Ventoy source code contains some unknown BLOBs, still no word on the issue from the dev after months
I had no idea this issue had been identified. While I find this tool very useful, the project is seeming rather questionable to me now.
https://github.com/ventoy/Ventoy/issues/2795Open linkView original on lemmy.one449
Comments117
I was bored at work one day. I decided to put a nyan cat easter egg in my company's app. If at the loading progress bar screen you typed NYAN it would turn the progress bar into a rainbow being created by a little nyan cat while playing the nyan cat song. The mp3 (inconspicuously renamed without the extension) doubled our build size. No one batted an eye cause no one paid attention to the build size much.
Fast forward 5 years later, at a different job, I get a phone call from the old boss. Do you happen to know anything about this nyan cat file we found?
I had no idea what he was talking about.
Years and years ago I worked on a project where the logo was the outline of a head and an inward swirl for the brain.
For the website, if you held your mouse over it for 9 seconds, it would spin and flush. No one ever found that one that I know of.
Should've included that in your FE analytics.
10/10
Aaaand thats why all commits should be signed with your pgp key
It sounds like they weren’t using any form of version control, so that’s definitely on them at this point
What makes you say that? To me, it sounds like that's what they do have cause they tracked the change back to him. The commit message obviously said nothing about the file.
Ah I could see that. I took it as them not knowing where the file came from at all, so they’re just asking all the devs who would have had access at that point, which is why it was “hey do you know anything about this file?” and not “is there a specific reason you committed this file to the build?”
You think they'd call up devs who left them just to ask if they happen to know about a random file?
I mean, that’s what op said happened. Literally with the verbiage of “file we found” and not “file you committed”
I did mean random devs, not the dev they tracked down that made the change.
That story was a journey.
After I saw that issue, I attempted to build Ventoy from source. After making numerous modifications and getting only the first couple components built, I got tired of it and quit. I've made some modifications to glim and use that instead, although it's still not as easy as Ventoy. But I don't trust Ventoy if I can't build it myself.
Further, when @[email protected] made some criticisms of Ventoy in one of her YouTube videos, she was subjected to a harassment campaign, and others told her the same happened to them. That pushed me from not trusting Ventoy to actively distrusting it.
What the fuck is happening to the world? Are we regressing or were we always this regressed and we've just given powerful tools to fucking chowderheads?
There's a subset of the Linux/FOSS/etc. community who are Conservative, misogynistic, racist, and/or otherwise general bigots. Compare the Ventoy-bros against the Elon-bros, and you'll see a similar pattern of behavior.
I don't personally understand it, since development is still sometimes seen as "work for weirdo nerds," so you'd think they would understand what it feels like to be rejected or bullied, but here we are. They manage to stay under the radar, because there's usually no reason to discuss politics or philosophy when you're debugging code.
right, the hackernews set...
Don't know why you're being downvoted, hackernews is an awful site of smug, dumb software "engineer" tech bros with some of the worst takes on anything that isn't explicitly about how to code
It’s the other way around I think. We are progressing. More voices are heard which “should” be a good thing. Right? Right…?
/s
I remember this thread! Before I saw this comment, I had already gone to look it up again:
Here's the initial post of Verionica's video on booting from ISO files: https://linuxmom.net/@vkc/112905487325961707
And here's the post on 'The Ventoy conspiracy": https://linuxmom.net/@vkc/112906968594601449
it's the opposite, actually: she got harassed because she didn't talk about it when talking about creating a bootable drive.
I too wish the developer would respond, but I don't think this is the catastrophe people are making it out to be. One comment seems to explain why these binaries are included:
If the hashes match the files from the Fedora or OpenSUSE releases, then does this really matter?
that’s what automation is for - nobody is going to manually check them, but anyone is able to automatically set something up to check their hashes in change… the fact that it’s possible that anyone is doing that now that it’s a known issue perhaps makes it less problematic as an attack vector
That is true, but also nobody is doing it. Just like nobody is verifying Signal's "reproducible builds".
are you sure?
there could be thousands just waiting for a failure to come out and say “HEY THIS IS DODGY”
Yea because I tested it myself. Nobody else seems to care, and if they did, I would think there would be a public way to see regular test results regardless.
