Keeping old versions available to have the history of Whonix alive!

Support
1

Totally on board with the security point of view here and why such archives are not kept. But what about the other way of looking at this? Today, with every old repository getting purged the end users are running out of options to get it directly from Whonix team. Have to dig through different not that trusted sources which could not be verified.

And what about looking at this as keeping the history alive? Many reputed release projects including the ones that provide similar Tor network based security keep the releases archived. The latest branch always updates to the modern version obviously.

And another one! Let the users know about the efforts put in to develop this! Many people are firing up collections from yesteryear, just so they can go back in time and see it. This goes for many of such projects too.

So if we could, we should keep the archives alive for anyone and everyone! :slightly_smiling_face:

2

Whonix binaries (packages, images, and accompanying metadata) take space to store. Storage space is a limited resource. Removal of old images helps reduce the cost of maintaining the project. For those who need to explore older images for some reason, derivative-maker can be used to build older images (with some effort).

Whonix is free to redistribute. Anyone interested can host their own archive of official Whonix binaries and give them out to people. Signatures can be used to verify those copies are unmodified, though given the fact that older versions of Whonix are unsupported (and especially older major versions are likely to be highly insecure the further back you go), one shouldn’t use them for any real work in any event.

2 Likes
3

Totally agreed. But what about the others that could do this? Many mirrors can do this, right? Do they charge a lot for this? We are talking about freely available hosts for users across various Linux distributions. This list is really massive so if one goes down the other copy survives.

Is there no major foundation that can help Whonix out? I am sure there would be some people who can independently host and help others. We need to try at least… :slight_smile:

4

I don’t think this is something we intend on spending development time pursuing. Like I said, Whonix is free to redistribute. If you want to set up a mirror, or convince an existing mirror to start archiving our binaries, you are welcome to do so.

1 Like
5

Hope this changes sooner than later as we will lose the archival data which could have been experienced by users seeking to learn from the development and challenges the team faced. You are also right about Whonix being free to redistribute but once the older versions are gone, it becomes extremely difficult to find them again from the net itself.

We are not talking about the next few years but the next few decades worth of life. And it is safe to say that having a publicly accessible archive also helps the survival of the project if anything goes wrong in future. In any case, thank you for your response.

6

If there are any other sources, they should preserve digital software signatures.

Problem is storage space. Carrying, preserving all historical releases is a huge burden. Doing it properly with backup best practices (3-2-1 backup rule and whatnot) makes it even more burdensome and expensive.

An original project isn’t the best historian and auditor for itself. Those are third-party / community jobs.

Hositing a Whonix mirror is a documented, non-permissioned system, meaning no need to ask for access or permission. No prior discussion required. → Hosting a Whonix ™ Mirror

Decision: Closed as not planned. → Community Feedback

Did old binaries ever help an abandoned project getting revived? Source code backups should be sufficient?

7

I understand that but would like to add something that’s beyond anybody’s control. That is age and time.

Whonix still is probably one of the last few projects that has kept the fundamentals as is. The structure is same including the programs within. Might I say that this is really rare today already and quite admirable too!

Yes, expense is the real issue along with extra hours of work, and that’s where I guess we could simply maybe raise some awareness about it? Some trial and error will not hurt. This is true that anyone can host without needing to ask for it but problem is finding the right versions from archives, right? This forum alone could close down one day without any warning along with many other things. What will happen then?

If possible, we should start backing up soon and also ask for help from community members and also from big data archival platforms including universities across several parts of the world. What’s harm in this? After all, we have nothing but this limited life on Earth! Worst, they would deny and that’s fine but we can keep trying.

Secondly, memory fades away with time. By design, we will not be able to recall everything in future no matter how hard we try. So while we are still in good health and alive, let’s try to create a long term legacy. Source code is of course the most critical part of the puzzle but keeping binaries can fast track process of usage, for users who are not that well equipped. This same applies to other projects too. Few manage to recreate as most just copy!

This is again “Beyond the scope” and maybe even farfetched and even unnecessary, but as I said, “We got one life” and I am sure there are many good people out there who will step up to help too. :slight_smile:

8

What you’re requesting is longevity.

A structure that helps ensure the survival of the project independently of the founder.

That’s very difficult to accomplish, and many people try to achieve this in many areas of life.

The project would need to become sufficiently independent from the founder. Most of the tasks currently done by the founder would need to be transferable to other staff so that they could cover for any founder absence.

That usually requires:

  • a) a medium or large sized legal entity such as a company or nonprofit foundation.
  • b) a large enough number of volunteers.

Relatively few projects manage to reach that level of independence.

Examples include:

  • Large public stock market listed corporations. It typically doesn’t matter so much who’s the CEO at the time. Corporations usually survive the tenure of an individual CEO, although there can of course be exceptional cases where leadership decisions seriously damage the corporation.
  • Some Open Source projects have also accomplished this, such as the Linux Foundation or probably The Tor Project. Many board members, directors and staff have come and gone, but the organization continues to exist.

It’s not something that can simply be “done” or “requested”. It’s one of the most difficult levels of organizational maturity to accomplish.

A medium or large sized legal entity such as a company would require:

A large enough number of volunteers may require:

  • outreach.
  • charisma.
  • social skills.

It also requires a specific set of:

  • personality traits (risk taking, …).
  • skills (bureaucracy, …).

Right, also sometimes called “hit by a bus” or “bus factor”.

Contribute has a chapter Backup Whonix.

The BackupScript tooling may need some improvements, but as far as I remember, there hasn’t been much interest in working on it so far.

Indeed. Clearnet, onion domain name, wiki, forums, server, it’s all only “rented” and requires ongoing maintenance. Very little infrastructure is designed for long term, zero maintenance stability nowadays. That’s an ecosystem wide issue. [1]

What would probably remain for a while are:

  • existing mirrors, which host images and source archives.
  • GitHub, which hosts source code.

In theory, that may be enough for someone to take over. Whether that would happen in practice is a different question.

I don’t think that’s easy either. Relatively few archival platforms exist, and maintaining them is difficult and expensive. The Web Archive, for example, has or used to have (I didn’t look up the latest news) been sued for alleged damages, which could potentially threaten its continued operation.

In practice, long term preservation is most likely to be sustained by people and organizations with an already existing, organic, ongoing interest in archiving the project.

[1] About Computer Insecurity