Skip to content
Snippets Groups Projects

MISC

Last edited by Alexander Færøy

Stuff that doesn't fit...

this is only temporary anyway, till we get a real bug tracker.

Problem getting software form Tails [SOLVED]

  • (proper) Following Tails is also very hard. I though about grabbing tails_htp. They have a git but that's not protected by SSL or SSH. Only way to safely extract something out Tails is downloading the iso, verifying the iso, unpacking squashfs (btw: "sudo unsquashfs -x -dest /home/user/tails filesystem.squashfs" and grabbing it from there. They also don't have an apt repository yet and they are also not like upstreaming all their work.
  • (anonymous) but they say git is signed, what's the problem? https://mailman.boum.org/pipermail/tails-dev/2012-June/001254.html
  • (proper) Do you know how to verify it? I haven't found out.
  • (anonymous) git tag -v; commits after the last signed tag are not to be trusted. There are tons of git tutorials and guides.
  • (proper) I was on the wrong path, understood "only the download iso is signed". "git tag -v 0.12" worked for me.
  • (proper) I'd also like to extract torsocks/libtorsocks from Tails, because they fixed the "The symbol res_query() was not found in any shared library. The error reported was: not found!" bug. Perhaps that's not necessary and we can use the Debian package, if they fixed that upstream.

[MISC] Ubuntu server 64-bit [ANSWERED]

  • (adrelanos) Any objections using Ubuntu server 64-bit as T-W's operating system? At least for private builds? What I see so far: fingerprinting issues, the exit node and mirror can guess, that someone uses aos with 64-bit instant of 32-bit. Since the streams are now separated, I see no big issue with that. Anything else? As long as we have PAE as requirement, we could also switch to 64-bit? Do all PAE-featured CPU's also support 64-bit?
  • (anonymous) I don't know. AMD64 is older than PAE. However, 32bit software runs without problems on 32bit and 64bit hosts, 64bit software no so much. Because we generally don't control what host OS people use I chose to base aos on 32bit. Vbox does support that mode for some time but I assumed that there are performance implications. Secondly 64bit software needs more RAM, we already run 3 OS (or more) on a system which eat RAM, better minimize that (KVM and other solutions improve RAM usage through page sharing or what it's called, VBox doesn't). Thirdly, according to Brad Spengler and/or PAX team amd64 is a brain dead instruction set and actually worse than x86, despite the large address space making ASLR more effective. They recommended to use grsec on x86 and I hope we can switch to a grsec kernel (wheezy has one, let's see if they maintain it).
  • (adrelanos) Moved to faq https://trac.torproject.org/projects/tor/wiki/doc/TorBOX/FAQ#Whydoyouusethe32bitoperatingsystemnot64bit

[0.2] [MISC] [WEBSITE] Not affiliated with torproject notice [DONE]

  • (adrelanos) Important link: tpo trademark faq. Less important link about being experimental software].
  • (adrelanos) I've been in e-mail contact with tpo and I wish I could publish the few mails, but I can not. My questions, if we can discuss it in public or if I can can publish the mails, remained unanswered. I don't want to publish them anyway, because I don't want to challenge them. This is also why I added a second sentence to the aos homepage root.
TorBOX is a non-offical, community project. We are not affiliated with torproject.org. The Tor developers are not responsible for this project. See Disclaimer for more information.

