But do you have any sources on whether they send this stuff in bug reports automatically like Windows?
For debugging and dev purposes it would make sense but for anything that uploads this sensitive info its a privacy nightmare.
Added usage instructions to Template:Scurl - Whonix that explains how to pass the url as variable to the template.
1 Like
Could you please fill out description= in Secure Command Line / Scurl and add to Whonix Documentation?
research and document secure downloads using Tor Browser:
https://phabricator.whonix.org/T677
1 Like
Yes, you’re both right. I don’t see anything indicating core dumps ever go back to Debian HQ or similar in Linux. 
Still, it was a surprise to learn that it was turned on by default. I’d assumed that only debuggers would enable it with a setting, not Debian would decide for all of us in advance that dumping this information locally on the HDD/SDD would (somehow) be a good idea.
I mean, Linux crashes so rarely compared to that trumped up malware running on most desktops.
Just checking here that I am doing {{scurl|
}} kind of thing for every wget instance?
How about the Security Guide for “Secure Downloads” info? Then after putting in that extra info there, do I just delete the page where it is now i.e. Secure Command Line / Scurl?
I’ll work on something else until the above is confirmed i.e. because I don’t want to stuff it up.
1 Like
Right.
1 Like
I am undecided. Security Guide is already massive in length. The old question on how to organize such as massive amount of docs to make it useful for most users. What about just adding it to the security guide checklist?
Any opinions?
OK - will do that now and just link to the existing page. If anyone wants to move it somewhere else later on - no problem.
I’ll get busy with those find / replace items too.
Cheers
1 Like
I’m going to finish off the Warnings entry before doing the find/replace stuff and other things on my “TODO”. Something easy for a change 
BTW I presume the only way to find every instance of “wget” etc is to just use the normal mediawiki search box(?).
Anyway, I added a “Verifying Fingerprints” section to the Security Guide, since it was needed.
To shorten up the Security Guide, do you mind if we split off the “System Hardening Checklist” part into its own webpage on the main Table of Contents page, appearing just after the “Advanced Security Guide”?
Then the Security Guide can just have a one liner saying "See [[System Hardening Guide]].
Logically it fits better to have Security Guide, Advanced Security Guide and a checklist. If you create an empty page, I’ll cut and paste it all across and fix up the broken internal references easy enough.
1 Like
Yes.
grep --exclude-dir=.git -r -i wget
And/or use search engines: site:whonix.org/wiki wget
Yes, that sounds like a good idea. Will be a good way for users to get an overview before being stumped by that big page. That way they can pick and choose what applies to them and what they want.
1 Like
Yes, awesome, very much needed indeed. Just a few nitpicks. We have Whonix and Tor Limitations but it may be insufficient / not actionable. Perhaps link from one to the other?
Just a few nitpicks. Perhaps that chapter name would be better “verify software signatures”? Of course, the first step is making sure having gotten the right key with the right fingerprint. After that, of course verify the file / repository against that key.
We have OpenPGP - Kicksecure but I am not sure it’s very understandable.
Perhaps you could summarize (and perhaps rework) Placing Trust in Whonix into a very few sentences? I think most users don’t get what software signatures proof and whatnot. They don’t magically prove “backdoor free”. They increase certainty “less likelihood of backdoor introduced by third party during transit”.
1 Like
Fixed. I’ll fix up internal references once all this is signed off, and change checklist entry around “Verifying Software Signatures” instead of “Verifying Fingerprints”.
Fixed and addressed all your points.
I’ve also added “Split Tor Browser in Qubes” and “Tor Browser without Tor” entries (empty) to the Advanced Tor Browser section, noted with “TODOs”.
Back to the Warnings section now.
1 Like
Warnings section -> Fixed.
I added significant information to the “Passwords” entry and the “Stylometry” part.
So once it’s signed off, that can probably get cut and pasted out to Security Guide & the Blogging Anonymously entries, respectively, with just internal references.
