I had no idea this issue had been identified. While I find this tool very useful, the project is seeming rather questionable to me now.

  • Antagnostic@lemmy.world
    link
    fedilink
    arrow-up
    219
    arrow-down
    1
    ·
    edit-2
    3 months ago

    I was bored at work one day. I decided to put a nyan cat easter egg in my company’s app. If at the loading progress bar screen you typed NYAN it would turn the progress bar into a rainbow being created by a little nyan cat while playing the nyan cat song. The mp3 (inconspicuously renamed without the extension) doubled our build size. No one batted an eye cause no one paid attention to the build size much.

    Fast forward 5 years later, at a different job, I get a phone call from the old boss. Do you happen to know anything about this nyan cat file we found?

    I had no idea what he was talking about.

    • fmstrat@lemmy.nowsci.com
      link
      fedilink
      English
      arrow-up
      64
      ·
      3 months ago

      Years and years ago I worked on a project where the logo was the outline of a head and an inward swirl for the brain.

      For the website, if you held your mouse over it for 9 seconds, it would spin and flush. No one ever found that one that I know of.

      • kautau@lemmy.world
        link
        fedilink
        arrow-up
        11
        ·
        3 months ago

        It sounds like they weren’t using any form of version control, so that’s definitely on them at this point

        • Alexstarfire@lemmy.world
          link
          fedilink
          arrow-up
          18
          ·
          3 months ago

          What makes you say that? To me, it sounds like that’s what they do have cause they tracked the change back to him. The commit message obviously said nothing about the file.

          • kautau@lemmy.world
            link
            fedilink
            arrow-up
            5
            ·
            3 months ago

            Ah I could see that. I took it as them not knowing where the file came from at all, so they’re just asking all the devs who would have had access at that point, which is why it was “hey do you know anything about this file?” and not “is there a specific reason you committed this file to the build?”

              • kautau@lemmy.world
                link
                fedilink
                arrow-up
                1
                ·
                3 months ago

                You think they’d call up devs who left them just to ask if they happen to know about a random file?

                I mean, that’s what op said happened. Literally with the verbiage of “file we found” and not “file you committed”

  • mashbooq@lemmy.world
    link
    fedilink
    arrow-up
    90
    ·
    3 months ago

    After I saw that issue, I attempted to build Ventoy from source. After making numerous modifications and getting only the first couple components built, I got tired of it and quit. I’ve made some modifications to glim and use that instead, although it’s still not as easy as Ventoy. But I don’t trust Ventoy if I can’t build it myself.

    Further, when @vkc@linuxmom.net made some criticisms of Ventoy in one of her YouTube videos, she was subjected to a harassment campaign, and others told her the same happened to them. That pushed me from not trusting Ventoy to actively distrusting it.

    • Snot Flickerman@lemmy.blahaj.zone
      link
      fedilink
      English
      arrow-up
      46
      ·
      3 months ago

      Further, when @vkc@linuxmom.net made some criticisms of Ventoy in one of her YouTube videos, she was subjected to a harassment campaign, and others told her the same happened to them.

      What the fuck is happening to the world? Are we regressing or were we always this regressed and we’ve just given powerful tools to fucking chowderheads?

      • Telorand@reddthat.com
        link
        fedilink
        arrow-up
        39
        ·
        3 months ago

        There’s a subset of the Linux/FOSS/etc. community who are Conservative, misogynistic, racist, and/or otherwise general bigots. Compare the Ventoy-bros against the Elon-bros, and you’ll see a similar pattern of behavior.

        I don’t personally understand it, since development is still sometimes seen as “work for weirdo nerds,” so you’d think they would understand what it feels like to be rejected or bullied, but here we are. They manage to stay under the radar, because there’s usually no reason to discuss politics or philosophy when you’re debugging code.

