5 ms·

I got a few comments since I love your blogs and opinion. I work on Whonix and am excited that you're commenting on it. A minimum Debian is grml [1], 150-350MB

I got a few comments since I love your blogs and opinion. I work on Whonix and am excited that you're commenting on it. A minimum Debian is grml [1], 150-350MB, which Whonix uses as a base. But by the time we're done adding packages and KDE, it's not minimal anymore. We use a popular GNU/Linux distro (instead of, say, hardened gentoo) because 1) Lots of eyes on a bigger project is more secure than few eyes on a smaller project, and 2) Bad or missing usability/UX hurts security: these systems are used by journalists and dissidents, not the Unix and computer security trained. The trick is making a system that moderately educated users can get work done on, without letting them shoot themselves in the foot. VMs have their problems, but VirtualBox inside an average Windows install is harder to exploit than an average Windows install alone. Whonix can also run on dedicated hardware or inside a dedicated/minimal/portable host OS. Running inside QubesOS, the Xen-based (everything is isolated) security focused desktop OS, is a mid-term goal. Additionally, as resources (that is, volunteers) grow, builds of Whonix based on other distros/desktops/hardware will appear. To see you post on our forum [2] or github issues [3], lending your experience with PORTAL, would be a dream! Let's talk stream isolation. Or just voice your concerns and we'll try to defend our choices. --- Ditto on Pond, which is weird since Appelbaum is behind it, but apparently they don't want to start from scratch (Pond was just a README last time I checked). I have big hopes for TIMB, BitMessage, and the new (crossplatform) TextSecure. Hopefully redphone will receive the same treatment as TextSecure. Me and the lead Whonix developer tried to set up a crossplatform secure voice chat over Jitsi... an hour later we gave up. Icebird + TorBirdy is just barely becoming a reality. A GPG capable email client that doesn't give away your time zone is big news in this world. Don't get me started on losing all your bookmarks when you update the tor browser bundle! We got a long way to go. [1]: https://grml.org/ https://grml.org/ [2]: https://www.whonix.org/forum/index.php?board=5.0 https://www.whonix.org/forum/index.php?board=5.0 [3]: https://github.com/Whonix/Whonix/issues https://github.com/Whonix/Whonix/issues

grugq 13y ago
I should have been more clear, I mean a minimal Debian install for RaspberryPi. I don't want to create a full debootstrap image and make that available (it comes to almost 512mb after adding all the software, WTF!). I am familiar with grml. A hardened Gentoo is a more solid platform because of the reliability of GRsec + PaX for exploit mitigation. Unfortunately, configuring GRsec to work generically for a large number of usecases would be time consuming. I would still like to see it though. There is an option on how to do it properly, but so far I don't believe that anyone is working on making it available publicly. I know it has been done in private at least twice but neither implementation is likely to become public. I would very much like it to be public. :( If you are interested, it is a viable business, but I personally don't have the time to put into it. I really don't like VirtualBox. I think Xen, KVM, VMware are all superior options. I have never been able to get Qubes to install on any of my computers. It just fails. I guess I have the wrong hardware. I think it is sort of the correct approach, but there is a much better way. Email me if you want to devote some time to "doing it right". Would be in line with Whonix/Qubes, but different. :)

grugq 13y ago

I should have been more clear, I mean a minimal Debian install for RaspberryPi. I don't want to create a full debootstrap image and make that available (it comes to almost 512mb after adding all the software, WTF!). I am familiar with grml. A hardened Gentoo is a more solid platform because of the reliability of GRsec + PaX for exploit mitigation. Unfortunately, configuring GRsec to work generically for a large number of usecases would be time consuming. I would still like to see it though. There is an option on how to do it properly, but so far I don't believe that anyone is working on making it available publicly. I know it has been done in private at least twice but neither implementation is likely to become public. I would very much like it to be public. :( If you are interested, it is a viable business, but I personally don't have the time to put into it. I really don't like VirtualBox. I think Xen, KVM, VMware are all superior options. I have never been able to get Qubes to install on any of my computers. It just fails. I guess I have the wrong hardware. I think it is sort of the correct approach, but there is a much better way. Email me if you want to devote some time to "doing it right". Would be in line with Whonix/Qubes, but different. :)