Wiki search fallback suggestion

andwhatnot · April 30, 2018, 6:50pm

If a search on the Whonix wiki goes wrong, the user sees

You can try searching via Google in the meantime.

There is a google search box right below. Yikes! Isn’t privacy a core goal around here? Would you consider making a different suggestion maybe?

0brand · April 30, 2018, 11:44pm

Tor Browser also has google search.

Just like users can choose not to use google search box with TBB, users can also choose not to use it in the wiki.

There are certainly better options though.

pano · May 1, 2018, 4:57am

I’d be more concerned of Javascript being required to post on this forum.

andwhatnot · May 1, 2018, 6:49am

Haven’t paid attention to this, would you list what you’ve found here?

pano · May 1, 2018, 11:35am

Hmm not sure if you replied to me or to 0brand?

Javascript could be used as a way to exploit the browser.

First, Whonix website can be directly compromised by an attacker if there are vulnerabilities. In this case javascript could be planted in any of the pages.

Alternatively, a MiTM attack could be implemented by the Tor exit node itself or anywhere between the exit node and the site, by stripping SSL (directing the use to a non-https version) and injecting malicious javascript code into the http responses, which could then compromise your browser. Or an attacker could use a forged / stolen certificate, so there would be no need to strip the SSL.

Patrick · May 1, 2018, 11:41am

whonix.org is using popular webapps such as mediawiki, phabricator and
discourse (forum software). These are developed by third parties, not
whonix.org. These are Libre Software. whonix.org is a user of these web
apps. When other projects make changes, they don’t necessarily (rather
seldom) prioritize privacy and security.

Whonix is based on many third party projects. On

starting from The User Co-developer Concept there is a small
description on how that is structure looks like. In essence, many
independent projects provide their software and source code for free.
One can use it as is or modify.

However, Whonix is not a traditional company with loads of full time
paid employees. There is no way for anyone in our community to issue a
directive to the discourse or any other developers saying “a google
search box is a nogo, remove it in an instant”. Same applies to all
other software projects.

If we want changes from third party projects, we can only:

try to understand their point of view (takes time)
ask nicely (takes time)
submit code that makes sense from their point of view (in most cases:
not doable due to time restraints)
patch and/or fork their software (in very most cases: not doable due
to time restraints)
or use an alternative (migration work, takes time)

I guess you are expecting a fully consistent experience, the best of the
best privacy choices everywhere form a we-provide-privacy-for-you
company. Just like you would expect comfort from a
we-provide-comfortable-cars-for-you company.

Actually, given the organizational differences

company hierarchies vs
Libre Software (collaborative, use it as is or modify it yourself
attitude)

I am surprised it works as good as it works.

The quality you are expecting and requesting (here and in other forum
threads) from Whonix, cannot be provided by a project of this size.

See also:
Bug Reports, Software Development and Feature Requests

@wiki editors:
I wonder if I wrote something similar before?
Could we put something like this on the subject on how Libre Software
development vs development inside a company works somewhere?

EDIT:
This was done. See:

Privacy Policy Technical Details - Kicksecure