DA Privacy Kit v0.1.0b4

A review release of DA Privacy Kit's public beta. Two rounds of testing on real machines (Linux Mint, KDE Plasma
on CachyOS, Fedora, Ubuntu and Omarchy) found about 180 problems, from wrong results to things written where they
shouldn't be. All of them are fixed here. Tor or Mullvad Browser in memory, What does this app keep? and Try an app had
a review of their own. 0.1.0b3 was a test build that was never published; this release includes everything in it.

Warning

Still a public beta: expect bugs. It is best used to scan, to learn about your own system and to try its
tools: don't rely on it yet for critical privacy matters. Several fixes and tools run commands with
administrator rights, so keep backups. It is no replacement for Tails or
Qubes OS, and it isn't antivirus.

New

• Keep the browser download for next time. In Tools → Tor or Mullvad Browser in memory, the download dialog
  has a tick, off by default: Keep the download for next time. The archive and its signature are then kept in
  ~/.cache/daprivacyscanner/browsers/, so the next set-up needn't download it again. A kept copy goes through the
  same checks as an archive you pick yourself:

  • the project's server is asked for the latest version, and a kept copy that is out of date is refused, with the
    new version offered for download;
  • its signature is verified again.

  The dialog says what keeping means: the file on your disk tells anyone who looks that the browser was set up on
  this computer, and deleting it later doesn't erase it. Kept copies are listed in the panel with Delete….

Privacy fixes

• Scans no longer write anything into your home folder.
  • On Fedora, every scan copied about 105 MB of package lists into ~/.cache.
  • Checking Flatpak made ~/.local/share/flatpak.
  • The online package test kept 269 MB of lists in ~/.cache. They now go in memory and are removed at once, and
    the copy an earlier version left is removed.
• The Outbox no longer writes the names of the files you share into the system journal. Its notification only
  ever counted them, but its log listed every name. The app's own units and timers now log counts only.
• Tor or Mullvad Browser in memory:
  • Your user name, home folder and computer name could be read from inside the browser's sandbox. The sandbox's
    first process carried them. A website that took the browser over can't read them now.
  • The sandbox's local-network fence missed some networks. It covered only the network card the browser's
    network was copied from. It now refuses every network this computer is on: a second card, Docker's or a virtual
    machine's network, a VPN's private ranges.
  • The sandbox no longer gets your real network addresses. Before, it showed your real IPv6 address and your
    router's hardware address. It now has addresses of its own.
  • More of the computer is hidden from the browser: the graphics card's serial number, the addresses of
    Bluetooth input devices, and the sizes of your disks and swap.
  • tor runs in a sandbox of its own, without the display, its X11 cookie, your sound or the browser's profile.
  • Closing a window opened by a right-click entry no longer wipes ~/TempBrowser. Every "Verify download…" or
    "Remove metadata…" window is a copy of the app, and closing one overwrote and deleted ~/TempBrowser, a download
    not saved yet with it. Only the window that opened ~/TempBrowser closes it now.
  • Add a file to upload… no longer follows a link a website planted in the Downloads folder. Before, such a link
    could have copied a file such as an SSH key to where the browser can read it.
  • View offline… with a Flatpak viewer no longer opens the file online. If that app was already open, the file
    was handed to the open copy, which has the network and keeps history. It is now refused while the app is open,
    and the viewer runs in Flatpak's strictest sandbox: no network, no files of yours, no sound, and no help from the
    desktop's file services, which could fetch a web address for it.
  • No more dated journal lines about the browser's sessions. Closing ~/TempBrowser left one every time, and
    quitting the app printed which browser had been used.
  • Downloads and the TempOutbox:
    • a download changed in place is judged again;
    • the TempOutbox no longer passes on a file that is still being copied in;
    • a crafted download can no longer stall the panel.
• What does this app keep? no longer names your own documents. A document an app saves often was listed by name.
  It is now only counted, as the page promises. The system journal no longer records which app you watched.
• Try an app:
  • quitting the app's window now discards the trial, which could stay on the disk with everything the tried app
    wrote;
  • a trial with the observed network now ends if the app is killed;
  • the tried program can no longer read your environment.

