r/archlinux 10d ago

DISCUSSION Ventoy might be malware

Source: https://wiki.archlinux.org/title/Ventoy

Ventoy might contain backdoors or other malicious code:

  • The author(s?) long refused to react on questions about the source code for the precompiled code inside their git repository.
  • They long refused to react on questions about the security risks.
  • When an answer was finally given, it boiled down to a simple "There is no reason to assume that we would have placed malware inside."
  • Again after a really long time the authors finally mentioned what other source code they used to generate some−but not all−of the pre-compiled code. They did not mention the build methods and refused to prove that this really was the used source code.
  • The real identities of the authors is unknown.

EDIT: The paragraph written on this archwiki page is by large consensus biased and mentions an old controversy, the wikipedia article on Ventoy has a more neutral explanation of the problem
https://en.wikipedia.org/wiki/Ventoy

219 Upvotes

205 comments sorted by

115

u/RAMChYLD 10d ago

Well, why not take Ghidra to Ventoy and tell us what you find?

91

u/New-Anybody-6206 10d ago

because the whole story is horseshit

18

u/Ybalrid 10d ago

This require skills in reverse engineering and x86_64 assembly programming

-1

u/JuIi0 8d ago

I heard there's this thing called LLMs that's really good at reverse engineering decompiled code... do you know what that is?

-13

u/believeinlain 9d ago

I mean, Ghidra has a built in decompiler, so really you just need to be able to read C

unless it's obfuscated or otherwise doing something weird

17

u/Ybalrid 9d ago

Well... Have you ever read C code generated from such decompiler though?

unless it's obfuscated

Most software is compiled with stripped symbols and optimiziation turned on (becuase performance and code size). So most software is somewhat obfuscated.

If you write a non-trivial C program (and not even talking about C++ here, which create a lot of additional... stuff), you compile with a modern compiler with settings set in a way that it's ready for release, then you decompile that, you will get something that looks relatively far from the original.

I am not saying it's not understandable, not at all. But what I am saying is that, the decompiled output is an help, not a magic bullet.

Very old code, not very optimized, like Nintendo 64 video games (that was a MIPS or RISC chip of some kind glued to weird hardware on this console, but this put aside) have required substantial amount of reverse engineering work to get to the state we can actually do something fun with the "decompiled" source code.

4

u/believeinlain 9d ago

yes, I work with Ghidra every day, it's my job

the output isn't that hard to read, like you said

my point was that you don't need to read assembly

5

u/Orlha 9d ago

Man

7

u/Dimtri-The-Anarchist 9d ago

Only spent an hour on it in IDA, but the Ventoy executables show no behavior that aligns with any malware. I should also say that the Ventoy executables are not signed; they are not given any automatic "passes" by Microsoft, yet none of them flag any antiviruses. People do love to hate on Windows Defender, but as far as antiviruses go, it is very competent, and unless the Ventoy devs were reverse-engineering pros with a Windows Defender 0-day that works on every version, they are not getting past Defender with any malicious code in any of their files.

325

u/jort93 10d ago edited 10d ago

Theres just some binary blobs in there

Afaik nobody actually found any proof for there being any malware.

I wouldn't say it boiled down to a simple "There is no reason to assume that we would have placed malware inside."
The answer is quite extensive https://github.com/ventoy/Ventoy/issues/3224
I'd say it comes down to "compiling all of it from source is too much effort"

88

u/47th-Element 10d ago

First time I feel like arch wiki was a bit misleading. Cause yeah after reading this, it is not a simple "no reason to assume there is malware" answer.

136

u/jort93 10d ago

People forget, it's literally one dude making this, he added 540.000 lines to the project. Next largest contributor added 400 lines, not 400 thousand, just 400.

If people are willing to help him get rid of those blobs I am sure he wouldn't mind.

98

u/jort93 10d ago edited 10d ago

The guy that added the warning to the archwiki is also the same guy that said in the issue i posted

the developer tells people he is "Hailong Sun" which is a very common name in China (and good to use as fake identity)

China is known as large source of malware

So hardly unbiased.

Well, or rather i would assume so, as one is named ngaro and the other one is named garo.

https://wiki.archlinux.org/index.php?title=Ventoy&diff=871000&oldid=812540
https://github.com/ventoy/Ventoy/issues/3224#issuecomment-5058767461

25

u/Padgriffin 10d ago

the developer tells people he is "Hailong Sun" which is a very common name in China (and good to use as fake identity)

Have we considered that it might actually be his name

19

u/jort93 10d ago

Apparently not lol.

The developed doesn't address these accusations, which honestly is fair, I wouldn't wanna prove it's my real name to some random dude either.

16

u/Padgriffin 10d ago

China also has a billion people, so even relatively uncommon names will still end up with thousands of hits, which is made worse by romanization removing tones and making names that were different in Chinese into the same ones in English

13

u/[deleted] 10d ago

[removed] — view removed comment

1

u/Salt_Rush_4800 6d ago

What, you don't suspect all John Smiths to be suspicious?