        • Snot Flickerman@lemmy.blahaj.zone
          link
          fedilink
          English
          arrow-up
          32
          arrow-down
          4
          ·
          edit-2
          3 months ago

          There’s a subset of the Linux/FOSS/etc. community who are Conservative, misogynistic, racist, and/or otherwise general bigots.

          right, the hackernews set…

          • WldFyre@lemm.ee
            link
            fedilink
            arrow-up
            29
            ·
            3 months ago

            Don’t know why you’re being downvoted, hackernews is an awful site of smug, dumb software “engineer” tech bros with some of the worst takes on anything that isn’t explicitly about how to code

      • aStonedSanta@lemm.ee
        link
        fedilink
        arrow-up
        5
        ·
        edit-2
        3 months ago

        It’s the other way around I think. We are progressing. More voices are heard which “should” be a good thing. Right? Right…?

        /s

    • noodlejetski@lemm.ee
      link
      fedilink
      arrow-up
      1
      ·
      edit-2
      2 months ago

      it’s the opposite, actually: she got harassed because she didn’t talk about it when talking about creating a bootable drive.

  • n2burns@lemmy.ca
    link
    fedilink
    arrow-up
    84
    arrow-down
    3
    ·
    3 months ago

    I too wish the developer would respond, but I don’t think this is the catastrophe people are making it out to be. One comment seems to explain why these binaries are included:

    Because ventoy supports shim, and by extension secure boot, these files needs to come from a signed Linux distro. In this case they are taken from Fedora releases, and OpenSUSE apparently, as they publish shim binaries and grub binaries signed by their certificate.

      • Quail4789@lemmy.ml
        link
        fedilink
        English
        arrow-up
        27
        arrow-down
        3
        ·
        3 months ago

        It matters because nobody is going to check the hashes for all of the files match whenever there’s a change so the maintainer can just replace them with whatever he wants.

        • Pup Biru@aussie.zone
          link
          fedilink
          English
          arrow-up
          25
          ·
          3 months ago

          that’s what automation is for - nobody is going to manually check them, but anyone is able to automatically set something up to check their hashes in change… the fact that it’s possible that anyone is doing that now that it’s a known issue perhaps makes it less problematic as an attack vector

          • refalo@programming.dev
            link
            fedilink
            arrow-up
            4
            arrow-down
            1
            ·
            3 months ago

            That is true, but also nobody is doing it. Just like nobody is verifying Signal’s “reproducible builds”.

            • Pup Biru@aussie.zone
              link
              fedilink
              English
              arrow-up
              5
              ·
              3 months ago

              are you sure?

              there could be thousands just waiting for a failure to come out and say “HEY THIS IS DODGY”

              • refalo@programming.dev
                link
                fedilink
                arrow-up
                1
                ·
                edit-2
                3 months ago

                Yea because I tested it myself. Nobody else seems to care, and if they did, I would think there would be a public way to see regular test results regardless.

                I know this exists for some projects, but somehow nothing privacy-sensitive

          • Quail4789@lemmy.ml
            link
            fedilink
            English
            arrow-up
            13
            arrow-down
            1
            ·
            edit-2
            3 months ago

            The amount of malware you can cram in a source-code patch without drawing attention vs. in a binary is vastly different.

            There’s also the fact that if you want to ship binaries, you can just wget them from source during the build process. Not a perfect solution but much better than what’s ventoy doing. The source code updates works the same in every project because it has to. That’s why this is drawing more attention.

            • Ferk@lemmy.ml
              link
              fedilink
              arrow-up
              3
              ·
              edit-2
              3 months ago

              That’s ok if we are talking about malware publicly shown in the published source code… but there’s also the possibility of a private source-code patch with malware that it’s secretly being applied when building the binaries for distribution. Having clean source code in the repo is not a guarantee that the source code is the same that was used to produce the binaries.

              This is why it’s important for builds to be reproducible, any third party should be able to build their own binary from clean source code and be able to obtain the exact same binary with the same hash. If the hashes match, then you have a proof of the binary being clean. You have this same problem with every single binary distribution, even the ones that don’t include pre-compiled binaries in their repo.