Wrong results fixed

• Secure Boot showed as "not supported" on every UEFI computer. The check read the wrong EFI variable.
• KDE Connect still showed as running after you removed it. It does run until you log out, from the program you
  removed: the check now says so, and the guide stops it.
• Fedora: firewalld 2.x's zones are read correctly, and so is NetworkManager's own setting for random hardware
  addresses, which outranked the app's. Security updates are counted by package, not by date.
• KDE Plasma:
  • thumbnails are found as Qt writes them;
  • the recent-files lock for Gwenview and Okular now holds;
  • the fix that keeps KDE Connect from being started again works at once, not only after you next log in.
• Kernel options are read as the kernel reads them: the last value given wins.
• Easy fixes no longer undo a stricter setting. After you chose to keep the system journal in memory only, Easy
  fixes offered a two-week limit that replaced it. Changes that two checks share are listed once.
• Undoing a fix says what really happened. It said "put back" while a folder in memory was still mounted.
• Turning Avahi off lasts. The printer service started it again at every boot. It is now masked, not only
  disabled, and undoing the fix unmasks it.
• Arch and Omarchy: install commands use pacman -Syu. Package lists that were never downloaded no longer read
  as "everything is up to date": the check says it couldn't tell.

Tools

• What does this app keep? finds more of what an app leaves:
  • the recent-files and file-metadata records GTK, Qt and Cinnamon write, KDE's compressed thumbnail names, and
    names with brackets or &;
  • an app that is already open behind a launcher script, such as LibreOffice, is now refused instead of giving an
    empty result;
  • a disk mounted in your home folder or during the watch is watched, or the page says why it can't be;
  • under heavy load it no longer takes kernel memory without limit, and events it had to drop are counted.
• Try an app:
  • the network report names each connection by the site it asked for, also when sites share an address;
  • a Box whose program fails at start says so in a dialog;
  • a newer program kept in a Box replaces the old one.
• Logging out with ~/TempBrowser open:
  • KDE Plasma: it is closed properly, with no password. Plasma closes the app's window, the app overwrites what
    is in it, and the computer unmounts it once you are logged out.
  • Cinnamon: quit the app before logging out (see below).

Install

Download DAPrivacyKit-0.1.0b4-x86_64.AppImage, make it executable and run it:

chmod +x DAPrivacyKit-0.1.0b4-x86_64.AppImage
./DAPrivacyKit-0.1.0b4-x86_64.AppImage
./DAPrivacyKit-0.1.0b4-x86_64.AppImage --install-helper    # once, recommended: the administrator helper

Coming from 0.1.0b2, replace the old file. History, accepted findings and the last report are kept in your home
folder, not in the AppImage, so they carry over. The administrator helper has changed: if you installed it, the
app says the installed one is from another version. Install this version's from the app, or with --install-helper
as above.

It needs x86-64 Linux with WebKitGTK 4.1 for its window:

Distribution
Ubuntu, Mint, Debian	sudo apt install gir1.2-webkit2-4.1
Fedora	sudo dnf install webkit2gtk4.1
Arch, CachyOS	sudo pacman -S webkit2gtk-4.1

The README says what it is; the
manual covers the rest.

Verify

The release is signed with the Digital Archon release key,
docs/release-key.asc, whose
fingerprint is:

3AA5 C061 33BB C05A 4151  EA41 5B59 48EB 785E D3AF

If you have 0.1.0b2, open Tools → Verify a download and choose the new AppImage. With its .asc beside it, it
should say Verified: made by Digital Archon. By hand, with the AppImage, its .asc and its .sha256 in one folder:

curl -sSfO https://raw.githubusercontent.com/DigitalArchon/DAPrivacyKit/v0.1.0b4/docs/release-key.asc
gpg --import release-key.asc
gpg --verify DAPrivacyKit-0.1.0b4-x86_64.AppImage.asc DAPrivacyKit-0.1.0b4-x86_64.AppImage
sha256sum -c DAPrivacyKit-0.1.0b4-x86_64.AppImage.sha256

gpg should say Good signature from "Digital Archon Release Signing", with the fingerprint above (its
warning that the key isn't certified is normal).

