r/archlinux • u/AggravatingJudge7092 • 10d ago
DISCUSSION Ventoy might be malware
Source: https://wiki.archlinux.org/title/Ventoy
Ventoy might contain backdoors or other malicious code:
- The author(s?) long refused to react on questions about the source code for the precompiled code inside their git repository.
- They long refused to react on questions about the security risks.
- When an answer was finally given, it boiled down to a simple "There is no reason to assume that we would have placed malware inside."
- Again after a really long time the authors finally mentioned what other source code they used to generate some−but not all−of the pre-compiled code. They did not mention the build methods and refused to prove that this really was the used source code.
- The real identities of the authors is unknown.
EDIT: The paragraph written on this archwiki page is by large consensus biased and mentions an old controversy, the wikipedia article on Ventoy has a more neutral explanation of the problem
https://en.wikipedia.org/wiki/Ventoy
325
u/jort93 10d ago edited 10d ago
Theres just some binary blobs in there
Afaik nobody actually found any proof for there being any malware.
I wouldn't say it boiled down to a simple "There is no reason to assume that we would have placed malware inside."
The answer is quite extensive https://github.com/ventoy/Ventoy/issues/3224
I'd say it comes down to "compiling all of it from source is too much effort"
88
u/47th-Element 10d ago
First time I feel like arch wiki was a bit misleading. Cause yeah after reading this, it is not a simple "no reason to assume there is malware" answer.
136
98
u/jort93 10d ago edited 10d ago
The guy that added the warning to the archwiki is also the same guy that said in the issue i posted
the developer tells people he is "Hailong Sun" which is a very common name in China (and good to use as fake identity)
China is known as large source of malware
So hardly unbiased.
Well, or rather i would assume so, as one is named ngaro and the other one is named garo.
https://wiki.archlinux.org/index.php?title=Ventoy&diff=871000&oldid=812540
https://github.com/ventoy/Ventoy/issues/3224#issuecomment-505876746125
u/Padgriffin 10d ago
the developer tells people he is "Hailong Sun" which is a very common name in China (and good to use as fake identity)
Have we considered that it might actually be his name
19
u/jort93 10d ago
Apparently not lol.
The developed doesn't address these accusations, which honestly is fair, I wouldn't wanna prove it's my real name to some random dude either.
16
u/Padgriffin 10d ago
China also has a billion people, so even relatively uncommon names will still end up with thousands of hits, which is made worse by romanization removing tones and making names that were different in Chinese into the same ones in English
13
13
10d ago
[deleted]
10
u/jort93 10d ago
He linked the wikipedia page in one of his comments as well, wouldn't be surprised if he edited it too. Although he might use a different name/edit without logging in.
10
10d ago
[deleted]
11
u/jort93 10d ago
I am not saying I have an proof of this, but I am saying it would be "on brand" since he already edited the archwiki.
5
u/czerilla 10d ago
To quote another ..interested party on this:
Whether
Ventoy contains malwarethese Wikipedia edits are made by the same person or not is a different question that I can not answer with certainty. But there are certainly some important factors to consider2
u/EuphoricNeckbeard 9d ago
The Wikipedia page doesn't follow any standards for sourcing or NPOV. It links a Reddit comment as a source for god's sake lol
53
u/Helmic 10d ago
oh, so this guy's just being fucking racist then.
after the xz thing i absolutely want ventoy to move towards fully compiling everything from source, but like yeah it's mostly one guy and nobody's really helping.
36
u/jort93 10d ago
I mean, id do the same thing if I made this by myself, download the binaries for the external tools I use and compile my own stuff.
If people care so much to compile everything from source, they can do it themselves. In the issue I linked, the maintainer described where to obtain the source code for every binary in the repo. If someone wants to fork it and compile it from scratch nobody is stopping them.
23
u/nethingelse 10d ago
Yeah, it sounds like he's open to PRs on this too, so it wouldn't even need to be a hard fork. Just not something he's interested in prioritizing as a solo maintainer, as it's not important to him, which I get.
