Long Wiki Edits Thread

[nurmagoz]

Not sure we gain much by importing other pages.

Saving time, as the gnu page made with strict laws about what to include and from where.

Doing our own research will improve more for sure.

[0brand]

Hi Patrick

apt-get-update-plus should be documented in “Operating System Software Updates”. Yes?

https://forums.whonix.org//apt-get-update-plus-8-secure-combined-apt-get-update-and-apt-get-install-dist-upgrade/5974

[Patrick]

0brand:

apt-get-update-plus should be documented in “Operating System Software Updates”. Yes?

Once there is a new build of Whonix, yes. (Otherwise we have a messy
state where not everyone can be reasonably expected to have it.)

[0brand]

Added “Spawning DispVMs from other AppVMs” to Qubes/DispVM. This TODO is not complete. Creating Named Whonix DispVM Based on Whonix-Workstation complicates this a bit.

For example, if the name-dispvm is not running it is possible to use (Qubes secure copy) qvm-copy some-file to the named-dispvm even if it is not running or defaut_dispvm for that AppVM. The named-dispvm will start just like a normal VM to receive the file. This is not normal DispVM behavior?

Also of concern if the name-dispvms have to be shut down like a normal AppVM. Meaning the following does not apply.

A DispVM automatically shuts down when the first user-launched process is terminated

I’ll be working on documenting named-dispvm next. And finishing the TODOs.

Opps almost forgot.

https://whonix.org/w/index.php?title=Qubes/DisposableVM&oldid=38822&diff=cur

[Patrick]

Could you give this unpublished draft a revision please? @torjunkie

User Poll - XFCE vs KDE - KDE Deprecation Considered!

Community Poll: Deprecate KDE in favor of XFCE in Non-Qubes-Whonix? The Whonix team is interested in polling the community’s preferred desktop environment. poll Why consider changing? Whonix bundled with an XFCE desktop environment is in development. This raises some questions: Do users generally prefer the KDE desktop environment over XFCE (or vice-versa)? When a Whonix XFCE variant becomes available, will users continue using KDE in Whonix or make the shift? Whonix developers are str…

[torjunkie]

@0brand

Update Qubes/Uninstall with new page Reinstall TemplateVM R4.0

Mostly fixed (plus associated qubes pages).

[torjunkie]

Tox - how to fix instructions.

• So Tox can’t be downloaded simply as a package for Debian.

• The GitHub instructions want you to build it from source for Debian (yeh, no thanks - too hard, too many steps).

• That Opensuse guy stopped packaging it for Debian stretch (so that won’t work anymore).

But, I see there is a AppImage for qtox on the official download page: Download - Tox

Since this is a wonderful new thing e.g. see here:

What is an "AppImage"? How do I install it?

I presume we can just fix the instructions to say:

1. Download this thing into Whonix-Workstation (anon-whonix)

2. Mark it as executable chmod a+x Some.Appimage

3. Install fuse if necessary as a dependency

sudo apt-get install fuse

4. Double-click on the file to run it.

While this will work, it’s not exactly safe i.e. downloading random thing from Internet and run compromised (?) AppImage without verification (how is verification done here, is it even possible?)

I think we just mark it as less-than-ideal security, but at least working instructions. Right now we have “current instructions don’t work”, which is pointless.

We can point advanced users to the GitHub build instructions to do it themselves.

Also, Retroshare is too large to be on the Chat page. Needs its own page, so I’ll go and split that off. Chat page should be general description (like the email one), with detailed stuff left to stand-alone pages.

[nurmagoz]

apparmor page needs an update as there is no more apparmor-profiles-whonix

http://www.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion/wiki/AppArmor

[Patrick]

Please don’t alphabetically sort items on the Chat and perhaps some other pages. The rationale is: sort by highest order of recommendation.

AppImage without verification (how is verification done here, is it even possible?)

The provider of the appimage (ideally same as developer of tox) could provide gpg signatures. People can gpg sign any kind of files.

[torjunkie]

@nurmagoz

apparmor page needs an update as there is no more apparmor-profiles-whonix

Package doesn’t exist or just changed name? If it doesn’t exist, we just have to delete one section, easy.

@Patrick

Please don’t alphabetically sort items on the Chat and perhaps some other pages. The rationale is: sort by highest order of recommendation.

OK. But we need to explicitly state that i.e. ranked in order.

@Patrick

The provider of the appimage (ideally same as developer of tox) could provide gpg signatures. People can gpg sign any kind of files.

Yes, but I was wondering about possibility with no advertised sig & key associated with that. Why don’t they put this on front page in an obvious place? Boggles the mind how uber-geeks lack common sense. No wonder their users are in the 100s or 1000s, because nobody can install it securely, 5 years after they started developing…

Anyway, this should work below and be easiest for Non-Qubes-Whonix? Reasonable?

Will not work in Qubes-Whonix due to blocks on downloading random stuff into TemplateVM at steps 2 & 3 ie “can’t load uri” etc. So another solution is required or one could just bypass it by downloading in non-TemplateVM and just shift it between qubes.

