rewrite donations page, provide qubes bitcoin address

[mfc]

https://www.qubes-os.org/donate/

it should be less wordy/scary.

there should be a way to donate using a credit card. This could be a service that converts immediately into bitcoin, or we have a paypal, worldpay, or something else account (research needed).

for future reference: https://github.com/QubesOS/qubesos.github.io/blob/master/pages/donate.md

[andrewdavidwong]

I agree with the idea, but this isn't primarily a doc issue. Revising the donations policy for Qubes/ITL and setting up payment systems falls far outside of the scope of simply rewriting the Donations page.

Historical explanation: @rootkovska was somewhat reticent to accept donations in the first place, which I think is why she chose to write the Donations page that way. Is that a fair description, @rootkovska? ;)

[andrewdavidwong]

I agree with the idea, but this isn't primarily a doc issue. Revising the donations policy for Qubes/ITL and setting up payment systems falls far outside of the scope of simply rewriting the Donations page.

Historical explanation: @rootkovska was somewhat reticent to accept donations in the first place, which I think is why she chose to write the Donations page that way. Is that a fair description, @rootkovska? ;)

[mfc]

true, agreed. from talking with @rootkovska my understanding is that we don't want to scare potential contributors anymore, hence the creation of the ticket. Also if we don't want donations then we shouldn't have a donations page.

[mfc]

true, agreed. from talking with @rootkovska my understanding is that we don't want to scare potential contributors anymore, hence the creation of the ticket. Also if we don't want donations then we shouldn't have a donations page.

[mfc]

sorry wrong button...

[mfc]

sorry wrong button...

[andrewdavidwong]

Yes, sounds good to me on both counts.

[andrewdavidwong]

Yes, sounds good to me on both counts.

[mfc]

folks have any recommendations on donation methods? @rootkovska do you have an existing paypal account we could add (given that the bitcoin address goes to you)? something that accepts credit cards, has low fees would be great.

[mfc]

folks have any recommendations on donation methods? @rootkovska do you have an existing paypal account we could add (given that the bitcoin address goes to you)? something that accepts credit cards, has low fees would be great.

[rootkovska]

On Tue, Oct 13, 2015 at 09:51:03PM -0700, Michael Carbone wrote:

folks have any recommendations on donation methods? @rootkovska do you have an existing paypal account we could add (given that the bitcoin address goes to you)? something that accepts credit cards, has low fees would be great.

No, not at this moment.

[rootkovska]

On Tue, Oct 13, 2015 at 09:51:03PM -0700, Michael Carbone wrote:

folks have any recommendations on donation methods? @rootkovska do you have an existing paypal account we could add (given that the bitcoin address goes to you)? something that accepts credit cards, has low fees would be great.

No, not at this moment.

[mfc]

draft of rewrite of donation page here: QubesOS/qubesos.github.io#9

would be great to be able to list additional donation mechanisms -- Paypal, Dwolla (see Tor's use), Flattr, bank transfer, etc.

[mfc]

draft of rewrite of donation page here: QubesOS/qubesos.github.io#9

would be great to be able to list additional donation mechanisms -- Paypal, Dwolla (see Tor's use), Flattr, bank transfer, etc.

[rootkovska]

The new pages looks good to me.

With regards other forms of donations -- can you create a separate ticket to track this?

[rootkovska]

The new pages looks good to me.

With regards other forms of donations -- can you create a separate ticket to track this?

[mfc]

done: #1434

[mfc]

done: #1434

[andrewdavidwong]

Merged. Thanks, @mfc.

