I need some second opinions

Support
1

Please check this out https://askubuntu.com/questions/1550871/how-do-i-install-whonix-on-ubuntu-24-04-lts/1550872?noredirect=1#comment2727910_1550872 and make sure you scroll all the way down and read the comments at the bottom. I’d like second opinions here. I think I’m just gonna delete the parts that show you how to verify Whonix, I just don’t wanna confuse the user and honestly are they future proofed, will those instructions work 5 years from now? Probably not. I’m specifically referring to the instructions that show you how to verify Whonix, in both Method 1 and Method 2 there are instructions on how to verify Whonix but are they future proofed, are they gonna work 5 years from now? Probably not so I think I’m just gonna delete it. And I’m not even sure they work cause they were edits from someone else. I’m afraid it might be edits from someone who doesn’t even really know what he’s doing.

I could test it on my own but then I need to sit down and figure out how to run Ubuntu as a VM in VirtualBox. But that’ll take some time to learn how to do so I’d rather just not bother with it. Or I could just completely uninstall both VirtualBox and Whonix and follow those instructions and see if they work. Again, I’m referring to the instructions in Methods 1 and 2, the parts where it shows you how to verify Whonix. I’m not even sure those instructions are accurate and even if they are accurate today they probably won’t be just 5 years from now.

And if you read the comments on the bottom, the user on askubuntu @mchid made some edits to my post. He put diffutils in there

sudo apt install curl diffutils

What is that package and is it even needed to install Whonix? I’d never even heard of diffutils til he came along and made his edits.

I think I’m just going to delete mchid’s edits and delete the parts that talk about verifying Whonix and be done with it. Man that tutorial literally took me over 20 hours to make! I’m exhausted, I need to cook my dinner and go get some sleep.

So just check it out, read it, and please give me your feedback? Thanks.

1 Like
2

The mods just closed my question apparently it’s too big for askubuntu, they want me to break it down into multiple question and answers. Can you guys still see it on your end, can you read my back and forth exchange with the mods https://askubuntu.com/questions/1550871/how-do-i-install-whonix-on-ubuntu-24-04-lts

Anyhow so I guess instead of one big all encompassing tutorial I need to break it down into individual questions. So I guess I’ll literally have to ask a question like “Is there anything you need to do for Whonix post installation?” and then answer this question and lay out the post installation steps like changing the password, manually updating gateway and workstation, how to create the shared folder etc.

I probably will just delete Method 2 though to make the tutorial shorter. And I’ll delete the part that talks about verifying Whonix (I don’t even know how to do that myself, and I think there’s only a small minority of people in the world who know how to do that, it’s very esoteric knowledge it seems. Well and to be fair the documentation could be cleaned up so it’s easier to follow, I’m referring to the documentation that tells you how to verify Whonix, it’s very hard to follow)

Anyhow I’ve gotta cook my dinner and get some sleep. I’ll pick this up later.

Oh and I hope someone answers my question about diffutils

1 Like
3

Not a full review. Just selective observations.

extpack isn’t mentioned in our user documentation. Not required nor recommended for most users. Actually discouraged as per Avoid Non-Freedom Software.

In our developer documentation on this topic is here:
VirtualBox Oracle VM VirtualBox Extension Pack

Note:

  • A) VirtualBox Guest Additions; and
  • B) VirtualBox Oracle VM VirtualBox Extension Pack

are different things.

Maybe more comments later.

2 Likes
4

wget -O- https://www.virtualbox.org/download/oracle_vbox_2016.asc | sudo gpg --dearmor --yes --output /usr/share/keyrings/oracle-virtualbox-2016.gpg

That style can be described as:

  • easier (maybe)
  • “just get it done”
  • but: less secure

It’s insecure because the signing key is imported without gpg key fingerprint verification.

