7 ms·

About the BLOBs in Ventoy

130 points by turrini 1y ago

lpcvoid 1y ago
Nice that the community is addressing this. I was never able to trust Ventoy in the past, and as such still have a wide array of USB sticks to install Linux flavors with.
- mkesper 1y ago
  NB mainly iVentoy seems to be suspicious, relying on Windows exploits to bypass certification needs.
  - ForOldHack 1y ago
    That was both it's charm,and it's notoriousness. I was using it, but when the blob thing became a concern, me and the guy who recommended it, stopped using it,and now it's more of a curiosity, but no longer used. EFI is basically crippleware now,and two dev friends of mine just bought macs, leaving me their Lenovo collections. Two X1 carbons and three T590s.
- dspillett 1y ago
  For installation I have had to drop back to a normal single-image USB stick before now because the installer became confused by the EFI partition presented by the unpacked ISO and anything found/not on the target drives. Ventoy is very handy for running things live though, and not all installers/situations are affected by this (and there they are, it isn't really ventoy's fault).
- alphager 1y ago
  I just use an enclosure that emulates a dvd-drive. Put a cheap SATA ssd in there and you can stop worrying about incompatibilities.
  - metadat 1y ago
    How do you image the SSD? Isn't it kind of the same issue as with imaging a USB stick?
    - doubled112 1y ago
      You don't image it. You drag and drop ISOs into a directory on the SSD, and the USB device emulates a DVD ROM drive with the contents. You choose the ISO through a small screen and button on the device.
      - beagle3 1y ago
        Can you give the model name of the one you use?
        green-salt 1y ago
        not the OP but I use the IODD ST400 for this purpose and wish I had gotten something like this long ago
        sigio 1y ago
        Can confirm, also have 2 IODD devices for this purpose, though I usually grab my (simplest) USB stick that has netboot.xyz flashed to it, and just boot off that, and select whatever netboot image I want and have it get everything from the interwebs. No need to ever update this workflow.
        doubled112 1y ago
        Will netboot.xyz boot from a WiFi connection? I've always assumed no, and most of my machines do not have Ethernet jacks anymore.
        burnt-resistor 1y ago
        Way too many unnecessary features and too expensive. The 2531 is perfect. I've had this since about 2014.
- Aaargh20318 1y ago
  I have a bunch of network-bootable installers set up on my DHCP server. If I want to install a new machine I simply set it to boot from the network. From there I can just select whichever distro I want. I also added some utils like Memtest86
  - jraph 1y ago
    Do you have this documented somewhere? I tried to set up netboot a few times, it seems like this should be very easy to do, especially that I self host many things, but I get lost in the technical details every time. I think I succeeded once, with the dhcp server running on a laptop running Debian… Turns out doing some speleology to find a USB key and burning an ISO on it using cat or pv ends up being radically easier… (OTOH it's been a while since I last tried and now I have root on my router running OpenWrt so I guess it would be a tad easier…)
    - toast0 1y ago
      I'm sure there's howto's around, maybe this one from ipxe is a good place to start [1], but if you're running isc-dhcpd (which is discontinued, but still works, so....) you add something like this into your subnet config: next-server 192.0.2.11; if exists user-class and option user-class = "iPXE" { option ipxe.no-pxedhcp 1; filename "http://192.0.2.11/tftpboot/menu.ipxe"; } else { if option client-arch = 00:06 { filename "ipxe.efi-i386"; } else if option client-arch = 00:07 { filename "ipxe.efi-x86_64"; } else { filename "undionly.kpxe"; } } (use your addresses instead of rfc 5737 addresses). Note that the client-arch for amd64/x86_64 matches what PXE clients actually use instead of what the rfc 4578 says (there's an errata, but rfc policy is not to incorporate corrections sigh ). If you've got other archs, you can probably figure it out. You've got to run a tftp server on the next server address; and just FYI some PXE clients won't reach outside their subnet