I was genuinely excited when I first learnt about the Ventoy from a YouTube, then I came to these:
Ventoy source code contains some unknown BLOBs, still no word on the issue from the dev after months https://programming.dev/post/19516543
Ventoy Update https://programming.dev/post/20508826
https://github.com/ventoy/Ventoy/issues/2795
https://www.reddit.com/r/Ventoy/comments/1flw461/today_i_discovered_ventoy/
so maybe I’ll hold off with Ventoy for now?
I understand how this could be a prime target of a supply chain attack and that things are a bit fishy. On the other hand people are waaaay less picky about installing other binary blobs on their machines. I wish paranoia would be more general :)