I had no idea this issue had been identified. While I find this tool very useful, the project is seeming rather questionable to me now.
Removed by mod
I was bored at work one day. I decided to put a nyan cat easter egg in my company’s app. If at the loading progress bar screen you typed NYAN it would turn the progress bar into a rainbow being created by a little nyan cat while playing the nyan cat song. The mp3 (inconspicuously renamed without the extension) doubled our build size. No one batted an eye cause no one paid attention to the build size much.
Fast forward 5 years later, at a different job, I get a phone call from the old boss. Do you happen to know anything about this nyan cat file we found?
I had no idea what he was talking about.
Years and years ago I worked on a project where the logo was the outline of a head and an inward swirl for the brain.
For the website, if you held your mouse over it for 9 seconds, it would spin and flush. No one ever found that one that I know of.
Aaaand thats why all commits should be signed with your pgp key
It sounds like they weren’t using any form of version control, so that’s definitely on them at this point
What makes you say that? To me, it sounds like that’s what they do have cause they tracked the change back to him. The commit message obviously said nothing about the file.
Ah I could see that. I took it as them not knowing where the file came from at all, so they’re just asking all the devs who would have had access at that point, which is why it was “hey do you know anything about this file?” and not “is there a specific reason you committed this file to the build?”
You think they’d call up devs who left them just to ask if they happen to know about a random file?
You think they’d call up devs who left them just to ask if they happen to know about a random file?
I mean, that’s what op said happened. Literally with the verbiage of “file we found” and not “file you committed”
I did mean random devs, not the dev they tracked down that made the change.
10/10
After I saw that issue, I attempted to build Ventoy from source. After making numerous modifications and getting only the first couple components built, I got tired of it and quit. I’ve made some modifications to glim and use that instead, although it’s still not as easy as Ventoy. But I don’t trust Ventoy if I can’t build it myself.
Further, when @[email protected] made some criticisms of Ventoy in one of her YouTube videos, she was subjected to a harassment campaign, and others told her the same happened to them. That pushed me from not trusting Ventoy to actively distrusting it.
it’s the opposite, actually: she got harassed because she didn’t talk about it when talking about creating a bootable drive.
I remember this thread! Before I saw this comment, I had already gone to look it up again:
Here’s the initial post of Verionica’s video on booting from ISO files: https://linuxmom.net/@vkc/112905487325961707
And here’s the post on 'The Ventoy conspiracy": https://linuxmom.net/@vkc/112906968594601449Further, when @[email protected] made some criticisms of Ventoy in one of her YouTube videos, she was subjected to a harassment campaign, and others told her the same happened to them.
What the fuck is happening to the world? Are we regressing or were we always this regressed and we’ve just given powerful tools to fucking chowderheads?
There’s a subset of the Linux/FOSS/etc. community who are Conservative, misogynistic, racist, and/or otherwise general bigots. Compare the Ventoy-bros against the Elon-bros, and you’ll see a similar pattern of behavior.
I don’t personally understand it, since development is still sometimes seen as “work for weirdo nerds,” so you’d think they would understand what it feels like to be rejected or bullied, but here we are. They manage to stay under the radar, because there’s usually no reason to discuss politics or philosophy when you’re debugging code.
There’s a subset of the Linux/FOSS/etc. community who are Conservative, misogynistic, racist, and/or otherwise general bigots.
right, the hackernews set…
Don’t know why you’re being downvoted, hackernews is an awful site of smug, dumb software “engineer” tech bros with some of the worst takes on anything that isn’t explicitly about how to code
Glad it’s getting a little more light. Been trying to tell people this for a few years now lol. It’s the reason I’ve stayed away from it since first learning of the tool and looking at the “source code”.
I too wish the developer would respond, but I don’t think this is the catastrophe people are making it out to be. One comment seems to explain why these binaries are included:
Because ventoy supports shim, and by extension secure boot, these files needs to come from a signed Linux distro. In this case they are taken from Fedora releases, and OpenSUSE apparently, as they publish shim binaries and grub binaries signed by their certificate.
If the hashes match the files from the Fedora or OpenSUSE releases, then does this really matter?