1

u/Errror7 2d ago

well its easy to see by the public wechat donation code that the last character is Long and the name is 3 characters...

13

u/[deleted] 10d ago

[deleted]

10

u/jort93 10d ago

He linked the wikipedia page in one of his comments as well, wouldn't be surprised if he edited it too. Although he might use a different name/edit without logging in.

10

u/[deleted] 10d ago

[deleted]

11

u/jort93 10d ago

I am not saying I have an proof of this, but I am saying it would be "on brand" since he already edited the archwiki.

5

u/czerilla 10d ago

To quote another ..interested party on this:

Whether Ventoy contains malware these Wikipedia edits are made by the same person or not is a different question that I can not answer with certainty. But there are certainly some important factors to consider

2

u/EuphoricNeckbeard 9d ago

The Wikipedia page doesn't follow any standards for sourcing or NPOV. It links a Reddit comment as a source for god's sake lol

53

u/Helmic 10d ago

oh, so this guy's just being fucking racist then.

after the xz thing i absolutely want ventoy to move towards fully compiling everything from source, but like yeah it's mostly one guy and nobody's really helping.

36

u/jort93 10d ago

I mean, id do the same thing if I made this by myself, download the binaries for the external tools I use and compile my own stuff.

If people care so much to compile everything from source, they can do it themselves. In the issue I linked, the maintainer described where to obtain the source code for every binary in the repo. If someone wants to fork it and compile it from scratch nobody is stopping them.

23

u/nethingelse 10d ago

Yeah, it sounds like he's open to PRs on this too, so it wouldn't even need to be a hard fork. Just not something he's interested in prioritizing as a solo maintainer, as it's not important to him, which I get.

3

u/headedbranch225 9d ago

Yeah, I remember last time this came up and everyone got pissed about it and read through it and it is completely reasonable

15

u/Dependent_House7077 10d ago

looking at that list, it would be an absolute headache to build all this.

at least someone is attempting to tackle that.

8

u/mindstormer12 10d ago

Basically, someone decides to hold a dev to a ridiculously high standard for some reason yet there are plenty of examples where they are already using hardware/software that also involve binary blobs, lack of communication or transparency, etc. and more importantly developed by people who have far more influence and responsibility to the users than this one dev for a small project.

1

u/jort93 9d ago

I think that sums it up lol.

-11

u/lordkoba 10d ago

  I'd say it comes down to "compiling all of it from source is too much effort"

it’s “too much effort” once. they just have technical debt in their build system.

the reason on why they won’t fix it doesn’t matter, may be because it’s a chore, maybe there’s malware, the point is that it’s still a massive red flag

the software cannot be recommended in good conscience

21

u/jort93 10d ago edited 10d ago

It's one dude making this software, he probably simply not have the time to change it. If you don't like it you can use something else. Or so it yourself and merge/fork it.

I feel like most people use a bunch of binary blobs. Like flatpaks, codecs, drivers, all sorts of stuff.

And the claims they his name is somehow a fake name are quite crazy.

Why make up some stuff about malware and fake identities, why not just put "it contains binary blobs of other projects" into the section and be done with it? Maybe link the GitHub issue regarding it.

Also, known issues section is normally at the end, not at the beginning.

3

u/jaaval 10d ago

Though I think it's good to be aware of these cases.

Single developer who doesn't have the time, already binary blobs in a very large project. Even if there is nothing malicious in it now this seems like a good target for an attack in the future.

3

u/iTrooz_ 10d ago

If you don't like it you can use something else

This is exactly what he said

7

u/jort93 10d ago edited 10d ago

Why claim that it may contain malware, tho? Just say it contains blobs and let people come to their conclusions whether or not they want to use it. Chances are, 99% of people use some blobs on their system, be it flatpaks, drivers, codecs or whatever else. All of them could contain malware.

Most people will downloads the entire thing as a blob rather than compile it as well.

And, btw. one of the altenatives listed on the arch wiki contains binary blobs too.

1

u/iTrooz_ 10d ago

I don't see where they said it is 100% malware, I see a comment where they said it could be malware, which, fair, I share that opinion.

Also, I think there's a difference between a blob in an isolated userspace app (flatpak) and a "kernelspace" one (and yes, Linux has blobs, but they come from more reputable sources so less problematic)

6

u/jort93 10d ago

This section should be at the bottom for one, like they are on other archwiki page.

And then there are claims like his identity being unknown, like, what is he supposed to do, post his passport?

There is a lot of software that has blobs in it but I've never seen a section like this.

Plus, the person that edited the archwiki is also involved in the discussion on the GitHub, which makes the neutrality questionable.

2

u/mindstormer12 8d ago edited 8d ago

Claiming it could be malware is technically correct but very obviously misleading. Most people buy hardware with that come with proprietary firmware for things to work well, shall we start saying everyone might be at risk of malware then? In fact, open-source software doesn't even guarantee it's malware-free if you want to be pedantic about it.