How to do it more securely? Documented here: Install Newer Versions of VirtualBox

1. Adding the VirtualBox.org APT repository.

Choose either: A, B OR C.

wget is also discouraged. Documented here: Secure Command Line / Scurl

Steps, screenshots such as https://i.sstatic.net/0bBL6uZC.png :

On Whonix for Windows, macOS, Linux inside VirtualBox there are already such screenshots.

For Whonix VirtualBox import instructions, please press the learn more button on the right.

Such as this:

diffutils:

answered here:

https://www.reddit.com/r/Whonix/comments/1lemars/tutorial_how_to_install_whonix_on_linux_ubuntu/

2 Likes
5

So I see here Recommended VirtualBox Version for use with Kicksecure that there’s a recommended VirtualBox version for use with Kicksecure, so that begs the question, is there a recommended VirtualBox version for use with Whonix?

I mean I’m assuming the answer is no cause if there was then I’m sure you would have said so by now cause I mean I’ve made a big stink about this, that if you do this

 curl --tlsv1.3 --output whonix-xfce-installer-cli --url https://www.whonix.org/dist-installer-cli

and then

 bash ./whonix-xfce-installer-cli

that gives you VirtualBox 7.0.16 and that isn’t the latest version of VirtualBox. We’re now onto VB 7.1

And also, so here Dev/VirtualBox it says “Since VirtualBox version 7.0.0 support for USB 2.0 and USB 3.0 devices is included in the base package and no longer requires the Extension Pack.”

So if you wanted to use an external drive while in Whonix you do not need the VirtualBox extension pack?

But, if you wanted to use a webcam while in Whonix then you would need the VB extension pack? Can one even use a webcam in Whonix?

1 Like
6

So when you go here Install Newer Versions of VirtualBox and see this

Screenshot from 2025-06-20 23-32-33
Screenshot from 2025-06-20 23-32-332845×1994 424 KB

So this command

 bash ./virtualbox-installer --oracle-repo

So is bash using apt to install VirtualBox? And so is this a safe and secure way to install VirtualBox? So apt is very safe to install packages (again I’m assuming here bash is running off apt, or maybe I’m just confused here)? Well, it seems that this way doesn’t verify VirtualBox to make sure it’s integrity is good. why? Why is there no need to verify VirtualBox here?

Anyhow, listen, I’m just gonna delete method 2 entirely and just keep method 1 (in my tutorial on askubuntu). I’m doing this cause the documentation is saying the wget command isn’t safe and then it goes on to talk about the scurl command and it appears you can only use scurl in kicksecure. So this is all over my head at this point, I’m not a computer expert so I’m just gonna delete Method 2 in my Whonix tutorial on askubuntu and I’m just gonna stick with Method 1 and be done with it. My brain is gonna explode. My average IQ brain is being pushed to it’s limits of understanding. Yeah I’m just getting confused but I do understand Method 1 though, that’s simple enough.

I’ve a question, in Method 1 of my tutorial https://askubuntu.com/questions/1550871/how-do-i-install-whonix-on-ubuntu-24-04-lts those commands will automatically install both VirtualBox and Whonix together, is there a need to verify both of them for integrity?

1 Like
7

Not needed.

The question to ask is:

Specific wiki chapter: Add a USB Device to VirtualBox

General wiki page:

Question to ask:

Does using an external USB drive using Debian inside VirtualBox require VirtualBox extension pack?

Untested. Unknown.

  • Host webcam passthrough as defined in VirtualBox manual might require VirtualBox extension pack. Please look up Host webcam passthrough in VirtualBox manual to learn the specifics if that interests you.
  • However, Host webcam passthrough might not be the only option. It might be possible to connect assign a webcam to a VM as USB device (similar to connecting other USB devices such as storage devices).

Unspecific to Whonix.

Question to ask:

Does using a USB webcam using Debian inside VirtualBox require VirtualBox extension pack?

Yes.

Yes.

Added here just now: VirtualBox Installer for Linux

Quote:

  • Digital software signature verification: Uses APT (which verifies digital software signatures). When using the --oracle-repo, installs Oracle’s repository and signing key.

virtualbox-installer does that.

