Whonix VirtualBox 14.0.0.5.5 Testers Wanted!

[nurmagoz]

@Patrick

Malicious session? How could that happen? When malware is on the system, it does not need to abuse session management. More likely to hide as kernel rootkit.

preferable to give it for the user choice , but from our side it will be empty.

@Patrick

developers repository will be closed btw. will beomce stretch-developers. Please move to stretch repository.

sudo whonix_repository --enable --codename stretch

done , but just mention anywhere when grup-live to be available there so i can install it (i rather stick to tester repo better than dev repo).

@Patrick

That’s difficult to get rid off. dolphin depends on it. See: apt-cache show dolphin. It’s a waste of space, mostly, and would be good to purge, but I don’t think it increases attack surface. A program on the gateway even if running does not increase attack surface. Malware would still need a way to interact with that code to exploit it. What’s the attack vector? A user downloading a malicious audio file, playing it on the gateway and then the audio file exploits a hypothetical vulnerability in phonon?

cant we remove even dolphin and reinstall it again ? so we can get ride of all of them ? to avoid sucha exploitation like this one PulseAudio 0.9.5 - ‘Assert()’ Remote Denial of Service or this one PulseAudio setuid Local Privilege Escalation Vulnerability or VideoLAN VLC Media Player 0.8.6d - ‘httpd_FileCallBack’ Remote Format String. they r old used exploitation but still it increase the attack surface. (specially gateway very likely to hold hidden services inside it).

@Patrick

@All Whonix 14 testers: Please move to stretch repository.

sudo whonix_repository --enable --codename stretch

Note:- it will cause the connection to drop in the gw , restart will solve the issue.

• additional features:-

if we can fix this issue here , its preferable to change the links inside whonix homepage to .onions only (for the website , documentation, forum …etc).