@rootkovska, would you be willing to provide a clearsigned text of the Bitcoin address? In other words, something like this:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Official Qubes OS Project Bitcoin donation address:
14zockMSKKp5MK6X2cHJ3mQwm9MwYsJ39j
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJWTPnWAAoJEJh4Btx1RPV8JWkP/3KAiC7mVDea85R24d/GBZ9E
nbzcNMIxh6PYQ5KmVyfiwDlZt8W+8XWolQWYIcxXf3R3GSWpGHCDnC7TtmQvrB5O
KA9Rm2+SfE6zgLTNH9yfFyPPGLcniVEoCpSKP3tDl5AoVp4zcSVSEWVIirXUkZUh
4vhuzy5B57QE1Hu5afey7Wo9ecKe0Co/OWlQjwxugsZg32+MfsZ+JH906PSLx3oU
YhVTnczgSjQMOxGS7/kLDqyZQrcz9cqzOl1noLDLvsZ+K+iPSOSE/+i9Sh20szUM
LXN2kc32VJN2fq1TX1QcGK7+fBA3HOVS5m/Bl076dV1aR415vATdmbhma4JGMvqV
g+w/F13ZoyOPhU07eWXgO+XD3Z/FcUvPEOdydI+mqS55x0MnI2yN+bx/BY770I/L
XAIWDnlzG/XFMz1ijnn0yawmLBkbo6OWilJMc1l4P6qY9caz+GfKmB06WUTSuL8L
iP36uRg0pGUFHaZ5Ip1sTk+UaDzeSM55svZv69u4EvBlKlsqb3OISMSX/F0BRdLY
X08O4BVhbVRgYXUK9pcF2/Y6g5LcVfrgE1RrYOY0GUgcPq3GHhJFGPq13pbWRXpt
QdgLD6ewu2SXJpcxDKfE1bv9t8ecfgGOZsFYyvWNrz6SKmZl4RcOpzMknVaoV0Z1
EcRPGut8VDR3Ng1ADbMI
=z3Dj
-----END PGP SIGNATURE-----

Except signed by the Qubes Master Signing Key instead of mine. ;)

I think this would make it easier for some users to verify the authenticity of that address and feel comfortable about sending BTC to it.

[andrewdavidwong]

Merged. Thanks, @mfc.

@rootkovska, would you be willing to provide a clearsigned text of the Bitcoin address? In other words, something like this:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Official Qubes OS Project Bitcoin donation address:
14zockMSKKp5MK6X2cHJ3mQwm9MwYsJ39j
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJWTPnWAAoJEJh4Btx1RPV8JWkP/3KAiC7mVDea85R24d/GBZ9E
nbzcNMIxh6PYQ5KmVyfiwDlZt8W+8XWolQWYIcxXf3R3GSWpGHCDnC7TtmQvrB5O
KA9Rm2+SfE6zgLTNH9yfFyPPGLcniVEoCpSKP3tDl5AoVp4zcSVSEWVIirXUkZUh
4vhuzy5B57QE1Hu5afey7Wo9ecKe0Co/OWlQjwxugsZg32+MfsZ+JH906PSLx3oU
YhVTnczgSjQMOxGS7/kLDqyZQrcz9cqzOl1noLDLvsZ+K+iPSOSE/+i9Sh20szUM
LXN2kc32VJN2fq1TX1QcGK7+fBA3HOVS5m/Bl076dV1aR415vATdmbhma4JGMvqV
g+w/F13ZoyOPhU07eWXgO+XD3Z/FcUvPEOdydI+mqS55x0MnI2yN+bx/BY770I/L
XAIWDnlzG/XFMz1ijnn0yawmLBkbo6OWilJMc1l4P6qY9caz+GfKmB06WUTSuL8L
iP36uRg0pGUFHaZ5Ip1sTk+UaDzeSM55svZv69u4EvBlKlsqb3OISMSX/F0BRdLY
X08O4BVhbVRgYXUK9pcF2/Y6g5LcVfrgE1RrYOY0GUgcPq3GHhJFGPq13pbWRXpt
QdgLD6ewu2SXJpcxDKfE1bv9t8ecfgGOZsFYyvWNrz6SKmZl4RcOpzMknVaoV0Z1
EcRPGut8VDR3Ng1ADbMI
=z3Dj
-----END PGP SIGNATURE-----

Except signed by the Qubes Master Signing Key instead of mine. ;)

I think this would make it easier for some users to verify the authenticity of that address and feel comfortable about sending BTC to it.

[rootkovska]

I sure can, but let us discuss internally if we could come up with a more distributed way of handling BTC donations for Qubes (i.e. not to just a private address owned by myself).

