this post was submitted on 14 Oct 2024
53 points (71.2% liked)
Linux
48363 readers
1421 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
so ive deep dived into as much information as i can find. the TLDR is the main dev LongPanda supposedly went on a vacation to china (most likely his home country?) to which there is conflicting information on his return. one path is he make a lemmy account 9hours ago and made a message that doesn't describe the blob and sound like a gpt response. to which his "irl friend made an account 3 hours ago to comment that he hasnt heard from LongPanda in months. both were removed from lemmy.ml because of suspected impersonation. the other side of the coin is the LongPanda is still gone and hasn't addressed the blobs. after looking thought the documentation, you can build from source. in the instructions it says "5. Binaries
There some binaries in Ventoy install package. These files are downloaded from other open source project's website, such as busybox."
i am not a programer but in the source build it lists the blobs and were there from supposedly from other FOSS projects with sha256's. so theoretically you should be able to verify the blobs, with the sha256.
https://github.com/ventoy/Ventoy/blob/master/DOC/BuildVentoyFromSource.txt
I like Ventoy, it's handy but I don't think it's indispensable so probably what I'll do is go back to using Etcher (which is open source AFAIK) until this resolves itself one way or another. I assume either the dev will respond properly with an explanation and everything will be fine, or someone will get fed up enough to fork it. I feel like it's probably nothing nefarious, but it doesn't really hurt to be overly cautious in this case IMO.
Ventoy's "killer feature" is the ability to have multiple ISOs in a single drive, can Etcher do that? If so I'll switch, if not why not just use dd?
dd can do that?
It's deja vu all over again 😹
So can grub. Actually ventoy is built on grub
Imho it will be much easier to replace blobs with verifiably correct blobs or add the source to build them than to retroactively find the original builds from whence they came.
Searching for some of those binaries looks like it would require comparing the hash against a large set of candidates which would need to first be unpacked from releases (fedora mostly???) and hashed unless the hashes already exist somewhere.