&gt; They said something like, &quot;um... but we&#x27;ve got root&quot;.<p>Which is incredibly misleading.<p>Sure, they could put malicious code in their distribution. It could do whatever they want. And then it would be on your machine, where you can potentially discover it and publish what you&#x27;ve discovered and allow others to verify your discovery. Which could cause Canonical to <i>not</i> have root anymore, because people would immediately switch to Debian or CentOS or something else.<p>But if they <i>send data</i> from your machine to their servers, no one has any ability to determine what they do with it from there, how well they secure it, who they give or sell it to, etc. It&#x27;s a completely different situation because it goes from trust-but-verify to blind trust.