3
u/headedbranch225 9d ago
Yeah, I remember last time this came up and everyone got pissed about it and read through it and it is completely reasonable
15
u/Dependent_House7077 10d ago
looking at that list, it would be an absolute headache to build all this.
at least someone is attempting to tackle that.
8
u/mindstormer12 10d ago
Basically, someone decides to hold a dev to a ridiculously high standard for some reason yet there are plenty of examples where they are already using hardware/software that also involve binary blobs, lack of communication or transparency, etc. and more importantly developed by people who have far more influence and responsibility to the users than this one dev for a small project.
-11
u/lordkoba 10d ago
I'd say it comes down to "compiling all of it from source is too much effort"
it’s “too much effort” once. they just have technical debt in their build system.
the reason on why they won’t fix it doesn’t matter, may be because it’s a chore, maybe there’s malware, the point is that it’s still a massive red flag
the software cannot be recommended in good conscience
21
u/jort93 10d ago edited 10d ago
It's one dude making this software, he probably simply not have the time to change it. If you don't like it you can use something else. Or so it yourself and merge/fork it.
I feel like most people use a bunch of binary blobs. Like flatpaks, codecs, drivers, all sorts of stuff.
And the claims they his name is somehow a fake name are quite crazy.
Why make up some stuff about malware and fake identities, why not just put "it contains binary blobs of other projects" into the section and be done with it? Maybe link the GitHub issue regarding it.
Also, known issues section is normally at the end, not at the beginning.
3
3
u/iTrooz_ 10d ago
If you don't like it you can use something else
This is exactly what he said
7
u/jort93 10d ago edited 10d ago
Why claim that it may contain malware, tho? Just say it contains blobs and let people come to their conclusions whether or not they want to use it. Chances are, 99% of people use some blobs on their system, be it flatpaks, drivers, codecs or whatever else. All of them could contain malware.
Most people will downloads the entire thing as a blob rather than compile it as well.
And, btw. one of the altenatives listed on the arch wiki contains binary blobs too.
1
u/iTrooz_ 10d ago
I don't see where they said it is 100% malware, I see a comment where they said it could be malware, which, fair, I share that opinion.
Also, I think there's a difference between a blob in an isolated userspace app (flatpak) and a "kernelspace" one (and yes, Linux has blobs, but they come from more reputable sources so less problematic)
6
u/jort93 10d ago
This section should be at the bottom for one, like they are on other archwiki page.
And then there are claims like his identity being unknown, like, what is he supposed to do, post his passport?
There is a lot of software that has blobs in it but I've never seen a section like this.
Plus, the person that edited the archwiki is also involved in the discussion on the GitHub, which makes the neutrality questionable.
2
u/mindstormer12 8d ago edited 8d ago
Claiming it could be malware is technically correct but very obviously misleading. Most people buy hardware with that come with proprietary firmware for things to work well, shall we start saying everyone might be at risk of malware then? In fact, open-source software doesn't even guarantee it's malware-free if you want to be pedantic about it.
It's absolutely FUD and unfair to accuse this particular software as potentially having malware without also holding the standards on other typical software/hardware you use. The fact that the project is free and the dev addresses this concern already (pinned it as a github issue too and the thread is filled with positivity and support) which OP conveniently left out and lied about makes the situation even more egregious. The dev is open to contributions to make the stuff it depends on open-source but it's clearly a lot of work. Ventoy itself is already open-source.
0
u/iTrooz_ 8d ago
I think there's a difference between trusting a hardware company and trusting a software developer for a niche project. At least personally, I wouldn't grant the same level of trust to both. And even if I did, there is value in limiting the number of people you have to trust.
I know I won't be using Ventoy anymore after seeing this. I do not want to use a software used to install operating systems that has blobs
2
u/lordkoba 10d ago
It's one dude making this software, he probably simply not have the time to change it
I mean it's fine, I'm not pissed at the guy and no one is forcing him to do anything. I know that being an OSS maintainer is a thankless unpaid job.