I know this exists for some projects, but somehow nothing privacy-sensitive
Is that any different from no one checking the code every update?
That's ok if we are talking about malware publicly shown in the published source code.. but there's also the possibility of a private source-code patch with malware that it's secretly being applied when building the binaries for distribution. Having clean source code in the repo is not a guarantee that the source code is the same that was used to produce the binaries.
This is why it's important for builds to be reproducible, any third party should be able to build their own binary from clean source code and be able to obtain the exact same binary with the same hash. If the hashes match, then you have a proof of the binary being clean. You have this same problem with every single binary distribution, even the ones that don't include pre-compiled binaries in their repo.
The problem is not near enough projects support reproducible builds, and many that do aren't being regularly verified, at least publicly.
Yes, that's why im saying that this kind of problem isn't something particular about this project.
In fact I'm not sure if it's the case that the builds aren't reproducible/verifiable for these binaries in ventoy. And if they aren't, then I think it's in the upstream projects where it should be fixed.
Of course ventoy should try to provide traceability for the specific versions they are using, but in principle I don't think it should be a problem to rely on those binaries if they are verifiable.. just the same way as we rely on binaries for many dynamic libraries in a lot of distributions. After all, Ventoy is closer to being an OS/distribution than a particular program.
On the contrary: that just goes to show what a fucking catastrophe for software freedom "Secure[sic] Boot" is.
While this is true, it only requires the shim and grub to be copied for another distro.
From other comments there are a lot more blobs than just these two.
It sounds like most, if not all, come from upstream projects.
Would be nice if the dev can respond and confirm that...
I think they did say that in the older thread. But for proper security, you shouldn't have to trust them. You should have build tools that will re-fetch everything to create an identical build. That gives a clear chain of custody, which proves that morning has been tampered with.
It sounds to me as a documentation issue, as the next comment says, simply including a
wgetscript should solve this.Hey guys open source is great you can look at all the code and therefore there are no security backdoors etc. Also here are a bunch of pre-compiled blobs in the repo, don't worry about those, but they are required to run the program.
The fact that people know there are pre-compiled blobs in open source means they have an informed reason to avoid the software!
Right, the fact that it's open is the reason this came to light, and we're having this discussion
God I hate people who use github comments for their own benefit. "Just fork it bro" is never helpful.
For me the problem is more in GPL violation: they distribute blobs under GPL3, user made a request of the source code by creating an issue, but they ignored that request. It is not only about "you have to fix it" versus "just fork it" imo.
Licence doesn't apply to the creator.
He already owns the copyright, he doesn't need a licence, he doesn't need to adhere to the gpl
The binaries in question are various GNU and FOSS tools from elsewhere, not part of the Ventoy project itself. So no, the Ventoy author does not own the copyright of the tools in question.
Even then, he's still allowed to provide binary blobs. He doesn't have to provide it as source code. If that was the case, we'd all have to build from source and package managers like apt, dnf and flatpak wouldn't exist.
All he has to do is make the source code available, i.e. just link back to the original Github Repo.
Seriously this. Any comment about a complicated system that starts with "just" can be ignored 99% of the time.
Also, there are 4k forks of Ventoy already. Obviously forking it isn't helping. Actual work needs to be done.
I agree that comments like that are unhelpful/unnecessary, but how is that "for their own benefit"? Other than the actual devs themselves using that as a way to just ignore issues, I do not follow
It makes them feel good and devalues the quality of discussion. Benefits them, harms others.
Glad it's getting a little more light. Been trying to tell people this for a few years now lol. It's the reason I've stayed away from it since first learning of the tool and looking at the "source code".
Makes me wonder how far the closest alternative, glim, could be upgraded to match Ventoy given the confines of GRUB.