It matters because nobody is going to check the hashes for all of the files match whenever there’s a change so the maintainer can just replace them with whatever he wants.
that’s what automation is for - nobody is going to manually check them, but anyone is able to automatically set something up to check their hashes in change… the fact that it’s possible that anyone is doing that now that it’s a known issue perhaps makes it less problematic as an attack vector
On the contrary: that just goes to show what a fucking catastrophe for software freedom “Secure[sic] Boot” is.
While this is true, it only requires the shim and grub to be copied for another distro.
From other comments there are a lot more blobs than just these two.
It sounds like most, if not all, come from upstream projects.
Would be nice if the dev can respond and confirm that…
I think they did say that in the older thread. But for proper security, you shouldn’t have to trust them. You should have build tools that will re-fetch everything to create an identical build. That gives a clear chain of custody, which proves that morning has been tampered with.
Hey guys open source is great you can look at all the code and therefore there are no security backdoors etc. Also here are a bunch of pre-compiled blobs in the repo, don’t worry about those, but they are required to run the program.
The fact that people know there are pre-compiled blobs in open source means they have an informed reason to avoid the software!
Right, the fact that it’s open is the reason this came to light, and we’re having this discussion
Exactly. Acting like this is an “ah-ha, see?!!” moment when this is exactly what open source is designed for. That’s like saying global warming is a hoax because “oh look it’s snowing”.
Thank you for sharing this. I remember using Ventoy quite often back when I was still on Windows. I’ll be sticking with the good old
ddcommand.Good ol’ disk destroyer
God I hate people who use github comments for their own benefit. “Just fork it bro” is never helpful.
For me the problem is more in GPL violation: they distribute blobs under GPL3, user made a request of the source code by creating an issue, but they ignored that request. It is not only about “you have to fix it” versus “just fork it” imo.
Licence doesn’t apply to the creator.
He already owns the copyright, he doesn’t need a licence, he doesn’t need to adhere to the gpl
The binaries in question are various GNU and FOSS tools from elsewhere, not part of the Ventoy project itself. So no, the Ventoy author does not own the copyright of the tools in question.
Even then, he’s still allowed to provide binary blobs. He doesn’t have to provide it as source code. If that was the case, we’d all have to build from source and package managers like apt, dnf and flatpak wouldn’t exist.
All he has to do is make the source code available, i.e. just link back to the original Github Repo.
Wtf is ventoy and why is nobody explaining it
Basically an OS which let’s you choose another OS to boot into. This way you can chose between multiple OS’s on one USB drive. You drag your ISO files into a USB folder and choose between them on boot.
That sounded like grub until you said ISO file
Yeah basically grub but on a USB stick and with ISO files
I used Ventoy (its still on my USB stick). Its actually a pretty cool concept. Normally without Ventoy, you would flash your Linux distribution on the USB stick. And then you can boot from it, right?
Ventoy instead allows you to have a folder where you put an ISO without flashing it, and then you can boot from it by selecting in the menu. You just need to flash Ventoy once, as the base system, then you can put as many ISO files into that directory. I tested it and have 7 different Linux distributions (ranging from 1 GB to 4 GB variants) on the same USB stick, and I can boot any of them without flashing again. Replacing ISO is extremely easy, just delete it and copy a new one. Filenames does not matter, anything can be found.
Wtf is a BLOB and why is nobody explaining it
Because you can look it up.
because search engines exist
Wtf is search engines and why is no one explaining it
Search engines are websites that people used to go to in order to get helpful information. These days, they just spam out a bunch of SEO garbage, AI-generated bullshit, and ads.
Google, probably
shh…it’s a spyware and adware!
Is there an alternative to Ventoy for booting Windows vhd images from an ntfs partition?
going back to using multiple usb
Makes me wonder how far the closest alternative, glim, could be upgraded to match Ventoy given the confines of GRUB.
Someone had mentioned that Fedora fails to verify when booting from Ventoy. Now I’m thinking if I could dd the media loaded via Ventoy and compare with an original copy to see what changed.
All my laziness about not checking it out has come to fruition. Now I simply don’t have to, because this is sketch as fuck until it is handled.
Anyone who wants to fix this can help fix it, but people are just making demands of an unpaid maintainer. The devs can run this project the way they want to. If you don’t like it, don’t use Ventoy.
