Should I be worried if I used ventoy to install qubes (or any other OS)?

Hellothere · May 2, 2025, 5:23pm

opened 05:47AM - 03 Apr 24 UTC

FairyTail2000

### What happened? Due to the recent XZ-Utils drama I checked the code and I'…m appalled. There are more BLOBS than source code. https://github.com/ventoy/Ventoy/tree/3f65f0ef03e4aebcd14f233ca808a4f894657802/cryptsetup https://github.com/ventoy/Ventoy/tree/3f65f0ef03e4aebcd14f233ca808a4f894657802/Unix/ventoy_unix https://github.com/ventoy/Ventoy/tree/3f65f0ef03e4aebcd14f233ca808a4f894657802/DMSETUP There is no reason to have those not be build in the release process. Of course it's convenient, they are prebuild, it's fast and nobody has a problem with it. Recent events however showed that these BLOBs can contain everything and nothing. The build instructions would not produce the exact same executable for everyone. It's better to have GitHub build it on-push and use them out of the build cache. I would do it myself, but unfortunately I'm not familiar enough with the Ventoy build process to actually do it. I understand that removing BLOBs isn't a priority over new and shiny features. But due to recent events, this should be rethought. Thank you for reading this and I hope for a productive conversation

So the idea behind qubesOS is, you’re ‘ok’ as long as anything can’t get to dom0, since you can delete VMs as you please, if you suspect they have anything malicious going on. However ventoy is used to boot isos/live environments so I’m given to believe it has complete control over the system, if it wants to. So, how far can it go, really? Maybe it could muck around in the efi system partition, or could it even install a uefi rootkit if it wanted to?

I ask because, as is mentioned in the links above, the ventoy project doesn’t have best practices when it comes to actually building the software; they pull in some binary blobs and people have no way of verifying those. But even more concerning (for me at least) is the fact that the developer hasn’t responded to any of the issues raised.

So my question is, if I used ventoy in the past, what should I do?

FranklyFlawless · May 3, 2025, 2:29am

Reinstall Qubes OS without using Ventoy.

Hellothere · May 3, 2025, 3:16am

Ah so, I shouldn’t worry too much about having a UEFI rootkit?

FranklyFlawless · May 3, 2025, 3:34am

If UEFI rootkits are a valid concern against your threat model, it would be prudent to consider devices using Coreboot now.