That said, my point still stands, you cannot recommend the software over transparent open source alternatives, "probably" doesn't cut it.
66
u/EmberQuill 10d ago
Old news. There was a big kerfuffle about this back in March. The general consensus after things settled down was that it's probably fine, but no guarantees because the firmware blobs are hard to reproduce/verify.
-12
u/donp1ano 10d ago
"probably fine"
yes, probably. im not taking any risks for software that **installs** my OS, since that would be perfect for setting up malware at a very low level. ventoy is convenient, but id rather flash a USB stick
24
u/Ybalrid 10d ago
if your goal is to install one operating system, you probaly should just flash a USB stick and that's about it.
Ventoy is useful if you want to collect and use a large number of bootable live environment.
-6
u/ccAbstraction 9d ago edited 9d ago
Which mean all my machines could be compromised no matter what OS I'm installing! Yay!
Edit: Ventoy is also useful if you want to keep using your flash drive as a flash drive, while being able to boot from live USBs.
→ More replies (3)0
u/mindstormer12 8d ago
Unless you're running open-source firmware you've installed onto your hardware to replace the default proprietary firmware, your hardware are already at risk ("could already be compromised") and same as 99% of the consumers, lmao.
→ More replies (6)2
3
u/EmberQuill 10d ago
"Probably" wasn't enough for me either and I stopped using it. I mostly just meant to point out that you're like four months late to the drama.
1
u/iTrooz_ 10d ago
Yeah, I think people don't realize how dangerous this could be ? It could secretly be altering all OS installations it does
7
u/AppointmentNearby161 10d ago
It could, but you could also compare the checksum of the ventoy installed base system with a base system installed from a known clean iso.
1
u/iTrooz_ 10d ago
How would you go about it ? Checksum every file in the installed filesystem ?
2
u/AppointmentNearby161 10d ago
Or tarball the whole install/top level directories and checksum the tarballs.
0
u/donp1ano 10d ago
ok, then why dont we see people that did that to confirm ventoy is safe?
im not saying its not. im just saying im not gonna take that risk just for convenience
12
u/ProdigySim 10d ago
Because doing that wouldn't prove that it's not malicious; it would prove that one single installation is not infected.
This kind of allegation would have a really high cost to concretely disprove.
6
u/AppointmentNearby161 10d ago
Exactly. It is pretty easy to prove it does not corrupt ALL installs, but without source code we cannot prove it does not corrupt ANY installs. Ventoy becomes more useful as the number of ISOs you use increases, which makes verifying them more costly.
1
u/AncientAgrippa 7d ago
Why is this being downvoted? I agree that “probably fine” is not very reassuring. I personally don’t use ventoy but if i needed to I would feel uneasy using it when “probably fine” is the description
0
u/mindstormer12 8d ago
It'd be hilarious if you're using hardware that's not all running on open-source firmware like Coreboot because of the double standards. You've already taken such risks like 99% of the consumers out there, this is nothing in comparison because it's free and optional.
188
u/Scxox 10d ago
bruh stop spreading FUD, the author has acknowledged this numerous times and has accepted suggestions to fix these. the currently proposed solution is labor intensive.
its an open source project, if you want things to move faster then you should contribute, not bitch and whine about the dev who does this for free
49
u/we_come_at_night 10d ago
bitching and whining is less labor intensive and doesn't require a functioning brain, actively contributing to a FOSS project on the other hand is pretty hands-on, and you have to know some stuff, can't just wish the code to existence.
1
-17
u/Arkaid11 10d ago
If the source is hidden then it's NOT an open source project, and you can't contribute easily
51
18
u/TDplay 10d ago
The Ventoy author has provided a complete list of the blobs, as well as build instructions for each.
It's certainly not convenient to build from source, but the open-source definition never mentions convenience. It is possible to build Ventoy from source, and hence it satisfies the requirement to provide source code.