[rootkovska]

I sure can, but let us discuss internally if we could come up with a more distributed way of handling BTC donations for Qubes (i.e. not to just a private address owned by myself).

[mfc]

multisig wallets exist which requires signing of multiple wallets prior to spending bitcoins:

http://docs.electrum.org/en/latest/multisig.html

[mfc]

multisig wallets exist which requires signing of multiple wallets prior to spending bitcoins:

http://docs.electrum.org/en/latest/multisig.html

[adrelanos]

FYI: There are also offline wallets. Air gap. Cold storage. Dedicated
specialized hardware.

[adrelanos]

FYI: There are also offline wallets. Air gap. Cold storage. Dedicated
specialized hardware.

[andrewdavidwong]

If the goal is a more distributed system (so that @rootkovska is not the sole handler of all donated BTC), then it sounds like a multisig wallet, as @mfc mentioned, is the way to go.

[andrewdavidwong]

If the goal is a more distributed system (so that @rootkovska is not the sole handler of all donated BTC), then it sounds like a multisig wallet, as @mfc mentioned, is the way to go.

[mfc]

electrum can be installed from debian-8 repos, is the bitcoin client included in Tails. so I think that's the way to go.

[mfc]

electrum can be installed from debian-8 repos, is the bitcoin client included in Tails. so I think that's the way to go.

[andrewdavidwong]

I sure can, but let us discuss internally if we could come up with a more distributed way of handling BTC donations for Qubes (i.e. not to just a private address owned by myself).

@rootkovska, would you mind elaborating a bit about the end goal here? My understanding is that ITL is currently in financial control of the Qubes OS Project, and you are in control of ITL. I don't see any problem with this. In fact, it seems much better than trying to make financial decisions by committee or something like that.

Is the concern just that the BTC would be forever lost if you (god forbid) were to suddenly pass away or something? (In other words, a concern specific to the nature of how BTC works, as compared to traditional banking and such?)

IMHO, we can throw around technical solutions all day, but in the end, we won't know which solution solves our problem until we clearly define the problem to be solved.

[andrewdavidwong]

I sure can, but let us discuss internally if we could come up with a more distributed way of handling BTC donations for Qubes (i.e. not to just a private address owned by myself).

@rootkovska, would you mind elaborating a bit about the end goal here? My understanding is that ITL is currently in financial control of the Qubes OS Project, and you are in control of ITL. I don't see any problem with this. In fact, it seems much better than trying to make financial decisions by committee or something like that.

Is the concern just that the BTC would be forever lost if you (god forbid) were to suddenly pass away or something? (In other words, a concern specific to the nature of how BTC works, as compared to traditional banking and such?)

IMHO, we can throw around technical solutions all day, but in the end, we won't know which solution solves our problem until we clearly define the problem to be solved.

[rootkovska]

On Wed, Nov 25, 2015 at 08:12:30PM -0800, Axon wrote:

I sure can, but let us discuss internally if we could come up with a more
distributed way of handling BTC donations for Qubes (i.e. not to just a
private address owned by myself).

@rootkovska, would you mind elaborating a bit about the end goal here? My
understanding is that ITL is currently in financial control of the Qubes OS
Project, and you are in control of ITL.

Yup, I'm trying to become less of an effective dictator for the project ;)

I don't see any problem with this. In fact, it seems much better than trying
to make financial decisions by committee or something like that.

Glad to hear, but any centralization should be avoided as much as possible,
generally. FWIW, I would be part of the committee, of course ;)

Is the concern just that the BTC would be forever lost if you (god forbid)
were to suddenly pass away or something? (In other words, a concern specific
to the nature of how BTC works, as compared to traditional banking and such?)

That's one of the concerns, sure.

Another concern: easier to hack them away from one person than from N people.

Last but not least, I think many people would feel more comfortable donating to
the Qubes project knowing the account is not just a "Joanna's personal BTC
account" ;)

[rootkovska]

On Wed, Nov 25, 2015 at 08:12:30PM -0800, Axon wrote:

I sure can, but let us discuss internally if we could come up with a more
distributed way of handling BTC donations for Qubes (i.e. not to just a
private address owned by myself).

