censorship circumvention / Tor pluggable transports

[Patrick]

Discussing functional clearnet DNS settings for gateway file /etc/resolv.conf.

@Patrick

, but I don’t think this has any
disadvantages. Except:

• when Whonix-Firewall would be broken plus at the same time its fail
  closed mechanism not work
• and when the user is trying to use Whonix-Gateway as a workstation
• then the user would be using clearnet

@Patrick

As long as wireshark does not run as user debian-tor but as user or root, as per Whonix-Gateway firewall default settings, there will still be no DNS access.

It would be completely reasonable to change this by default for all users in call cases. Advantages:

• That would be a simpler implementation. No code in ACW required.
• A “complete” gateway file /etc/resolv.conf that does not later get modified by ACW for meek users only.

Current implementation of using ACW to edit gateway file /etc/resolv.conf advantages:

• Functional gateway system DNS for user debian-tor only available in cases where this is required (meek).
• Abundance of caution.

To paraphrase Configure (Private) (Obfuscated) Tor Bridges “use bridges only when necessary”. For exact quote and why see that page.