r/archlinux • u/AggravatingJudge7092 • 2d ago
DISCUSSION Ventoy might be malware
Source: https://wiki.archlinux.org/title/Ventoy
Ventoy might contain backdoors or other malicious code:
- The author(s?) long refused to react on questions about the source code for the precompiled code inside their git repository.
- They long refused to react on questions about the security risks.
- When an answer was finally given, it boiled down to a simple "There is no reason to assume that we would have placed malware inside."
- Again after a really long time the authors finally mentioned what other source code they used to generate some−but not all−of the pre-compiled code. They did not mention the build methods and refused to prove that this really was the used source code.
- The real identities of the authors is unknown.
EDIT: The paragraph written on this archwiki page is by large consensus biased and mentions an old controversy, the wikipedia article on Ventoy has a more neutral explanation of the problem
https://en.wikipedia.org/wiki/Ventoy
308
u/jort93 2d ago edited 2d ago
Theres just some binary blobs in there
Afaik nobody actually found any proof for there being any malware.
I wouldn't say it boiled down to a simple "There is no reason to assume that we would have placed malware inside."
The answer is quite extensive https://github.com/ventoy/Ventoy/issues/3224
I'd say it comes down to "compiling all of it from source is too much effort"
86
u/47th-Element 2d ago
First time I feel like arch wiki was a bit misleading. Cause yeah after reading this, it is not a simple "no reason to assume there is malware" answer.
131
93
u/jort93 2d ago edited 2d ago
The guy that added the warning to the archwiki is also the same guy that said in the issue i posted
the developer tells people he is "Hailong Sun" which is a very common name in China (and good to use as fake identity)
China is known as large source of malware
So hardly unbiased.
Well, or rather i would assume so, as one is named ngaro and the other one is named garo.
https://wiki.archlinux.org/index.php?title=Ventoy&diff=871000&oldid=812540
https://github.com/ventoy/Ventoy/issues/3224#issuecomment-505876746124
u/Padgriffin 1d ago
the developer tells people he is "Hailong Sun" which is a very common name in China (and good to use as fake identity)
Have we considered that it might actually be his name
20
u/jort93 1d ago
Apparently not lol.
The developed doesn't address these accusations, which honestly is fair, I wouldn't wanna prove it's my real name to some random dude either.
15
u/Padgriffin 1d ago
China also has a billion people, so even relatively uncommon names will still end up with thousands of hits, which is made worse by romanization removing tones and making names that were different in Chinese into the same ones in English
13
2d ago
[deleted]
13
u/jort93 2d ago
He linked the wikipedia page in one of his comments as well, wouldn't be surprised if he edited it too. Although he might use a different name/edit without logging in.
11
2d ago
[deleted]
12
u/jort93 2d ago
I am not saying I have an proof of this, but I am saying it would be "on brand" since he already edited the archwiki.
4
u/czerilla 1d ago
To quote another ..interested party on this:
Whether
Ventoy contains malwarethese Wikipedia edits are made by the same person or not is a different question that I can not answer with certainty. But there are certainly some important factors to consider2
u/EuphoricNeckbeard 1d ago
The Wikipedia page doesn't follow any standards for sourcing or NPOV. It links a Reddit comment as a source for god's sake lol
47
u/Helmic 2d ago
oh, so this guy's just being fucking racist then.
after the xz thing i absolutely want ventoy to move towards fully compiling everything from source, but like yeah it's mostly one guy and nobody's really helping.
34
u/jort93 2d ago
I mean, id do the same thing if I made this by myself, download the binaries for the external tools I use and compile my own stuff.
If people care so much to compile everything from source, they can do it themselves. In the issue I linked, the maintainer described where to obtain the source code for every binary in the repo. If someone wants to fork it and compile it from scratch nobody is stopping them.
25
u/nethingelse 2d ago
Yeah, it sounds like he's open to PRs on this too, so it wouldn't even need to be a hard fork. Just not something he's interested in prioritizing as a solo maintainer, as it's not important to him, which I get.
3
u/headedbranch225 1d ago
Yeah, I remember last time this came up and everyone got pissed about it and read through it and it is completely reasonable
11
u/Dependent_House7077 2d ago
looking at that list, it would be an absolute headache to build all this.
at least someone is attempting to tackle that.