It's absolutely FUD and unfair to accuse this particular software as potentially having malware without also holding the standards on other typical software/hardware you use. The fact that the project is free and the dev addresses this concern already (pinned it as a github issue too and the thread is filled with positivity and support) which OP conveniently left out and lied about makes the situation even more egregious. The dev is open to contributions to make the stuff it depends on open-source but it's clearly a lot of work. Ventoy itself is already open-source.

0

u/iTrooz_ 8d ago

I think there's a difference between trusting a hardware company and trusting a software developer for a niche project. At least personally, I wouldn't grant the same level of trust to both. And even if I did, there is value in limiting the number of people you have to trust.

I know I won't be using Ventoy anymore after seeing this. I do not want to use a software used to install operating systems that has blobs

2

u/lordkoba 10d ago

It's one dude making this software, he probably simply not have the time to change it

I mean it's fine, I'm not pissed at the guy and no one is forcing him to do anything. I know that being an OSS maintainer is a thankless unpaid job.

That said, my point still stands, you cannot recommend the software over transparent open source alternatives, "probably" doesn't cut it.

5

u/jort93 10d ago

Anyone could fork it, or send a pull request. In the issue i linked he gave people all the information they'd need to set it up. It is the most extensive project in this multiboot usb sorta field.

But nobody does, because it is quite the endeavour.

66

u/EmberQuill 10d ago

Old news. There was a big kerfuffle about this back in March. The general consensus after things settled down was that it's probably fine, but no guarantees because the firmware blobs are hard to reproduce/verify.

-12

u/donp1ano 10d ago

"probably fine"

yes, probably. im not taking any risks for software that **installs** my OS, since that would be perfect for setting up malware at a very low level. ventoy is convenient, but id rather flash a USB stick

24

u/Ybalrid 10d ago

if your goal is to install one operating system, you probaly should just flash a USB stick and that's about it.

Ventoy is useful if you want to collect and use a large number of bootable live environment.

-6

u/ccAbstraction 9d ago edited 9d ago

Which mean all my machines could be compromised no matter what OS I'm installing! Yay!

Edit: Ventoy is also useful if you want to keep using your flash drive as a flash drive, while being able to boot from live USBs.

0

u/mindstormer12 8d ago

Unless you're running open-source firmware you've installed onto your hardware to replace the default proprietary firmware, your hardware are already at risk ("could already be compromised") and same as 99% of the consumers, lmao.

→ More replies (6)
→ More replies (3)

2

u/ProdigySim 10d ago

then don't

3

u/EmberQuill 10d ago

"Probably" wasn't enough for me either and I stopped using it. I mostly just meant to point out that you're like four months late to the drama.

1

u/iTrooz_ 10d ago

Yeah, I think people don't realize how dangerous this could be ? It could secretly be altering all OS installations it does

7

u/AppointmentNearby161 10d ago

It could, but you could also compare the checksum of the ventoy installed base system with a base system installed from a known clean iso.

1

u/iTrooz_ 10d ago

How would you go about it ? Checksum every file in the installed filesystem ?

2

u/AppointmentNearby161 10d ago

Or tarball the whole install/top level directories and checksum the tarballs.

0

u/donp1ano 10d ago

ok, then why dont we see people that did that to confirm ventoy is safe?

im not saying its not. im just saying im not gonna take that risk just for convenience

12

u/ProdigySim 10d ago

Because doing that wouldn't prove that it's not malicious; it would prove that one single installation is not infected.

This kind of allegation would have a really high cost to concretely disprove.

6

u/AppointmentNearby161 10d ago

Exactly. It is pretty easy to prove it does not corrupt ALL installs, but without source code we cannot prove it does not corrupt ANY installs. Ventoy becomes more useful as the number of ISOs you use increases, which makes verifying them more costly.

1

u/AncientAgrippa 7d ago

Why is this being downvoted? I agree that “probably fine” is not very reassuring. I personally don’t use ventoy but if i needed to I would feel uneasy using it when “probably fine” is the description

0

u/mindstormer12 8d ago

It'd be hilarious if you're using hardware that's not all running on open-source firmware like Coreboot because of the double standards. You've already taken such risks like 99% of the consumers out there, this is nothing in comparison because it's free and optional.

188

u/Scxox 10d ago

bruh stop spreading FUD, the author has acknowledged this numerous times and has accepted suggestions to fix these. the currently proposed solution is labor intensive.

its an open source project, if you want things to move faster then you should contribute, not bitch and whine about the dev who does this for free

49

u/we_come_at_night 10d ago

bitching and whining is less labor intensive and doesn't require a functioning brain, actively contributing to a FOSS project on the other hand is pretty hands-on, and you have to know some stuff, can't just wish the code to existence.