TorBOX is produced independently from the Tor® anonymity software and carries no guarantee from The Tor Project about quality, suitability or anything else.
  • (adrelanos) Also with aos 0.1.3 it happened, that people mirrored aos and offered it for download from their site without linking to our homepage. People might use aos without ever reading the notice. We must make it absolutely clear for anyone, that aos is not torproject.
  • (adrelanos) For the (trademarkdomain user disappeared) website it might be best to add the non-affiliated-with-tpo notice to root page and to all sub pages. (People on forums/blog/etc. enjoy posting deep links.)
  • (adrelanos) Here is my proposal for the aos message on aos-Gateway.
# aos help/welcome message
cp /home/$USERNAME/.bashrc.backup /home/$USERNAME/.bashrc
echo \
'echo "Welcome to aos Tor-Gateway Version $TORBOX_VERSION!"
echo "TorBOX is a non-offical, community project. We are not affiliated with torproject.org. The Tor developers are not responsible for this project. See Disclaimer for more information."
echo "TorBOX is produced independently from the Tor® anonymity software and carries no guarantee from The Tor Project about quality, suitability or anything else."
echo "TorBOX is based on Tor."
echo "TorBOX is experimental software by means of concept and design. Do not rely on it for strong anonymity."
echo "Type: \"torbox\" <enter> for help."
' | sudo -u $USERNAME tee -a /home/$USERNAME/.bashrc
  • (adrelanos) For aos-Workstation I propose to add this notice to our torcheck script.
  • (trademarkdomain user disappeared) All looks good to me. Will do on (trademarkdomain user disappeared) website.
  • (adrelanos) I think it were best if this notice must only be changed once (variable) and effects changing it on all sub pages. Only admins may change it.
    • (trademarkdomain user disappeared) Definitely. Good idea... I'm working on implementing only one HTML/CSS template source anyway, since I hate to have to manage & modify several template versions. But for even easier updating of text blurbs like this, I can put this in the database. Abstracting it out of the HTML into the database might be done upfront at launch or a bit later, depending upon time & launch motivation. Easily doable though.
  • (adrelanos) Ok, not the most pretty solution, not the best places, but should be okay. Open for suggestions.

[MISC] better Marketing [DONE]

  • (adrelanos) Currently the main page is way too geeky, scary and complicated. I appreciate being upfront about security and other issues but we should perhaps orientate more on front pages of successful projects, such as Tor and Tails. Successful in having lots of developers, users, supporters and progress. Without having users the most promising implementation is not very useful or secure. Users attract interest, more user, more reviewers, devs and so on. Of course, we will always be upfront with the interested ones about open issues, but that are the ones who click to a sub page and who read the full documentation. When you look at the torproject.org you also won't see a "Uh, we actually have no defense against traffic confirmation, internet exchange point spying, don't pin SSL certificates, have no deterministic builds, no apparmor and a huge amount of other critical issues". It's a fact that most users don't read documentation. I'll aim to make offer a project which provides them with as much as security then possible, at very least more security than the Tor Browser Bundle. The interested ones and those who really care will always be very welcome and they will be offered additional information on how they can get best safety. And when they learned everything they may help us to improve the project even further (use multiple vm's/snampshots, physical isolation, etc.).
  • (adrelanos) I plan to make big changes, a rewrite to the aos front page. News and You Can Help will be moved to the Readme.

[SOURCE CODE] no longer hardcode user folder [FIXED]

  • (adrelanos) Currently Whonix build scripts assume to be build as user "user" and the Whonix source code being in /home/user/Whonix. This should no longer be hardcoded.
  • (adrelanos) fixed.

remove wpolipo [DONE]

  • (adrelanos) Remove wpolipo. Put wpolipo in it's own git repository. Not in use for anything. When discussing wpolipo, privoxy was rather recommend. So perhaps create wprivoxy? -> New ticket.
  • (adrelanos) Done. It's still inside but does not do anything because no ports are defined.

[FEATURE] Feedback collector [ANSWERED]