10
u/mindstormer12 1d ago
Basically, someone decides to hold a dev to a ridiculously high standard for some reason yet there are plenty of examples where they are already using hardware/software that also involve binary blobs, lack of communication or transparency, etc. and more importantly developed by people who have far more influence and responsibility to the users than this one dev for a small project.
-11
u/lordkoba 2d ago
I'd say it comes down to "compiling all of it from source is too much effort"
it’s “too much effort” once. they just have technical debt in their build system.
the reason on why they won’t fix it doesn’t matter, may be because it’s a chore, maybe there’s malware, the point is that it’s still a massive red flag
the software cannot be recommended in good conscience
20
u/jort93 2d ago edited 2d ago
It's one dude making this software, he probably simply not have the time to change it. If you don't like it you can use something else. Or so it yourself and merge/fork it.
I feel like most people use a bunch of binary blobs. Like flatpaks, codecs, drivers, all sorts of stuff.
And the claims they his name is somehow a fake name are quite crazy.
Why make up some stuff about malware and fake identities, why not just put "it contains binary blobs of other projects" into the section and be done with it? Maybe link the GitHub issue regarding it.
Also, known issues section is normally at the end, not at the beginning.
3
u/iTrooz_ 1d ago
If you don't like it you can use something else
This is exactly what he said
6
u/jort93 1d ago edited 1d ago
Why claim that it may contain malware, tho? Just say it contains blobs and let people come to their conclusions whether or not they want to use it. Chances are, 99% of people use some blobs on their system, be it flatpaks, drivers, codecs or whatever else. All of them could contain malware.
Most people will downloads the entire thing as a blob rather than compile it as well.
And, btw. one of the altenatives listed on the arch wiki contains binary blobs too.
1
u/iTrooz_ 1d ago
I don't see where they said it is 100% malware, I see a comment where they said it could be malware, which, fair, I share that opinion.
Also, I think there's a difference between a blob in an isolated userspace app (flatpak) and a "kernelspace" one (and yes, Linux has blobs, but they come from more reputable sources so less problematic)
7
u/jort93 1d ago
This section should be at the bottom for one, like they are on other archwiki page.
And then there are claims like his identity being unknown, like, what is he supposed to do, post his passport?
There is a lot of software that has blobs in it but I've never seen a section like this.
Plus, the person that edited the archwiki is also involved in the discussion on the GitHub, which makes the neutrality questionable.
2
1
u/lordkoba 1d ago
It's one dude making this software, he probably simply not have the time to change it
I mean it's fine, I'm not pissed at the guy and no one is forcing him to do anything. I know that being an OSS maintainer is a thankless unpaid job.
That said, my point still stands, you cannot recommend the software over transparent open source alternatives, "probably" doesn't cut it.
61
u/EmberQuill 2d ago
Old news. There was a big kerfuffle about this back in March. The general consensus after things settled down was that it's probably fine, but no guarantees because the firmware blobs are hard to reproduce/verify.
-14
u/donp1ano 1d ago
"probably fine"
yes, probably. im not taking any risks for software that **installs** my OS, since that would be perfect for setting up malware at a very low level. ventoy is convenient, but id rather flash a USB stick
21
u/Ybalrid 1d ago
if your goal is to install one operating system, you probaly should just flash a USB stick and that's about it.
Ventoy is useful if you want to collect and use a large number of bootable live environment.
-5
u/ccAbstraction 1d ago edited 1d ago
Which mean all my machines could be compromised no matter what OS I'm installing! Yay!
Edit: Ventoy is also useful if you want to keep using your flash drive as a flash drive, while being able to boot from live USBs.
-1
u/headedbranch225 1d ago
If you really care so much about it just build it from source then
6
u/EmberQuill 1d ago
That's the neat part: you can't. Being unable to reproduce the builds is in fact the core of the entire controversy.
2
u/ccAbstraction 1d ago
I'm not saying Ventoy is malware, but that if Ventoy were to be compromised, the risk would be rootkit levels of enormous, and because of people tend to use ventoy across multiple machines with multiple OSes, pervasive. If Ventoy had a rootkit nearly every computer in my house would be compromised. It doesn't help anyone to downplay the potential severity of supply chain attack on stuff like Ventoy, Rufus, grub, systemd-boot etc.