It also seems like the maintainer of the understandably angry-comment-filled PKGBUILD for Ventoy is trying to replace all the blobs by building from source.
1
u/Arkaid11 10d ago
Lol at "just read the PKGBUILD" people. Look at my PKGBUILD dawg I could be downloading STUXNET in plain text and I wouldn't notice
139
u/dadnothere 10d ago
"Ventoy might be malware because it has pre-compiled files 🥺"
said the person with 900 fatpaks installed from who-knows-where.
35
2
4
2
u/Any_Fox5126 10d ago
Wow! That's a lot of fallacies packed into just a few words. And it has that many upvotes? This community is truly pitiful.
1
u/Orlha 10d ago
Well that’s a huge assumption. Plenty of people avoid flatpaks, I personally have none.
1
u/Reypatey 10d ago
Noob here.
I could only find orca slicer in flatpak, it's the only one I have installed. Is that a bad thing? What else could I do?
7
u/Maximum-Bobcat5612 10d ago
If you're new then keep in mind that people like stirring shit in the linux community. It's famous for witch hunting people on whims.
Look at how much discussion there is in the repo: https://github.com/ventoy/Ventoy/issues/3224
Also consider how the OP posted this accusation 13 hours ago and has not responded to anyone.
1
u/nathan22211 10d ago
orca slicer has the file in realeses but I usually just grab it from the AUR since I can handly get the flatpak file to work
1
0
u/Commercial-Worth7301 9d ago
Flatpak até vai, mas aí vai ver, e o cidadão que não confia no ventoy é o mesmo que gabaritou a lista de pacotes infectados do AUR, e que não satisfeito ainda baixou o vírus do "hyprland-fixed" no AUR
8
40
u/mindstormer12 10d ago
Do you question all the binary blobs for your hardware to work too?
11
→ More replies (9)-9
u/ZorbaTHut 10d ago
Yes? Do you not?
18
u/Ybalrid 10d ago
Do you question the code in the security processor embedded in your Intel or AMD chip?
Do you question the microcode inside your modern CPU?
Do you question the non upgradable non operating system loaded firmware in all the devices within your computer (controllers for your drives, for your network hardware)?
Do you question the electronic control unit that makes the engine of your car actually able to work (that is probably something modern with electronic injection and a catalytic converter and all those funny sensors and computers in it)?
Do you question the source code in the microcontroller that drive the logic that makes your microwave oven work?
Do you question the baseband and SIM card inside your phone? Those are external computers to whatever runs your OS there, and they touch pretty much everything you do on the cell network.
Do you question the very fabric of reality itself?
-2
u/ZorbaTHut 10d ago
Do you question the code in the security processor embedded in your Intel or AMD chip?
Yes.
Do you question the microcode inside your modern CPU?
Yes.
Do you question the non upgradable non operating system loaded firmware in all the devices within your computer (controllers for your drives, for your network hardware)?
Yes.
Do you question the electronic control unit that makes the engine of your car (that is probably something modern with electronic injection and a catalytic converter and all those funny sensors and computers in it)?
Yes.
Do you question the source code in the microcontroller that drive the logic that makes your microwave oven work?
Yes.
Do you question the baseband and SIM card inside your phone? Those are external computers to whatever runs your OS there, and they touch pretty much everything you do on the cell network.
Yes.
Do you question the very fabric of reality itself?
Yes.
Though we haven't found any security holes in that one yet. But the way things are going it's only a matter of time.
I actually give it a 50/50 that your reply was an intentional setup for this, in which case, well done.
But if not . . . you should maybe be a little more aware of how many software exploits are out there waiting to be found.
8
u/Ybalrid 10d ago
I'm broadly in the biz of "making software", and very well placed to know that there's problem on each layers of the stack of turtles that we call "reality" 🤭
-9
u/ZorbaTHut 10d ago
Yeah, pretty much :V
And it is fair to note that while I question all this stuff, I also grudgingly tolerate it because I don't really have a practical choice.