to get to the tftp server. Grab the ipxe binaries from wherever is convenient and they live in the root of the tftpserver. You can follow the ipxe docs for what to put in your menu file. I've got a menu of weird things, which includes item --key n netboot netboot.xyz [n] :netboot chain --autofree http://boot.netboot.xyz/ goto main_menu You could probably just use the boot.netboot.xyz in your dhcpd config and then you don't have to write a menu at all. Depending on your client machines, expect to have to fiddle around a bit. I've got some machines where PXE works, but the keyboard won't work in PXE, so that's not super useful. Others where PXE doesn't really work in UEFI mode, only in BIOS mode; there's probably some vice versa. Also, I've never figured out a good way to load ISOs in UEFI mode ... in BIOS mode you can use MEMDISK and if the OS supports it, it can find the disk image in memory and mount it when it boots. The netboot people do a good job of finding ways to make things work, but don't expect everything to work. I originally started from some version of this document [2], but I've moved on since then. IMHO, netbooting is a nice way to run hobby OSes... no need to worry about a boot loader and all that, just build for multiboot and ipxe will work (and grub will work, too, if you ever do want to run off a disk) It's possible to get Windows ISOs to boot with PXE, but it takes a lot more patience than I've got to make it work well ... if I use iscsi, the OS loads, but takes several minutes to get the disk image mounted after the installer starts; it would probably be faster to write the image to a usb disk and run from there. I was able to install to an iscsi drive, but then the same problem with mounting happened when I tried to boot from there, and then you just end up at a stop error screen because the OS really does want a mounted filesystem when it starts. (there's something about tweaking the driver setup, but that's too much work for me, I found a drive to run off of, and did what I needed to do) [1] https://ipxe.org/howto/dhcpd https://ipxe.org/howto/dhcpd [2] https://wiki.debian.org/PXEBootInstall?action=show&redirect=DebianInstaller%2FNetbootPXE https://wiki.debian.org/PXEBootInstall?action=show&redirect=...
immibis 1y ago
FWIW "blob" isn't an acronym. It refers metaphorically to an amorphous ball of goop. In databases only, it has been backronymed to "binary large object".
- unwind 1y ago
  Good point, [1] is a handy reference on the word. Also used in the compound word "blobfish", of which [2] is a well-known specimen. [1]: https://en.wiktionary.org/wiki/blob https://en.wiktionary.org/wiki/blob [2]: https://en.wikipedia.org/wiki/Mr_Blobby_(fish) https://en.wikipedia.org/wiki/Mr_Blobby_(fish)
- dspillett 1y ago
  Or where the LOB types could actually be text ([N]NVARCHAR(MAX) in SQL Server, or the deprecated [N]TEXT in the same), I refer to them as Bloody Large OBject. Or if you don't like blobs but do like recursive acronyms: Bloody Large Odious BLOB.
- aleph_minus_one 1y ago
  > FWIW "blob" isn't an acronym. As far as I am aware, BLOB is an acronym for "Binary Large Object" [1], but it is part of the pun that, as you wrote, a blob is (also) an amorphous ball of goop. [1] At least according to the German Wikipedia: https://de.wikipedia.org/wiki/Binary_Large_Object https://de.wikipedia.org/wiki/Binary_Large_Object
  - colonwqbang 1y ago
    The Blob is a movie from 1958 and the blobs in databases were named after the movie. Later, some people felt that blob should be an acronym. https://web.archive.org/web/20231108173312/https://www.ibphoenix.com/resources/documents/history/doc_299 https://web.archive.org/web/20231108173312/https://www.ibpho...
    - aleph_minus_one 1y ago
      > Later, some people felt that blob should be an acronym. At least this acronym took on a life of its own: we now also have CLOBs (which correspond to no English word that I am aware of): https://en.wikipedia.org/wiki/Character_large_object https://en.wikipedia.org/wiki/Character_large_object
Tatiana343 1y ago
[dead]
karambanoonoo 1y ago
[flagged]
- maplant 1y ago
  care to elaborate on this?
  - ForOldHack 1y ago
    [flagged]
- elitepleb 1y ago
  citation needed
- rlonstein 1y ago