2
3
u/EmberQuill 1d ago
"Probably" wasn't enough for me either and I stopped using it. I mostly just meant to point out that you're like four months late to the drama.
3
u/iTrooz_ 1d ago
Yeah, I think people don't realize how dangerous this could be ? It could secretly be altering all OS installations it does
7
u/AppointmentNearby161 1d ago
It could, but you could also compare the checksum of the ventoy installed base system with a base system installed from a known clean iso.
1
u/iTrooz_ 1d ago
How would you go about it ? Checksum every file in the installed filesystem ?
2
u/AppointmentNearby161 1d ago
Or tarball the whole install/top level directories and checksum the tarballs.
0
u/donp1ano 1d ago
ok, then why dont we see people that did that to confirm ventoy is safe?
im not saying its not. im just saying im not gonna take that risk just for convenience
13
u/ProdigySim 1d ago
Because doing that wouldn't prove that it's not malicious; it would prove that one single installation is not infected.
This kind of allegation would have a really high cost to concretely disprove.
4
u/AppointmentNearby161 1d ago
Exactly. It is pretty easy to prove it does not corrupt ALL installs, but without source code we cannot prove it does not corrupt ANY installs. Ventoy becomes more useful as the number of ISOs you use increases, which makes verifying them more costly.
186
u/Scxox 2d ago
bruh stop spreading FUD, the author has acknowledged this numerous times and has accepted suggestions to fix these. the currently proposed solution is labor intensive.
its an open source project, if you want things to move faster then you should contribute, not bitch and whine about the dev who does this for free
48
u/we_come_at_night 1d ago
bitching and whining is less labor intensive and doesn't require a functioning brain, actively contributing to a FOSS project on the other hand is pretty hands-on, and you have to know some stuff, can't just wish the code to existence.
-17
u/Arkaid11 2d ago
If the source is hidden then it's NOT an open source project, and you can't contribute easily
50
19
u/TDplay 1d ago
The Ventoy author has provided a complete list of the blobs, as well as build instructions for each.
It's certainly not convenient to build from source, but the open-source definition never mentions convenience. It is possible to build Ventoy from source, and hence it satisfies the requirement to provide source code.
It also seems like the maintainer of the understandably angry-comment-filled PKGBUILD for Ventoy is trying to replace all the blobs by building from source.
0
u/Arkaid11 1d ago
Lol at "just read the PKGBUILD" people. Look at my PKGBUILD dawg I could be downloading STUXNET in plain text and I wouldn't notice
132
u/dadnothere 2d ago
"Ventoy might be malware because it has pre-compiled files 🥺"
said the person with 900 fatpaks installed from who-knows-where.
27
3
3
u/Any_Fox5126 1d ago
Wow! That's a lot of fallacies packed into just a few words. And it has that many upvotes? This community is truly pitiful.
-1
u/Orlha 1d ago
Well that’s a huge assumption. Plenty of people avoid flatpaks, I personally have none.
1
u/Reypatey 1d ago
Noob here.
I could only find orca slicer in flatpak, it's the only one I have installed. Is that a bad thing? What else could I do?
7
u/Maximum-Bobcat5612 1d ago
If you're new then keep in mind that people like stirring shit in the linux community. It's famous for witch hunting people on whims.
Look at how much discussion there is in the repo: https://github.com/ventoy/Ventoy/issues/3224
Also consider how the OP posted this accusation 13 hours ago and has not responded to anyone.
1
u/nathan22211 1d ago
orca slicer has the file in realeses but I usually just grab it from the AUR since I can handly get the flatpak file to work
1
1
0
u/Commercial-Worth7301 1d ago
Flatpak até vai, mas aí vai ver, e o cidadão que não confia no ventoy é o mesmo que gabaritou a lista de pacotes infectados do AUR, e que não satisfeito ainda baixou o vírus do "hyprland-fixed" no AUR
8
40
u/mindstormer12 2d ago
Do you question all the binary blobs for your hardware to work too?
10
-8
u/ZorbaTHut 1d ago
Yes? Do you not?
18
u/Ybalrid 1d ago
Do you question the code in the security processor embedded in your Intel or AMD chip?
Do you question the microcode inside your modern CPU?
Do you question the non upgradable non operating system loaded firmware in all the devices within your computer (controllers for your drives, for your network hardware)?
