this post was submitted on 18 May 2026
868 points (99.3% liked)
Lemmy Shitpost
39926 readers
3374 users here now
Welcome to Lemmy Shitpost. Here you can shitpost to your hearts content.
Anything and everything goes. Memes, Jokes, Vents and Banter. Though we still have to comply with lemmy.world instance rules. So behave!
Rules:
1. Be Respectful
Refrain from using harmful language pertaining to a protected characteristic: e.g. race, gender, sexuality, disability or religion.
Refrain from being argumentative when responding or commenting to posts/replies. Personal attacks are not welcome here.
...
2. No Illegal Content
Content that violates the law. Any post/comment found to be in breach of common law will be removed and given to the authorities if required.
That means:
-No promoting violence/threats against any individuals
-No CSA content or Revenge Porn
-No sharing private/personal information (Doxxing)
...
3. No Spam
Posting the same post, no matter the intent is against the rules.
-If you have posted content, please refrain from re-posting said content within this community.
-Do not spam posts with intent to harass, annoy, bully, advertise, scam or harm this community.
-No posting Scams/Advertisements/Phishing Links/IP Grabbers
-No Bots, Bots will be banned from the community.
...
4. No Porn/Explicit
Content
-Do not post explicit content. Lemmy.World is not the instance for NSFW content.
-Do not post Gore or Shock Content.
...
5. No Enciting Harassment,
Brigading, Doxxing or Witch Hunts
-Do not Brigade other Communities
-No calls to action against other communities/users within Lemmy or outside of Lemmy.
-No Witch Hunts against users/communities.
-No content that harasses members within or outside of the community.
...
6. NSFW should be behind NSFW tags.
-Content that is NSFW should be behind NSFW tags.
-Content that might be distressing should be kept behind NSFW tags.
...
If you see content that is a breach of the rules, please flag and report the comment and a moderator will take action where they can.
Also check out:
Partnered Communities:
1.Memes
10.LinuxMemes (Linux themed memes)
Reach out to
All communities included on the sidebar are to be made in compliance with the instance rules. Striker
founded 2 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
This is new to me, I can't find a reference. Can you share?
While Ventoy is technically open source so the code can be verified, the source also contains a number of binary blobs. As these blobs are already compiled, there is no way to verify what they actually do. Ostensibly, these blobs are just drivers and whatnot that are taken from the official upstream sources and are used by Ventoy for good reason to install things. But because they are already compiled blobs, no one is able to actually verify that. It is possible that they can also do something else nefarious, like secretly install some hidden spyware in your new OS that you are installing using Ventoy.
https://github.com/ventoy/Ventoy/issues/2795
https://github.com/ventoy/Ventoy/issues/3224
ELI5: Imagine you like a particular restaurant because they post the ingredients list on their menu. That way, you can tell if a dish fits your dietary requirements. But you notice that while one of their salads lists ingredients that make sense like "ICEBERG LETTUCE" and "CHERRY TOMATO", one of that salad's other ingredients is just "CANNED FOOD PRODUCT". Well, that is incredibly vague and not all that helpful. You can't really tell what that ingredient is or if it is something you are allergic to. For most people, in most situations, it is entirely fine. They can probably eat the salad with no problem. But some people would rather not risk the potential problems that come from not knowing for sure.
It was also strange that after this issue was brought up about Ventoy, it took quite a long time for the developer to actually respond. I believe they eventually came up with a good idea for a solution (using GitHub build actions or whatever to build the blobs from source), but mentioned that will be a big effort to actually switch to. So, they have not actually done that yet. I believe the unverified blobs are still in place in the source right now.
I've tried using GH Actions before to build binaries from source and it's difficult AF. It seems like using something like Nix could make this more doable.
This is the alert in Nixpkgs:
https://github.com/NixOS/nixpkgs/blob/d233902339c02a9c334e7e593de68855ad26c4cb/pkgs/by-name/ve/ventoy/package.nix#L213
Interesting. Worrying, even.