@rootkovska, would you mind elaborating a bit about the end goal here? My
understanding is that ITL is currently in financial control of the Qubes OS
Project, and you are in control of ITL.

Yup, I'm trying to become less of an effective dictator for the project ;)

I don't see any problem with this. In fact, it seems much better than trying
to make financial decisions by committee or something like that.

Glad to hear, but any centralization should be avoided as much as possible,
generally. FWIW, I would be part of the committee, of course ;)

Is the concern just that the BTC would be forever lost if you (god forbid)
were to suddenly pass away or something? (In other words, a concern specific
to the nature of how BTC works, as compared to traditional banking and such?)

That's one of the concerns, sure.

Another concern: easier to hack them away from one person than from N people.

Last but not least, I think many people would feel more comfortable donating to
the Qubes project knowing the account is not just a "Joanna's personal BTC
account" ;)

[mfc]

any feedback on electrum?

• it has multisig wallet functionality
• it is included in Tails (so lightly vetted by the security/privacy community, not just bitcoin community)
• it is in the Debian 8 repos

i'm not aware of other tools with these features

[mfc]

any feedback on electrum?

• it has multisig wallet functionality
• it is included in Tails (so lightly vetted by the security/privacy community, not just bitcoin community)
• it is in the Debian 8 repos

i'm not aware of other tools with these features

[adrelanos]

The stable (jessie) of electrum in Debian does not work. Is too old. Requires jessie-backports.

[adrelanos]

The stable (jessie) of electrum in Debian does not work. Is too old. Requires jessie-backports.

[mfc]

is electrum the client included / recommended in whonix?

https://www.whonix.org/wiki/Money#Clients

[mfc]

is electrum the client included / recommended in whonix?

https://www.whonix.org/wiki/Money#Clients

[adrelanos]

Not included for that purpose.

https://phabricator.whonix.org/T215

Recommended, well, that may be strong a word. Can certainly not vouch
for it.

[adrelanos]

Not included for that purpose.

https://phabricator.whonix.org/T215

Recommended, well, that may be strong a word. Can certainly not vouch
for it.

[mfc]

great thanks for the link. just a reality check, I have installed it fine in Debian 8. not sure if this is an issue that has since been resolved? I think you mean it is not the most up-to-date version of electrum, and more recent versions have additional features (as Tails notes).

from your feedback it sounds like it is the bitcoin client secure OS projects want to use, but incorporating by default still requires work (not the focus of this ticket). unless there is another client with multisig functionality that whonix, tails, and others would recommend instead of electrum?

[mfc]

great thanks for the link. just a reality check, I have installed it fine in Debian 8. not sure if this is an issue that has since been resolved? I think you mean it is not the most up-to-date version of electrum, and more recent versions have additional features (as Tails notes).

from your feedback it sounds like it is the bitcoin client secure OS projects want to use, but incorporating by default still requires work (not the focus of this ticket). unless there is another client with multisig functionality that whonix, tails, and others would recommend instead of electrum?

[marmarek]

There is also gocoin. It is interesting because it supports really offline wallet, which fit well into Qubes architecture. And also support multisig. But on the other hand, I can't find any opinion about its quality/security. And the quality may be a problem - for example most of the 3850 commits have absolutely no commit message...

[marmarek]

There is also gocoin. It is interesting because it supports really offline wallet, which fit well into Qubes architecture. And also support multisig. But on the other hand, I can't find any opinion about its quality/security. And the quality may be a problem - for example most of the 3850 commits have absolutely no commit message...

[mfc]

hmm yeah just checked it out. sounds like something worth following but not currently in a state for use.

just a note we can always install the latest electrum from their website in Fedora or Debian: https://electrum.org/#download

the point is for us to agree on a multisig platform that we are all comfortable with using internally (not necessarily pushing to users like with whonix or tails). I'd prefer something well-documented, community-vouched and -tested, with GUI, etc. anyway i'm going to create a thread about it, once we update the bitcoin with whatever we decide we can close this ticket.