Do you question the electronic control unit that makes the engine of your car actually able to work (that is probably something modern with electronic injection and a catalytic converter and all those funny sensors and computers in it)?
Do you question the source code in the microcontroller that drive the logic that makes your microwave oven work?
Do you question the baseband and SIM card inside your phone? Those are external computers to whatever runs your OS there, and they touch pretty much everything you do on the cell network.
Do you question the very fabric of reality itself?
-3
u/ZorbaTHut 1d ago
Do you question the code in the security processor embedded in your Intel or AMD chip?
Yes.
Do you question the microcode inside your modern CPU?
Yes.
Do you question the non upgradable non operating system loaded firmware in all the devices within your computer (controllers for your drives, for your network hardware)?
Yes.
Do you question the electronic control unit that makes the engine of your car (that is probably something modern with electronic injection and a catalytic converter and all those funny sensors and computers in it)?
Yes.
Do you question the source code in the microcontroller that drive the logic that makes your microwave oven work?
Yes.
Do you question the baseband and SIM card inside your phone? Those are external computers to whatever runs your OS there, and they touch pretty much everything you do on the cell network.
Yes.
Do you question the very fabric of reality itself?
Yes.
Though we haven't found any security holes in that one yet. But the way things are going it's only a matter of time.
I actually give it a 50/50 that your reply was an intentional setup for this, in which case, well done.
But if not . . . you should maybe be a little more aware of how many software exploits are out there waiting to be found.
9
u/Ybalrid 1d ago
I'm broadly in the biz of "making software", and very well placed to know that there's problem on each layers of the stack of turtles that we call "reality" 🤭
-9
u/ZorbaTHut 1d ago
Yeah, pretty much :V
And it is fair to note that while I question all this stuff, I also grudgingly tolerate it because I don't really have a practical choice.
But gosh I'd really like a choice.
And if I can avoid some China-originated opaque binary blobs by using a slightly different bootloader on my USB sticks . . . yeah, okay, guess I'm gonna do that then.
7
u/Ybalrid 1d ago
what has china anything to do with anything here?
-6
u/ZorbaTHut 1d ago
The Ventoy developer is (probably) in China and I don't trust the Chinese government; in terms of "interest in compromising computers", "ability to force their citizens to help", and "ability to hide the fact that this is all going on", they're very high on every axis, to an extent that IMO no other country is.
I don't mind Chinese people. I just don't trust the Chinese government.
-9
u/Any_Fox5126 1d ago
OP didn't say he distrusts all blobs, but he did explain why he doesn't trust the authors of ventoy. Pay attention.
5
u/mindstormer12 1d ago edited 1d ago
And the implication is that they do not hold the same high standard to the developers of these other blobs for hardware who have greater influence and responsibility to their users than some optional software project. Practically everyone is running on what might be malware then. Use your brain.
Also, OP's concerns are already addressed in a variety of discussions including open pinned issue. If that's not satisfactory, don't use the software, lmao. They are not obligated to provide personal identification or prove anything. Most people don't assume their routers, PCs, phones, etc. running off proprietary firmware to be at risk of malware nor do they cry about it on the forums even if it's technically possible. If you're wearing the tin foil hat, you would be looking at hardware that supports open-source only and not spread FUD based on double standards.
-4
u/Any_Fox5126 1d ago
No. It makes no sense to compare the trustworthiness of well‑known devs or big‑company teams with complete strangers. The fact that it is optional software actually means there is even less scrutiny.
4
u/mindstormer12 1d ago
No shit, you're using a free product.
0
u/Any_Fox5126 1d ago edited 1d ago
That's irrelevant. There's plenty of trustworthy open-source software, and it's usually not because of the reputation of its authors, but because of its transparency. The point here is that ventoy lacks both.
4
u/mindstormer12 1d ago edited 1d ago
No where did I claim Ventoy is trustworthy. I merely claimed that if you're worried about this, you should actually worry about the proprietary blob running on the hardware you paid for and prioritize less on accusing a particular project that is free, itself 100% open-source. I pointed out double standards as the issue.
Also, have you actually looked into the discussions about this issue on their repo page or are you merely looking to pick at battle based on misleading premises set by the OP? They even pinned the primary one and it's met with overwhelming positivity by the public. The author is open to accepting contributions. Their 100% free and open-source project depends on proprietary blobs because of lack of manpower, and they welcome any that addresses this issue. What exactly do you expect more from them?
Sigh, pay attention.
-1
u/Any_Fox5126 1d ago
You never said it was trustworthy, but that’s hardly the point after several comments defending ventoy and aggressively attacking the OP for raising a reasonable concern. If you acknowledge that even the devs themselves recognize the importance of the issue, then it becomes pretty clear how absurd it is to focus your replies on attacking the person pointing it out and mocking the concern itself.
The irony is that you accuse the OP of a double standard, yet depending on what suits your argument it’s either "it’s a free product" or "hardware blobs are more deserving of scrutiny". If these are different categories, then demanding that they be treated as equivalent makes no sense in the first place. And either way, you’re just repeating a basic whataboutism.
It’s especially incoherent to call it 100% open source while admitting it depends on proprietary blobs. With your argument, logic is clearly working overtime.
2
u/mindstormer12 1d ago
You're way too emotional and fixated on attempting to argue against my points when they are not relevant to OP's issue at all. I already proved OP's claims are misleading by pointing out the dev has addressed the concerns adequately in a pinned github post on their repo as well made it clear how double standards are the issue.
You're not longer worth my time anymore, sorry. Should have been obvious from your condescending initial reply to my top comment without any of your own supporting thoughts. You can do better.
1
u/Any_Fox5126 1d ago
You're way too emotional
How ironic that you’re making a personal judgment about my emotional state right after several paragraphs of logical analysis addressing your inconsistencies point by point.
and fixated on attempting to argue against my points when they are not relevant to OP's issue at all. (...) as well made it clear how double standards are the issue.
The issue isn't your criticism of the OP's standards. You introduced that argument yourself, derailing the issue. The existence of contradictory standards does not even invalidate the underlying concern.
. I already proved OP's claims are misleading by pointing out the dev has addressed the concerns adequately in a pinned github post on their repo
That doesn't prove it.
You're not longer worth my time anymore
Likewise, I'll leave it here. Your theatrical exit was a nice touch, though.
Should have been obvious from your condescending
True, but you're being hypocritical, again. I'll leave you to reflect on your consistency.
49
u/47th-Element 2d ago
That's a shame, I like ventoy. But here's the question that presents itself, is there an actively maintained fork/clone/alternative to ventoy that is more open source than ventoy?
20
u/Excellent-Copy-2688 2d ago
https://wiki.archlinux.org/title/Multiboot_USB_drive#Automated_tools
there are some apparently, not sure if there replicate complete functionality of ventoy, but you can check for yourself4
u/Charming_Professor53 1d ago
I'm a big fan of MultiOS-USB. It supports Secure Boot and booting Windows images. The multiboot approach is also a lot more puristical using a very lightly modified version of Grub (Ventoy esentially "hijacks early boot" from what I heard/understood). The only downside is that Ubuntu(-based distro) images can't boot from exFAT since Ubuntu live images don't include exFAT drivers for some stupid reason, but Ubuntu images are too large (>4 GiB) for FAT.
6
u/Outrageous-Machine-5 2d ago
isn't ventoy using grub under the hood
3
u/imactuallynotalright 1d ago
ventoy is a convoluted hack that shouldn't work, but nothing works as well as ventoy if you need windows support. The alternatives are Linux only.
39
u/mindstormer12 2d ago
Yes, there's always risk to using software that uses pre-compiled code. How is this Arch Linux-specific?
25
u/SmallRocks 2d ago
“How is this Arch specific?”
From Rule 1:
“Only Arch Linux itself; no Arch-based distros. Posts about other software used on Arch are welcome”
-3
4
u/-i0f- 1d ago
I find this one really weird. I'm somewhat sure, it really is not malware, after this discussion surfaced some time ago. But I would never use software that I was "somewhat sure" about. Why would anyone use a software that contains the base of an operating system under this premise?
Everybody can do as they please, but this strikes me as one of the worst things you could do.
1
u/Historical_Move6359 18h ago
Do you use Android or Iphone ?
4
u/Ybalrid 1d ago edited 1d ago
I haven't used Ventoy in years, and so I do not really care about this, but from what I can see, this "Ventoy might contain backdoors or other malicious code:" section on the wiki seems an over reach and oversealous.