  I don't have a dog in the fight, since I don't use Ventoy. Are you referring to this https://github.com/ventoy/Ventoy/issues/3224#issuecomment-2992687654 https://github.com/ventoy/Ventoy/issues/3224#issuecomment-29...?
- 77pt77 1y ago
  is that Ventoy or IVentoy?
daft_pink 1y ago
I really like Ventoy and use it and I’m just not worried about getting attacked with it on my personal homelab. It just works really well.
mococa 1y ago
I used Ventoy for a long time with various distros and even Windows, but for some reason it didn’t work with Arch (btw). I had to use a separate USB thumbdrive just for it.
- fumeux_fume 1y ago
  Arch worked just fine for me
- Halian 1y ago
  I’ve never had issues using Ventoy to install Arch.
- c-hendricks 1y ago
  I've had Arch isos work fine from Ventoy, also had Arch isos not able to complete installs without Ventoy.
graton 1y ago
I'll believe it when it happens. The maintainer hasn't done much regarding this for over 5 years. There are issues raised about this back in 2020 and not much has changed. It just seems suspicious to me. But I might be paranoid. I'm not willing to trust it.
- spookie 1y ago
  Same. Even the issue presented here seems to not be taken seriously. Paraphrasing, but things like: "Ah well, some blobs are ok, it is just for convenience" just smells like trouble. The project is free and all, but damn. Has nobody, in the last half a decade, thought about automagically building those blobs alongside the project? In my brain you're just postponing a large build system refactor, one that will get worse over time.
baobun 1y ago
If[0] the maintainer is entirely honest and well-intentioned, they are clearly a vulnerable target lacking the capabilities to reliably detect if their supply chain would be compromised. Using Ventoy is a huge risk regardless of what you think of maintainer credibility at this point. The cynical take is that what's on display in this issue is feigned ignorance/incompetence constructing plausible deniability. Their security posture has not evolved with the times, the threat-landscape, and the growth of the project. [0]: Very doubtful if you have been following this saga or dig around enough
- wavemode 1y ago
  > Very doubtful if you have been following this saga or dig around enough This is the first I'm hearing of any of this drama. Any links to relevant information indicating that the maintainer is being disingenuous?
  - baobun 1y ago
    There are probably better links still around if you DYOR but a sample with further pointers: https://nixsanctuary.com/ventoy-718-shades-of-open-source/ https://nixsanctuary.com/ventoy-718-shades-of-open-source/ https://news.ycombinator.com/item?id=40689629 https://news.ycombinator.com/item?id=40689629 (See also: Sus behavior from Deepin which recently got the project removed from Suse) https://feddit.org/post/12078124 https://feddit.org/post/12078124 https://linuxmom.net/@vkc/112906968594601449 https://linuxmom.net/@vkc/112906968594601449
echoangle 1y ago
Having just used Ventoy to install Linux on a computer, should I consider it compromised and reinstall? Or technically completely trash it?
- Technetium 1y ago
  That would be quite an overblown reaction. There is currently no proof of malicious activity.
  - halJordan 1y ago
    In fact there's no suspicion or allegation of malicious activity. This all started as a "hey it's not oss and i can't stand things that aren't oss." With all the security scare theater being used to justify the "it needs to be oss" demands.
josteink 1y ago
So much work because most people can’t manage a simple dd-invocation. And because Windows don’t allow direct access to the physical layer from a user-space shell. Such a waste.
- FuturisticGoo 1y ago
  The primary reason why I use Ventoy is because of its ability to use multiple ISO's, which I can select from when booting. I don't think that's possible with dd. It's also possible to use the usb stick for regular files, Ventoy will just ignore them. Pretty useful when you need it.
Technetium 1y ago
https://github.com/fnr1r https://github.com/fnr1r is currently working on a reproducible open build system. If you wish to help the process, direct your attention there! You can see progress on the issues of their repos, as well as in this now (appropriately) locked issue: https://github.com/ventoy/Ventoy/issues/2795 https://github.com/ventoy/Ventoy/issues/2795