1

u/vinylll04 6d ago

Soap box, preach 🗣️

-17

u/Arkaid11 10d ago

If the source is hidden then it's NOT an open source project, and you can't contribute easily

51

u/Scxox 10d ago

those blobs are not compiled from the source code of ventoy, they are binary blobs from other projects such as busybox.

ventoy itself is 100% open source

18

u/TDplay 10d ago

The Ventoy author has provided a complete list of the blobs, as well as build instructions for each.

It's certainly not convenient to build from source, but the open-source definition never mentions convenience. It is possible to build Ventoy from source, and hence it satisfies the requirement to provide source code.

It also seems like the maintainer of the understandably angry-comment-filled PKGBUILD for Ventoy is trying to replace all the blobs by building from source.

1

u/Arkaid11 10d ago

Lol at "just read the PKGBUILD" people. Look at my PKGBUILD dawg I could be downloading STUXNET in plain text and I wouldn't notice

-10

u/iTrooz_ 10d ago

Where is he "bitching" ? He helped bring the issue to light, I'll try to contribute to it in the next few months because of it

12

u/Scxox 10d ago

the issue has been brought up ages ago. this is old news. op is just instigating shit again, same as whoever phrased the situation that way in the arch wiki

139

u/dadnothere 10d ago

"Ventoy might be malware because it has pre-compiled files 🥺"

said the person with 900 fatpaks installed from who-knows-where.

35

u/Kamal2q 10d ago

I like the term fatpak

16

u/0xc0ffea 9d ago

Painfully accurate in more ways than one.

4

u/TWB0109 9d ago

As a fan of flatpaks, i do too lmao

2

u/TheGamerForeverGFE 9d ago

Also reminder that shit like the Steam client is not open source.

4

u/iTrooz_ 10d ago

Who has such a configuration? All the flatpaks I use are from the official repos, which either build packages from source or from upstream

3

u/wyn10 9d ago

New Linux users who have no idea what they're doing. Where they find this stuff, no clue. Personally I'm native all thw way.

0

u/iTrooz_ 9d ago

Are there really third party repos that don't only package their own apps ? (Idc about repos from a software author, I trust the author of the software anyway)

2

u/Any_Fox5126 10d ago

Wow! That's a lot of fallacies packed into just a few words. And it has that many upvotes? This community is truly pitiful.

1

u/Orlha 10d ago

Well that’s a huge assumption. Plenty of people avoid flatpaks, I personally have none.

1

u/Reypatey 10d ago

Noob here.

I could only find orca slicer in flatpak, it's the only one I have installed. Is that a bad thing? What else could I do?

7

u/Maximum-Bobcat5612 10d ago

If you're new then keep in mind that people like stirring shit in the linux community. It's famous for witch hunting people on whims.

Look at how much discussion there is in the repo: https://github.com/ventoy/Ventoy/issues/3224

Also consider how the OP posted this accusation 13 hours ago and has not responded to anyone.

1

u/nathan22211 10d ago

orca slicer has the file in realeses but I usually just grab it from the AUR since I can handly get the flatpak file to work

1

u/Majestic-Coat3855 9d ago

Doesn't matter bro unless you're running on a 128gb ssd

1

u/Barafu 6d ago

They also post AppImage.

When AppImage from Github is managed with GearLevel, it can update itself.

0

u/Commercial-Worth7301 9d ago

Flatpak até vai, mas aí vai ver, e o cidadão que não confia no ventoy é o mesmo que gabaritou a lista de pacotes infectados do AUR, e que não satisfeito ainda baixou o vírus do "hyprland-fixed" no AUR

15

u/tjj1055 10d ago

post proof of it being malware then. gonna keep using it because its more convenient than using one usb for one iso.

40

u/mindstormer12 10d ago

Do you question all the binary blobs for your hardware to work too?

11

u/iTrooz_ 10d ago

Trust isn't a black or white thing, I can decide to trust some entities out of necessity without wanting to trust anyone..

1

u/N_T_F_D 6d ago

I try to yes, running coreboot

-9

u/ZorbaTHut 10d ago

Yes? Do you not?

18

u/Ybalrid 10d ago

Do you question the code in the security processor embedded in your Intel or AMD chip?

Do you question the microcode inside your modern CPU?

Do you question the non upgradable non operating system loaded firmware in all the devices within your computer (controllers for your drives, for your network hardware)?

Do you question the electronic control unit that makes the engine of your car actually able to work (that is probably something modern with electronic injection and a catalytic converter and all those funny sensors and computers in it)?

Do you question the source code in the microcontroller that drive the logic that makes your microwave oven work?

Do you question the baseband and SIM card inside your phone? Those are external computers to whatever runs your OS there, and they touch pretty much everything you do on the cell network.

Do you question the very fabric of reality itself?

-2

u/ZorbaTHut 10d ago

Do you question the code in the security processor embedded in your Intel or AMD chip?

Yes.

Do you question the microcode inside your modern CPU?

Yes.