Though, one thing to me is sure: it would be better if it was straightforward to compile Venoty 100% from source code rather than relying on precompiled blobs for the bits and bobs of busybox and whatnot that are in there
But I see absolutely no reason to see any malice in the way Ventoy is built and distributed. But to each there own.
TL;DR: it's probably just FUD. though it would be better if it was 100% built from source anyways.
3
u/RandomXUsr 1d ago
We have to use caution with any software we install. Especially those in the AUR.
Nothing wrong with being skeptical and running it through some reverse engineering tools.
I'm suspicious of that one person is putting in all that work for vendor. Its a herculean effort to get ventoy built.
Additionally; we should not make assumptions about what may be in the software.
Extraordinary claims require Extraordinary evidence. If someone is going to make the claim; be prepared to show your work.
9
u/Charming_Professor53 2d ago
Ventoy has not been proven malicious, but it is pretty prone to a supply chain attack. For that reason, I like the more puristical polyrepo approach of MultiOS-USB: https://github.com/Mexit/MultiOS-USB
2
3
u/tjj1055 1d ago
ventoy has never been proven malicious, there is literally zero evidence of it being malware.
10
u/Charming_Professor53 1d ago edited 1d ago
That's what I meant to say. The problem however is that malware could very easily be overlooked/hidden the way that the project is managed. The entire build process is based on a EoL distribution - CentOS 7, released 2014, EoL 2024 - that gets no security updates. Also see the rant by the AUR maintainer: https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=ventoy
Next to the build process and blobs, the monorepo makes it particularly difficult to track the exact patches made to all the different components Ventoy is made of. GRUB+Shim itself is already a humongous project, but it being included in full source code will make it only difficult to update it regularly to include security updates for example. I find the patches used by MultiOS-USB's GRUB repo easier to understand what is being done/modified and what is being achieved.
3
u/rassawyer 1d ago
This has been documented for like what, 5 years? Why is it coming back up now?
2
u/Any_Fox5126 1d ago
I guess someone has noticed this now. More importantly, why hasn't it been resolved yet? This is a serious issue in terms of security and transparency.
1
u/TheGamerForeverGFE 17h ago
It's been resolved, just run the checksums
1
u/Any_Fox5126 17h ago
Is that really a solution? Is it now 100% transparent and reproducible?
1
u/TheGamerForeverGFE 17h ago
It always was, it's still using binaries from other projects but you can run checksum checks since now the hashes are provided.
1
3
u/Fast_Librarian 1d ago
What was anyone’s first thought when this could slip stream anything into the iso
1
7
2
u/XOmniverse 1d ago
I just use Fedora Media Writer. Works fine for basically everything, not just Fedora.
2
u/TheGamerForeverGFE 17h ago
Here we go again, people already did this shit a while ago.
No, it's not, the checksums are available and you can do the work yourself to make sure the blobs are safe.
And, just because they're Chinese doesn't mean we should be racist.
3
u/ByteCorum 1d ago
There were plenty of conserns around Ventoy for a long time, sadly almost none had gone. I'm not using tools, which source code can not be fully audited, cuz what the point of being open source if there are some shaidy parts with no particular description or reason. This is not trustworthy software, it looks more like "oh hey I'm open source you can trust me, but actually not".
I've used https://github.com/Mexit/MultiOS-USB for a long time and so far perfect user experience!
1
u/Charming_Professor53 1d ago
Yup, me too. The only downside is Ubuntu(-derivative) live images not being able to boot from exFAT partitions due to no exFAT drivers being enabled in the live image, so you have to add a NTFS partition and boot it from there. That's only a Ubuntu issue AFAIK. No issues with any other distro's, and it even has support for Secure Boot and Windows images :D.
3
4
3
u/Practical-Plan-2560 2d ago
What are the alternatives?
6
u/Charming_Professor53 1d ago
https://wiki.archlinux.org/title/Multiboot_USB_drive#Automated_tools
Personal favourite: MultiOS-USB
0
u/Expensive-Sock-7876 2d ago
Build from source
-1
u/Practical-Plan-2560 1d ago
If the concern is that there’s already precompiled code in the Git repository, but there’s no source code for it, your comment doesn’t address the issue.
-1
u/Expensive-Sock-7876 1d ago
https://github.com/ventoy/ventoy there you go
0
u/Practical-Plan-2560 1d ago
What are you talking about?
