Conversation

Notices

It's FOSS (itsfoss@mastodon.social)'s status on Thursday, 08-Aug-2024 02:32:52 JST It's FOSS

Use Ventoy for easy ISO boots on a flash drive!
https://itsfoss.com/use-ventoy/

In conversation about 4 months ago from mastodon.social permalink
- johnpiers (farstrider@mastodon.social)'s status on Thursday, 08-Aug-2024 03:05:54 JST johnpiers
  in reply to
  
  @itsfoss
  [sic] "Ventoy is not available in the default repositories or 3rd party repos on Ubuntu or 𝘢𝘯𝘺 𝘰𝘵𝘩𝘦𝘳 𝘓𝘪𝘯𝘶𝘹 𝘥𝘪𝘴𝘵𝘳𝘪𝘣𝘶𝘵𝘪𝘰𝘯" From your website.
  ArchLinux AUR Repository.
  yay ventoy
  6: aur/iventoy-bin 1.0.20-1 (+2 0.07) PXE server.
  5: aur/grub-theme-ventoy 3.3-1 (+6 0.75)
  4: aur/ventoy-bin 1.0.99-1 (+347 13.53)
  
  3:arcolinux_repo_3party/ventoy-bin 1.0.99-1 (15.5 MiB 18.1 MiB)
  
  2:arcolinux_repo_3party/ventoy 1.0.97-2 (11.0 MiB 13.4 MiB)
  
  1: aur/ventoy 1.0.99-2 (+20 4.57)
  
  In conversation about 4 months ago permalink
- Kevin (kevin_vermassen@mastodon.social)'s status on Thursday, 08-Aug-2024 04:19:10 JST Kevin
  in reply to
  
  @itsfoss It’s a great tool, I have a USB device dedicated to it and I can quickly boot a bunch of OS’s.
  
  In conversation about 4 months ago permalink
- [iván] (iuveaene@mastodon.social)'s status on Thursday, 08-Aug-2024 04:36:21 JST [iván]
  in reply to
  
  @itsfoss
  Here's something to take into account before using Ventoy:
  https://theres.life/@arraybolt3/112910860206028596
  In conversation about 4 months ago permalink
  Attachments
  1. No result found on File_thumbnail lookup.
    
    Aaron Rainbolt (@arraybolt3@theres.life)
    
    from Aaron Rainbolt
    
    #Ventoy Security Concerns (please boost for visibility) Ventoy is a popular utility for making USB drives containing multiple operating systems in the form of bootable image files. While very useful in theory, the source tree contains numerous binary blobs without source code. This issue has been brought up to the authors multiple times, have not been corrected, and have even gotten worse (more blobs have been added to the code over time). This is a potential malware vector, similar to the "test files" in the xz-utils backdoor catastrophe. Recently the author has ignored a very lengthy thread raising security concerns because of these binary blobs. Given the amount of attention the thread has gotten, this seems strange, especially given that the authors have been active since then. https://github.com/ventoy/Ventoy/issues/2795 Stranger yet still, a video by Veronica Explains (@vkc@linuxmom.net) on how to create bootable USB flash drives got flooded by comments heavily suggesting the use of Ventoy and even being somewhat accusing because Veronica didn't advertise Ventoy. This is... not anything I've seen users of ANY open-source project do, and it feels similar to the social engineering done against Lasse Collin that convinced him to add Jia Tan as a maintainer, thus compromising xz-utils. See the comments of https://www.youtube.com/watch?v=QiSXClZauXA&t=3s If you're using Ventoy, you may want to consider ceasing its use for the time being out of an abundance of caution. If you truly need its functionality, you might look into something like the IODD SSD Enclosure (https://www.iodd.shop/HDD/SSD-Enclosure) which can emulate an optical drive and allows you to select an ISO saved to the drive to boot from. #linux #boot #security #malicious #backdoor

Public

Conversation

Notices

Feeds