== Installation ==

{{mbox
| type = notice
| image = [[File:Ambox_notice.png|40px|alt=Info]]
| text = Non-Qubes-Whonix only.
}}

As qTox is not currently available as a stand-alone Debian package, users have three choices in late-2018:

• Build the package from source (difficult).
• Rely on an unsigned, self-contained AppImage downloaded from the Tox homepage (insecure).
• Install Flatpak from stretch-backports and then install Tox from the Flathub repository (easiest).

== Flatpak Method ==

Note: .flatpakrepo files generally include the base64-encoded version of the GPG key that was used to sign the repository.

Steps for the Flatpak method are outlined below.

‘’‘1.’‘’ Install Flatpak.

Note: It is recommended to create a separate Whonix-Workstation before installing addtional software. Also qTox is alpha software which has not been formally audited, therefore it is less trusted.

Flatpak must be installed in Whonix-Workstation from Debian backports.

{{Install Backport|package=
flatpak
}}

‘’‘2.’‘’ Add the Flathub repository.

Flathub is a common place to source Flatpak applications. To enable it, run.

{{CodeSelect|code=
flatpak remote-add --if-not-exists flathub https://flathub.org/repo/flathub.flatpakrepo
}}

‘’‘3.’‘’ Restart and install qTox.

A restart of Whonix-Workstation is necessary for flatpak to finish setting up.

To install qTox from flathub, open a terminal (Konsole) and run. Flathub—An app store and build service for Linux

{{CodeSelect|code=
flatpak install flathub io.github.qtox.qTox
}}

‘’‘4.’‘’ Start qTox.

To launch qTox, run.

{{CodeSelect|code=
flatpak run io.github.qtox.qTox
}}

[nurmagoz]

Package doesn’t exist or just changed name? If it doesn’t exist, we just have to delete one section, easy.

changed from apparmor-profiles-whonix to apparmor-profiles-hardened-debian.

also i dunno if these profiles are valid for whonix-gw , as i can see all of the profiles targeting the WS but i leave that answer to @Patrick

[Patrick]

@torjunkie

Yes, but I was wondering about possibility with no advertised sig & key associated with that. Why don’t they put this on front page in an obvious place? Boggles the mind how uber-geeks lack common sense. No wonder their users are in the 100s or 1000s, because nobody can install it securely, 5 years after they started developing…

Software signatures is a broken system that only at least somewhat-computer-geeks will get. At the same time these chase way regular users due to added complexity. They’d rather skip installing something with signatures available if they don’t know how and install something insecure instead that doesn’t mention it feeling more secure.

Fixing this mess could be metalink with OpenPGP support automating all of this:

• Metalink - MozillaWiki
• https://bugzilla.mozilla.org/show_bug.cgi?id=331979

@torjunkie

Anyway, this should work below and be easiest for Non-Qubes-Whonix? Reasonable?

Looks good.

@torjunkie

Note: .flatpakrepo files generally include the base64-encoded version of the GPG key that was used to sign the repository.

Is that a secure system? @HulaHoop

[Patrick]

Point Release - Kicksecure - introduced this term for an upcoming Qubes-Whonix point release Qubes-Whonix 14 (4.0.1-201811040215) TemplateVMs Point Release for Qubes R4 -- Testers Wanted! and soon also Non-Qubes-Whonix 14 point release.

[HulaHoop]

According to their lead dev, they do implement GPG signing (htough optional) of flatpak repos and code commits:

https://blogs.gnome.org/alexl/2017/02/10/maintaining-a-flatpak-repository/

I want to suggest they adopt TUF for their software repo code because it has defense in depth against so many other attacks than basic download poisoning.

Security

[nurmagoz]

include keepassxc to the comparison

http://www.dds6qkxpwdeubwucdiaord2xgbbeyds25rbsgr73tbfpqpt4a6vjwsyd.onion/wiki/Dev/Password_Manager

very important as i think now its the best one in use from high tech ppl like micahlee

[Patrick]

But how does it link the creator of the package with the package itself? If someone replaced the package on the website and resigned it, no one would notice that?

Imagine one day of the month Whonix downloads were signed by someone other than me. Key/signatures delivered the same way. Looks like with flatpak no one would notice?

[HulaHoop]

But how does it link the creator of the package with the package itself? If someone replaced the package on the website and resigned it, no one would notice that?

One would need to add the dev key to their keyring for this process to go thru. Much the same way as adding an outside apt repo to Whonix.

[Patrick]

HulaHoop:

But how does it link the creator of the package with the package itself? If someone replaced the package on the website and resigned it, no one would notice that?

One would need to add the dev key to their keyring for this process to go thru. Much the same way as adding an outside apt repo to Whonix.

Then it sounds ok. I was missing that step in @torjunkie 's instructions
above or overlooked.

In any case, please proceed @torjunkie.

[Patrick]

Tox is also alpha software which has not been formally audited, therefore it is less trusted.

formally audited is a very high hoop to jump through. Not much software has been formally audited ever. And even formal audit isn’t a “replaced brakes” alike operation. It’s like a “medical checkup”. It can mean many things, can be superficial and cheap or it can be super throughly and cost hundreds of thousands.