Someone had mentioned that Fedora fails to verify when booting from Ventoy. Now I'm thinking if I could dd the media loaded via Ventoy and compare with an original copy to see what changed.
As a wise one once said: "Talk is cheap, send patches"
Little did they know that Patches the Cat bit through their LAN lines and actually increased the cost of their communication.
Good ol' disk destroyer
I love double d
From what others have said: The blobs violate GPL because they are taken from other FOSS project but the changes Ventoy makes are not viewable.
Wtf is ventoy and why is nobody explaining it
Basically an OS which let's you choose another OS to boot into. This way you can chose between multiple OS's on one USB drive. You drag your ISO files into a USB folder and choose between them on boot.
That sounded like grub until you said ISO file
Yeah basically grub but on a USB stick and with ISO files
So like rEFInd but on the same drive?
Wtf is a BLOB and why is nobody explaining it
Binary Large OBject
Basically any binary file, often objected to in open source repos because of the lack of source and 'openness'. See also the recent xz backdoor.
Binary data. In the case of lz it was a carefully "corrupted" archive.
Because you can look it up.
because search engines exist
Wtf is search engines and why is no one explaining it
Google, probably
shh..it's a spyware and adware!
https://www.ventoy.net/en/index.html
Any alternatives to this tool? I've used it a lot lately because I was testing out live OSes before installing one to the hard drive, but otherwise I don't need it on a daily basis.
I'll be real, this is part of why I didn't understand Ventoy. I keep a bunch of large, fast thumbdrives around blank and available. When I need/want to put an OS on there, I do it when I need it, and then I'm always installing the most current version of the install. It takes under 5 minutes, at best.
I used to try to keep various installs on thumbdrives... but it would be two years down the line by the time I needed to use it again and by that time it's literally pointless to be using two year old installation media.
Part of the point behind Ventoy is that you don't need to prepare the USB to be bootable. You can just copy/paste the whole iso into Ventoy and it will be bootable. New release comes out? Just copy it onto your USB drive. Don't even need to remove the old version of you don't want to.
Makes things much easier in the tech world for having a single USB with 50+ bootable tools and installers on there like with MediCat (which uses Ventoy as a base).
Only thing I've had issues with booting from Ventoy is the ProxMox install iso. Everything else has worked first try.
Ventoy wasn't a foolproof solution but it really did beat the hell out of using 6 different USB drives. Most USB "pen drives" don't make labeling easy and without labeling I'm just plugging them in one by one till I find the one I want.
I remember various different concepts of USB flash drives with integrated LCDs that would display a label and the remaining capacity. Then they vanished and the only thing left were the Lexar Echo drives. Until a few years ago, when they have been pulled from the markets. Probably, because they didn't work with the now default GPT and its many different partition types.
IODD makes some. I had the older HDD version that stopped working after it got dropped, so now I use this one:
https://www.iodd.shop/IODD-SSD-drive-with-mini-USB-30-with-secure-256-bit-encryption
I use this thing all the time. It will serve up ISOs and VMDK images also. It’s quite fast
The IODD is basically a small drive enclosure, not a "stupid" USB drive.
I was more thinking of devices like this, this or this. Which have the simplicity of a normal USB device (just plug it in and go) and come with an automatically updating label so you can find the correct dongle.
But yeah, nowadays, I'd probably prefer the IODD thing.
As someone with few USBs available, Ventoy takes me 2 minutes to flash, several minutes to copy a set of ISOs, and then any time I need it, it takes 0 minutes to have a working USB with some arbitrary ISO. Sure, it's not up to date, but I don't need it to be if I need to recover an install or use some random tool.
https://github.com/thias/glim
I guess, you could buy a handful of USB sticks...
All my laziness about not checking it out has come to fruition. Now I simply don't have to, because this is sketch as fuck until it is handled.
I never trusted it because I thought it was completely proprietary. Well now I know it basically is.
Time for a fork, then?
