About the BLOBs in Ventoy · Issue #3224 · ventoy/Ventoy
github.com
In #2795 there are some discuss about the BLOBs in Ventoy. For a long time, I devoted my limited spare time to adding new features and fixing bugs and didn't get around to considering this. It shou...

The author addresses the issue.

  • HayadSont@discuss.online
    0·
    1 month ago

    Perhaps I’m too skeptical and/or have trust issues, but isn’t this too little too late? This issue had been ignored for so long, but -suddenly- within 24 hours of this very peculiar find[1], Ventoys maintainer goes into full damage-control mode. Should we just accept that?

    Sorry, at least for now, I simply don’t buy it.

    1. Spoiler alert: Ventoy’s sister software -called iVentoy- employs a trick that has been utilized for installing compromised kernel drivers. ↩︎

    • pastermil@sh.itjust.works
      0·
      1 month ago

      Quoting directly from the author:

      For a long time, I devoted my limited spare time to adding new features and fixing bugs and didn’t get around to considering this.

      I hate to break it to you, but it appears the author don’t even have the bandwidth to worry about your trust.

      • HayadSont@discuss.online
        0·
        1 month ago

        The fact remains though: why did they literally go radio silence on this issue for over a year? Like, a simple, “I would like to notify everyone that I’m working on this.” would have been sufficient. Was that too much to ask?

            • Kogasa@programming.dev
              0·
              1 month ago

              I mean the specific issue about the binary blobs. Something that might set off alarm bells for you or a security-focused group may not do so for some dude working on a passion project in his free time.

              • HayadSont@discuss.online
                0·
                1 month ago

                Thanks for clarifying.

                The example sentence could also be something like “I would like to notify everyone that I’m aware of this issue and I intend to start tackling it from <insert date> onwards. Allow me to explain the status quo for … (etc. etc.).”. Or whatever sentence you like. The point is not what the exact message is, but an alternative to the absolute radio silence we’ve met.

                As for them working on it or not. Clearly, they haven’t worked on it until now. But I don’t understand what was so crucial in the last 8 releases that they couldn’t address this issue instead. Especially, in the aftermath of the XZ utils backdoor. But that’s not the issue I was trying to address with my previous comment. The issue is radio silence. It doesn’t have to set off alarm bells for themselves in order to acknowledge (timely) the concern a chunk of its user base experiences.