Ticket above closed and convo moved to tails-dev.

It looks like bpfilter is in rather early stages, and it's few years until we'll see it in Debian.

Or skip nftables and use Berkeley Packet Filter (BPF)?

Not a problem anymore.

https://www.whonix.org/wiki/Chat#Ricochet_IM

NonaSuomy:

Added requested NFTables example from duclicsic #netfilter freenode.

Starting with Bullseye nftables will be the default:

https://redmine.tails.boum.org/code/issues/17156

Analysis by Cyrus cited here for completion:

Reported build failures:

When an implementation is decided, let's decide if we can include this in security-misc for use on Linux hosts and Kicksecure. We would need some way in detecting the active NIC since on wireless systems wlan0 is the interface of choice and not eth0

tc-netem is a utility that is part of the iproute2 package in Debian. It leverages functionality already built into Linux and userspace utilities to simulate networks including packet delays and loss.

install electrum appimage by default:
https://github.com/Whonix/anon-meta-packages/commit/71d40f5316ee7eb38eb04142d80d23c56a48407b

Any update?

Will keep watching what Tails is doing.

Maybe there is no need. It's just when Tails has a ticket, we should
check it at Whonix too. Thank you for looking into this, too!

The way it is now looks fine. Why would it need to be changed?

madaidan (madaidan):

madaidan added a comment.

> https://lists.ubuntu.com/archives/apparmor/2016-February/009371.html says it is used for various things so it might break some things.

Wouldn't using a fake machine-id e.g. a bunch of zeroes fix this?

https://lists.ubuntu.com/archives/apparmor/2016-February/009371.html says it is used for various things so it might break some things.

In T582#18461, @madaidan wrote:

Would it cause any issues if the machine-id was just deleted or replaced with a bunch of 0s?

Would it cause any issues if the machine-id was just deleted or replaced with a bunch of 0s?

Unfortunately, not possible.

The concept was documented for operational use. Auto Guard de-duplication considered too complex to deploy and manual checking is enough.

Done

https://www.whonix.org/wiki/Onion_Services#Step_1:_Install_Server_Software needs update.

Done. You can close this ticket once you agree with edits.

Sounds good!

From this size comparison on Debian wiki, I think the best and most secure option is the smallest and most minimal one: micro-httpd

We still have the warning on https://www.whonix.org/wiki/Onion_Services.

I think hiding the clock is a bad idea as a user may want to manually run sdwdate to adjust it if it's out of whack before initiating internet traffic. (This is on non-Qubes versions lacking auto time adjust)

https://researchut.com/post/migrating-firewall-to-nftables/