this post was submitted on 17 Sep 2024

442 points (99.1% liked)

Open Source

31272 readers

331 users here now

All about open source! Feel free to ask questions, and share news, and interesting stuff!

Useful Links

Rules

Posts must be relevant to the open source ideology
No NSFW content
No hate speech, bigotry, etc

Related Communities

Community icon from opensource.org, but we are not affiliated with them.

founded 5 years ago

MODERATORS

kevincox@lemmy.ml

CrypticCoffee@lemmy.ml

Lettuceeatlettuce@lemmy.ml

442

Ventoy source code contains some unknown BLOBs, still no word on the issue from the dev after months (github.com)

submitted 2 months ago by SatyrSack@lemmy.one to c/opensource@lemmy.ml

134 comments fedilink hide all child comments

I had no idea this issue had been identified. While I find this tool very useful, the project is seeming rather questionable to me now.

you are viewing a single comment's thread
view the rest of the comments

[–] todd_bonzalez@lemm.ee 27 points 2 months ago (2 children)

Anyone who wants to fix this can help fix it, but people are just making demands of an unpaid maintainer. The devs can run this project the way they want to. If you don't like it, don't use Ventoy.

The people comparing this to the xz exploit are out of line. xz was a library that was deeply embedded in a lot of software. Ventoy is an IT tool used to boot live OSes. Not even remotely the same attack surface.

Blobs in the source tree are not ideal, but people need to pick their battles.

[–] Lemongrab@lemmy.one 50 points 2 months ago

From what others have said: The blobs violate GPL because they are taken from other FOSS project but the changes Ventoy makes are not viewable.

[–] zarkanian@sh.itjust.works 3 points 2 months ago

If you don't like it, ~~don't use~~ fork Ventoy.