SHA-256: ad2b91bed1009df37b9f216ae19bd619d6d7e6257f1be4bb2e94404dc79aa71d

The AppImage is reproducible: packaging/verify-release.sh v0.1.0b4 in a clone (rootless Podman) builds the
tag and compares the result with this release, byte for byte. See
[packaging/README.md](https://github....

DA Privacy Kit v0.1.0b2

A bug-fix release of DA Privacy Kit's public beta, with fixes for problems reported against 0.1.0b1. Thank you
for the reports.

Warning

Still a public beta: expect bugs. It is best used to scan, to learn about your own system and to try its
tools: don't rely on it yet for critical privacy matters. Several fixes and tools run commands with
administrator rights, so keep backups. It is no replacement for Tails or
Qubes OS, and it isn't antivirus.

What's fixed

• Mullvad VPN no longer shows as "without DNS leak protection or kill switch". Mullvad's app has no
  setting for either: while it is connected, its firewall blocks all traffic outside the tunnel and every DNS
  lookup except to the servers it set. The check now knows this. With Mullvad VPN connected it passes and says
  why, and it shows whether Lockdown mode is on. Lockdown mode is the app's one related setting, and it also
  blocks the internet when you disconnect or quit. The How to… and Guide… steps for the VPN, DNS-leak and IPv6
  tests no longer tell you to turn on a switch that isn't there. If a test still finds a leak, they say what to
  look at (split tunnelling, a custom DNS server). Please report it if your Mullvad app shows something
  different.
• VPN DNS leaks are judged by what this computer actually uses. The check read systemd-resolved's
  settings even on systems where programs don't ask systemd-resolved. It now checks the servers in
  /etc/resolv.conf there instead.
• Clearing VLC's and Haruna's history no longer looks like deleting their settings. These fixes only
  remove the history lines from the settings files, but the confirmation said the files were "deleted
  permanently". Each step now says that only those lines change, and lists the settings it empties without
  showing their contents.
  • VLC's fix also emptied matching lines outside its recent-media list. It now changes only that list.
  • Haruna's database is deleted only while it holds nothing but its recent files and resume points.
    Otherwise it is left alone, and the fix says so.
• Deleting leftovers now shows where they are. Before any files are deleted, the step lists them, or
  their folders with a count when there are many, so you can look first. Before, the editor backup files in
  your folders showed only as "N files in ~". VS Code's local history folders have hashed names, so each is
  shown with the file whose earlier versions it holds.
• Discord was reported as "made for 0.0". The version Discord's checks were made for was a placeholder,
  so every release from 1.0 on was reported as a newer major version. It is now recorded as 1.0.161.

Install

Download DAPrivacyKit-0.1.0b2-x86_64.AppImage, make it executable and run it:

chmod +x DAPrivacyKit-0.1.0b2-x86_64.AppImage
./DAPrivacyKit-0.1.0b2-x86_64.AppImage
./DAPrivacyKit-0.1.0b2-x86_64.AppImage --install-helper    # once, recommended: the administrator helper

Coming from 0.1.0b1, replace the old file. History, accepted findings and the last report are kept in your home
folder, not in the AppImage, so they carry over. The administrator helper hasn't changed, so an installed one
keeps working as it is.

It needs x86-64 Linux with WebKitGTK 4.1 for its window:

Distribution
Ubuntu, Mint, Debian	sudo apt install gir1.2-webkit2-4.1
Fedora	sudo dnf install webkit2gtk4.1
Arch, CachyOS	sudo pacman -S webkit2gtk-4.1

The README says what it is; the
manual covers the rest.