130 points by turrini 1y ago

Nice that the community is addressing this. I was never able to trust Ventoy in the past, and as such still have a wide array of USB sticks to install Linux flavors with.

mkesper 1y ago
NB mainly iVentoy seems to be suspicious, relying on Windows exploits to bypass certification needs.
- ForOldHack 1y ago
  That was both it's charm,and it's notoriousness. I was using it, but when the blob thing became a concern, me and the guy who recommended it, stopped using it,and now it's more of a curiosity, but no longer used. EFI is basically crippleware now,and two dev friends of mine just bought macs, leaving me their Lenovo collections. Two X1 carbons and three T590s.
dspillett 1y ago
For installation I have had to drop back to a normal single-image USB stick before now because the installer became confused by the EFI partition presented by the unpacked ISO and anything found/not on the target drives. Ventoy is very handy for running things live though, and not all installers/situations are affected by this (and there they are, it isn't really ventoy's fault).
alphager 1y ago
I just use an enclosure that emulates a dvd-drive. Put a cheap SATA ssd in there and you can stop worrying about incompatibilities.
- metadat 1y ago
  How do you image the SSD? Isn't it kind of the same issue as with imaging a USB stick?
  - doubled112 1y ago
    You don't image it. You drag and drop ISOs into a directory on the SSD, and the USB device emulates a DVD ROM drive with the contents. You choose the ISO through a small screen and button on the device.
    - beagle3 1y ago
      Can you give the model name of the one you use?
      - green-salt 1y ago
        not the OP but I use the IODD ST400 for this purpose and wish I had gotten something like this long ago
        sigio 1y ago
        Can confirm, also have 2 IODD devices for this purpose, though I usually grab my (simplest) USB stick that has netboot.xyz flashed to it, and just boot off that, and select whatever netboot image I want and have it get everything from the interwebs. No need to ever update this workflow.
        doubled112 1y ago
        Will netboot.xyz boot from a WiFi connection? I've always assumed no, and most of my machines do not have Ethernet jacks anymore.
        burnt-resistor 1y ago
        Way too many unnecessary features and too expensive. The 2531 is perfect. I've had this since about 2014.
Aaargh20318 1y ago
I have a bunch of network-bootable installers set up on my DHCP server. If I want to install a new machine I simply set it to boot from the network. From there I can just select whichever distro I want. I also added some utils like Memtest86
- jraph 1y ago
  Do you have this documented somewhere? I tried to set up netboot a few times, it seems like this should be very easy to do, especially that I self host many things, but I get lost in the technical details every time. I think I succeeded once, with the dhcp server running on a laptop running Debian… Turns out doing some speleology to find a USB key and burning an ISO on it using cat or pv ends up being radically easier… (OTOH it's been a while since I last tried and now I have root on my router running OpenWrt so I guess it would be a tad easier…)
  - toast0 1y ago
    I'm sure there's howto's around, maybe this one from ipxe is a good place to start [1], but if you're running isc-dhcpd (which is discontinued, but still works, so....) you add something like this into your subnet config: next-server 192.0.2.11; if exists user-class and option user-class = "iPXE" { option ipxe.no-pxedhcp 1; filename "http://192.0.2.11/tftpboot/menu.ipxe"; } else { if option client-arch = 00:06 { filename "ipxe.efi-i386"; } else if option client-arch = 00:07 { filename "ipxe.efi-x86_64"; } else { filename "undionly.kpxe"; } } (use your addresses instead of rfc 5737 addresses). Note that the client-arch for amd64/x86_64 matches what PXE clients actually use instead of what the rfc 4578 says (there's an errata, but rfc policy is not to incorporate corrections sigh ). If you've got other archs, you can probably figure it out. You've got to run a tftp server on the next server address; and just FYI some PXE clients won't reach outside their subnet to get to the tftp server. Grab the ipxe binaries from wherever is convenient and they live in the root of the tftpserver. You can follow the ipxe docs for what to put in your menu file. I've got a menu of weird things, which includes item --key n netboot netboot.xyz [n] :netboot chain --autofree http://boot.netboot.xyz/ goto main_menu You could probably just use the boot.netboot.xyz in your dhcpd config and then you don't have to write a menu at all. Depending on your client machines, expect to have to fiddle around a bit. I've got some machines where PXE works, but the keyboard won't work in PXE, so that's not super useful. Others where PXE doesn't really work in UEFI mode, only in BIOS mode; there's probably some vice versa. Also, I've never figured out a good way to load ISOs in UEFI mode ... in BIOS mode you can use MEMDISK and if the OS supports it, it can find the disk image in memory and mount it when it boots. The netboot people do a good job of finding ways to make things work, but don't expect everything to work. I originally started from some version of this document [2], but I've moved on since then. IMHO, netbooting is a nice way to run hobby OSes... no need to worry about a boot loader and all that, just build for multiboot and ipxe will work (and grub will work, too, if you ever do want to run off a disk) It's possible to get Windows ISOs to boot with PXE, but it takes a lot more patience than I've got to make it work well ... if I use iscsi, the OS loads, but takes several minutes to get the disk image mounted after the installer starts; it would probably be faster to write the image to a usb disk and run from there. I was able to install to an iscsi drive, but then the same problem with mounting happened when I tried to boot from there, and then you just end up at a stop error screen because the OS really does want a mounted filesystem when it starts. (there's something about tweaking the driver setup, but that's too much work for me, I found a drive to run off of, and did what I needed to do) [1] https://ipxe.org/howto/dhcpd https://ipxe.org/howto/dhcpd [2] https://wiki.debian.org/PXEBootInstall?action=show&redirect=DebianInstaller%2FNetbootPXE https://wiki.debian.org/PXEBootInstall?action=show&redirect=...