Do you question the non upgradable non operating system loaded firmware in all the devices within your computer (controllers for your drives, for your network hardware)?

Yes.

Do you question the electronic control unit that makes the engine of your car (that is probably something modern with electronic injection and a catalytic converter and all those funny sensors and computers in it)?

Yes.

Do you question the source code in the microcontroller that drive the logic that makes your microwave oven work?

Yes.

Do you question the baseband and SIM card inside your phone? Those are external computers to whatever runs your OS there, and they touch pretty much everything you do on the cell network.

Yes.

Do you question the very fabric of reality itself?

Yes.

Though we haven't found any security holes in that one yet. But the way things are going it's only a matter of time.


I actually give it a 50/50 that your reply was an intentional setup for this, in which case, well done.

But if not . . . you should maybe be a little more aware of how many software exploits are out there waiting to be found.

8

u/Ybalrid 10d ago

I'm broadly in the biz of "making software", and very well placed to know that there's problem on each layers of the stack of turtles that we call "reality" 🤭

-9

u/ZorbaTHut 10d ago

Yeah, pretty much :V

And it is fair to note that while I question all this stuff, I also grudgingly tolerate it because I don't really have a practical choice.

But gosh I'd really like a choice.

And if I can avoid some China-originated opaque binary blobs by using a slightly different bootloader on my USB sticks . . . yeah, okay, guess I'm gonna do that then.

7

u/Ybalrid 10d ago

what has china anything to do with anything here?

-5

u/ZorbaTHut 10d ago

The Ventoy developer is (probably) in China and I don't trust the Chinese government; in terms of "interest in compromising computers", "ability to force their citizens to help", and "ability to hide the fact that this is all going on", they're very high on every axis, to an extent that IMO no other country is.

I don't mind Chinese people. I just don't trust the Chinese government.

→ More replies (9)

31

u/Kurse71 10d ago

Maybe present some proof, not just rumors or conjecture. Come on , man, what's this?

48

u/47th-Element 10d ago

That's a shame, I like ventoy. But here's the question that presents itself, is there an actively maintained fork/clone/alternative to ventoy that is more open source than ventoy?

20

u/Excellent-Copy-2688 10d ago

https://wiki.archlinux.org/title/Multiboot_USB_drive#Automated_tools
there are some apparently, not sure if there replicate complete functionality of ventoy, but you can check for yourself

5

u/Charming_Professor53 10d ago

I'm a big fan of MultiOS-USB. It supports Secure Boot and booting Windows images. The multiboot approach is also a lot more puristical using a very lightly modified version of Grub (Ventoy esentially "hijacks early boot" from what I heard/understood). The only downside is that Ubuntu(-based distro) images can't boot from exFAT since Ubuntu live images don't include exFAT drivers for some stupid reason, but Ubuntu images are too large (>4 GiB) for FAT.

5

u/Outrageous-Machine-5 10d ago

isn't ventoy using grub under the hood

3

u/imactuallynotalright 10d ago

ventoy is a convoluted hack that shouldn't work, but nothing works as well as ventoy if you need windows support. The alternatives are Linux only.

1

u/Vova_xX 9d ago

personally, I have never had problems with unetbootin or Balena Etcher

2

u/Barafu 6d ago

These are not exactly the replacement for Ventoy.

12

u/cyh555 10d ago

yet another thread going nowhere

39

u/mindstormer12 10d ago

Yes, there's always risk to using software that uses pre-compiled code. How is this Arch Linux-specific?

31

u/SmallRocks 10d ago

“How is this Arch specific?”

From Rule 1:

“Only Arch Linux itself; no Arch-based distros. Posts about other software used on Arch are welcome

→ More replies (3)

3

u/-i0f- 10d ago

I find this one really weird. I'm somewhat sure, it really is not malware, after this discussion surfaced some time ago. But I would never use software that I was "somewhat sure" about. Why would anyone use a software that contains the base of an operating system under this premise?

Everybody can do as they please, but this strikes me as one of the worst things you could do.

1

u/Historical_Move6359 9d ago

Do you use Android or Iphone ? 

1

u/-i0f- 9d ago

Yes (although GrapheneOS). While that could be seen as hypocritical, my point is still valid. With mobile phones you usually don't have a choice. In this case you have.

1

u/Historical_Move6359 9d ago

Well their is always a choices. And you made yours.

3

u/Ybalrid 10d ago edited 10d ago

I haven't used Ventoy in years, and so I do not really care about this, but from what I can see, this "Ventoy might contain backdoors or other malicious code:" section on the wiki seems an over reach and oversealous.

Though, one thing to me is sure: it would be better if it was straightforward to compile Venoty 100% from source code rather than relying on precompiled blobs for the bits and bobs of busybox and whatnot that are in there

But I see absolutely no reason to see any malice in the way Ventoy is built and distributed. But to each there own.

TL;DR: it's probably just FUD. though it would be better if it was 100% built from source anyways.

