Disabling TCP SACK, DSACK, FACK

[madaidan]

@Patrick

Even just net.ipv4.tcp_sack=0 causes grave issues with my clearnet connectivity. A usually 2 seconds page load time goes up to 10 seconds or so.

For me, there isn’t a difference in speed.

@Patrick

The problem is out style of development is rather early stage. We don’t have a testing farm of various computers in various configurations such as in globally distributed locations using different ISPs, different hardware, different routers, different configurations, running various automated connectivity and performance tests.

I am not calling it amateur because not even commercial operating systems might have that level of testing. However, without that level of testing we are flipping settings with very limited testing. Mostly just in our own configuration. With our computer, our ISP, our setup, etc. We’re kinda walking blind so to speak.

We can probably make our own test suite, rent a few VPSes and test them after each change. VPSes are rather cheap nowadays.

@Patrick

Therefore this change is too experimental to be applied by default for all users. Note: security-misc is a general, non-Whonix specific page.

I will merge this change to have it inside the git history and then undo it by deleting file /etc/sysctl.d/tcp_sack.conf .

It would be better to keep the file but have those lines commented out by default. If a user wants to disable SACK, they can just comment out that file and it can be documented in Whonix-Workstation Security Hardening - Whonix and the readme like the hardware info restrictions.