              • refalo@programming.dev
                link
                fedilink
                arrow-up
                3
                ·
                3 months ago

                The problem is not near enough projects support reproducible builds, and many that do aren’t being regularly verified, at least publicly.

                • Ferk@lemmy.ml
                  link
                  fedilink
                  arrow-up
                  1
                  ·
                  edit-2
                  3 months ago

                  Yes, that’s why im saying that this kind of problem isn’t something particular about this project.

                  In fact I’m not sure if it’s the case that the builds aren’t reproducible/verifiable for these binaries in ventoy. And if they aren’t, then I think it’s in the upstream projects where it should be fixed.

                  Of course ventoy should try to provide traceability for the specific versions they are using, but in principle I don’t think it should be a problem to rely on those binaries if they are verifiable… just the same way as we rely on binaries for many dynamic libraries in a lot of distributions. After all, Ventoy is closer to being an OS/distribution than a particular program.

    • grue@lemmy.world
      link
      fedilink
      English
      arrow-up
      33
      arrow-down
      7
      ·
      3 months ago

      On the contrary: that just goes to show what a fucking catastrophe for software freedom “Secure[sic] Boot” is.

    • nialv7@lemmy.world
      link
      fedilink
      arrow-up
      17
      ·
      3 months ago

      While this is true, it only requires the shim and grub to be copied for another distro.

      From other comments there are a lot more blobs than just these two.

          • davad@lemmy.world
            link
            fedilink
            arrow-up
            3
            ·
            2 months ago

            I think they did say that in the older thread. But for proper security, you shouldn’t have to trust them. You should have build tools that will re-fetch everything to create an identical build. That gives a clear chain of custody, which proves that morning has been tampered with.

    • infeeeee@lemm.ee
      link
      fedilink
      arrow-up
      12
      arrow-down
      1
      ·
      3 months ago

      It sounds to me as a documentation issue, as the next comment says, simply including a wget script should solve this.

  • PowerCrazy@lemmy.ml
    link
    fedilink
    English
    arrow-up
    75
    arrow-down
    14
    ·
    3 months ago

    Hey guys open source is great you can look at all the code and therefore there are no security backdoors etc. Also here are a bunch of pre-compiled blobs in the repo, don’t worry about those, but they are required to run the program.

    • snooggums@lemmy.world
      link
      fedilink
      English
      arrow-up
      91
      ·
      3 months ago

      The fact that people know there are pre-compiled blobs in open source means they have an informed reason to avoid the software!

      • ulkesh@beehaw.org
        link
        fedilink
        English
        arrow-up
        4
        ·
        3 months ago

        Exactly. Acting like this is an “ah-ha, see?!!” moment when this is exactly what open source is designed for. That’s like saying global warming is a hoax because “oh look it’s snowing”.

        • PowerCrazy@lemmy.ml
          link
          fedilink
          English
          arrow-up
          2
          ·
          3 months ago

          This isn’t a knock against opensource programming, but there shouldn’t ever be precompiled blobs in the repo unless they are the official builds for the various OS’s and if you want to build from source, the pre-compiled blobs shouldn’t be part of that, otherwise you can’t really claim you are opensource.

          • ulkesh@beehaw.org
            link
            fedilink
            English
            arrow-up
            1
            ·
            3 months ago

            Yes, and that’s what is being called out here. But your original comment makes it sound like you are advocating for closed source software and that somehow open source software is bad.

            This is the system working as intended. When potential issues arise, it’s openly discussed and ideally resolved. And if not, trust is lost and people will stop using it.

            • PowerCrazy@lemmy.ml
              link
              fedilink
              English
              arrow-up
              1
              ·
              edit-2
              3 months ago

              I don’t know about the history of the project, but it sounds like those blobs have been there for quite some time. When in reality, the PR that added the blobs in the first place shouldn’t ever have been approved.

              Actually just checked 3+ years.

        • delirious_owl@discuss.online
          link
          fedilink
          arrow-up
          1
          ·
          3 months ago

          Well, it is an “ah-ha, see!” moment, because it shows the benefit of open source.