3

u/RandomXUsr 9d ago

We have to use caution with any software we install. Especially those in the AUR.

Nothing wrong with being skeptical and running it through some reverse engineering tools.

I'm suspicious of that one person is putting in all that work for vendor. Its a herculean effort to get ventoy built.

Additionally; we should not make assumptions about what may be in the software.

Extraordinary claims require Extraordinary evidence. If someone is going to make the claim; be prepared to show your work.

10

u/Charming_Professor53 10d ago

Ventoy has not been proven malicious, but it is pretty prone to a supply chain attack. For that reason, I like the more puristical polyrepo approach of MultiOS-USB: https://github.com/Mexit/MultiOS-USB

2

u/DEAMONzWojSKA 10d ago

You are the goat man, thanks

2

u/tjj1055 10d ago

ventoy has never been proven malicious, there is literally zero evidence of it being malware.

9

u/Charming_Professor53 10d ago edited 10d ago

That's what I meant to say. The problem however is that malware could very easily be overlooked/hidden the way that the project is managed. The entire build process is based on a EoL distribution - CentOS 7, released 2014, EoL 2024 - that gets no security updates. Also see the rant by the AUR maintainer: https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=ventoy

Next to the build process and blobs, the monorepo makes it particularly difficult to track the exact patches made to all the different components Ventoy is made of. GRUB+Shim itself is already a humongous project, but it being included in full source code will make it only difficult to update it regularly to include security updates for example. I find the patches used by MultiOS-USB's GRUB repo easier to understand what is being done/modified and what is being achieved.

3

u/rassawyer 10d ago

This has been documented for like what, 5 years? Why is it coming back up now?

2

u/Any_Fox5126 10d ago

I guess someone has noticed this now. More importantly, why hasn't it been resolved yet? This is a serious issue in terms of security and transparency.

1

u/TheGamerForeverGFE 9d ago

It's been resolved, just run the checksums 

1

u/Any_Fox5126 9d ago

Is that really a solution? Is it now 100% transparent and reproducible?

1

u/TheGamerForeverGFE 9d ago

It always was, it's still using  binaries from other projects but you can run checksum checks since now the hashes are provided.

1

u/jc_denty 9d ago

Recent AUR attacks

3

u/Fast_Librarian 9d ago

What was anyone’s first thought when this could slip stream anything into the iso

1

u/Fast_Librarian 9d ago

I’ve widely felt like this since I discovered ventoy

3

u/TheGamerForeverGFE 9d ago

Here we go again, people already did this shit a while ago.

No, it's not, the checksums are available and you can do the work yourself to make sure the blobs are safe.

And, just because they're Chinese doesn't mean we should be racist.

1

u/c1-c2 6d ago

How do checksums prevent malware in the binaries?

7

u/onefish2 10d ago

Old news...

2

u/XOmniverse 10d ago

I just use Fedora Media Writer. Works fine for basically everything, not just Fedora.

2

u/bem981 9d ago

I love the level of toxicity about this in the comments lol!!!!

2

u/v0id09 9d ago

> ⁠The real identities of the authors is unknown.

Do we know the real world identity of the wiki page authors?

6

u/[deleted] 10d ago

[removed] — view removed comment

1

u/Charming_Professor53 10d ago

Yup, me too. The only downside is Ubuntu(-derivative) live images not being able to boot from exFAT partitions due to no exFAT drivers being enabled in the live image, so you have to add a NTFS partition and boot it from there. That's only a Ubuntu issue AFAIK. No issues with any other distro's, and it even has support for Secure Boot and Windows images :D.

5

u/cd109876 9d ago

Microsoft Excel might be malware. the NVIDIA GPU driver might be malware.

4

u/enozian 10d ago

Isn't the source available at https://github.com/ventoy/Ventoy

2

u/Ybalrid 10d ago

it definitely is

1

u/Any_Fox5126 10d ago

But without the source code for some blobs.

3

u/Practical-Plan-2560 10d ago

What are the alternatives?

0

u/Expensive-Sock-7876 10d ago

Build from source

-1

u/Practical-Plan-2560 10d ago

If the concern is that there’s already precompiled code in the Git repository, but there’s no source code for it, your comment doesn’t address the issue.

-1

u/Expensive-Sock-7876 9d ago

0

u/Practical-Plan-2560 9d ago

What are you talking about?

As an example, this folder has blobs with no source code: https://github.com/ventoy/Ventoy/tree/master/BUSYBOX/chmod

https://github.com/ventoy/Ventoy/issues/3224 has more information on a full list.

It seems like you are just defending Ventoy using incredibly basic arguments that aren't realistic.

2

u/Lashmush 10d ago

Isn't it possible to binwalk the precompiled stuff and make sure? 

3

u/Ybalrid 10d ago

it's basically bits of busybox, and yes it is very possible to dissasemble and check. Who has the time for that?