The people comparing this to the xz exploit are out of line. xz was a library that was deeply embedded in a lot of software. Ventoy is an IT tool used to boot live OSes. Not even remotely the same attack surface.
Blobs in the source tree are not ideal, but people need to pick their battles.
From what others have said: The blobs violate GPL because they are taken from other FOSS project but the changes Ventoy makes are not viewable.
If you don’t like it,
don’t usefork Ventoy.
I haven’t read to far into this but the issue is completely devoid of contributors and maintainers. I find the wording of the issue quite concerning:
Due to the recent XZ-Utils drama I checked the code and I’m appalled. There are more BLOBS than source code. https://github.com/ventoy/Ventoy/tree/3f65f0ef03e4aebcd14f233ca808a4f894657802/cryptsetup https://github.com/ventoy/Ventoy/tree/3f65f0ef03e4aebcd14f233ca808a4f894657802/Unix/ventoy_unix https://github.com/ventoy/Ventoy/tree/3f65f0ef03e4aebcd14f233ca808a4f894657802/DMSETUP
There is no reason to have those not be build in the release process. Of course it’s convenient, they are prebuild, it’s fast and nobody has a problem with it.
Recent events however showed that these BLOBs can contain everything and nothing. The build instructions would not produce the exact same executable for everyone. It’s better to have GitHub build it on-push and use them out of the build cache.
I would do it myself, but unfortunately I’m not familiar enough with the Ventoy build process to actually do it. I understand that removing BLOBs isn’t a priority over new and shiny features. But due to recent events, this should be rethought.
Thank you for reading this and I hope for a productive conversation
This is free software, they don’t owe you anything and this kind of language sounds angry and entitled. You can’t just Gordon Ramsay on someone else’s codebase.
I mean the author has simply ignored this issue. If you look into it there are a few that people simply do not know how to generate, so without the maintainer it’s impossible to make a PR solving this.
I cannot fathom what in this issue description gives rise to your concern. It’s worded very calmly, clearly explaining why the author thinks these BLOBs shouldn’t be there, expressing an understanding that it’s not a top priority and even closing with a thank you.
Is this not rude:
I checked the code and I’m appalled. There are more BLOBs than source code
And this:
I understand that removing BLOBs isn’t a priority over new and shiny features. But due to recent events, this should be rethought.
We didn’t like it when MS made an issue trying to direct ffmpeg
They should have opened with a complement or asked for directions if they didn’t know. In this message “Thank You” means fuck all
Is this not rude:
I checked the code and I’m appalled. There are more BLOBs than source code
No. The commenter is voicing their own feelings and explains why they have them. There is neither blaming nor rudeness here.
And this:
I understand that removing BLOBs isn’t a priority over new and shiny features. But due to recent events, this should be rethought.
It would have been nice if you had explained why you think this is rude. The author expresses understanding that the maintainers’ priorities don’t align with the author’s. This seems to be an uncontroversial statement to me.
Then the author explains (I agree, it’s more a hint than an explanation) why they think the priorities should be changed. In my view their argument is sound. Again, there is no blaming or rudeness here.
They should have opened with a complement
I assume you mean “compliment”.
I’ve often heard of the “sandwich technique” – start with a compliment, then voice criticism, end with another positive thing. I find this is an appropriate procedure when voicing open feedback, that is, good things and bad things. However, this is a Github issue. Its whole point is to point out a perceived problem, not to give the maintainers a pat on the back or thank them.
I don’t understand how “appalled” being strong language is so controversial, maybe everyone here is just a rude little shit.
I would have worded it like so:
Hi, I’m concerned about the BLOBs used in this repo as they are a security risk, making the code less auditable. It looks like we could generate these BLOBs in a github action or something so we can keep the fast build process while making it easier to audit the code. I’m not exactly sure how to go about this myself but I’ve done similar things in other projects, maybe you could point me in the right direction as I am unfamiliar with the ventoy build process? Thanks for the really cool project, and hopefully we can sort this out easily. Looking forward to your response.
I did it with less anger and entitlement and in less words
maybe everyone here is just a rude little shit.
Or maybe you’re just a snowflake that can’t handle criticism.
deleted by creator
deleted by creator
I didn’t say they’re wrong it’s the way they communicated which I found off-putting and Gordon Ramsay -esque
