems operate, especially in an era where personal data and privacy are paramount. This incident serves as a reminder to tech companies about the importance of clear and early communication about their systems and potentials changes to avoid breeding unnecessary anxiety and speculation among their users.
Please, don’t let these issues deter you from running your own node. Running a node is the ultimate way to directly use bitcoin and to help decentralize the network.
The implementations available are:
- Umbrel
- Citadel
- Mynode
- Raspiblitz
- Start9 (Use the coupon code LOVEISBITCOIN for 9% off)