Verify

The release is signed with the Digital Archon release key,
docs/release-key.asc, whose
fingerprint is:

3AA5 C061 33BB C05A 4151  EA41 5B59 48EB 785E D3AF

If you have 0.1.0b1, open Tools → Verify a download and choose the new AppImage: with its .asc beside
it, it should say Verified: made by Digital Archon. By hand, with the AppImage, its .asc and its .sha256
in one folder:

curl -sSfO https://raw.githubusercontent.com/DigitalArchon/DAPrivacyKit/v0.1.0b2/docs/release-key.asc
gpg --import release-key.asc
gpg --verify DAPrivacyKit-0.1.0b2-x86_64.AppImage.asc DAPrivacyKit-0.1.0b2-x86_64.AppImage
sha256sum -c DAPrivacyKit-0.1.0b2-x86_64.AppImage.sha256

gpg should say Good signature from "Digital Archon Release Signing", with the fingerprint above (its
warning that the key isn't certified is normal).

SHA-256: 2cb6be6f0b5154b577e1744c2c957a9ba3b79b5f1968114cb4f9ec7c89cf4bbe

The AppImage is reproducible: packaging/verify-release.sh v0.1.0b2 in a clone (rootless Podman) builds the
tag and compares the result with this release, byte for byte. See
packaging/README.md.

Known limitations

Unchanged since 0.1.0b1: made for and tested on Cinnamon (Linux Mint) and KDE Plasma 6 only; some checks need
administrator access; deleting is not erasing; x86-64 only. The
0.1.0b1 notes have the full list.

Feedback

Bugs and ideas: issues, with a redacted report if it
helps (Export… with Redact ticked; read it first, since an issue is public). Security problems: please
report privately as described in
SECURITY.md.

Licensed GPL-3.0-or-later.

DA Privacy Kit v0.1.0b1

The first public beta of DA Privacy Kit, a desktop app that finds common privacy issues on a Linux
computer and, where it is safe, fixes them, with tools for your files, drives, browsing and apps beside it.
It says how much each finding matters on this machine, shows exactly what a fix will change before making
it, and can put it back. Scans are read-only and work fully offline.

Warning

Public beta: expect bugs, in what it detects, in what it tells you, and in what its fixes and tools do.
For now it is best used to scan, to learn about your own system and to try its tools: don't rely on it yet
for critical privacy matters. It isn't risk-free either: several fixes and tools run commands with
administrator rights, and a bug in one of those can affect the whole system. Keep backups.

It is no replacement for Tails or Qubes OS, it isn't
antivirus, and it doesn't make you anonymous online.

What it does

• Scans the machine, changing nothing. 125 checks of disk encryption and swap, logins and the screen
  lock, the network, browsers, telemetry, what the desktop and your apps record, sandboxing and updates.
  Nothing leaves the computer.
• Rates each finding for this machine. No disk encryption matters more on a laptop than on a virtual
  machine; a saved password matters less on an encrypted disk. What couldn't be checked is listed first,
  never passed over, and the caches and histories every computer has are listed apart, not counted.
• Fixes what it safely can. Every fix shows its dry run first: each setting, file and command. Changes
  are recorded and can be reverted from History; deleting caches and histories can't be undone, so each is
  confirmed on its own. Easy fixes… gathers the ones that cost you nothing, or next to nothing.
• Guides you through the rest, step by step for this machine, and explains, with the commands, what the
  app shouldn't do for you.
• Keeps track. Each scan says what is new, resolved or worse since the last one, and whether a fix has
  been undone. Scheduled scans notify only about those.
• Teaches. Every check says what leaks, to whom, and why its fix works, and every action the app takes
  is shown as the command that does it.

Tools you start yourself: Verify a download (the release keys of Linux Mint, Ubuntu, Debian, Fedora, Arch,
Tails, Qubes OS, Tor Browser and more built in), Remove metadata, a RAM disk, Tor or Mullvad Browser run from
memory in a sandbox, Try an app in a sandbox with decoy files, What does this app keep?, the TRIM test, Deleted
file names, Before you hand over a drive, Retire a drive, Before you travel, Presentation mode, and a live view
of the camera and microphone. Online tests (DNS leaks around a VPN, IPv6 going round it, ports the router
forwards and more) are separate and opt-in, and name every host they contact before anything runs.