          Its more like pointing at the absence of a glacier on a mountaintop and saying “yep, see, climate change does exist”

          • ulkesh@beehaw.org
            link
            fedilink
            English
            arrow-up
            1
            ·
            3 months ago

            I was referring to the commenter and how it read to me :) But agreed, what you said, too.

  • Feathercrown@lemmy.world
    link
    fedilink
    English
    arrow-up
    54
    arrow-down
    2
    ·
    3 months ago

    God I hate people who use github comments for their own benefit. “Just fork it bro” is never helpful.

    • Sem@lemmy.ml
      link
      fedilink
      English
      arrow-up
      29
      arrow-down
      1
      ·
      3 months ago

      For me the problem is more in GPL violation: they distribute blobs under GPL3, user made a request of the source code by creating an issue, but they ignored that request. It is not only about “you have to fix it” versus “just fork it” imo.

    • friend_of_satan@lemmy.world
      link
      fedilink
      English
      arrow-up
      7
      arrow-down
      3
      ·
      edit-2
      3 months ago

      Seriously this. Any comment about a complicated system that starts with “just” can be ignored 99% of the time.

      Also, there are 4k forks of Ventoy already. Obviously forking it isn’t helping. Actual work needs to be done.

    • SatyrSack@lemmy.oneOP
      link
      fedilink
      arrow-up
      1
      ·
      3 months ago

      I agree that comments like that are unhelpful/unnecessary, but how is that “for their own benefit”? Other than the actual devs themselves using that as a way to just ignore issues, I do not follow

  • Mikelius@lemmy.ml
    link
    fedilink
    arrow-up
    49
    arrow-down
    3
    ·
    3 months ago

    Glad it’s getting a little more light. Been trying to tell people this for a few years now lol. It’s the reason I’ve stayed away from it since first learning of the tool and looking at the “source code”.

  • monovergent 🏁@lemmy.ml
    link
    fedilink
    arrow-up
    33
    ·
    3 months ago

    Makes me wonder how far the closest alternative, glim, could be upgraded to match Ventoy given the confines of GRUB.

    Someone had mentioned that Fedora fails to verify when booting from Ventoy. Now I’m thinking if I could dd the media loaded via Ventoy and compare with an original copy to see what changed.

    • tetris11@lemmy.ml
      link
      fedilink
      arrow-up
      7
      ·
      3 months ago

      Little did they know that Patches the Cat bit through their LAN lines and actually increased the cost of their communication.

    • Linkerbaan@lemmy.world
      link
      fedilink
      arrow-up
      38
      arrow-down
      2
      ·
      edit-2
      3 months ago

      Basically an OS which let’s you choose another OS to boot into. This way you can chose between multiple OS’s on one USB drive. You drag your ISO files into a USB folder and choose between them on boot.

    • thingsiplay@beehaw.org
      link
      fedilink
      arrow-up
      24
      ·
      3 months ago

      I used Ventoy (its still on my USB stick). Its actually a pretty cool concept. Normally without Ventoy, you would flash your Linux distribution on the USB stick. And then you can boot from it, right?

      Ventoy instead allows you to have a folder where you put an ISO without flashing it, and then you can boot from it by selecting in the menu. You just need to flash Ventoy once, as the base system, then you can put as many ISO files into that directory. I tested it and have 7 different Linux distributions (ranging from 1 GB to 4 GB variants) on the same USB stick, and I can boot any of them without flashing again. Replacing ISO is extremely easy, just delete it and copy a new one. Filenames does not matter, anything can be found.

        • namingthingsiseasy@programming.dev
          link
          fedilink
          arrow-up
          7
          ·
          3 months ago

          Search engines are websites that people used to go to in order to get helpful information. These days, they just spam out a bunch of SEO garbage, AI-generated bullshit, and ads.

