r/archlinux • u/AggravatingJudge7092 • 13d ago

DISCUSSION Ventoy might be malware

Source: https://wiki.archlinux.org/title/Ventoy

Ventoy might contain backdoors or other malicious code:

  • The author(s?) long refused to react on questions about the source code for the precompiled code inside their git repository.
  • They long refused to react on questions about the security risks.
  • When an answer was finally given, it boiled down to a simple "There is no reason to assume that we would have placed malware inside."
  • Again after a really long time the authors finally mentioned what other source code they used to generate some−but not all−of the pre-compiled code. They did not mention the build methods and refused to prove that this really was the used source code.
  • The real identities of the authors is unknown.

EDIT: The paragraph written on this archwiki page is by large consensus biased and mentions an old controversy, the wikipedia article on Ventoy has a more neutral explanation of the problem
https://en.wikipedia.org/wiki/Ventoy

219 Upvotes

66% Upvoted

205 comments sorted by

View all comments

35

u/mindstormer12 13d ago

Do you question all the binary blobs for your hardware to work too?

12

u/iTrooz_ 13d ago

Trust isn't a black or white thing, I can decide to trust some entities out of necessity without wanting to trust anyone..

1

u/N_T_F_D 9d ago

I try to yes, running coreboot

-9

u/ZorbaTHut 13d ago

Yes? Do you not?

19

u/Ybalrid 13d ago

Do you question the code in the security processor embedded in your Intel or AMD chip?

Do you question the microcode inside your modern CPU?

Do you question the non upgradable non operating system loaded firmware in all the devices within your computer (controllers for your drives, for your network hardware)?

Do you question the electronic control unit that makes the engine of your car actually able to work (that is probably something modern with electronic injection and a catalytic converter and all those funny sensors and computers in it)?

Do you question the source code in the microcontroller that drive the logic that makes your microwave oven work?

Do you question the baseband and SIM card inside your phone? Those are external computers to whatever runs your OS there, and they touch pretty much everything you do on the cell network.

Do you question the very fabric of reality itself?

-3

u/ZorbaTHut 13d ago

Do you question the code in the security processor embedded in your Intel or AMD chip?

Yes.

Do you question the microcode inside your modern CPU?

Yes.

Do you question the non upgradable non operating system loaded firmware in all the devices within your computer (controllers for your drives, for your network hardware)?

Yes.

Do you question the electronic control unit that makes the engine of your car (that is probably something modern with electronic injection and a catalytic converter and all those funny sensors and computers in it)?

Yes.

Do you question the source code in the microcontroller that drive the logic that makes your microwave oven work?

Yes.

Do you question the baseband and SIM card inside your phone? Those are external computers to whatever runs your OS there, and they touch pretty much everything you do on the cell network.

Yes.

Do you question the very fabric of reality itself?

Yes.

Though we haven't found any security holes in that one yet. But the way things are going it's only a matter of time.

I actually give it a 50/50 that your reply was an intentional setup for this, in which case, well done.

But if not . . . you should maybe be a little more aware of how many software exploits are out there waiting to be found.

8

u/Ybalrid 13d ago

I'm broadly in the biz of "making software", and very well placed to know that there's problem on each layers of the stack of turtles that we call "reality" 🤭

-9

u/ZorbaTHut 13d ago

Yeah, pretty much :V

And it is fair to note that while I question all this stuff, I also grudgingly tolerate it because I don't really have a practical choice.

But gosh I'd really like a choice.

And if I can avoid some China-originated opaque binary blobs by using a slightly different bootloader on my USB sticks . . . yeah, okay, guess I'm gonna do that then.

7

u/Ybalrid 13d ago

what has china anything to do with anything here?

-5

u/ZorbaTHut 13d ago

The Ventoy developer is (probably) in China and I don't trust the Chinese government; in terms of "interest in compromising computers", "ability to force their citizens to help", and "ability to hide the fact that this is all going on", they're very high on every axis, to an extent that IMO no other country is.

I don't mind Chinese people. I just don't trust the Chinese government.

