SatyrSackVentoy source code contains some unknown BLOBs, still no word on the issue from the dev after months
GolfNovemberUniformI never trusted it because I thought it was completely proprietary. Well now I know it basically is.
Quail4789Yep, some people these are saying just 7 of the 150 binaries don’t have source or build info. Yeah, one binary is enough to do all the evil in the world, not that other binaries support reproducible builds anyway.
Snot FlickermanAll my laziness about not checking it out has come to fruition. Now I simply don’t have to, because this is sketch as fuck until it is handled.
Any alternatives to this tool? I’ve used it a lot lately because I was testing out live OSes before installing one to the hard drive, but otherwise I don’t need it on a daily basis.
but otherwise I don’t need it on a daily basis.
I’ll be real, this is part of why I didn’t understand Ventoy. I keep a bunch of large, fast thumbdrives around blank and available. When I need/want to put an OS on there, I do it when I need it, and then I’m always installing the most current version of the install. It takes under 5 minutes, at best.
I used to try to keep various installs on thumbdrives… but it would be two years down the line by the time I needed to use it again and by that time it’s literally pointless to be using two year old installation media.
Ventoy wasn’t a foolproof solution but it really did beat the hell out of using 6 different USB drives. Most USB “pen drives” don’t make labeling easy and without labeling I’m just plugging them in one by one till I find the one I want.
I remember various different concepts of USB flash drives with integrated LCDs that would display a label and the remaining capacity. Then they vanished and the only thing left were the Lexar Echo drives. Until a few years ago, when they have been pulled from the markets. Probably, because they didn’t work with the now default GPT and its many different partition types.
IODD makes some. I had the older HDD version that stopped working after it got dropped, so now I use this one:
I use this thing all the time. It will serve up ISOs and VMDK images also. It’s quite fast
The IODD is basically a small drive enclosure, not a “stupid” USB drive.
I was more thinking on devices like this, this or this. Which have the simplicity of a normal USB device (just plug it in and go) and come with an automatically updating label so you can find the correct dongle.
But yeah, nowadays, I’d probably prefer the IODD thing.
jevans ⁂When I was working in IT, this would have been a very useful tool for doing some on-site troubleshooting with various tools or for one-off reimaging machines that were missed during a big update or something. Instead, I had a bag of USB sticks with labels on them, which was annoying to use and to maintain.
Part of the point behind Ventoy is that you don’t need to prepare the USB to be bootable. You can just copy/paste the whole iso into Ventoy and it will be bootable. New release comes out? Just copy it onto your USB drive. Don’t even need to remove the old version of you don’t want to.
Makes things much easier in the tech world for having a single USB with 50+ bootable tools and installers on there like with MediCat (which uses Ventoy as a base).
Only thing I’ve had issues with booting from Ventoy is the ProxMox install iso. Everything else has worked first try.
As someone with few USBs available, Ventoy takes me 2 minutes to flash, several minutes to copy a set of ISOs, and then any time I need it, it takes 0 minutes to have a working USB with some arbitrary ISO. Sure, it’s not up to date, but I don’t need it to be if I need to recover an install or use some random tool.
I guess, you could buy a handful of USB sticks…
God I hate people who use github comments for their own benefit. “Just fork it bro” is never helpful.
SemFor me the problem is more in GPL violation: they distribute blobs under GPL3, user made a request of the source code by creating an issue, but they ignored that request. It is not only about “you have to fix it” versus “just fork it” imo.
Licence doesn’t apply to the creator.
He already owns the copyright, he doesn’t need a licence, he doesn’t need to adhere to the gpl
The binaries in question are various GNU and FOSS tools from elsewhere, not part of the Ventoy project itself. So no, the Ventoy author does not own the copyright of the tools in question.
Even then, he’s still allowed to provide binary blobs. He doesn’t have to provide it as source code. If that was the case, we’d all have to build from source and package managers like apt, dnf and flatpak wouldn’t exist.
All he has to do is make the source code available, i.e. just link back to the original Github Repo if he changed nothing.
Seriously this. Any comment ablut a complicated system that starts with “just” can be ignored 99% of the time.
Also, there are 4k forks of Ventoy already. Obviously forking it isn’t helping. Actual work needs to be done.
I agree that comments like that are unhelpful/unnecessary, but how is that “for their own benefit”? Other than the actual devs themselves using that as a way to just ignore issues, I do not follow
It makes them feel good and devalues the quality of discussion. Benefits them, harms others.
Hey guys open source is great you can look at all the code and therefore there are no security backdoors etc. Also here are a bunch of pre-compiled blobs in the repo, don’t worry about those, but they are required to run the program.
[deleted] in lemmyThe fact that people know there are pre-compiled blobs in open source means they have an informed reason to avoid the software!
delirious_owlRight, the fact that it’s open is the reason this came to light, and we’re having this discussion
ulkeshExactly. Acting like this is an “ah-ha, see?!!” moment when this is exactly what open source is designed for. That’s like saying global warming is a hoax because “oh look it’s snowing”.