          Google, probably

    • Lemongrab@lemmy.one
      link
      fedilink
      arrow-up
      51
      arrow-down
      1
      ·
      3 months ago

      From what others have said: The blobs violate GPL because they are taken from other FOSS project but the changes Ventoy makes are not viewable.

  • BrianTheeBiscuiteer@lemmy.world
    link
    fedilink
    arrow-up
    23
    arrow-down
    1
    ·
    3 months ago

    Any alternatives to this tool? I’ve used it a lot lately because I was testing out live OSes before installing one to the hard drive, but otherwise I don’t need it on a daily basis.

    • Snot Flickerman@lemmy.blahaj.zone
      link
      fedilink
      English
      arrow-up
      25
      arrow-down
      2
      ·
      3 months ago

      but otherwise I don’t need it on a daily basis.

      I’ll be real, this is part of why I didn’t understand Ventoy. I keep a bunch of large, fast thumbdrives around blank and available. When I need/want to put an OS on there, I do it when I need it, and then I’m always installing the most current version of the install. It takes under 5 minutes, at best.

      I used to try to keep various installs on thumbdrives… but it would be two years down the line by the time I needed to use it again and by that time it’s literally pointless to be using two year old installation media.

      • CoopaLoopa@lemmy.dbzer0.com
        link
        fedilink
        arrow-up
        23
        arrow-down
        1
        ·
        3 months ago

        Part of the point behind Ventoy is that you don’t need to prepare the USB to be bootable. You can just copy/paste the whole iso into Ventoy and it will be bootable. New release comes out? Just copy it onto your USB drive. Don’t even need to remove the old version of you don’t want to.

        Makes things much easier in the tech world for having a single USB with 50+ bootable tools and installers on there like with MediCat (which uses Ventoy as a base).

        Only thing I’ve had issues with booting from Ventoy is the ProxMox install iso. Everything else has worked first try.

      • BrianTheeBiscuiteer@lemmy.world
        link
        fedilink
        arrow-up
        14
        arrow-down
        2
        ·
        3 months ago

        Ventoy wasn’t a foolproof solution but it really did beat the hell out of using 6 different USB drives. Most USB “pen drives” don’t make labeling easy and without labeling I’m just plugging them in one by one till I find the one I want.

        • mbirth@lemmy.ml
          link
          fedilink
          English
          arrow-up
          3
          ·
          3 months ago

          I remember various different concepts of USB flash drives with integrated LCDs that would display a label and the remaining capacity. Then they vanished and the only thing left were the Lexar Echo drives. Until a few years ago, when they have been pulled from the markets. Probably, because they didn’t work with the now default GPT and its many different partition types.

      • thejevans@lemmy.ml
        link
        fedilink
        arrow-up
        6
        arrow-down
        2
        ·
        3 months ago

        When I was working in IT, this would have been a very useful tool for doing some on-site troubleshooting with various tools or for one-off reimaging machines that were missed during a big update or something. Instead, I had a bag of USB sticks with labels on them, which was annoying to use and to maintain.

      • TheGalacticVoid@lemm.ee
        link
        fedilink
        arrow-up
        2
        ·
        3 months ago

        As someone with few USBs available, Ventoy takes me 2 minutes to flash, several minutes to copy a set of ISOs, and then any time I need it, it takes 0 minutes to have a working USB with some arbitrary ISO. Sure, it’s not up to date, but I don’t need it to be if I need to recover an install or use some random tool.

  • Snot Flickerman@lemmy.blahaj.zone
    link
    fedilink
    English
    arrow-up
    23
    arrow-down
    1
    ·
    edit-2
    3 months ago

    All my laziness about not checking it out has come to fruition. Now I simply don’t have to, because this is sketch as fuck until it is handled.

    • Quail4789@lemmy.ml
      link
      fedilink
      English
      arrow-up
      10
      ·
      3 months ago

      Yep, some people these are saying just 7 of the 150 binaries don’t have source or build info. Yeah, one binary is enough to do all the evil in the world, not that other binaries support reproducible builds anyway.