Install

Download DAPrivacyKit-0.1.0b1-x86_64.AppImage, make it executable and run it:

chmod +x DAPrivacyKit-0.1.0b1-x86_64.AppImage
./DAPrivacyKit-0.1.0b1-x86_64.AppImage
./DAPrivacyKit-0.1.0b1-x86_64.AppImage --install-helper    # once, recommended: the administrator helper

It needs x86-64 Linux: Ubuntu 24.04 / Mint 22, Debian 13, or a current Fedora, Arch or CachyOS, with
WebKitGTK 4.1 for its window:

Distribution
Ubuntu, Mint, Debian	sudo apt install gir1.2-webkit2-4.1
Fedora	sudo dnf install webkit2gtk4.1
Arch, CachyOS	sudo pacman -S webkit2gtk-4.1

The app never runs as root: what needs it goes through a small helper that offers only named actions, and you
approve each session with your password. Installing the helper makes that prompt name the app rather than
python3.

The README says what it is; the
manual covers the rest.

Verify

The release is signed with the Digital Archon release key,
docs/release-key.asc, whose
fingerprint is:

3AA5 C061 33BB C05A 4151  EA41 5B59 48EB 785E D3AF

With the AppImage, its .asc and its .sha256 in one folder:

curl -sSfO https://raw.githubusercontent.com/DigitalArchon/DAPrivacyKit/v0.1.0b1/docs/release-key.asc
gpg --import release-key.asc
gpg --verify DAPrivacyKit-0.1.0b1-x86_64.AppImage.asc DAPrivacyKit-0.1.0b1-x86_64.AppImage
sha256sum -c DAPrivacyKit-0.1.0b1-x86_64.AppImage.sha256

gpg should say Good signature from "Digital Archon Release Signing", with the fingerprint above (its
warning that the key isn't certified is normal). From now on the app checks its own next release itself:
Verify a download in Tools says Verified: made by Digital Archon.

SHA-256: 9e7367773a99aab60c8fca81f67417e9533ad86620828e0735bcd0018ef00db8

The AppImage is reproducible: packaging/verify-release.sh v0.1.0b1 in a clone (rootless Podman) builds the
tag and compares the result with this release, byte for byte. See
packaging/README.md.

Known limitations

• Made for and tested on two desktops: Cinnamon (Linux Mint) and KDE Plasma 6. GNOME, Xfce and KDE
  Plasma 5 are not tested and not supported: the app has checks and fixes for them, but none have been tried
  on a real machine. If you use it there anyway, read each fix's dry run before applying it.
• Without administrator access some checks can't run (disk encryption key slots, the account password
  database, and others). They are listed as couldn't check, never as passed.
• It can't see what isn't on this computer: inside a virtual machine, the host's disk encryption; your
  router's settings beyond what the online tests show; what websites and services do with your data.
• Deleting is not erasing. On SSDs and copy-on-write filesystems, deleted data can stay readable; the app
  never claims to securely delete a file. Disk encryption is what protects deleted data, and the app tells you
  where you don't have it.
• On X11 the browser sandbox protects your files and network address, not the screen, unless you give
  the browser a display of its own (Xephyr, an option in the panel). On Wayland it depends on the compositor;
  the panel says what yours still lets the browser do.
• It never updates itself or checks for updates online. Once a copy is more than three months old, it
  says so at the top of the window, with the link to the releases page.
• x86-64 only. Internally, the command and folders are named daprivacyscanner.

Feedback

Bugs and ideas: issues, with a redacted report if it
helps (Export… with Redact ticked; read it first, since an issue is public). The app sends nothing by
itself, so we only hear of a bug from you. Security problems: please report privately as described in
SECURITY.md, not in an issue.

Licensed GPL-3.0-or-later.