[mfc]

hmm yeah just checked it out. sounds like something worth following but not currently in a state for use.

just a note we can always install the latest electrum from their website in Fedora or Debian: https://electrum.org/#download

the point is for us to agree on a multisig platform that we are all comfortable with using internally (not necessarily pushing to users like with whonix or tails). I'd prefer something well-documented, community-vouched and -tested, with GUI, etc. anyway i'm going to create a thread about it, once we update the bitcoin with whatever we decide we can close this ticket.

[andrewdavidwong]

Here's an article which states, "The following 13 wallets are the only ones we could find today that offer multisignature addresses, and still appear to be supported." (I can't vouch for the quality of this article in any way, but I'm linking it here just in case it happens to mention a good multisig wallet that we might not have otherwise considered.)

[andrewdavidwong]

Here's an article which states, "The following 13 wallets are the only ones we could find today that offer multisignature addresses, and still appear to be supported." (I can't vouch for the quality of this article in any way, but I'm linking it here just in case it happens to mention a good multisig wallet that we might not have otherwise considered.)

[adrelanos]

Michael Carbone:

great thanks for the link. just a reality check, I have installed it
fine in Debian 8. not sure if this is an issue that has since been
resolved?

Debs from Debian stable will most of the time install just fine. Wether
the intended networking function actually works or not is a different
question. The Tails ticket says, it doesn't connect to all servers which
is kinda confusing. And more importantly, if I remember right, it does
not set the right transaction fee so it would take too long. Also I
recall that the stable totally stopped working for me.

But you're right, if someone was to through test for all of that, then
jessie stable version may be sufficient.

[adrelanos]

Michael Carbone:

great thanks for the link. just a reality check, I have installed it
fine in Debian 8. not sure if this is an issue that has since been
resolved?

Debs from Debian stable will most of the time install just fine. Wether
the intended networking function actually works or not is a different
question. The Tails ticket says, it doesn't connect to all servers which
is kinda confusing. And more importantly, if I remember right, it does
not set the right transaction fee so it would take too long. Also I
recall that the stable totally stopped working for me.

But you're right, if someone was to through test for all of that, then
jessie stable version may be sufficient.

[adrelanos]

Michael Carbone:

just a note we can always install the latest electrum from their website in Fedora or Debian: https://electrum.org/#download

That is problematic. Gpg verification wise and installing a package
without apt-get is to be avoided. Without strong reason against, I
advice installing from jessie-backports.

[adrelanos]

Michael Carbone:

just a note we can always install the latest electrum from their website in Fedora or Debian: https://electrum.org/#download

That is problematic. Gpg verification wise and installing a package
without apt-get is to be avoided. Without strong reason against, I
advice installing from jessie-backports.

[adrelanos]

I am also wondering if multi sig and offline wallets are worth the
trouble at this point. It's a non-negligible overhead. Depends on what
you want to do. For storage of bigger amounts of money in form of BTC,
it certainly is worth it. But just for accepting donations so these can
be converted to EUR... Are that big and that huge BTC transactions
incoming that loosing them would be disastrous and justify multisig /
offline wallet? It's more of a rhetoric question. Just liked to mention
it, up to you.

[adrelanos]

I am also wondering if multi sig and offline wallets are worth the
trouble at this point. It's a non-negligible overhead. Depends on what
you want to do. For storage of bigger amounts of money in form of BTC,
it certainly is worth it. But just for accepting donations so these can
be converted to EUR... Are that big and that huge BTC transactions
incoming that loosing them would be disastrous and justify multisig /
offline wallet? It's more of a rhetoric question. Just liked to mention
it, up to you.

[mfc]

multisig wallet for donations has been implemented, closing ticket:

• https://www.qubes-os.org/news/2016/07/13/qubes-distributed-fund/
• https://www.qubes-os.org/donate/

[mfc]

multisig wallet for donations has been implemented, closing ticket:

• https://www.qubes-os.org/news/2016/07/13/qubes-distributed-fund/
• https://www.qubes-os.org/donate/