immibis 1y ago

FWIW "blob" isn't an acronym. It refers metaphorically to an amorphous ball of goop. In databases only, it has been backronymed to "binary large object".

unwind 1y ago
Good point, [1] is a handy reference on the word. Also used in the compound word "blobfish", of which [2] is a well-known specimen. [1]: https://en.wiktionary.org/wiki/blob https://en.wiktionary.org/wiki/blob [2]: https://en.wikipedia.org/wiki/Mr_Blobby_(fish) https://en.wikipedia.org/wiki/Mr_Blobby_(fish)
dspillett 1y ago
Or where the LOB types could actually be text ([N]NVARCHAR(MAX) in SQL Server, or the deprecated [N]TEXT in the same), I refer to them as Bloody Large OBject. Or if you don't like blobs but do like recursive acronyms: Bloody Large Odious BLOB.
aleph_minus_one 1y ago
> FWIW "blob" isn't an acronym. As far as I am aware, BLOB is an acronym for "Binary Large Object" [1], but it is part of the pun that, as you wrote, a blob is (also) an amorphous ball of goop. [1] At least according to the German Wikipedia: https://de.wikipedia.org/wiki/Binary_Large_Object https://de.wikipedia.org/wiki/Binary_Large_Object
- colonwqbang 1y ago
  The Blob is a movie from 1958 and the blobs in databases were named after the movie. Later, some people felt that blob should be an acronym. https://web.archive.org/web/20231108173312/https://www.ibphoenix.com/resources/documents/history/doc_299 https://web.archive.org/web/20231108173312/https://www.ibpho...
  - aleph_minus_one 1y ago
    > Later, some people felt that blob should be an acronym. At least this acronym took on a life of its own: we now also have CLOBs (which correspond to no English word that I am aware of): https://en.wikipedia.org/wiki/Character_large_object https://en.wikipedia.org/wiki/Character_large_object