All software by Kicksecure, Whonix always verifies digital software signatures and the wiki mentions digital software signatures whenever applicable.

For virtualbox-installer digital software signature verification is documented on the same wiki page:

Optional: Digital signature verification.
[Learn More]

  • whonix-xfce-installer-cli installs and performs digital software verification for VirtualBox + Whonix.
  • virtualbox-installer installs and performs digital software verification for VirtualBox only.
1 Like
8

Patrick, the recommended VirtualBox version for use with Whonix is VirtualBox 7.0.16 ain’t it?

If you say yes to that then in Method 1 of my Whonix tutorial on askubuntu, I’ll probably just delete any mention of the --oracle-repo command line option. I mean if VirtualBox 7.0.16 is literally the recommended (so that literally means recommended by the Whonix developers) version of VirtualBox for use with Whonix then why would I even mention the --oracle-repo option?

In fact, if you say yes, then I’ll literally uninstall both VB and whonix completely and reinstall them using

 bash ./whonix-xfce-installer-cli

Which means instead of using VB 7.1.10, I’ll be using VB 7.0.16 but hey that’s fine cause I’ll be using the recommended version of VirtualBox.

1 Like
9

Please refer to the wiki and earlier forum posts on this topic. I don’t have anything to add.

1 Like
10

Patrick even the documentation doesn’t answer it. This documentation here Recommended VirtualBox Version for use with Whonix literally does not answer the question, but it does lead you to the whonix installer which for Ubuntu 24.04 LTS, if you use this command

 bash ./whonix-xfce-installer-cli

It will install VirtualBox 7.0.16 so, that leads me to suspect that the recommended VB for use with whonix is VB 7.0.16

Even the documentation does not specifically answer this.

Dude why won’t you just answer my question? I can’t go read the documentation to answer my question cause the documentation doesn’t specifically answer my question.

1 Like
11

Refer to the duplicate forum threads previously created by you on the same topic.

1 Like
12

Dude I have asked you in the past if it’s perfectly ok to use VB 7.0.16 and you’ve NEVER EVER answered it.

And if VB 7.0.16 really truly is the recommended version for use with whonix, why wouldn’t you simply say so?

And again I can’t refer to the documentation to answer this cause the documentation does not answer it.

1 Like
13

Moderation comment:
Please use existing forum threads and don’t duplicate the same topic here.

1 Like
14

I am the one creating this Whonix tutorial on askubuntu https://askubuntu.com/questions/1550871/how-do-i-install-whonix-on-ubuntu-24-04-lts

Why?

Cause most if not all tutorials on the internet that show you how to install Whonix on Ubuntu are now old and out of date with incorrect information. So I’m trying to fix this because I want the user base of Whonix to grow. Whonix has a shared folder. Tails does not. This is why I don’t use Tails. Plus I’ve heard Whonix is more secure than Tails.

When I first decided I wanted to use whonix I went and googled “how to install whonix on ubuntu”

So I’m going to create a Whonix tutorial that will eventually be viewed by thousands of people. People who will be using Whonix for the first time. And don’t forget Ubuntu is the most widely used Linux distribution by far. I’m on Ubuntu cause of this reason. When I was first looking at jumping over to Linux when I’d heard Ubuntu was the most widely used, well, that’s why I picked Ubuntu.

So my point is, I’m creating this whonix tutorial that’s gonna get viewed by thousands and it needs to have the correct information in it (Patrick why aren’t you trying to help me?). And I literally am not sure which is the recommended VirtualBox version for use with Whonix, I’m not sure.

I’m sitting here trying to decide, so should I include the --oracle-repo command line option or not? I am literally about to go finish my Whonix tutorial over on askubuntu but I don’t know if I should include the --oracle-repo command line option or not?

1 Like
15

I am at the point where I wanna pull my hair out and fucking scream. I am just trying to help grow the user base of Whonix. Whonix has a shared folder and this is precisely why I’m not using Tails.

