55
Nobody knows who responded here. Don't spread rumors.
I thought it was clear from the details that it was suspicious. Edited.
Things are suspicious but you still spread gossip and maybe lies.
My name is Linus torvalds and this is why I TempleOS...
so ive deep dived into as much information as i can find. the TLDR is the main dev LongPanda supposedly went on a vacation to china (most likely his home country?) to which there is conflicting information on his return. one path is he make a lemmy account 9hours ago and made a message that doesn't describe the blob and sound like a gpt response. to which his "irl friend made an account 3 hours ago to comment that he hasnt heard from LongPanda in months. both were removed from lemmy.ml because of suspected impersonation. the other side of the coin is the LongPanda is still gone and hasn't addressed the blobs. after looking thought the documentation, you can build from source. in the instructions it says "5. Binaries
There some binaries in Ventoy install package. These files are downloaded from other open source project's website, such as busybox."
i am not a programer but in the source build it lists the blobs and were there from supposedly from other FOSS projects with sha256's. so theoretically you should be able to verify the blobs, with the sha256.
https://github.com/ventoy/Ventoy/blob/master/DOC/BuildVentoyFromSource.txt
I like Ventoy, it's handy but I don't think it's indispensable so probably what I'll do is go back to using Etcher (which is open source AFAIK) until this resolves itself one way or another. I assume either the dev will respond properly with an explanation and everything will be fine, or someone will get fed up enough to fork it. I feel like it's probably nothing nefarious, but it doesn't really hurt to be overly cautious in this case IMO.
Ventoy's "killer feature" is the ability to have multiple ISOs in a single drive, can Etcher do that? If so I'll switch, if not why not just use dd?
Imho it will be much easier to replace blobs with verifiably correct blobs or add the source to build them than to retroactively find the original builds from whence they came.
Searching for some of those binaries looks like it would require comparing the hash against a large set of candidates which would need to first be unpacked from releases (fedora mostly???) and hashed unless the hashes already exist somewhere.
I understand the concern raised, but unless I'm reading this wrong there is an assumption that Ventoy may be doing something untoward, but I'm not sure how at this level. It can't inject anything into the ISO files at rest without bricking then, and I don't know if an OS that doesn't verify it's own image before booting.
Just sounds like super lazy project administration. Maybe I'm missing something?
- Around April, there was this big thing where a maintainer for XZ Compression included an SSH backdoor in binaries that were only built on release. If a freaking piece of compression software can backdoor SSH, who knows what else is possible.
- The response to the blob concern is nonsensical, made without their previously-known accounts, and coincides with someone's claim that they are a close friend and was on vacation to China, the country where the XZ maintainer was from.
The xz issue is something totally different though. That was a software library running and executing against flat files. I'm just not sure there's a way to alter an ISO image before boot, undetected in the case of Ventoy.
If the goal is to alter files to provide access to something, this must be some sort of ingenious way that bypasses checksums, and targets something universal, which doesn't seem quite possible in the case of a substitute bootloader.
Yeah, it would be really big. I wouldn't have posted about this if it weren't for the radio silence and blabbering statement.
It can’t inject anything into the ISO files at rest without bricking then, and I don’t know if an OS that doesn’t verify it’s own image before booting.
As far as I can tell, this is not talking about ISOs installed using Ventoy, but precompiled blobs of things like Busybox that are included in the Ventoy install package. It's an important distinction. The developer could bundle a tampered blob, include in the documentation the checksum that matches that blob, and then if someone checks with the upstream project and calls them out, say something along the lines of, "Oh, they must have withdrawn that release," and replace it with an untampered blob. If they don't fight to preserve the tampered blob, they might even get away with it.
The claim of the person you're replying to is that even if the binaries were tampered, Ventoy wouldn't be able to do anything.
Even if the original issue had anything to do with ISOs, he's way overestimating the level of protection on many install ISOs, in my experience—they're just disk images, and presumably all the files read off them are passing through Ventoy itself. Even if you find one that performs some kind of verification, easy enough to change a jump instruction to a no-op somewhere in the machine code guts of a file as it passes through Ventoy, and prevent the verification from executing. (The difficult part is figuring out which instruction to change, but people have done it before.)
No, I'm saying the way ISOs are written, you couldn't just, say, inject changes via text tools or whatever like the xz attack.
I'm not aware of HOW a binary blob not knowing specifically what it was going to attack COULD attack anything in a resting and isolated state like it would be with Ventoy.
Didn't something similar just happen with RustDesk? ChatGPT response from author in an hours old account.
On second sight, that specific response seems like a troll
I banned that one now too.
Some common threads I'm seeing with these troll accounts:
- lemmings.world
- new account
- claim to be or know the creators
- make claims about the insecurity of an open source app
- blame china in some way
Oh hell naw, I was rooting for rustdesk...
There are some random accounts that do not look like the original creator. I highly discourage from such titles like this post, because we don't know. "Ventoy" (creator) did not respond as far as I can see.
Edit: Even if it looks legitimate, it can be impersonating to gain trust. Don't blindly trust random people from new accounts.
In the best case, the software is unmaintained.
It is very much actively maintained other than this supposed vacation from the developer. Everything else is purely speculation and what seems to be impersonation of the dev on the fediverse.
This big issue has been open since April, and the dev has not responded, and his last commit was in early June. Yes, most of this is pure speculation, but 4 months is unmaintained.
Let's see... Ventoy is a tool intended for sysadmins to use.
Something sketchy is going on in a tool sysadmins use when working on the crown jewels.
What could possibly go wrong? /s
Interesting context to bring up Lemmy
Edit: from the thread, it's pretty clear those people were not the creator?
I'm not saying it was aliens, but it was aliens.
ancient aliens
view more: next ›
this post was submitted on 14 Oct 2024
55 points (71.7% liked)
Linux
48179 readers
993 users here now
From Wikipedia, the free encyclopedia
Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).
Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.
Rules
- Posts must be relevant to operating systems running the Linux kernel. GNU/Linux or otherwise.
- No misinformation
- No NSFW content
- No hate speech, bigotry, etc
Related Communities
Community icon by Alpár-Etele Méder, licensed under CC BY 3.0
founded 5 years ago
MODERATORS