Need to compare hashes between a stock ISO and one
flashedbooted by Ventoy (dd the latter to a file and check)Wat? Ventoy doesn't flash isos, it boots from them
Thanks edited
I like multiboot. Used it back when I used Windows.
The Ventoy advertisements on Reddit looked too suspicious, so I never checked it out.
What does BLOB stand for?
Only kind of. That’s a backronym.
https://en.wikipedia.org/wiki/Object_storage#History
They even made a movie about it!
I just wish it had a real alternative. GRUB on USB doesnt support as much distros or windows.
It's a useful tool, but there is a security concern for anything not fully open source. You will have to weigh your risk factors, I doubt that it's any problem for most consumers or distro hoppers.
Best to keep an eye in case any new contributers arrive suddenly...
Is BLOB an acronym?
Nope, but it has become a backronym https://wikipedia.org/wiki/Object_storage#Origins
Cool thanks :)
I've had too many issues with Ventoy that I'd rather just use fedora media writer or balenaetcher for when that doesn't work. I mean honestly it's a bit gimmicky, even if it's a cool concept. I believe Glim and some other options exist too
Ugh, balenaetcher messed with my USB pen drive so that I had to jump through hoops to make it usable again. Based on web searches, this was not uncommon at that time. I haven't had issues with ventoy so far. However, maybe I'll just go back to Rufus.
This is a bit absurd. I really don't think this is as serious as some comments say. Also there is a comment from AUR package manager which explains more details. . And even the blobs in the first post there are source and build instructions in their respective folder.
No it is not. It is supposedly the built result based on the instruction provided. If they can just provide that instruction, why not provide the source as well?
The issue thread also highlights the stubbornness and hostility of the project maintainer toward possible contributors.
OK but that's hardly reassuring.
Not suspicious at all.
I cannot fathom what in this issue description gives rise to your concern. It’s worded very calmly, clearly explaining why the author thinks these BLOBs shouldn’t be there, expressing an understanding that it’s not a top priority and even closing with a thank you.
No. The commenter is voicing their own feelings and explains why they have them. There is neither blaming nor rudeness here.
It would have been nice if you had explained why you think this is rude. The author expresses understanding that the maintainers’ priorities don’t align with the author’s. This seems to be an uncontroversial statement to me.
Then the author explains (I agree, it’s more a hint than an explanation) why they think the priorities should be changed. In my view their argument is sound. Again, there is no blaming or rudeness here.
I assume you mean “compliment”.
I’ve often heard of the “sandwich technique” – start with a compliment, then voice criticism, end with another positive thing. I find this is an appropriate procedure when voicing open feedback, that is, good things and bad things. However, this is a Github issue. Its whole point is to point out a perceived problem, not to give the maintainers a pat on the back or thank them.
Or maybe you’re just a snowflake that can’t handle criticism.
I mean the author has simply ignored this issue. If you look into it there are a few that people simply do not know how to generate, so without the maintainer it's impossible to make a PR solving this.
Actually you can and should Gordon Ramsey all over it. It is the duty of audience members to express how they feel honestly about the artwork.
Open Source can and do understand that and open source software becomes better for it.
Yes, that's users for you. A diverse bunch and many lacking in basic politeness. But you just have to listen to whiney users. You just have to... and figure it out if you want to make world class software.
Is there an alternative to Ventoy for booting Windows vhd images from an ntfs partition?
Ventoy was never the go to option. There are many alternative FOSS that have been running for ages.
I don't understand the sudden recent (over the last few years) interest for it. It sounds like bot marketing pushing a product.
Google "multiboot usb" and you will be smashed with ventoy. This is googles bad algorithm and seo farming. No mention of YUMI or any of the hundred other options available.
Try searching for "multiboot usb -ventoy" ...
Doesn't YUMI use Ventoy code? I hope I am wrong because I would prefer to use that instead.
yep
bruh.
going back to using multiple usb
Hm, so now people suddenly notice and care about this? lol
First I’m hearing of it and I’m starting to question my security given I installed my OS using it.