Ventoy is a tool to make a USB with multiple ISOs bootable, letting you select which ISO to use on boot. Another newly-created account claims to be the dev’s friend and translator and has received no contact from the maintainer.

  • just_another_person@lemmy.world
    link
    fedilink
    arrow-up
    13
    arrow-down
    2
    ·
    16 hours ago

    I understand the concern raised, but unless I’m reading this wrong there is an assumption that Ventoy may be doing something untoward, but I’m not sure how at this level. It can’t inject anything into the ISO files at rest without bricking then, and I don’t know if an OS that doesn’t verify it’s own image before booting.

    Just sounds like super lazy project administration. Maybe I’m missing something?

    • Aatube@kbin.melroy.orgOP
      link
      fedilink
      arrow-up
      13
      ·
      16 hours ago
      1. Around April, there was this big thing where a maintainer for XZ Compression included an SSH backdoor in binaries that were only built on release. If a freaking piece of compression software can backdoor SSH, who knows what else is possible.
      2. The response to the blob concern is nonsensical, made without their previously-known accounts, and coincides with someone’s claim that they are a close friend and was on vacation to China, the country where the XZ maintainer was from.
      • just_another_person@lemmy.world
        link
        fedilink
        arrow-up
        13
        arrow-down
        2
        ·
        16 hours ago

        The xz issue is something totally different though. That was a software library running and executing against flat files. I’m just not sure there’s a way to alter an ISO image before boot, undetected in the case of Ventoy.

        If the goal is to alter files to provide access to something, this must be some sort of ingenious way that bypasses checksums, and targets something universal, which doesn’t seem quite possible in the case of a substitute bootloader.

        • Aatube@kbin.melroy.orgOP
          link
          fedilink
          arrow-up
          2
          ·
          16 hours ago

          Yeah, it would be really big. I wouldn’t have posted about this if it weren’t for the radio silence and blabbering statement.