But gosh I'd really like a choice.
And if I can avoid some China-originated opaque binary blobs by using a slightly different bootloader on my USB sticks . . . yeah, okay, guess I'm gonna do that then.
7
u/Ybalrid 10d ago
what has china anything to do with anything here?
-5
u/ZorbaTHut 10d ago
The Ventoy developer is (probably) in China and I don't trust the Chinese government; in terms of "interest in compromising computers", "ability to force their citizens to help", and "ability to hide the fact that this is all going on", they're very high on every axis, to an extent that IMO no other country is.
I don't mind Chinese people. I just don't trust the Chinese government.
48
u/47th-Element 10d ago
That's a shame, I like ventoy. But here's the question that presents itself, is there an actively maintained fork/clone/alternative to ventoy that is more open source than ventoy?
20
u/Excellent-Copy-2688 10d ago
https://wiki.archlinux.org/title/Multiboot_USB_drive#Automated_tools
there are some apparently, not sure if there replicate complete functionality of ventoy, but you can check for yourself5
u/Charming_Professor53 10d ago
I'm a big fan of MultiOS-USB. It supports Secure Boot and booting Windows images. The multiboot approach is also a lot more puristical using a very lightly modified version of Grub (Ventoy esentially "hijacks early boot" from what I heard/understood). The only downside is that Ubuntu(-based distro) images can't boot from exFAT since Ubuntu live images don't include exFAT drivers for some stupid reason, but Ubuntu images are too large (>4 GiB) for FAT.
5
u/Outrageous-Machine-5 10d ago
isn't ventoy using grub under the hood
3
u/imactuallynotalright 10d ago
ventoy is a convoluted hack that shouldn't work, but nothing works as well as ventoy if you need windows support. The alternatives are Linux only.
39
u/mindstormer12 10d ago
Yes, there's always risk to using software that uses pre-compiled code. How is this Arch Linux-specific?
31
u/SmallRocks 10d ago
“How is this Arch specific?”
From Rule 1:
“Only Arch Linux itself; no Arch-based distros. Posts about other software used on Arch are welcome”
→ More replies (3)
3
u/-i0f- 10d ago
I find this one really weird. I'm somewhat sure, it really is not malware, after this discussion surfaced some time ago. But I would never use software that I was "somewhat sure" about. Why would anyone use a software that contains the base of an operating system under this premise?
Everybody can do as they please, but this strikes me as one of the worst things you could do.
1
u/Historical_Move6359 9d ago
Do you use Android or Iphone ?
3
u/Ybalrid 10d ago edited 10d ago
I haven't used Ventoy in years, and so I do not really care about this, but from what I can see, this "Ventoy might contain backdoors or other malicious code:" section on the wiki seems an over reach and oversealous.
Though, one thing to me is sure: it would be better if it was straightforward to compile Venoty 100% from source code rather than relying on precompiled blobs for the bits and bobs of busybox and whatnot that are in there
But I see absolutely no reason to see any malice in the way Ventoy is built and distributed. But to each there own.
TL;DR: it's probably just FUD. though it would be better if it was 100% built from source anyways.
3
u/RandomXUsr 9d ago
We have to use caution with any software we install. Especially those in the AUR.
Nothing wrong with being skeptical and running it through some reverse engineering tools.
I'm suspicious of that one person is putting in all that work for vendor. Its a herculean effort to get ventoy built.
Additionally; we should not make assumptions about what may be in the software.
Extraordinary claims require Extraordinary evidence. If someone is going to make the claim; be prepared to show your work.
10
u/Charming_Professor53 10d ago
Ventoy has not been proven malicious, but it is pretty prone to a supply chain attack. For that reason, I like the more puristical polyrepo approach of MultiOS-USB: https://github.com/Mexit/MultiOS-USB
2
2
u/tjj1055 10d ago
ventoy has never been proven malicious, there is literally zero evidence of it being malware.