Tatiana343 1y ago

[dead]

karambanoonoo 1y ago

[flagged]

maplant 1y ago
care to elaborate on this?
- ForOldHack 1y ago
  [flagged]
elitepleb 1y ago
citation needed
rlonstein 1y ago
I don't have a dog in the fight, since I don't use Ventoy. Are you referring to this https://github.com/ventoy/Ventoy/issues/3224#issuecomment-2992687654 https://github.com/ventoy/Ventoy/issues/3224#issuecomment-29...?
77pt77 1y ago
is that Ventoy or IVentoy?

daft_pink 1y ago

I really like Ventoy and use it and I’m just not worried about getting attacked with it on my personal homelab. It just works really well.

mococa 1y ago

I used Ventoy for a long time with various distros and even Windows, but for some reason it didn’t work with Arch (btw). I had to use a separate USB thumbdrive just for it.

fumeux_fume 1y ago
Arch worked just fine for me
Halian 1y ago
I’ve never had issues using Ventoy to install Arch.
c-hendricks 1y ago
I've had Arch isos work fine from Ventoy, also had Arch isos not able to complete installs without Ventoy.

graton 1y ago

I'll believe it when it happens. The maintainer hasn't done much regarding this for over 5 years. There are issues raised about this back in 2020 and not much has changed. It just seems suspicious to me. But I might be paranoid. I'm not willing to trust it.

spookie 1y ago
Same. Even the issue presented here seems to not be taken seriously. Paraphrasing, but things like: "Ah well, some blobs are ok, it is just for convenience" just smells like trouble. The project is free and all, but damn. Has nobody, in the last half a decade, thought about automagically building those blobs alongside the project? In my brain you're just postponing a large build system refactor, one that will get worse over time.

baobun 1y ago

If[0] the maintainer is entirely honest and well-intentioned, they are clearly a vulnerable target lacking the capabilities to reliably detect if their supply chain would be compromised. Using Ventoy is a huge risk regardless of what you think of maintainer credibility at this point. The cynical take is that what's on display in this issue is feigned ignorance/incompetence constructing plausible deniability. Their security posture has not evolved with the times, the threat-landscape, and the growth of the project. [0]: Very doubtful if you have been following this saga or dig around enough

wavemode 1y ago
> Very doubtful if you have been following this saga or dig around enough This is the first I'm hearing of any of this drama. Any links to relevant information indicating that the maintainer is being disingenuous?
- baobun 1y ago
  There are probably better links still around if you DYOR but a sample with further pointers: https://nixsanctuary.com/ventoy-718-shades-of-open-source/ https://nixsanctuary.com/ventoy-718-shades-of-open-source/ https://news.ycombinator.com/item?id=40689629 https://news.ycombinator.com/item?id=40689629 (See also: Sus behavior from Deepin which recently got the project removed from Suse) https://feddit.org/post/12078124 https://feddit.org/post/12078124 https://linuxmom.net/@vkc/112906968594601449 https://linuxmom.net/@vkc/112906968594601449

echoangle 1y ago

Having just used Ventoy to install Linux on a computer, should I consider it compromised and reinstall? Or technically completely trash it?

Technetium 1y ago
That would be quite an overblown reaction. There is currently no proof of malicious activity.
- halJordan 1y ago
  In fact there's no suspicion or allegation of malicious activity. This all started as a "hey it's not oss and i can't stand things that aren't oss." With all the security scare theater being used to justify the "it needs to be oss" demands.

josteink 1y ago

So much work because most people can’t manage a simple dd-invocation. And because Windows don’t allow direct access to the physical layer from a user-space shell. Such a waste.

FuturisticGoo 1y ago
The primary reason why I use Ventoy is because of its ability to use multiple ISO's, which I can select from when booting. I don't think that's possible with dd. It's also possible to use the usb stick for regular files, Ventoy will just ignore them. Pretty useful when you need it.

Technetium 1y ago

https://github.com/fnr1r https://github.com/fnr1r is currently working on a reproducible open build system. If you wish to help the process, direct your attention there! You can see progress on the issues of their repos, as well as in this now (appropriately) locked issue: https://github.com/ventoy/Ventoy/issues/2795 https://github.com/ventoy/Ventoy/issues/2795