DispVM should be non-networked by default, or have a clear option to users to do so

[mfc]

DispVMs are meant to be used to open untrusted files. However if that file can exfiltrate information (such as the fact it was opened), that can be seen as a security failure in some use cases.

DispVMs should be non-networked by default, and/or there should an option change this default if desired.

[unman]

Look at #862 for the rationale for the current position.
There is already an option to change the default in R3. Look in qubes manager on advanced tab for a VM, or use qvm-prefs.

[unman]

Look at #862 for the rationale for the current position.
There is already an option to change the default in R3. Look in qubes manager on advanced tab for a VM, or use qvm-prefs.

[mfc]

ah I hadn't seen that option in Qubes manager Advanced tab, I was looking in global settings.

I feel like the use-cases for inherited-network DispVMs are fewer (...printing?) than the use-cases for no-network DispVMs (opening untrusted files), so I would still submit to that being the default, with users being able to change it in the particular VM's settings as desired.

[mfc]

ah I hadn't seen that option in Qubes manager Advanced tab, I was looking in global settings.

I feel like the use-cases for inherited-network DispVMs are fewer (...printing?) than the use-cases for no-network DispVMs (opening untrusted files), so I would still submit to that being the default, with users being able to change it in the particular VM's settings as desired.

[marmarek]

One note - this shouldn't affect starting web browser in DispVM (from KDE/Xfce menu), of course.

[marmarek]

One note - this shouldn't affect starting web browser in DispVM (from KDE/Xfce menu), of course.