As an example, this folder has blobs with no source code: https://github.com/ventoy/Ventoy/tree/master/BUSYBOX/chmod
https://github.com/ventoy/Ventoy/issues/3224 has more information on a full list.
It seems like you are just defending Ventoy using incredibly basic arguments that aren't realistic.
2
u/Lashmush 1d ago
Isn't it possible to binwalk the precompiled stuff and make sure?
3
u/Ybalrid 1d ago
it's basically bits of busybox, and yes it is very possible to dissasemble and check. Who has the time for that?
1
u/Lashmush 1d ago
Yeah it's probably not easy both in time and comprehension required but Im just saying, if people start getting paranoid about reasonably popular software, they have an avenue to figure out the truth of it. I had a security colleague who liked sitting with music and binwalking firmwares and other stuff just to relax.
2
u/DaffyDuckMuthaFucker 1d ago
Blah blah blah.
Come back with some actual evidence and you might actually be taken seriously...
2
u/Rayregula 1d ago
The author(s?) long refused to react on questions about the source code for the precompiled code inside their git repository.
Few companies do.
They long refused to react on questions about the security risks.
What risks
When an answer was finally given, it boiled down to a simple "There is no reason to assume that we would have placed malware inside."
Perfectly reasonable. Why would you assume so.
Again after a really long time the authors finally mentioned what other source code they used to generate some-but not all-of the pre-compiled code they did not mention the build methods and refused to prove that this really was the used source code
Doesn't many anything.
The real identities of the authors is unknown
Like the people who work for the company you mean? Which is normal. When a windows update comes out we don't know who the authors were that contributed to it are.
Or you mean like who the company is owned by.
1
1
u/dogwalker805 1d ago
I like ventoy but don't really trust it. why have we not created a duplicate by now?
1
u/Commercial-Worth7301 1d ago
Que exagero, é só um software de inicialização estilo canivete suíço.
Já recuperei uma partição inteira pelo systemrescue, sergei strelec, instalei meu arch por lá, tenho um Linux mint para resolver problemas simples, um debian para servidores e um mini-OS para computadores fracos
1
•
1
u/ZVyhVrtsfgzfs 1d ago
The question about binary blobs in Ventoy was raised after the XZ take over, the primary author is a professor in computer science in China, questions of how much liberty a developer has in a dictatorship were raised.
But it's been two years and no one has found anything and the developers are working slowly on removing the binary blobs.
I have discontinued using Ventoy out of an abundance of caution, but at this point I would be surprised if it did turn out to actually have any malware.
1
-16
2d ago
[deleted]
22
u/st_heron 2d ago
Why? It works really nice, I can just throw a bunch of isos on one flash drive and install any of them. What's an alternative?
-5
u/NyCodeGHG 1d ago
ventoy injects itself into the boot process to do it's thing. UEFI doesn't have the concept of a loop device, so it's a giant pile of hacks. It's known to cause a bunch of weird problems.
-16
0
u/anxious_and_stupid 2d ago
I literally have to learn how to manually boot win11 iso via grub after I learned about this sometime ago
0
u/VendorNeutral 2d ago
Ventoy and rustdesk are the two tools I had to kick off the tool list at work after a supply chain audit. Not only aren't there enough eyes on all of the code, but there are no legal entities I can drag in front of a court if things go sideways.
9
u/LefTimaDev 1d ago
The latter applies to basically all open source software. If it's not owned by anyone, you're using it at your own risk. If you want to always have a legal entity to drag in front of a court you probably shouldn't be using Linux, except Ubuntu
-1
u/VendorNeutral 1d ago
Yes, but the paid tier rustdesk is closed source and (as this discussion indicates and is about) ventoy contains binary blobs. Open source can be audited and verified and even built myself, while closed source software requires a different angle. The moment I can't do either, software is off the list.
-11
u/Excellent-Copy-2688 2d ago edited 2d ago
you guys use USB for installation? I just live boot into ISOs from grub
if you don't have grub, just extract the ISO on a fat32 partition, and boot into it from your boot menu(might have to add a boot entry in UEFI)
I have installed win 10 iot ltsc this way, debian too (it required downloading and replacing the kernel and initrd with versions labeled as 'hd-media')
I've seen someone on yt use this method for ubuntu as well
for ISOs larger than 4GB you might need some extra steps of splitting some big file, I am not completely sure about the process
14
u/anonymous-bot 2d ago
Ain't no one got time for that. I just make my Ventoy USB and then I can use it across multiple computers.
