16
“Ventoy” responds to blobs concern on GitHub with ChatGPT nonsense from a newly-created Lemmy account after sole maintainer’s vacation to China (github.com)
submitted 14 hours ago by Aatube@kbin.melroy.org to c/linux@lemmy.ml
18 comments fedilink hide all child comments

Ventoy is a tool to make a USB with multiple ISOs bootable, letting you select which ISO to use on boot. Another newly-created account claims to be the dev's friend and translator and has received no contact from the maintainer.

top 18 comments
sorted by: hot top controversial new old
[-] Steamymoomilk@sh.itjust.works 12 points 9 hours ago* (last edited 9 hours ago)

so ive deep dived into as much information as i can find. the TLDR is the main dev LongPanda supposedly went on a vacation to china (most likely his home country?) to which there is conflicting information on his return. one path is he make a lemmy account 9hours ago and made a message that doesn't describe the blob and sound like a gpt response. to which his "irl friend made an account 3 hours ago to comment that he hasnt heard from LongPanda in months. both were removed from lemmy.ml because of suspected impersonation. the other side of the coin is the LongPanda is still gone and hasn't addressed the blobs. after looking thought the documentation, you can build from source. in the instructions it says "5. Binaries

There some binaries in Ventoy install package. These files are downloaded from other open source project's website, such as busybox."

i am not a programer but in the source build it lists the blobs and were there from supposedly from other FOSS projects with sha256's. so theoretically you should be able to verify the blobs, with the sha256.

https://github.com/ventoy/Ventoy/blob/master/DOC/BuildVentoyFromSource.txt

[-] callcc@lemmy.world 39 points 14 hours ago

Nobody knows who responded here. Don't spread rumors.

[-] Aatube@kbin.melroy.org 4 points 13 hours ago

I thought it was clear from the details that it was suspicious. Edited.

[-] callcc@lemmy.world 5 points 5 hours ago

Things are suspicious but you still spread gossip and maybe lies.

[-] Quackdoc@lemmy.world 26 points 14 hours ago

My name is Linus torvalds and this is why I TempleOS...

[-] thingsiplay@beehaw.org 6 points 10 hours ago* (last edited 10 hours ago)

There are some random accounts that do not look like the original creator. I highly discourage from such titles like this post, because we don't know. "Ventoy" (creator) did not respond as far as I can see.

Edit: Even if it looks legitimate, it can be impersonating to gain trust. Don't blindly trust random people from new accounts.

[-] Aatube@kbin.melroy.org 1 points 10 hours ago

In the best case, the software is unmaintained.

[-] Virkkunen@fedia.io 1 points 2 hours ago

It is very much actively maintained other than this supposed vacation from the developer. Everything else is purely speculation and what seems to be impersonation of the dev on the fediverse.

[-] Aatube@kbin.melroy.org 1 points 1 hour ago

This big issue has been open since April, and the dev has not responded, and his last commit was in early June. Yes, most of this is pure speculation, but 4 months is unmaintained.

[-] just_another_person@lemmy.world 11 points 12 hours ago

I understand the concern raised, but unless I'm reading this wrong there is an assumption that Ventoy may be doing something untoward, but I'm not sure how at this level. It can't inject anything into the ISO files at rest without bricking then, and I don't know if an OS that doesn't verify it's own image before booting.

Just sounds like super lazy project administration. Maybe I'm missing something?

[-] Aatube@kbin.melroy.org 13 points 12 hours ago
  1. Around April, there was this big thing where a maintainer for XZ Compression included an SSH backdoor in binaries that were only built on release. If a freaking piece of compression software can backdoor SSH, who knows what else is possible.
  2. The response to the blob concern is nonsensical, made without their previously-known accounts, and coincides with someone's claim that they are a close friend and was on vacation to China, the country where the XZ maintainer was from.
[-] just_another_person@lemmy.world 10 points 12 hours ago

The xz issue is something totally different though. That was a software library running and executing against flat files. I'm just not sure there's a way to alter an ISO image before boot, undetected in the case of Ventoy.

If the goal is to alter files to provide access to something, this must be some sort of ingenious way that bypasses checksums, and targets something universal, which doesn't seem quite possible in the case of a substitute bootloader.

[-] Aatube@kbin.melroy.org 2 points 12 hours ago

Yeah, it would be really big. I wouldn't have posted about this if it weren't for the radio silence and blabbering statement.

[-] deadbeef79000@lemmy.nz 2 points 8 hours ago

I'm not saying it was aliens, but it was aliens.

[-] Blaze@lemmy.zip 7 points 14 hours ago* (last edited 14 hours ago)

Interesting context to bring up Lemmy

Edit: from the thread, it's pretty clear those people were not the creator?

this post was submitted on 14 Oct 2024
16 points (61.4% liked)

Linux

47715 readers
839 users here now

From Wikipedia, the free encyclopedia

Linux is a family of open source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991 by Linus Torvalds. Linux is typically packaged in a Linux distribution (or distro for short).

Distributions include the Linux kernel and supporting system software and libraries, many of which are provided by the GNU Project. Many Linux distributions use the word "Linux" in their name, but the Free Software Foundation uses the name GNU/Linux to emphasize the importance of GNU software, causing some controversy.

Rules

Related Communities

Community icon by Alpár-Etele Méder, licensed under CC BY 3.0

founded 5 years ago
MODERATORS
AgreeableLandscape@lemmy.ml
nooter692@lemmy.ml
MarcellusDrum@lemmy.ml
cypherpunks@lemmy.ml
cyclohexane@lemmy.ml
d3Xt3r@lemmy.nz