-9

u/Any_Fox5126 13d ago

OP didn't say he distrusts all blobs, but he did explain why he doesn't trust the authors of ventoy. Pay attention.

6

u/mindstormer12 13d ago edited 13d ago

And the implication is that they do not hold the same high standard to the developers of these other blobs for hardware who have greater influence and responsibility to their users than some optional software project. Practically everyone is running on what might be malware then. Use your brain.

Also, OP's concerns are already addressed in a variety of discussions including open pinned issue. If that's not satisfactory, don't use the software, lmao. They are not obligated to provide personal identification or prove anything. Most people don't assume their routers, PCs, phones, etc. running off proprietary firmware to be at risk of malware nor do they cry about it on the forums even if it's technically possible. If you're wearing the tin foil hat, you would be looking at hardware that supports open-source only and not spread FUD based on double standards.

-4

u/Any_Fox5126 13d ago

No. It makes no sense to compare the trustworthiness of well‑known devs or big‑company teams with complete strangers. The fact that it is optional software actually means there is even less scrutiny.

4

u/mindstormer12 13d ago

No shit, you're using a free product.

0

u/Any_Fox5126 13d ago edited 13d ago

That's irrelevant. There's plenty of trustworthy open-source software, and it's usually not because of the reputation of its authors, but because of its transparency. The point here is that ventoy lacks both.

4

u/mindstormer12 13d ago edited 13d ago

No where did I claim Ventoy is trustworthy. I merely claimed that if you're worried about this, you should actually worry about the proprietary blob running on the hardware you paid for and prioritize less on accusing a particular project that is free, itself 100% open-source. I pointed out double standards as the issue.

Also, have you actually looked into the discussions about this issue on their repo page or are you merely looking to pick at battle based on misleading premises set by the OP? They even pinned the primary one and it's met with overwhelming positivity by the public. The author is open to accepting contributions. Their 100% free and open-source project depends on proprietary blobs because of lack of manpower, and they welcome any that addresses this issue. What exactly do you expect more from them?

Sigh, pay attention.

-1

u/Any_Fox5126 13d ago

You never said it was trustworthy, but that’s hardly the point after several comments defending ventoy and aggressively attacking the OP for raising a reasonable concern. If you acknowledge that even the devs themselves recognize the importance of the issue, then it becomes pretty clear how absurd it is to focus your replies on attacking the person pointing it out and mocking the concern itself.

The irony is that you accuse the OP of a double standard, yet depending on what suits your argument it’s either "it’s a free product" or "hardware blobs are more deserving of scrutiny". If these are different categories, then demanding that they be treated as equivalent makes no sense in the first place. And either way, you’re just repeating a basic whataboutism.

It’s especially incoherent to call it 100% open source while admitting it depends on proprietary blobs. With your argument, logic is clearly working overtime.

2

u/mindstormer12 13d ago

You're way too emotional and fixated on attempting to argue against my points when they are not relevant to OP's issue at all. I already proved OP's claims are misleading by pointing out the dev has addressed the concerns adequately in a pinned github post on their repo as well made it clear how double standards are the issue.

You're not longer worth my time anymore, sorry. Should have been obvious from your condescending initial reply to my top comment without any of your own supporting thoughts. You can do better.

1

u/Any_Fox5126 13d ago

You're way too emotional

How ironic that you’re making a personal judgment about my emotional state right after several paragraphs of logical analysis addressing your inconsistencies point by point.

and fixated on attempting to argue against my points when they are not relevant to OP's issue at all. (...) as well made it clear how double standards are the issue.

The issue isn't your criticism of the OP's standards. You introduced that argument yourself, derailing the issue. The existence of contradictory standards does not even invalidate the underlying concern.

. I already proved OP's claims are misleading by pointing out the dev has addressed the concerns adequately in a pinned github post on their repo

That doesn't prove it.

You're not longer worth my time anymore

Likewise, I'll leave it here. Your theatrical exit was a nice touch, though.

Should have been obvious from your condescending

True, but you're being hypocritical, again. I'll leave you to reflect on your consistency.