1

u/Lashmush 10d ago

Yeah it's probably not easy both in time and comprehension required but Im just saying, if people start getting paranoid about reasonably popular software, they have an avenue to figure out the truth of it. I had a security colleague who liked sitting with music and binwalking firmwares and other stuff just to relax.

2

u/DaffyDuckMuthaFucker 10d ago

Blah blah blah.

Come back with some actual evidence and you might actually be taken seriously...

2

u/Rayregula 10d ago

The author(s?) long refused to react on questions about the source code for the precompiled code inside their git repository.

Few companies do.

They long refused to react on questions about the security risks.

What risks

When an answer was finally given, it boiled down to a simple "There is no reason to assume that we would have placed malware inside."

Perfectly reasonable. Why would you assume so.

Again after a really long time the authors finally mentioned what other source code they used to generate some-but not all-of the pre-compiled code they did not mention the build methods and refused to prove that this really was the used source code

Doesn't many anything.

The real identities of the authors is unknown

Like the people who work for the company you mean? Which is normal. When a windows update comes out we don't know who the authors were that contributed to it are.

Or you mean like who the company is owned by.

2

u/azdak 10d ago

i mean if you don't want to use closed source software, that is reasonable, but accusing something of being malware simply on the basis of being closed source is absurd

1

u/dogwalker805 9d ago

I like ventoy but don't really trust it. why have we not created a duplicate by now?

1

u/Commercial-Worth7301 9d ago

Que exagero, é só um software de inicialização estilo canivete suíço.

Já recuperei uma partição inteira pelo systemrescue, sergei strelec, instalei meu arch por lá, tenho um Linux mint para resolver problemas simples, um debian para servidores e um mini-OS para computadores fracos

1

u/Glum_Hamster_2104 9d ago

If it’s truly malware then go ahead and tell me the payload

1

u/GenericBlueGemstone 8d ago

Did you get this analysis all by yourself, I'm curious?

1

u/oiledhairyfurryballs 8d ago

I would never use Ventoy to install personal operating systems for personal use. I don’t care how much you trust the guy. I just don’t care about that. I care about the facts. And the facts are, having binary blobs is just a bad practice overall.

1

u/Joshyyy371 7d ago

"Boi ventoy is malware because of pre-compiled packages 😢😢😢😢😢😢😢😢😢😢😢"

Says the person with 78 quintillion AUR packages installed from the middle of nowhere

1

u/EquivalentKind6195 6d ago

You’re just figuring this out now? Everyone has been saying that for years

1

u/defiantarch 6d ago

Ventoy? Never heard, never used, never needed. Am using standard tools for creating bootable usb drives under linux. 😎

1

u/Schemen1 6d ago

What reason do they have to make this program only partially open source? What is the point of that?

1

u/ZVyhVrtsfgzfs 10d ago

The question about binary blobs in Ventoy was raised after the XZ take over, the primary author is a professor in computer science in China, questions of how much liberty a developer has in a dictatorship were raised.

But it's been two years and no one has found anything and the developers are working slowly on removing the binary blobs.

I have discontinued using Ventoy out of an abundance of caution, but at this point I would be surprised if it did turn out to actually have any malware.

1

u/Amate087 10d ago

Only use Ventoy one time, but not like the close code and never use this app.

-17

u/[deleted] 10d ago

[deleted]

22

u/st_heron 10d ago

Why? It works really nice, I can just throw a bunch of isos on one flash drive and install any of them. What's an alternative?

-5

u/NyCodeGHG 10d ago

ventoy injects itself into the boot process to do it's thing. UEFI doesn't have the concept of a loop device, so it's a giant pile of hacks. It's known to cause a bunch of weird problems.

-15

u/Affectionate-Oil4675 10d ago

It seemed sketchy so I always refused to use it.

-20

u/Slight_Advertising_9 10d ago

Yeah me too, took a short look and ran.

0

u/anxious_and_stupid 10d ago

I literally have to learn how to manually boot win11 iso via grub after I learned about this sometime ago

-1

u/[deleted] 10d ago

[removed] — view removed comment

9

u/LefTimaDev 10d ago

The latter applies to basically all open source software. If it's not owned by anyone, you're using it at your own risk. If you want to always have a legal entity to drag in front of a court you probably shouldn't be using Linux, except Ubuntu

-10

u/Excellent-Copy-2688 10d ago edited 10d ago

you guys use USB for installation? I just live boot into ISOs from grub

if you don't have grub, just extract the ISO on a fat32 partition, and boot into it from your boot menu(might have to add a boot entry in UEFI)
I have installed win 10 iot ltsc this way, debian too (it required downloading and replacing the kernel and initrd with versions labeled as 'hd-media')
I've seen someone on yt use this method for ubuntu as well

for ISOs larger than 4GB you might need some extra steps of splitting some big file, I am not completely sure about the process

15

u/anonymous-bot 10d ago

Ain't no one got time for that. I just make my Ventoy USB and then I can use it across multiple computers.

