I had no idea this issue had been identified. While I find this tool very useful, the project is seeming rather questionable to me now.
I was bored at work one day. I decided to put a nyan cat easter egg in my company’s app. If at the loading progress bar screen you typed NYAN it would turn the progress bar into a rainbow being created by a little nyan cat while playing the nyan cat song. The mp3 (inconspicuously renamed without the extension) doubled our build size. No one batted an eye cause no one paid attention to the build size much.
Fast forward 5 years later, at a different job, I get a phone call from the old boss. Do you happen to know anything about this nyan cat file we found?
I had no idea what he was talking about.
Aaaand thats why all commits should be signed with your pgp key
It sounds like they weren’t using any form of version control, so that’s definitely on them at this point
What makes you say that? To me, it sounds like that’s what they do have cause they tracked the change back to him. The commit message obviously said nothing about the file.
Ah I could see that. I took it as them not knowing where the file came from at all, so they’re just asking all the devs who would have had access at that point, which is why it was “hey do you know anything about this file?” and not “is there a specific reason you committed this file to the build?”
You think they’d call up devs who left them just to ask if they happen to know about a random file?
Years and years ago I worked on a project where the logo was the outline of a head and an inward swirl for the brain.
For the website, if you held your mouse over it for 9 seconds, it would spin and flush. No one ever found that one that I know of.
Should’ve included that in your FE analytics.
That story was a journey.
10/10
What does BLOB stand for?
Binary Large OBject
Thank you for sharing this. I remember using Ventoy quite often back when I was still on Windows. I’ll be sticking with the good old
ddcommand.Good ol’ disk destroyer
I love double d
Makes me wonder how far the closest alternative, glim, could be upgraded to match Ventoy given the confines of GRUB.
Someone had mentioned that Fedora fails to verify when booting from Ventoy. Now I’m thinking if I could dd the media loaded via Ventoy and compare with an original copy to see what changed.
I like multiboot. Used it back when I used Windows.
The Ventoy advertisements on Reddit looked too suspicious, so I never checked it out.Hey guys open source is great you can look at all the code and therefore there are no security backdoors etc. Also here are a bunch of pre-compiled blobs in the repo, don’t worry about those, but they are required to run the program.
The fact that people know there are pre-compiled blobs in open source means they have an informed reason to avoid the software!
Right, the fact that it’s open is the reason this came to light, and we’re having this discussion
Exactly. Acting like this is an “ah-ha, see?!!” moment when this is exactly what open source is designed for. That’s like saying global warming is a hoax because “oh look it’s snowing”.
This isn’t a knock against opensource programming, but there shouldn’t ever be precompiled blobs in the repo unless they are the official builds for the various OS’s and if you want to build from source, the pre-compiled blobs shouldn’t be part of that, otherwise you can’t really claim you are opensource.
Yes, and that’s what is being called out here. But your original comment makes it sound like you are advocating for closed source software and that somehow open source software is bad.
This is the system working as intended. When potential issues arise, it’s openly discussed and ideally resolved. And if not, trust is lost and people will stop using it.
I don’t know about the history of the project, but it sounds like those blobs have been there for quite some time. When in reality, the PR that added the blobs in the first place shouldn’t ever have been approved.
Actually just checked 3+ years.
Well, it is an “ah-ha, see!” moment, because it shows the benefit of open source.
Its more like pointing at the absence of a glacier on a mountaintop and saying “yep, see, climate change does exist”
I was referring to the commenter and how it read to me :) But agreed, what you said, too.
Time for a fork, then?
Any alternatives to this tool? I’ve used it a lot lately because I was testing out live OSes before installing one to the hard drive, but otherwise I don’t need it on a daily basis.
I guess, you could buy a handful of USB sticks…
but otherwise I don’t need it on a daily basis.
I’ll be real, this is part of why I didn’t understand Ventoy. I keep a bunch of large, fast thumbdrives around blank and available. When I need/want to put an OS on there, I do it when I need it, and then I’m always installing the most current version of the install. It takes under 5 minutes, at best.
I used to try to keep various installs on thumbdrives… but it would be two years down the line by the time I needed to use it again and by that time it’s literally pointless to be using two year old installation media.
As someone with few USBs available, Ventoy takes me 2 minutes to flash, several minutes to copy a set of ISOs, and then any time I need it, it takes 0 minutes to have a working USB with some arbitrary ISO. Sure, it’s not up to date, but I don’t need it to be if I need to recover an install or use some random tool.
When I was working in IT, this would have been a very useful tool for doing some on-site troubleshooting with various tools or for one-off reimaging machines that were missed during a big update or something. Instead, I had a bag of USB sticks with labels on them, which was annoying to use and to maintain.