But whonix has one glaring problem, none of the whonix tutorials (that show you how to install it on ubuntu) are correct anymore, they are all literally incorrect!

So you can use the whonix installer to install both virtualbox and whonix but there are all sorts of things you gotta do post installation to get whonix up and running successfully and a beginner can’t go off the documentation alone cause the documentation (in my opinion) is really hard to understand.

Beginners need a tutorial that will hold your hand and walk you through it. And well, that’s where I come in.

Why do I want the whonix user base to grow?

Cause it’s got one thing Tails doesn’t. A convenient shared folder. Plus I’ve heard whonix is more secure than Tails.

But if you go on Reddit you’ll notice r/Whonix has 10 thousand members but guess how many members Tails has on Reddit? r/tails has 117 thousand members so clearly most people are choosing to use Tails over Whonix. But don’t they realize Whonix has a shared folder and Tails doesn’t?

1 Like
16

This post on reddit is actually great https://www.reddit.com/r/Whonix/comments/1lemars/comment/myxruzd/

Honestly I’m just gonna delete the portions that even mention verifying Whonix cause honestly it’s something I just don’t really know how to do myself as the documentation on it is not straightforward, it’s hard to follow. I’m specifically talking about the documentation that shows you how to verify Whonix, I just don’t understand it as it’s not easy to understand.

So tell me this, if you follow the Whonix installer and do no verify it, how dangerous is that?

Again the documentation on how to verify Whonix is very confusing, I can’t understand it all, it needs to be improved, cause I can’t understand it. So I’m just not going to even include it.

My answer:

See: Verifying Software Signatures

If someone is like “too much wall of text, please summarize, don’t want to read” then this isn’t the best tool for them. Related post: Change password documentation improvements - #7 by Patrick

Unfortunately, there’s proverbial security versus usability slider. This is just for illustrative purposes.

      SECURITY  <---|---|---|---|---|---|---|---|--->  USABILITY
      🔒               🖱️

I don’t want to guess there we are is on this slider.

The wiki has a certain security level.
Related: Security versus Usability

Not “maximum”. Because then nobody will be able to use it.
Related:
Maximum Security: Unrealistic Expectations?

These are complex systems. Their complexity cannot be reduced without compromising (reducing) security or anonymity.

If one wants to become a heart surgeon or take on other complex jobs, that’s going to be complicated. One cannot study medicine and demand they make it easier for me. And certainly, one cannot attempt to perform heart surgery based on intuitions.

Trying to interpret this…

So this is supposed to invoke some Tails versus Whonix competition, who has the most users?

This is basically a request “make Whonix more easy to use, so it has more users than Tails”?

But why compete with Tails? VPNs have millions of users. All of Tor is just a drop in the bucket versus VPNs. Quote VPN Statistics and Trends 2025 – Forbes Advisor UK

Worldwide VPN Usage 2025

  • 1.75 billion people use VPNs worldwide, one-third of all internet users [1]
  • the VPN market is expected to reach $76bn by 2027[1]

And according to https://piracymonitor.org/survey-55-of-people-know-what-vpns-do-40-use-them-to-access-streaming/

Survey: 55% of people know what VPNs do. 40% use them to access streaming

That would be roughly 700 million people. But the exact number does not matter to make this point. Give or take a few hundred million. Whonix, Tails, Tor is a drop in the bucket by comparison.

What’s the overall goal?

Number of users go up? No, I don’t think any qualities of my life are going to improve by seeing the reddit user counter for Whonix having more users than Tails.

What’s the next carrot to run after? More money? This isn’t a maximizing income operations. There would be easier ways to make more money with different software (such as financial, crypto or AI). So no, this is not my motivation.

So let’s see what would be required to grow the user base:

  • Business development.
  • Marketing, advertising.
  • Usability development.

From my work life, I’ve learned a lot about all of these areas. So here’s the business advice that is thrown around:

  • Go proprietary, closed source.
  • Freemium
  • Cloud
  • Monthly subscription
  • Change industry
  • Google ads, YouTube ads, other promotions, etc.

