Some of the comments in this thread are rather disappointing, especially since the front page of this website claims:
"Open source home automation that puts local control and privacy first. "
This post is probably just going to cause more arguments, but for the few honestly wondering what concerns can/should be, here are some additional thoughts.
Many of us have chosen Home Assistant to give us this control, for both privacy and security reasons.
From a privacy perspective (I’m not even touching the Nothing-to-hide fallacy), Home Assistant is more chatty than it should be. This thread is a great example, and then there’s the ‘feature’ where Home Assistant overrides local DNS preferences and using Google/Cloudflare for DNS queries, which has its own privacy implications (How do I stop Home Assistant from trying to bypass my local DNS? - #3 by vitaprimo old thread, but still an existing behavior). IF Network Manager really needs to know I’m connected to the internet, despite not using any cloud-dependent components and having all analytics reporting features disabled, then it should at least prompt and/or allow you to change these parameters.
It’s also extremely disappointing when applications don’t fail gracefully because they can’t handle a failed connection properly. Home Assistant falls in this category according to their own instructions, so now I’m losing this tiny bit of control unless I’m willing to forcefully remove this behavior via unsupported code changes.
This could even pose a security risk. Here we have a system which may have any form of updates and analytics disabled, but is still pulling down a file on a very regular basis. Imagine a Log4Shell-like scenario, maybe in curl or whatever library it uses, where just the act of Network Manager downloading this file would compromise your system. Now all a malicious actor has to do is compromise/redirect this file, and now every single instance is compromised. Domains expire (sometimes by accident), DNS infrastructure gets hijacked, it happens.
So is a state actor trying to spy on you? Is Nabu Casa trying to spy on you? Most likely not. But I strongly encourage everyone to do their own research, assess which values matter most to you, and not look down on people who are attempting to answer these questions for themselves, it’s what makes products such as Home Assistant better.
That’s all.