-1
u/Excellent-Copy-2688 2d ago edited 1d ago
my usb broke :(
I used gemini for the custom boot entry, did not expect it to work but it did somehow.
Took less than a minute, faster than downloading ventoy, literallyI understand the structure of the custom grub entry now, I can reuse it for all distros, just need to change 2 lines
3
3
u/LefTimaDev 1d ago
That's... not an alternative, the methods you described have a different use case (booting into another ISO on a machine that already has an OS)
2
u/Any_Fox5126 1d ago
... yes? Pretty much everyone has a USB drive, and the installation guides always use one.
0
u/onefish2 2d ago
I do this with rEFInd. I extract the Arch iso into a directory in/boot/EFI/archiso and have rEFInd boot it. I do the same with Clonezilla.
0
u/V2UgYXJlIG5vdCBJ 1d ago
First time I even heard of this software. Install OpenSnitch, which will catch it if it tries to phone home. Firejail couldn’t hurt either.
0
0
u/instancer-kirik 1d ago
If I had a spare x86_64 machine that wasn't secure boot locked by AWS for their specific Ubuntu distro, I'd consider doing this migration bc I'm free this whole month
-14
u/OwningLiberals 2d ago
I like how a lot of people are shitting on OP without realizing this is basically a direct excerpt from the arch wiki. If you guys want to shit on this that's fine but you should probably fix the arch wiki if you care so much.
-8
u/activedusk 2d ago edited 1d ago
I mention it all the times ventoy is recommended, it is not to be trusted, from any Linux distro, you don't even need a GUI to prepare a bootable USB drive. You can use TTY console with wget examplelink to download the .iso (you can manually type download link from smartphone and it will download to working directory, cd to /home/user/Downloads for safety) and use
sudo dd if=/home/user/Downloads/exact-name.iso of=/dev/sdX bs=4M status=progress oflag=sync
Note to use lsblk before to identify USB name correctly and write the name of the entire USB device and not a partition within, if any, example if internal SATA drive is sda, USB drive will be sdb so of=/dev/sdb and not of=/dev/sdb1. Also it is recommended to unmount the USB drive but not eject it before using dd, check with lsblk, the command is umount /dev/sdb1 (I did not forget the n in umount, that's just the command, blame nerds for thinking that's an abbreviation).
While you should be cautious with dd and not take it lightly, it is the best way to make a bootable USB that I found. Alternative create a bootable partition within the drive, as in that partition will boot with .iso like a bootable USB, it is however a drive partition. There are several solutions, the Arch .iso works with systemd-boot but it is more universal to use GRUB. With systemd-boot you would need to size /boot partition beforehand to be able to house the Arch .iso because it needs it to be on the ESP (EFI System Partition, more precisely /boot/EFI/ subdirectory or /boot/efi/EFI/) to be able to install from internal drive, with GRUB it is easier, make a separate, say 5GB partition at the end of the drive with cfdisk or your GUI partitioning program of choice. It may or may not be possible to extract the .iso and use some files within to make an EFI boot stub but said extracted files need to be on ESP afaik.
To prepare a Windows bootable USB, same thing, download .iso from official source, things differ a bit afterwards. First format USB to NTFS, will need dependencies like ntfs 3G package. After that mount .iso, cd to it and copy the contents to USB drive. Wait a few minutes after it says it finished to actually finish and it should be done, this can be done from GUI or TTY console, in both cases.
I did not try but from Windows to prepare bootable Linux USB, it might be possible to use WSL and reuse the dd command. It is easier however to make a bootable partition within the internal drive, mount .iso, copy contents to that partition and make it an EFI system partition with command prompt, there are tutorials on youtube.
11
u/LefTimaDev 1d ago
You don't seem to realize the point of Ventoy is being able to drag and drop multiple ISOs into a folder on the same USB, then when booting from the USB choose which ISO to boot into. While the remaining space on the USB drive is free to be used for anything else.
You can't do any of these things with the methods you listed
108
u/RAMChYLD 2d ago
Well, why not take Ghidra to Ventoy and tell us what you find?