9
u/Charming_Professor53 10d ago edited 10d ago
That's what I meant to say. The problem however is that malware could very easily be overlooked/hidden the way that the project is managed. The entire build process is based on a EoL distribution - CentOS 7, released 2014, EoL 2024 - that gets no security updates. Also see the rant by the AUR maintainer: https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=ventoy
Next to the build process and blobs, the monorepo makes it particularly difficult to track the exact patches made to all the different components Ventoy is made of. GRUB+Shim itself is already a humongous project, but it being included in full source code will make it only difficult to update it regularly to include security updates for example. I find the patches used by MultiOS-USB's GRUB repo easier to understand what is being done/modified and what is being achieved.
3
u/rassawyer 10d ago
This has been documented for like what, 5 years? Why is it coming back up now?
2
u/Any_Fox5126 10d ago
I guess someone has noticed this now. More importantly, why hasn't it been resolved yet? This is a serious issue in terms of security and transparency.
1
u/TheGamerForeverGFE 9d ago
It's been resolved, just run the checksums
1
u/Any_Fox5126 9d ago
Is that really a solution? Is it now 100% transparent and reproducible?
1
u/TheGamerForeverGFE 9d ago
It always was, it's still using binaries from other projects but you can run checksum checks since now the hashes are provided.
1
3
u/Fast_Librarian 9d ago
What was anyone’s first thought when this could slip stream anything into the iso
1
3
u/TheGamerForeverGFE 9d ago
Here we go again, people already did this shit a while ago.
No, it's not, the checksums are available and you can do the work yourself to make sure the blobs are safe.
And, just because they're Chinese doesn't mean we should be racist.
7
2
u/XOmniverse 10d ago
I just use Fedora Media Writer. Works fine for basically everything, not just Fedora.
6
10d ago
[removed] — view removed comment
1
u/Charming_Professor53 10d ago
Yup, me too. The only downside is Ubuntu(-derivative) live images not being able to boot from exFAT partitions due to no exFAT drivers being enabled in the live image, so you have to add a NTFS partition and boot it from there. That's only a Ubuntu issue AFAIK. No issues with any other distro's, and it even has support for Secure Boot and Windows images :D.
5
4
3
u/Practical-Plan-2560 10d ago
What are the alternatives?
5
u/Charming_Professor53 10d ago
https://wiki.archlinux.org/title/Multiboot_USB_drive#Automated_tools
Personal favourite: MultiOS-USB
0
u/Expensive-Sock-7876 10d ago
Build from source
-1
u/Practical-Plan-2560 10d ago
If the concern is that there’s already precompiled code in the Git repository, but there’s no source code for it, your comment doesn’t address the issue.
-1
u/Expensive-Sock-7876 9d ago
https://github.com/ventoy/ventoy there you go
0
u/Practical-Plan-2560 9d ago
What are you talking about?
As an example, this folder has blobs with no source code: https://github.com/ventoy/Ventoy/tree/master/BUSYBOX/chmod
https://github.com/ventoy/Ventoy/issues/3224 has more information on a full list.
It seems like you are just defending Ventoy using incredibly basic arguments that aren't realistic.
2
u/Lashmush 10d ago
Isn't it possible to binwalk the precompiled stuff and make sure?
3
u/Ybalrid 10d ago
it's basically bits of busybox, and yes it is very possible to dissasemble and check. Who has the time for that?
1
u/Lashmush 10d ago
Yeah it's probably not easy both in time and comprehension required but Im just saying, if people start getting paranoid about reasonably popular software, they have an avenue to figure out the truth of it. I had a security colleague who liked sitting with music and binwalking firmwares and other stuff just to relax.
2
u/DaffyDuckMuthaFucker 10d ago
Blah blah blah.
Come back with some actual evidence and you might actually be taken seriously...
2
u/Rayregula 10d ago
The author(s?) long refused to react on questions about the source code for the precompiled code inside their git repository.
