So, here we’ll talk about the following ways to flash ISOs:
- BalenaEtcher: https://etcher.balena.io/
- Raspberry Pi Imager: https://www.raspberrypi.com/software/
- Fedora Media Writer (you can just download this when you go to download Fedora, but here’s the GitHub): https://github.com/FedoraQt/MediaWriter
- Rufus: https://rufus.ie/
Probably fine if you just want to install a single OS once and be done with things. But if you plan on dedicating a flash drive to be your Linux install media for the foreseeable future, just use Ventoy: https://www.ventoy.net/en/index.html
Ventoy has a lot of work to do if they want to earn our trust:
Remove BLOBs from the source tree #2795
This ticket has been open now for 5 months with no engagement from the maintainer.
Your install media and anything that modifies your EFI partition or UEFI firmware settings needs to be the most trusted part of your system. And here is Ventoy, a tool that looks open source and then includes a large number of binary blobs in its repository, with no indication of how they were compiled. This is horrible security practice and for me that’s enough for me to never use it.
You can also see a discussion on the subject on HN here: https://news.ycombinator.com/item?id=40689629
A much better alternative, if you want a multi-boot USB, is GLIM: https://github.com/thias/glim
It’s just a collection of Grub configs, so very simple and easy to audit.
Thanks for bringing this up! I started a thread here for us Lemmings to discuss: https://lemmy.one/post/19193506
@drspod @SatyrSack Ventoy has bad parts yes but many things either are only supported by it or rely too much in it, for example, as a sysadmin I need to have at all time a winlol ISO (even though I hate myself every time I use it) and also as an IT I need to have a MediCat USB at all time, both cannot be done with Glim, so until a better solution sees the light of day, Ventoy should remain my main tool
So your approach to security is that you cross your fingers and hope?
