New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[issue]: Remove BLOBs from the source tree #2795
Comments
Hear hear! |
For those that are not familiar with the xz-utils backdoor, here is the original email send by Andres Freund who discovered the backdoor: |
Ventoy is in a quite unique position to be the target of state and non-state adversaries as malware and exploits could not only target certain installations or distros but the whole user base. In the face of headlines about linux desktop percentages ventoy could attract focus in search for new vectors. |
I fully agree, I use this not just at home but work too! |
Don't get your hopes up this has been an issue for a very long time. Use something else! |
Regardless of recent events, this should be addressed. Ventoy is an excellent concept and pretty solid execution, but security should be a critical focus. If the developer does or does not want to address this, hopefully some community members can contribute to alleviate this as a concern. For now I think it is a good idea to not use Ventoy myself. |
An XZ style attack is a once every few years worst case.
Do you want Jia Tan to come in and save us from these blobs? The main maintainer has been on vacation for a while has only just gotten back online a few days ago. Regarding the specifically attached binaries. There are certainly security considerations when using Ventoy. #135 |
You're missing the point. No there's nothing inheritly more dangerous about the blobs themselves. The issue is that one can't verify if it's safe or not. Source code can be audited, vulnerabilities discovered. You can't really do that with binary blobs. That's a major part of the open-source ethos. |
It's been a month. I think the developer should have enough time to respond to both the xz attack and this issue. I really hope to hear some official response. 从 XZ 的攻击到现在已经过了一个月了,我想开发者应该有足够的时间就这个 issue 所谈及的问题做出回应了。我真诚希望能够看到开发者官方的回应。 Thanks for developing this useful software. 感谢你开发这个软件的时间精力。 |
What happened?
Due to the recent XZ-Utils drama I checked the code and I'm appalled. There are more BLOBS than source code.
https://github.com/ventoy/Ventoy/tree/3f65f0ef03e4aebcd14f233ca808a4f894657802/cryptsetup
https://github.com/ventoy/Ventoy/tree/3f65f0ef03e4aebcd14f233ca808a4f894657802/Unix/ventoy_unix
https://github.com/ventoy/Ventoy/tree/3f65f0ef03e4aebcd14f233ca808a4f894657802/DMSETUP
There is no reason to have those not be build in the release process. Of course it's convenient, they are prebuild, it's fast and nobody has a problem with it.
Recent events however showed that these BLOBs can contain everything and nothing. The build instructions would not produce the exact same executable for everyone. It's better to have GitHub build it on-push and use them out of the build cache.
I would do it myself, but unfortunately I'm not familiar enough with the Ventoy build process to actually do it. I understand that removing BLOBs isn't a priority over new and shiny features. But due to recent events, this should be rethought.
Thank you for reading this and I hope for a productive conversation
The text was updated successfully, but these errors were encountered: