I2P Tweaks and Suggestions

[nurmagoz]

@HulaHoop

You’re confusing openjdk with the shitty and unsecure java applets of a decade ago. Java is a memory safe language like Python and if anything, coding errors here result in a crash rather than RCE.

hmm i would agree, but Rust Python Go are actually memory safe languages Java like in the middle. But actually i was referring to the performance not the security which is really slow/resources consumption comparing to others.

@HulaHoop

I2PSnark works over I2P.

yes I2P connected over clearnet, but in our case I2P over Tor and isnt that will cause the same load damage as if Torrent over Tor directly?

@HulaHoop

Updater is disabled in the Debian version

Updater is disabled but I2P news updates is not disabled unless refresh frequently disabled.

@HulaHoop

We track Debian stable versioning so we’ll be on 9.38 for the foreseeable future.

Well thats not good idea specially with I2P , the debian package maintainer/s are not always available and no stable maintainer that for surely will always showing up. So better to upgrade I2Pj in similar way to electrum. unless I2Pj developers or stable maintainer doing the job. (mahatta not stable maintainer, and its preferable to consider doing that once I2Pj becoming just as a router and remove the rest of su3 garbage plugins).

@HulaHoop

The java version has a nice GUI that introduces the users to all the major sites and services of the network.

I agree, but this GUI needs real love maintaining its impacts one of the flaws it uses JS and its not security built/focus at all which needs many hardening to be considered safe like for e.g:

• I2P JS attack

Tails from the Cri2p - Exodus Intelligence

Though JS not yet removed from I2Pconsole and ticket closed as wont fix #2537

• I2Pconsole increases the surface attacks: (I2Pj router not yet isolated)

#2132

• Currently it missed the following hardening configurations:

http://zzz.i2p/topics/2831-harden-i2pconsole

This is why better at the moment to keep using I2Pj from I2P developers/repo not debian repo.

[Thinkablemellow]

@HulaHoop

What extra benefits do we get from using their project instead of what we do right now?

The ones i posted in the Quote above, at the moment not much other than a single click i2p solution, when they merge the Addon its going to be more useful and as i see it its going to be more user friendly in the long run than the router.

@HulaHoop

A custom I2P landing page would be a nice little addition to the current i2pbrowser script but not necessary.

I2P Browser in the whonix repo had(has?) a custom landing, but i agree a nicer one like the TBB one would be nice, but what links to add?

[nurmagoz]

@Thinkablemellow

We can try to lower that and see how it impacts performance, but these Defaults seem to me quite Outdated.
I remember a Poll about that here on the Forum, is this really an Issue ?

Its recommended against to lower ram more than this , as it will show not friendly router logs something like this:

 Router Logs

    ERROR [uterWatchdog] 2p.router.tasks.RouterWatchdog?: Memory: 38.03MB / 114.00MB
    ERROR [uterWatchdog] 2p.router.tasks.RouterWatchdog?: Outbound send rate: 776Bps
    ERROR [uterWatchdog] 2p.router.tasks.RouterWatchdog?: 1 minute send processing time: 243ms
    ERROR [uterWatchdog] 2p.router.tasks.RouterWatchdog?: Participating tunnel count: 2
    ERROR [uterWatchdog] 2p.router.tasks.RouterWatchdog?: Job lag: 0
    ERROR [uterWatchdog] 2p.router.tasks.RouterWatchdog?: Ready and waiting jobs: 0
    ERROR [uterWatchdog] client.ClientManagerFacadeImpl?: Client 8nwlmr has a leaseSet that expired 38m ago
    ERROR [uterWatchdog] 2p.router.tasks.RouterWatchdog?: Memory: 49.92MB / 114.00MB
    ERROR [uterWatchdog] 2p.router.tasks.RouterWatchdog?: Outbound send rate: 776Bps
    ERROR [uterWatchdog] 2p.router.tasks.RouterWatchdog?: 1 minute send processing time: 

But since I2Pj will not run by default , then i think user should understand why memory consumption accruing when he want to run it.

[Thinkablemellow]

@nurmagoz

yes over I2P connected over clearnet, but in our case over Tor isnt that will cause the same load damage as if its over Tor directly?

no I2Ps Torrents cant be compared to Clearnet ones, the most i get is usually 50-150kB’s which wouldnt “hurt” Tor more than music streaming or youtube.

The whole argument against torrent over Tor because it hurts it is quite nonsensical to me (not talking about the OPSEC risk)

@HulaHoop

We track Debian stable versioning so we’ll be on 9.38 for the foreseeable future.

Well thats not good idea specially with I2P , the debian package maintainer/s are not always available and no stable maintainer that for surely will always showing up. So better to upgrade I2Pj in similar way to electrum. unless I2Pj developers or stable maintainer doing the job. (mahatta not stable maintainer, and its preferable to consider doing that once I2Pj becoming just as a router and remove the rest of su3 garbage plugins).

Yeah thats no good, adding the I2P repo would solve that, or using I2PBrowser(once its able to update )

@nurmagoz

• I2Pconsole increases the surface attacks: (I2Pj router not yet isolated)

We could (should?) disable or lock it with a password to prevent that ?
What reason does a User have to open it anyway?

[Thinkablemellow]

@nurmagoz

Its recommended against to lower ram more than this , as it will show not friendly router logs something like this:

Right thats why i brought up the low RAM specs of whonix, i know its quite unrealistic to lower the RAM for I2P or even when you run 2 TBB’s the RAM needs to increase anyway and the Specs dont reflect modern day hardware. Anyone who is serious about Security (most Whonix Users?) own or buy hardware for these kind of things, but those People probably also dont use Virtualbox…

@Patrick
Are there any Stats/Download numbers for Virtualbox,KVM and Qubes-Whonix Users ?

[nurmagoz]

@Thinkablemellow

no I2Ps Torrents cant be compared to Clearnet ones, the most i get is usually 50-150kB’s which wouldnt “hurt” Tor more than music streaming or youtube.

The whole argument against torrent over Tor because it hurts it is quite nonsensical to me (not talking about the OPSEC risk)

Good point! , i missed that actually. Then yeah wont be harmful to be used over Tor in this case.

@Thinkablemellow

We could (should?) disable or lock it with a password to prevent that ?
What reason does a User have to open it anyway?

Well I2Pconsole it has this feature (if im not mistaken), not bad idea (and we add public username/password for users to unlock it and if they want to change it). Reason is to make more configurations that will suit the end user if the default settings not enough or not good for him like playing with tunnels or adding more services/plugins…etc.

[Thinkablemellow]

@nurmagoz

Well I2Pconsole it has this feature, not bad idea (and we add public username/password for users to unlock it and if they want to change it). Reason is to make more configurations that will suit the end user if the default settings not enough or not good for him like playing with tunnels or adding more services/plugins…etc.

Most stuff could be done trough the I2P Control Plugin and the Config file, i could write a short bash script for custom config stuff, after all is the Terminal as “pretty” as the Router Console and way more useful

[nurmagoz]

@Thinkablemellow

It looks like i(/we?) should focus more on the I2P Browser

If you mean I2PBrowser from I2P devs, its nice great idea but its very alpha and very unmaintained currently e.g:

• I2Pbrowser not signed #2530
• NoScript just on the plugin level/effect not browser level #2536
• Its not catching up with firefox/TB updates thus it has all major security vulns not fixed e.g #2570
• NoScript default allowed websites not removed #2559
• I2Pbrowser now includes I2Pj within it , mean I2Pj installed in the OS wont effect I2Pbrowser thus useless to our case.

and on top of that meeh/mikalv the maintainer of I2Pbrowser is not really active (at the moment missing since months).

[Thinkablemellow]

Yes,i know i wasnt talking short Term, I2P takes ages compared to Tor but thats understandable given the Manpower and funding difference.
There are People actively working on it and as was stated in my Post they are on a good way merging everything TBB does and keeping it up to date.
Given the short time frame I2PB is a great leap forward in a I2P Perspective.

@nurmagoz

and on top of that meeh/mikalv the maintainer of I2Pbrowser is not really active (at the moment missing since months).

Life (sometimes the Government) gets in the way of these less important Projects, i can attest to that.
Rome wasnt build in one day…

[Thinkablemellow]

https://github.com/Whonix/anon-apps-config/compare/master...Thinkablemell0w:master

I added a small change so we enforce .i2p and .bit.
@HulaHoop do you know any reason not to add them ? (since you left them out)
If not i’ll make a pull request

[HulaHoop]

Too much complexity. Would require enabling trustfile support in main config. I don’t see the advantage over just leaving everything as is. “if it ain’t broke don’t fix it” mantra.

[Thinkablemellow]

@nurmagoz i made a small list of things a user might want to change in this setup for a script, if you know anything else to add feel free to tell me.

  	Bandwidth settings
  		-Upload
  		-Download
  	Tunnel settings
  		-Length of In-Out Tunnels
  		-Quantity 
  		-Backups
  	I2Psnark settings
  		-Length of In-Out Tunnels
  		-Quantity 
  		-autostart	
  	Router Console settings
  		-Password
  		-Graphs
  		-Logs
  		-Advanced Console
  		-summaryBar
  		-search engine (if one works again)
  	Webapps settings
  		-i2psnark
  		-susimail
  	RAM settings
  		-set RAM
  	Privoxy settings
  		-trustfile
  		-tlds
  		-blocks 

@HulaHoop 10-4 (10-4 Meaning & Origin | Slang by Dictionary.com)

[HulaHoop]

@Thinkablemellow

@HulaHoop 10-4

?

[nurmagoz]

@HulaHoop I2P gonna be included from its main devs repo or debian repo?

[Thinkablemellow]

@nurmagoz Debian AFAIK

[nurmagoz]

I see, As im living in I2P community since years now so i know very well this wont go well if its going to be installed from debian repos.

not worth it to have old I2P installed by default.