OK, moving on…
1 Like
Awesome! All reviewed.
from Whonix 0.4.5 release announce
I speculate that quote there from 0.4.5 isn’t the best English either. Reword useful? (And add “was reworded, same meaning”. Or remove the quote altogether if we already said that elsewhere?
→ Fixed.
Passwords text (mostly) shifted to Security Guide. → Fixed.
Stylometry text (mostly) shifted to Surfing Post Blogging entry → Fixed.
System Hardening Checklist links check (ok) and some minor added text → Fixed.
Note:
-
On the main wiki contents page, there is two instances of “Known Issues” (under General Information and Bugs sections). Suggest you delete one of them.
-
Under “Bugs” section, the Troubleshooting entry is mostly in development. Suggest it is moved to the “Dev” section until it is done and a one-liner references it from either “Reporting Bugs” or “Known Issues”. Very, very draft material like that doesn’t belong on the main wiki page.
Other comments:
I might edit the “Install Additional Software” part next as an easy win before doing Advanced Security Guide. Once those two are done, all of the entries under “Get Whonix” and “First Steps with Whonix” will be finished. Rejigging the various sections in these entries will kill the phabricator item too.
(I haven’t forgotten the “TODO” list, I’ll get to it.)
After that point, it’s probably worth editing remaining items in “General Information” (easy, generally short) and doing some significant merging, renaming and shifting stuff around in these first 3 sections, because I just don’t like the haphazard nature of it.
I’d like to see “Download Whonix”, “Secure Whonix” “Whonix Features and Design” or similar titling (TBA; requires significant consideration). Section renaming should imitate other software projects like QubesOS and Linux platforms.
There are simply too many “General Information” entries right now before the user gets to the meat e.g. downloading, verifying, securing the platform and so on. Also, Bridges doesn’t belong under “First Steps” since only 3% of all Tor users do this configuration etc.
1 Like
Yes, I agree. Needs all to be condenses / reorganized.
Deleted under general information.
Wish list: Could you please turn the new stylometry documentation into a wiki template? So it could be reused on the related
https://forums.whonix.org/t/standalone-wiki-pages
Btw related:
Some other minor stuff…
At the top of Combining Tunnels with Tor it’s saying Combining Tunnels with Tor. The wiki markup for that is:
{{Title|
title=Combining Tunnels with Tor
}}
{{#seo:
|description=Instructions on how to combine tunnels (VPN, SSH, proxy) with Tor. (User -> Tor -> proxy/VPN/SSH -> Internet) (User -> proxy/VPN/SSH -> Tor -> Internet)
|image=https://www.whonix.org/w/images/8/86/Beyond-1087922640.jpg
}}
``
So we have `Tunnels/Introduction` as well as `Combining Tunnels with Tor`. That should help search engines to find relevant content as well as users to quickly see what the page is about.
Long story short, perhaps you would like to use the stylistic utility of `title=` every now and then.
----
The top level chapter of https://www.whonix.org/wiki/System_Hardening_Checklist currently is ` System Hardening Checklist`, which seems redundant. Perhaps got any idea for `title=` and `description=`?
As for `image=`, @TNT_BOM_BOM is our expert for that who will be looking for Libre Software licensed illustrative images. We could create a forum thread or ticket for any missing `image=`. With or without suggestions on what would suit as image. @TNT_BOM_BOM will see to it eventually.
-----
https://www.whonix.org/wiki/System_Hardening_Checklist is awesome. A short summary was really needed. Helpful as reminder. People can check what they know and/or already did and check out topics they don't know yet.
Could you please mention keystroke fingerprinting, https://www.whonix.org/wiki/Metadata and https://www.whonix.org/wiki/Surfing_Posting_Blogging#Anonymous_Photo_Sharing? Please keep the security list as short and concise as currently so we won't one day require a checklist for the checklist. :)Fixed.
Fixed. Plus watermarking with anonymous doc sharing.
Stylometry Template → Will do.
1 Like