This isn’t a knock against opensource programming, but there shouldn’t ever be precompiled blobs in the repo unless they are the official builds for the various OS’s and if you want to build from source, the pre-compiled blobs shouldn’t be part of that, otherwise you can’t really claim you are opensource.
Yes, and that’s what is being called out here. But your original comment makes it sound like you are advocating for closed source software and that somehow open source software is bad.
This is the system working as intended. When potential issues arise, it’s openly discussed and ideally resolved. And if not, trust is lost and people will stop using it.
I don’t know about the history of the project, but it sounds like those blobs have been there for quite some time. When in reality, the PR that added the blobs in the first place shouldn’t ever have been approved.
Well, it is an “ah-ha, see!” moment, because it shows the benefit of open source.
Its more like pointing at the absence of a glacier on a mountaintop and saying “yep, see, climate change does exist”
I was referring to the commenter and how it read to me :) But agreed, what you said, too.
I too wish the developer would respond, but I don’t think this is the catastrophe people are making it out to be. One comment seems to explain why these binaries are included:
Because ventoy supports shim, and by extension secure boot, these files needs to come from a signed Linux distro. In this case they are taken from Fedora releases, and OpenSUSE apparently, as they publish shim binaries and grub binaries signed by their certificate.
On the contrary: that just goes to show what a fucking catastrophe for software freedom “Secure[sic] Boot” is.
It sounds to me as a documentation issue, as the next comment says, simply including a
wget script should solve this.
If the hashes match the files from the Fedora or OpenSUSE releases, then does this really matter?
It matters because nobody is going to check the hashes for all of the files match whenever there’s a change so the maintainer can just replace them with whatever he wants.
Taasz/WoofIs that any different from no one checking the code every update?
The amount of malware you can cram in a source-code patch without drawing attention vs. in a binary is vastly different.
FerkI think the point wasn’t so much about there being malware publicly shown in the published code… but that there’s a source-code patch secretly being applied before uploading the binaries, even if all the code published was open and clean. This is why it’s important for builds to be reproducible, you should be able to build your own binary and obtain the exact same hash.
The problem is not near enough projects support reproducible builds, and many that do aren’t being regularly verified, at least publicly.
Yes, but I’m not sure if that’s the problem in this case. And if it is, then that’d be an issue with the upstream project rather than ventoy.
that’s what automation is for - nobody is going to manually check them, but anyone is able to automatically set something up to check their hashes in change… the fact that it’s possible that anyone is doing that now that it’s a known issue perhaps makes it less problematic as an attack vector
That is true, but also nobody is doing it. Just like nobody is verifying Signal’s “reproducible builds”.
are you sure?
there could be thousands just waiting for a failure to come out and say “HEY THIS IS DODGY”
Yea because I tested it myself. Nobody else seems to care, and if they did, I would think there would be a public way to see regular test results regardless.
While this is true, it only requires the shim and grub to be copied for another distro.
From other comments there are a lot more blobs than just these two.
It sounds like most, if not all, come from upstream projects.
Would be nice if the dev can respond and confirm that…
I think they did say that in the older thread. But for proper security, you shouldn’t have to trust them. You should have build tools that will re-fetch everything to create an identical build. That gives a clear chain of custody, which proves that morning has been tampered with.
that’s only a few files out of the 153
153 binaries? where?
Pasta Dental
TCB13Hm, so now people suddenly notice and care about this? lol
First I’m hearing of it and I’m starting to question my security given I installed my OS using it.
It’s a useful tool, but there is a security concern for anything not fully open source. You will have to weigh your risk factors, I doubt that it’s any problem for most consumers or distro hoppers.
Best to keep an eye in case any new contributers arrive suddenly…
After I saw that issue, I attempted to build Ventoy from source. After making numerous modifications and getting only the first couple components built, I got tired of it and quit. I’ve made some modifications to glim and use that instead, although it’s still not as easy as Ventoy. But I don’t trust Ventoy if I can’t build it myself.
Further, when @[email protected] made some criticisms of Ventoy in one of her YouTube videos, she was subjected to a harassment campaign, and others told her the same happened to them. That pushed me from not trusting Ventoy to actively distrusting it.
Further, when @[email protected] made some criticisms of Ventoy in one of her YouTube videos, she was subjected to a harassment campaign, and others told her the same happened to them.
What the fuck is happening to the world? Are we regressing or were we always this regressed and we’ve just given powerful tools to fucking chowderheads?
There’s a subset of the Linux/FOSS/etc. community who are Conservative, misogynistic, racist, and/or otherwise general bigots. Compare the Ventoy-bros against the Elon-bros, and you’ll see a similar pattern of behavior.
I don’t personally understand it, since development is still sometimes seen as “work for weirdo nerds,” so you’d think they would understand what it feels like to be rejected or bullied, but here we are. They manage to stay under the radar, because there’s usually no reason to discuss politics or philosophy when you’re debugging code.