• troed@fedia.io
        link
        fedilink
        arrow-up
        39
        arrow-down
        1
        ·
        2 months ago

        oh wow that really put the trust back into Ventoy. Nice! Thanks for the link

        • fmstrat@lemmy.nowsci.com
          link
          fedilink
          English
          arrow-up
          15
          ·
          2 months ago

          Happened after a partner product in the Ventoy repo was found to have a pretty major vulnerability due to a… you guessed it, pre-compiled supply chain attack.

      • Possibly linux@lemmy.zip
        link
        fedilink
        English
        arrow-up
        19
        ·
        2 months ago

        There is also a new community fork to get rid of the blobs and bad cert loading. The ventroy dev has made a bunch of concerning choices so some people hard forked the code. I forgot where is was though.

      • Turret3857
        link
        fedilink
        English
        arrow-up
        3
        arrow-down
        1
        ·
        2 months ago

        Took them over a year to say anything? I have since just gone back to burning single drives and honestly it’s fine. Ventoy was convenient but taking a year to respond to a genuine concern is crazy.

        • rtxn@lemmy.worldM
          link
          fedilink
          arrow-up
          6
          arrow-down
          1
          ·
          edit-2
          2 months ago

          I’m going to guess you’ve never been part of a project with complexity and sheer black magic fuckery comparable to Ventoy. The developer (a singular person) had to make a choice between:

          • Pandering to a small group of vocal open-source extremists, dedicating a large part of their time to changing the incredibly complex build process to also build the binaries of other open-source projects, potentially at the cost of stability, eventually arriving at a product with the same feature set, pleasing some open-source extremists, but still receiving criticism for “taking a year to respond to a genuine concern”; or
          • Not doing that and focusing their effort on stability and compatibility fixes to arrive at an improved product.

          I’ve read the original issue thread front to back, and it’s a fucking clown show. I can’t blame the developer for not wanting to engage with those people. Nobody is entitled to the developer’s time or attention. Right now the issue is being worked on, which is more than most of the whiners can say about themselves; if you think that’s still insufficient, do better.

          • Turret3857
            link
            fedilink
            English
            arrow-up
            1
            arrow-down
            1
            ·
            2 months ago

            I don’t think a simple statement of “I see your concern, I’ll address it when I have time” is really that hard for one person to issue when the alternative is, as you’ve said, letting “a fucking clown show” fester on. It would’ve made my worries go away if the developer had said literally anything instead of radio silence for a year. Sure, no one is entitled to a developers time or attention. That developer is also not entitled to my trust or recommendation to others when a serious issue was swept under the rug for over a year. There’s no doing better when it comes to a matter of personal opinion on how a situation was handled.

    • Lucien [he/him]@mander.xyz
      link
      fedilink
      arrow-up
      12
      ·
      2 months ago

      Off topic, but I’d never heard of Ventoy before and looking at it now, holy shit, I wish I’d known about it sooner.

        • Possibly linux@lemmy.zip
          link
          fedilink
          English
          arrow-up
          7
          ·
          edit-2
          2 months ago

          It isn’t a “proprietary back end” it is what Stallman calls Service as a Software Substitute. (SaaSS) It wouldn’t matter if they claimed it was completely foss. You are still using a foreign service you don’t control.

          With a package manager that is sort of unavoidable though. In the case of snaps you could always modify the source to have a different repo. The real reason not to use snaps is all the other issues.

          • merci3@lemmy.world
            link
            fedilink
            arrow-up
            8
            ·
            2 months ago

            Fair point. Just to be clear: I am NOT a developer, so I may be very wrong on that take.

            But from what I understand, the difference from what snaps does to what traditional packages does is that the Canonical repos are hard coded in it, thus making it harder to decentralise, and that’s not very in line with what many wish for a FOSS ecosystem.

  • andybytes@programming.dev
    link
    fedilink
    English
    arrow-up
    4
    arrow-down
    1
    ·
    2 months ago

    If the working conditions don’t change computers will become a ball and chain Then deemed useless.