  • (adrelanos) We could add a small application on T-W where the user would only see a small text box and a send button. The feedback would be send to us. E-mail would make sense, but any other suitable method will do. There are open questions about user privacy. Should we encrypt that message? Should we normally send over the Tor network or should we add another layer of protection such as remailing? Or simply send over Tor and tell the user to switch circuit afterwards? How do we answer the users? Are there existing applications for this task or would we have to develop it ourselves? Does this make sense at all?
  • (anonymous) I really think that's overkill neither Tor nor Ubuntu has that, why should we - we just configure the two?
  • (adrelanos) Agreed. Update: Reopened. We have 173 download of Whonix 0.1.3 through sourceforge.org and barely any user feedback. Tails has [whisperback, you can see it in action if you get a recent Tails version. Unfortunately, whisperback requires a SMTP relay. Apart from that, they have a git repository for whisperback and after changing the messages, it could be used as a drop in replacement (still needs more research).
  • (trademarkdomain user disappeared) A feedback collector is a good idea. However, I think doing it over email is a bad idea. This increases chances of interception and it makes it very hard for all developers and/or community to receive & review the feedback. I think the best way to implement it would be via HTTP through the (trademarkdomain user disappeared) website, where it goes into the database. I assume that there would be an obmenu item to initiate the feedback form. Either we could have a form on the desktop submit to a (trademarkdomain user disappeared) processing script in the background (extra feature development & maintenance), or we could simply open up a standard feedback webpage on the (trademarkdomain user disappeared) website in the browser that everyone uses, whether coming from the desktop or web (simpler, one unified solution to maintain & pull from). Also, by launching a webpage in the browser, people can have more certainty about where the feedback is going, compared to an uncertain form overlayed on the desktop that goes out into the ether. So, I'd probably vote to simply open a standard (trademarkdomain user disappeared) feedback webpage like that. Could be done via SSL or Hidden Service in the TorBrowser.
  • (adrelanos) About interception: I was going to ask if we could host a hidden mail relay (only relaying to (trademarkdomain user disappeared), no outside targets). That way no interception is possible. I was only going to ask, if I would not have found an alternative to the mail relay. I was thinking about using remailers and encrypted posting to usenet. Whisperback from Tails looks very pretty, here is a https://tails.boum.org/doc/first_steps/bug_reporting/whisperback.png screenshot]. Thanks for joining this thread. Most features can be implemented over http and a hidden service. I think the Tails threat model for having an application for that is, that not even the server host can read the gpg encrypted reports. (The "add gpg key" field is allow the Tails developer to send back an encrypted answer.) Not sure we have such a threat model? If we had we could gpg encrypt inside the browser using a locally stored website. Most discussion should got into public areas anyway.
  • (trademarkdomain user disappeared) Hmmm... Interesting. I like the idea of initiating feedback from the desktop, even if just linking to the website. However, I don't like the idea of doubling the infrastructure of an issue tracker, both for the double maintenance as well as having similar types of postings end up in two separate systems/places. So, to me, it seems more ideal to somehow integrate this desktop feedback into the central issue tracker system. This would also likely allow for better inter-developer workflow for processing the feedback properly (every approved developer gets to see it, no overlapping responses, accountability for responses, etc). Beyond integration with existing issue tracker infrastructure, the challenge seems to be handling private non-public feedback/issues, and secure notification/transport of responses for private feedback/issues. So, overall, ideally looking for... Tracker Integration + Shared Developer Processing + Private & Public + Secure Transport. Does this sound accurate?
  • (trademarkdomain user disappeared) And, if so, is private feedback/issues that important, if we can offer anonymous public feedback/issues?
  • (adrelanos) Yes, having two systems sounds complicated and I am not sure we have the manpower yet. Let's make it easy but at least make it. One website, one issue tracker, one forum, one wiki, done so far. A website link can still be added, but it shouldn't encourage posting duplicates. If anyone really needs encrypted bug reports, they can mail be personally using my gpg key, I don't expect that to happen often.
    • (trademarkdomain user disappeared) Agreed.
  • (adrelanos) Tails reason to have the feedback collector as application is sending anonymized hardware data to Tails develoeprs and not to the open public. Since Whonix delegates hardware support to the host operating system and does not have so strong requirements to safe space and kernel modules, it might not be necessary to use their tool.

[BUG] uwt wrapper localhost connections broken [FIXED]

  • (adrelanos) I deactivated the wget uwt wrapper, because connections to localhost were broken. That may not be needed often, but if so, it leads to errors where the source is hard to find. The same goes probable also for the ssh wget wrapper and perhaps others.
  • (anonymous) can't we add an exception? "IF localhost use wget, ELSE use wrapper"?
  • (adrelanos) Good idea. I added an check not to use torsocks when 127.0.0.1 or localhost is inside the parameters.
  • (adrelanos) Not sure if anything else is still broken. uwt might still not be a generic solution for applications which internally decide to connect to localhost, not sure if git does this.
  • (adrelanos) Removed [0.2] tag until I or someone else finds a new issue.

Comments

    Please register or sign in to add a comment.