this post was submitted on 17 Sep 2024
442 points (99.1% liked)

Open Source

31111 readers
282 users here now

All about open source! Feel free to ask questions, and share news, and interesting stuff!

Useful Links

Rules

Related Communities

Community icon from opensource.org, but we are not affiliated with them.

founded 5 years ago
MODERATORS
Cloak@lemmy.ml
kevincox@lemmy.ml
CrypticCoffee@lemmy.ml
Lettuceeatlettuce@lemmy.ml
442
Ventoy source code contains some unknown BLOBs, still no word on the issue from the dev after months (github.com)
submitted 1 month ago by SatyrSack@lemmy.one to c/opensource@lemmy.ml
134 comments fedilink hide all child comments
 

I had no idea this issue had been identified. While I find this tool very useful, the project is seeming rather questionable to me now.

you are viewing a single comment's thread
view the rest of the comments
[โ€“] refalo@programming.dev 2 points 1 month ago (1 children)

The problem is not near enough projects support reproducible builds, and many that do aren't being regularly verified, at least publicly.

[โ€“] Ferk@lemmy.ml 1 points 1 month ago* (last edited 1 month ago)

Yes, that's why im saying that this kind of problem isn't something particular about this project.

In fact I'm not sure if it's the case that the builds aren't reproducible/verifiable for these binaries in ventoy. And if they aren't, then I think it's in the upstream projects where it should be fixed.

Of course ventoy should try to provide traceability for the specific versions they are using, but in principle I don't think it should be a problem to rely on those binaries if they are verifiable.. just the same way as we rely on binaries for many dynamic libraries in a lot of distributions. After all, Ventoy is closer to being an OS/distribution than a particular program.