An interesting product that triggers a system wipe if the cable is pulled:

Any attempted access of /boot would be logged the same way anyway although it might be good to use that to stop it from showing up in aa-logprof.

Would an audit denyrule for /boot be useful for the sake of audit?

/boot isn't allowed in init-systemd anyway so we don't need to add it to dangerous-files. Apparmor denies access to files that aren't explicitly allowed. The only reason we need to blacklist /lib/modules and not /boot is because we give access to all libraries.

Still need to add /boot to https://github.com/Whonix/apparmor-profile-everything/blob/master/etc/apparmor.d/abstractions/dangerous-files? Currently cannot find it there.

/boot/ is already unreadable.

• An analysis of TCP secure SN generation in Linux and its privacy issues
• Tirdad kernel module for random ISN generation

This was done. If not, please create specific tickets where it isn't done.

https://redmine.tails.boum.org/code/issues/17156

Analysis by Cyrus cited here for completion:

An alternative proposal for editing ISNs without involving the kernel:

Implemented for some time now.

Reported build failures:

When an implementation is decided, let's decide if we can include this in security-misc for use on Linux hosts and Kicksecure. We would need some way in detecting the active NIC since on wireless systems wlan0 is the interface of choice and not eth0

tc-netem is a utility that is part of the iproute2 package in Debian. It leverages functionality already built into Linux and userspace utilities to simulate networks including packet delays and loss.

In T543#18086, @HulaHoop wrote:

@Patrick What is the status of integration?

@Patrick What is the status of integration? Since we have kloak this is also a great defense to have. There is a script on there for packing as a deb:

release kloak v0.2

Many code enhancements were recently added by its author.

To build a package with qubes-builder, you need to add Makefile.builder file with just one line: DEBIAN_BUILD_DIRS := debian. This will tell qubes-builder that given repository contains Debian package.
Alternatively, if that would be too much of a problem, it should be easy to add an option that do auto detection (probably just looks for debian directory).

With TPO infrastructure using onions, its now a good idea to switch tb-updater to check for version info and downloads to these more secure mirrors.

https://forums.whonix.org/t/user-poll-xfce-vs-kde-kde-deprecation-considered/6235

https://forums.whonix.org/t/user-poll-xfce-vs-kde-kde-deprecation-considered/6235

https://forums.whonix.org/t/user-poll-xfce-vs-kde-kde-deprecation-considered/6235

https://forums.whonix.org/t/user-poll-xfce-vs-kde-kde-deprecation-considered/6235

We can now grab the browser tarball from the TPO onion instead which makes this ticket obsolete. Close if you concur.

This should be fixed by default in the next build.

linking to forum:

He was busy those past few months and thought there was no interest. @Patrick Expect a new release this coming week.

Ping:
https://github.com/vmonaco/kloak/issues/10

Why not ping him first? Its a waste of good work otherwise.

Dead upstream.

Created [way to find out name of gateway from witin VM - qubesdb-read /qubes-gateway-name](https://github.com/QubesOS/qubes-issues/issues/4117) for it.

In T534#16397, @troubadour wrote:

The easiest way would be to have a new entry for qubesdb-read, in addition to qubes-gateway which holds the IP address.
Something like qubesdb-read /qubes-gateway-name.

For the time being, the vm's whonix gateway is hard coded in two files, the one watching and sending sdwdate satus and the one sending the shutdown notification.

What happens in case of multiple Whonix-Gateway ProxyVMs? I.e. in case of sys-whonix, sys-whonix-two, etc.? How would anon-whonix-two know it has to connect to sys-whonix-two?

https://forums.whonix.org/t/content-security-policy-now-deployed-on-whonix-websites

We have now a DNS Certification Authority Authorization (CAA) Policy.

From sdwdate log. Clock was right but I got this using a bridge.

In T84#14765, @marmarek wrote:

Well, google is going to deprecate HPKP in chrome/chromium.

Same as T84#14765.

Have run the fuzzer unit test simultaneously in sys-whonix and five anon-vm.