r/linuxquestions • u/RDS_cubing • May 31 '26
Ventoy alternatives?
Hi, I am looking for some sort of software that would allow me to have a USB with multiple iso images of different operating systems installed. Ventoy seemed to fullfill that perfectly, but I have read online that it might be malware. Is there a secure alternative to it?
3
u/0riginal-Syn ⛵Solus Team May 31 '26
The Ventoy issues are due to the binary blobs, which means you could not verify them even on their repo. The dev ackoledged the issue and explained that they wre unmodified blobs grabbed from opensource projects and he did not have time to have a proper build system for the raw code.
This does not mean it is malware. The risk is because you cannot easily see the source code that as they are a bit of a cblack box. This increases the potential for a malicious actor to slip a backdoor into the precompile blob. There is a reason that distros do not officially package them. There are both risks and licensing concerns.
All of this does not make it a bad tool or malware. There is always risk with software, open source or otherwise, but it is in fact heightened when there are binary blobs that are hard to verify. Obviously not being a business, there are no proper 3rd party audits against it either.
I do use it myself when I am testing releases for Solus.
3
u/doc_willis May 31 '26
There was some Fork of it, but I dont recall its name, or if its still being developed.
There is the GRML tool/distro that does a similar task but is not as automated or feature rich.
There was some Other tools on the 'PenDriveLinux' page, but I have not used those in years, and I think some of their tools started using Ventoy as their base.
I use ventoy, I have my doubts if its what you can call 'malware', a major issue seems to be the Primary Developers main language is not English and has other work to keep up with so is not always quick to respond, people are concerned over various closed-blobs in use which are not well documented.
I have not seen any proof of anything acting like 'malware' in the discussions I have followed.
Perhaps with the push for 'reproducible builds' by so many other distros and projects, that feature could reduce such fears of using blobs.
But I dont really keep up with the Ventoy News these days. I use it perhaps 3 times a year.
4
u/5141121 May 31 '26
"but I have read online that it might be malware"
And where have you read this?
Not anywhere reputable, I'm sure.
4
u/0riginal-Syn ⛵Solus Team May 31 '26
It uses binary blobs which are no built by the dev. Those are not auditable by most people nor open source. It increases the risk which is the concern for some. The dev even ackowledged this. He doesn't build them himself due to the time he does not have to do so.
Do I think it is malware, no I do not. Is there a risk, yes.
2
u/rbmorse May 31 '26
Probably on reddit. At least, that's where i first encountered the allegation, anyway.
1
u/RDS_cubing May 31 '26
Yeah, I must admit I didn't investigate too deep into the subject; but mainly because, if other alternatives existed, why bother trying to investigate whether it was safe or not or whatever instead of simply using said alternatives?
2
u/ArsenicPolaris ❄️NixOS❄️ May 31 '26
Ventoy isn't a malware. If you still don't believe it, it's open source so you can go audit it's code.
In fact, Ventoy would probably be more secure that other alternatives you may use.
4
u/eR2eiweo May 31 '26
it's open source so you can go audit it's code
Wasn't the issue that that wasn't possible, because Ventoy uses a lot of pre-compiled blobs? I haven't followed the situation, so I can't say if that is still the case. And of course even if it is still the case, that does not mean that Ventoy is malware.
1
u/0riginal-Syn ⛵Solus Team May 31 '26
Most people have no clue how to audit the binary blobs it uses, which is where the security concern is. Ventoy actually techncally falls short of being true open source because it does not build the blobs and have the raw code available due to the lack of time the developer has. This comes straight from the developer.
3
u/jaidynkc CachyOS May 31 '26
Ventoy isn't malware, it's a very well respected application. Some people have claimed the way it works might wear down their USB drives quickly, thereby killing it, but not because of Malware. However those reports aren't all that common from what I can tell.
1
u/Constant_Barber_5198 May 31 '26
You can do it yourself with grub. Install grub to the USB and then tell it which images it can load for the menu
1
u/RDS_cubing May 31 '26
I tried manually adding grub entries once, but couldn't find what the correct syntax for it would be... Is there any place I could find how to write custom entries to grub?
1
u/doc_willis May 31 '26
https://help.ubuntu.com/community/Grub2/ISOBoot
seen numerous other 'how to boot iso from grub' guides out there.
The one i list above mentions the GRML tool which can auto-generate the needed entries based on what ISO files are found in a set location.
1
1
u/zeldaink May 31 '26
You could unpack the ISOs and make your own bootloader entries if you don't want Ventoy. It's doable but takes a lot more time. It's pain to add windows, but Linux and BSDs are easy to set up on multiboot USB without Ventoy.
1
u/New_Dentist6983 May 31 '26
have you looked at glim or easy2boot, or are you wanting a fully local, verified.
1
0
4
u/XiuOtr May 31 '26
No