For the most part, “reduce security, promise more, deliver less”, or turning Whonix into a VPN. Just promise, sell, makes money and don’t worry too much about the actual effectiveness.

That is against what Whonix stands for. Whonix is in a niche. It’s for users who are willing to invest time to gain real security and anonymity.

As for usability advice, that’s non-trivial too. There is a whole professional for this called usability engineering (UX designer). One typically cannot land a job as UX designer without any knowledge (let alone experience) as a UX designer. It certainly isn’t purely based on opinion and intuition. It’s based on knowledge, for example, search terms:

  • Principles for Usable Design
  • Minimize Cognitive Load
1 Like
17

So for years I was using TOR browser on Windows and I kept hearing people say if you care about your privacy get over to Linux and use Tails, and other people would chime in and say they prefer to use Whonix. So for years I just kept hearing about Linux, Tails, and Whonix. So back in 2021 I did finally make the leap over to Linux from Windows 8.1. I was a lifelong Windows user who didn’t even know what a command line was.

And then last year I decided “Well it’s probably time to finally start using either Tails or Whonix for added security.” So I did some research into both, I mainly read Reddit threads on this, like this one for example https://www.reddit.com/r/tails/comments/1bct9xd/is_tails_safer_than_whonix/ and many people say whonix is safer than tails. Well and whonix will run on your host OS you don’t need to plug in a thumb drive and then boot into UEFI (BIOS on my old PC) and then change the boot order just to use it. I’ve got a question if you wanna answer it, so to use tails do I have to first plug in the thumb drive, then boot into UEFI (BIOS on my PC) and then change the boot order in order to boot into tails on startup, do you have to change the boot order every single time you wanna use tails? That would be a huge pain in the ass!!! No thank you I wouldn’t wanna put up with that.

So since people were saying whonix is more secure than tails and whonix runs on the host OS. I decided to use whonix. And now that I’ve been using whonix, one thing I’ve realized, man the shared folder is super convenient and there is no shared folder on tails.

And I know more people are choosing to use tails over whonix cause I’ve definitely seen tails mentioned much more often than whonix over the years and also the tails group on Reddit is much bigger than the whonix group.

I’d like to see more people start using whonix, don’t they know how convenient it is to have a shared folder? And plus, whonix is much more secure. There are certain scenarios where you’d want to use tails, you know the way it can run off any computer and how it’s amnesic, but yeah I’d like to see the whonix user base grow. I think most people should be using whonix but in reality, in this niche, most people are using tails.

1 Like
18

So Patrick you’re the head Whonix developer right. So here’s my latest Whonix tutorial it should have up to date and correct information in it.

Can you review it and tell me if the information in it is correct?

The installation steps are correct right? I removed the --oracle-repo command line option.

Is there anything about this tutorial you’d change?

https://askubuntu.com/questions/1550871/how-do-i-install-whonix-on-ubuntu-24-04-lts

1 Like
19

Had to jump in.

@FutureMan, really try to understand the gravity of what he’s saying here.

That is the true essence of open source. It’s people like this and their sacrifice who build the foundation of FOSS, which in today’s age is really just freedom itself. When I see this it makes me want to contribute in the same way. And you too, from what I can see.

So let’s relax a bit.

1 Like
20

I left a few comments earlier.

I rarely comment on third-party content. Time is a scarce resource.

A full review and stamp of approval is not planned. Endorsements are risky. This is a general issue and applies to any not only here.

  • reputation
  • accuracy
  • future edits
  • copyright
  • affiliation and reputation risk of getting entangled in off-site, off-topic activities, opinions by the content creator

I am not convinced that any new tutorial is needed either. If there are any confirmed shortcomings, these will be fixed in the wiki.

In other words, the status of “Ubuntu documentation bugs” is cannot reproduce, more feedback by other users needed.

Too many issues. Too much to explain.

Related:

1 Like