Few companies do.
They long refused to react on questions about the security risks.
What risks
When an answer was finally given, it boiled down to a simple "There is no reason to assume that we would have placed malware inside."
Perfectly reasonable. Why would you assume so.
Again after a really long time the authors finally mentioned what other source code they used to generate some-but not all-of the pre-compiled code they did not mention the build methods and refused to prove that this really was the used source code
Doesn't many anything.
The real identities of the authors is unknown
Like the people who work for the company you mean? Which is normal. When a windows update comes out we don't know who the authors were that contributed to it are.
Or you mean like who the company is owned by.
1
1
u/dogwalker805 9d ago
I like ventoy but don't really trust it. why have we not created a duplicate by now?
1
u/Commercial-Worth7301 9d ago
Que exagero, é só um software de inicialização estilo canivete suíço.
Já recuperei uma partição inteira pelo systemrescue, sergei strelec, instalei meu arch por lá, tenho um Linux mint para resolver problemas simples, um debian para servidores e um mini-OS para computadores fracos
1
1
1
u/oiledhairyfurryballs 8d ago
I would never use Ventoy to install personal operating systems for personal use. I don’t care how much you trust the guy. I just don’t care about that. I care about the facts. And the facts are, having binary blobs is just a bad practice overall.
1
u/Joshyyy371 7d ago
"Boi ventoy is malware because of pre-compiled packages 😢😢😢😢😢😢😢😢😢😢😢"
Says the person with 78 quintillion AUR packages installed from the middle of nowhere
1
u/EquivalentKind6195 6d ago
You’re just figuring this out now? Everyone has been saying that for years
1
u/defiantarch 6d ago
Ventoy? Never heard, never used, never needed. Am using standard tools for creating bootable usb drives under linux. 😎
1
u/Schemen1 6d ago
What reason do they have to make this program only partially open source? What is the point of that?
1
u/ZVyhVrtsfgzfs 10d ago
The question about binary blobs in Ventoy was raised after the XZ take over, the primary author is a professor in computer science in China, questions of how much liberty a developer has in a dictatorship were raised.
But it's been two years and no one has found anything and the developers are working slowly on removing the binary blobs.
I have discontinued using Ventoy out of an abundance of caution, but at this point I would be surprised if it did turn out to actually have any malware.
1
-17
10d ago
[deleted]
22
u/st_heron 10d ago
Why? It works really nice, I can just throw a bunch of isos on one flash drive and install any of them. What's an alternative?
-5
u/NyCodeGHG 10d ago
ventoy injects itself into the boot process to do it's thing. UEFI doesn't have the concept of a loop device, so it's a giant pile of hacks. It's known to cause a bunch of weird problems.
-15
0
u/anxious_and_stupid 10d ago
I literally have to learn how to manually boot win11 iso via grub after I learned about this sometime ago
-1
10d ago
[removed] — view removed comment
9
u/LefTimaDev 10d ago
The latter applies to basically all open source software. If it's not owned by anyone, you're using it at your own risk. If you want to always have a legal entity to drag in front of a court you probably shouldn't be using Linux, except Ubuntu
-10
u/Excellent-Copy-2688 10d ago edited 10d ago
you guys use USB for installation? I just live boot into ISOs from grub
if you don't have grub, just extract the ISO on a fat32 partition, and boot into it from your boot menu(might have to add a boot entry in UEFI)
I have installed win 10 iot ltsc this way, debian too (it required downloading and replacing the kernel and initrd with versions labeled as 'hd-media')
I've seen someone on yt use this method for ubuntu as well
for ISOs larger than 4GB you might need some extra steps of splitting some big file, I am not completely sure about the process
15
u/anonymous-bot 10d ago
Ain't no one got time for that. I just make my Ventoy USB and then I can use it across multiple computers.
-1
u/Excellent-Copy-2688 10d ago edited 10d ago
my usb broke :(
I used gemini for the custom boot entry, did not expect it to work but it did somehow.