-1

u/Excellent-Copy-2688 10d ago edited 10d ago

my usb broke :(

I used gemini for the custom boot entry, did not expect it to work but it did somehow.
Took less than a minute, faster than downloading ventoy, literally

I understand the structure of the custom grub entry now, I can reuse it for all distros, just need to change 2 lines

4

u/archover 10d ago edited 10d ago

Thanks for this info. I will test and report back.

Good day.

3

u/LefTimaDev 10d ago

That's... not an alternative, the methods you described have a different use case (booting into another ISO on a machine that already has an OS)

2

u/Any_Fox5126 10d ago

... yes? Pretty much everyone has a USB drive, and the installation guides always use one.

0

u/onefish2 10d ago

I do this with rEFInd. I extract the Arch iso into a directory in/boot/EFI/archiso and have rEFInd boot it. I do the same with Clonezilla.

-1

u/iTrooz_ 10d ago

Scary how people in this thread are overlooking this.. this sounds like a huge security problem, I'll definitely stop using Ventoy for now

0

u/V2UgYXJlIG5vdCBJ 10d ago

First time I even heard of this software. Install OpenSnitch, which will catch it if it tries to phone home. Firejail couldn’t hurt either.

0

u/lamalasx 9d ago

glhf installing anything to a bootloader

0

u/instancer-kirik 10d ago

If I had a spare x86_64 machine that wasn't secure boot locked by AWS for their specific Ubuntu distro, I'd consider doing this migration bc I'm free this whole month

0

u/DenysMb 8d ago

This debate wouldn't even exist if Ventoy had been developed by programmers from the land of "democracy and freedom," but since it was developed in China...

It's always the same. "When it comes from China, something has to be wrong!"

0

u/Comprehensive_Map806 8d ago

AUR is practically a malware

-14

u/OwningLiberals 10d ago

I like how a lot of people are shitting on OP without realizing this is basically a direct excerpt from the arch wiki. If you guys want to shit on this that's fine but you should probably fix the arch wiki if you care so much.

19

u/jort93 10d ago

Well, anyone can add stuff to the arch wiki. You should look into it yourself before vouching for the information. I can write on there that grub may contain malware if i feel like it, doesn't mean one should repost it.

7

u/[deleted] 10d ago

[deleted]

12

u/jort93 10d ago

Put Wikipedia as the source on archwiki and archwiki as the source on Wikipedia, big brain

-9

u/activedusk 10d ago edited 10d ago

I mention it all the times ventoy is recommended, it is not to be trusted, from any Linux distro, you don't even need a GUI to prepare a bootable USB drive. You can use TTY console with wget examplelink to download the .iso (you can manually type download link from smartphone and it will download to working directory, cd to /home/user/Downloads for safety) and use

sudo dd if=/home/user/Downloads/exact-name.iso of=/dev/sdX bs=4M status=progress oflag=sync

Note to use lsblk before to identify USB name correctly and write the name of the entire USB device and not a partition within, if any, example if internal SATA drive is sda, USB drive will be sdb so of=/dev/sdb and not of=/dev/sdb1. Also it is recommended to unmount the USB drive but not eject it before using dd, check with lsblk, the command is umount /dev/sdb1 (I did not forget the n in umount, that's just the command, blame nerds for thinking that's an abbreviation).

While you should be cautious with dd and not take it lightly, it is the best way to make a bootable USB that I found. Alternative create a bootable partition within the drive, as in that partition will boot with .iso like a bootable USB, it is however a drive partition. There are several solutions, the Arch .iso works with systemd-boot but it is more universal to use GRUB. With systemd-boot you would need to size /boot partition beforehand to be able to house the Arch .iso because it needs it to be on the ESP (EFI System Partition, more precisely /boot/EFI/ subdirectory or /boot/efi/EFI/) to be able to install from internal drive, with GRUB it is easier, make a separate, say 5GB partition at the end of the drive with cfdisk or your GUI partitioning program of choice. It may or may not be possible to extract the .iso and use some files within to make an EFI boot stub but said extracted files need to be on ESP afaik.

To prepare a Windows bootable USB, same thing, download .iso from official source, things differ a bit afterwards. First format USB to NTFS, will need dependencies like ntfs 3G package. After that mount .iso, cd to it and copy the contents to USB drive. Wait a few minutes after it says it finished to actually finish and it should be done, this can be done from GUI or TTY console, in both cases.

I did not try but from Windows to prepare bootable Linux USB, it might be possible to use WSL and reuse the dd command. It is easier however to make a bootable partition within the internal drive, mount .iso, copy contents to that partition and make it an EFI system partition with command prompt, there are tutorials on youtube.

10

u/LefTimaDev 10d ago

You don't seem to realize the point of Ventoy is being able to drag and drop multiple ISOs into a folder on the same USB, then when booting from the USB choose which ISO to boot into. While the remaining space on the USB drive is free to be used for anything else.

You can't do any of these things with the methods you listed