Part of the point behind Ventoy is that you don’t need to prepare the USB to be bootable. You can just copy/paste the whole iso into Ventoy and it will be bootable. New release comes out? Just copy it onto your USB drive. Don’t even need to remove the old version of you don’t want to.
Makes things much easier in the tech world for having a single USB with 50+ bootable tools and installers on there like with MediCat (which uses Ventoy as a base).
Only thing I’ve had issues with booting from Ventoy is the ProxMox install iso. Everything else has worked first try.
Ventoy wasn’t a foolproof solution but it really did beat the hell out of using 6 different USB drives. Most USB “pen drives” don’t make labeling easy and without labeling I’m just plugging them in one by one till I find the one I want.
I remember various different concepts of USB flash drives with integrated LCDs that would display a label and the remaining capacity. Then they vanished and the only thing left were the Lexar Echo drives. Until a few years ago, when they have been pulled from the markets. Probably, because they didn’t work with the now default GPT and its many different partition types.
IODD makes some. I had the older HDD version that stopped working after it got dropped, so now I use this one:
https://www.iodd.shop/IODD-SSD-drive-with-mini-USB-30-with-secure-256-bit-encryption
I use this thing all the time. It will serve up ISOs and VMDK images also. It’s quite fast
The IODD is basically a small drive enclosure, not a “stupid” USB drive.
I was more thinking of devices like this, this or this. Which have the simplicity of a normal USB device (just plug it in and go) and come with an automatically updating label so you can find the correct dongle.
But yeah, nowadays, I’d probably prefer the IODD thing.
Glad it’s getting a little more light. Been trying to tell people this for a few years now lol. It’s the reason I’ve stayed away from it since first learning of the tool and looking at the “source code”.
I never trusted it because I thought it was completely proprietary. Well now I know it basically is.
Yep, some people these are saying just 7 of the 150 binaries don’t have source or build info. Yeah, one binary is enough to do all the evil in the world, not that other binaries support reproducible builds anyway.
It’s a useful tool, but there is a security concern for anything not fully open source. You will have to weigh your risk factors, I doubt that it’s any problem for most consumers or distro hoppers.
Best to keep an eye in case any new contributers arrive suddenly…
bruh.
Hm, so now people suddenly notice and care about this? lol
First I’m hearing of it and I’m starting to question my security given I installed my OS using it.
God I hate people who use github comments for their own benefit. “Just fork it bro” is never helpful.
For me the problem is more in GPL violation: they distribute blobs under GPL3, user made a request of the source code by creating an issue, but they ignored that request. It is not only about “you have to fix it” versus “just fork it” imo.
Licence doesn’t apply to the creator.
He already owns the copyright, he doesn’t need a licence, he doesn’t need to adhere to the gpl
The binaries in question are various GNU and FOSS tools from elsewhere, not part of the Ventoy project itself. So no, the Ventoy author does not own the copyright of the tools in question.
I agree that comments like that are unhelpful/unnecessary, but how is that “for their own benefit”? Other than the actual devs themselves using that as a way to just ignore issues, I do not follow
It makes them feel good and devalues the quality of discussion. Benefits them, harms others.
Seriously this. Any comment about a complicated system that starts with “just” can be ignored 99% of the time.
Also, there are 4k forks of Ventoy already. Obviously forking it isn’t helping. Actual work needs to be done.
Wtf is ventoy and why is nobody explaining it
I used Ventoy (its still on my USB stick). Its actually a pretty cool concept. Normally without Ventoy, you would flash your Linux distribution on the USB stick. And then you can boot from it, right?
Ventoy instead allows you to have a folder where you put an ISO without flashing it, and then you can boot from it by selecting in the menu. You just need to flash Ventoy once, as the base system, then you can put as many ISO files into that directory. I tested it and have 7 different Linux distributions (ranging from 1 GB to 4 GB variants) on the same USB stick, and I can boot any of them without flashing again. Replacing ISO is extremely easy, just delete it and copy a new one. Filenames does not matter, anything can be found.
because search engines exist
Wtf is search engines and why is no one explaining it
Search engines are websites that people used to go to in order to get helpful information. These days, they just spam out a bunch of SEO garbage, AI-generated bullshit, and ads.
Google, probably
shh…it’s a spyware and adware!
Wtf is a BLOB and why is nobody explaining it
Binary Large OBject
Basically any binary file, often objected to in open source repos because of the lack of source and ‘openness’. See also the recent xz backdoor.
Binary data. In the case of lz it was a carefully “corrupted” archive.
Because you can look it up.
Basically an OS which let’s you choose another OS to boot into. This way you can chose between multiple OS’s on one USB drive. You drag your ISO files into a USB folder and choose between them on boot.
That sounded like grub until you said ISO file
Yeah basically grub but on a USB stick and with ISO files
So like rEFInd but on the same drive?