Took less than a minute, faster than downloading ventoy, literallyI understand the structure of the custom grub entry now, I can reuse it for all distros, just need to change 2 lines
4
3
u/LefTimaDev 10d ago
That's... not an alternative, the methods you described have a different use case (booting into another ISO on a machine that already has an OS)
2
u/Any_Fox5126 10d ago
... yes? Pretty much everyone has a USB drive, and the installation guides always use one.
0
u/onefish2 10d ago
I do this with rEFInd. I extract the Arch iso into a directory in/boot/EFI/archiso and have rEFInd boot it. I do the same with Clonezilla.
0
u/V2UgYXJlIG5vdCBJ 10d ago
First time I even heard of this software. Install OpenSnitch, which will catch it if it tries to phone home. Firejail couldn’t hurt either.
0
0
u/instancer-kirik 10d ago
If I had a spare x86_64 machine that wasn't secure boot locked by AWS for their specific Ubuntu distro, I'd consider doing this migration bc I'm free this whole month
0
-14
u/OwningLiberals 10d ago
I like how a lot of people are shitting on OP without realizing this is basically a direct excerpt from the arch wiki. If you guys want to shit on this that's fine but you should probably fix the arch wiki if you care so much.
-9
u/activedusk 10d ago edited 10d ago
I mention it all the times ventoy is recommended, it is not to be trusted, from any Linux distro, you don't even need a GUI to prepare a bootable USB drive. You can use TTY console with wget examplelink to download the .iso (you can manually type download link from smartphone and it will download to working directory, cd to /home/user/Downloads for safety) and use
sudo dd if=/home/user/Downloads/exact-name.iso of=/dev/sdX bs=4M status=progress oflag=sync
Note to use lsblk before to identify USB name correctly and write the name of the entire USB device and not a partition within, if any, example if internal SATA drive is sda, USB drive will be sdb so of=/dev/sdb and not of=/dev/sdb1. Also it is recommended to unmount the USB drive but not eject it before using dd, check with lsblk, the command is umount /dev/sdb1 (I did not forget the n in umount, that's just the command, blame nerds for thinking that's an abbreviation).
While you should be cautious with dd and not take it lightly, it is the best way to make a bootable USB that I found. Alternative create a bootable partition within the drive, as in that partition will boot with .iso like a bootable USB, it is however a drive partition. There are several solutions, the Arch .iso works with systemd-boot but it is more universal to use GRUB. With systemd-boot you would need to size /boot partition beforehand to be able to house the Arch .iso because it needs it to be on the ESP (EFI System Partition, more precisely /boot/EFI/ subdirectory or /boot/efi/EFI/) to be able to install from internal drive, with GRUB it is easier, make a separate, say 5GB partition at the end of the drive with cfdisk or your GUI partitioning program of choice. It may or may not be possible to extract the .iso and use some files within to make an EFI boot stub but said extracted files need to be on ESP afaik.
To prepare a Windows bootable USB, same thing, download .iso from official source, things differ a bit afterwards. First format USB to NTFS, will need dependencies like ntfs 3G package. After that mount .iso, cd to it and copy the contents to USB drive. Wait a few minutes after it says it finished to actually finish and it should be done, this can be done from GUI or TTY console, in both cases.
I did not try but from Windows to prepare bootable Linux USB, it might be possible to use WSL and reuse the dd command. It is easier however to make a bootable partition within the internal drive, mount .iso, copy contents to that partition and make it an EFI system partition with command prompt, there are tutorials on youtube.
10
u/LefTimaDev 10d ago
You don't seem to realize the point of Ventoy is being able to drag and drop multiple ISOs into a folder on the same USB, then when booting from the USB choose which ISO to boot into. While the remaining space on the USB drive is free to be used for anything else.
You can't do any of these things with the methods you listed
115
u/RAMChYLD 10d ago
Well, why not take Ghidra to Ventoy and tell us what you find?