https://community.kde.org/Baloo/Configuration

It appears that baloo is disabled by default. On a fresh WS:

balooctl status

it says disabled.

Baloo is installed by default in both GW and WS

If baloo shouldn't be on by default in Whonix, then lets not include the baloo package (and 2 dependencies?) at all.

dpkg -l | baloo

Hmm but apt-get remove shows that dolphin and some whonix packages (??) depend on it.

Whonix does not depend on baloo directly. It's a dependency of dolphin. Therefore cannot be avoided.

reverse-depends baloo-kf5

TODO:

• add a new whonixcheck test that tests if baloo is disabled and warns if it is enabled (now or later)
• or lazy reassign the ticket to Debian version 10 codename Buster so we manually recheck then

It's off by default. If someone enables it by choice, should we warn them to turn it off? Warn them that it's another attack vector? Is it a big enough security risk? whonixcheck shouldn't be in charge of checking and warning the user about most modifications they make that may be attack vectors.

Compromise: Kick the problem to deb 10 and see if they've turned it on by default. Worry about it then.

JasonJAyalaP (Jason J. Ayala P.):

JasonJAyalaP added a comment.

It's off by default. If someone enables it by choice, should we warn
them to turn it off? Warn them that it's another attack vector? Is it
a big enough security risk?

Good question. My idea was to make sure it stays disabled in Debian 10
based Whonix later on. Perhaps that doesn't belong into whonixcheck but
would more be part of an automated test suite.

Compromise: Kick the problem to deb 10 and see if they've turned it
on by default. Worry about it then.

Right.