Meta-ticket: suggest/remove default applications in official templates

[mfc]

forked from: #1375 (comment)

This is to track any changes from the current default applications, ideally for all templates officially offered by Qubes:

• Debian 8
• Fedora 23
• Whonix (12) gateway
• Whonix (12) workstation

First thing to note is that Fedora 23 comes with Evolution mail client, which can probably be excluded since we include Thunderbird.

[mfc]

debian 8 should have evince installed by default, as fedora 23 already does. currently debian 8 does not come with a decent PDF viewer.

debian 8 should have gedit installed by default, as fedora 23 already does. emacs and vim can be removed from debian 8 (at minimum emacs should be removed).

[tasket]

Last time I performed an install, the debian templates were essentially bare-bones. I used 'tasksel' and chose gnome3 that pulled in stuff like evince. There really should be a choice of debian templates -- minimal and desktop -- to match fedora templates. Would save people the confusion of installing a template and having almost no default apps.

Another problem with defaults on debian 8 is with the addition of certain apps: If you install Gimp it will become the default for things like pdf.... its as awful as having emacs/vi pop up when you double-click a txt file.

Also ImageMagick will add some rather useless associations for image files that get in the way.

[adrelanos]

konsole -> gnome-terminal
dolphin -> nautilus
many more....

---

For which release would you like to see this implemented? Whonix 13 or Whonix 14? Or in other words, which Qubes release is the target of being moved to gnome? (Not useful to forcibly squeeze this into the "next" release, since that would delay the release of new stuff such as DispVM.)

(Whonix 13 mostly done | Whonix 13 mostly todo)

---

//cc @bnvk

[marmarek]

For which release would you like to see this implemented?

Gnome is planned for Qubes 4.0, which is at least few months away. So if Whonix 13 is mostly done, probably should go into Whonix 14.

[mfc]

as a reminder, transitioning to default gnome apps within a template is not the same (and not related) to what desktop environment is the adminVM/dom0.

at the adminvm/dom0 level, XFCE comes with a GUI file manager thunar while KDE does not come with any file manager. Depending on dependencies maybe thunar can be added to KDE.

[cfcs]

So I think the primary reason to add something to the base templates is to enable troubleshooting in any VM when you are in a situation where something doesn't work. Most other things, people can install themselves. It is a bit hard to remember which packages I have manually installed, and which ones ship by default. Do we have an updated list of our selected packages for fedora/debian?

I suggest adding the following (for debugging scenarios):

• tmux (right now we don't have neither tmux nor screen)
• ltrace
• git
• unar or p7zip or some kind of story for opening .7z and .rar files
• man-dev manpages (if they aren't installed, I seem to remember I was missing some - maybe I should learn how to use info ?)
• socat

There are also some convenience features currently lacking in the debian-8 template:

• @mfc identified that there is no PDF reader.
• there is no default image viewer registered with xdg / xdg-open
• openvpn client so you don't have to do unencrypted connections from your local uplink at install time
• I disagree with @mfc's suggestion to remove emacs.

[adrelanos]

Please add the tags Debian, Fedora and Whonix. @andrewdavidwong

Related: Add support for GNOME in dom0/GUI domain (#1806)

[andrewdavidwong]

Debian and Whonix labels added, but we currently don't have a Fedora label. @marmarek, should there be one?

[marmarek]

On Tue, May 17, 2016 at 04:58:27PM -0700, Andrew David Wong wrote:

Debian and Whonix labels added, but we currently don't have a Fedora label. @marmarek, should there be one?

Currently Fedora is "default template", at least from tickets point of
view. But IMO it would be good to have Fedora label.

Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?

[unman]

I think I am at least partly responsible for the current limited state of the debian template: my suggestion was that we replace debian+minimal with "debian" and then ADD flavours. I assumed that debian+desktop would be the one shipped. That's why the debian template is far more limited than the fedora.

For what it's worth I don't think @cfcs additions are right for most users, and I assume that's what we are talking about here. (Maybe there's a place for a dev template?). The comments on convenience features are good.

The default templates should be as close as possible to a default install for the relevant distro. I don't see much point in standardizing applications across the distros - if you do that what's the point in having different offerings at all?

[tasket]

I'd be inclined to say that using debian-curated defaults is the logical choice, but have you looked at some of the defaults you get from 'tasksel' Gnome and Debian Desktop? If double-clicking textfiles opens them in emacs, and pdfs open in libreoffice draw, and images open in imagemagik 'display' -- ignoring the Gnome programs that are present -- then I'm wary of leaving those choices to the distro. That right there is a UX train wreck.

OTOH, is it worth the fuss to fix this? I'd much rather see the effort put into a working Ubuntu template instead.

[adrelanos]

I'd much rather see the effort put into a working Ubuntu template instead.

Off-topic. Not possible. Legal reasons, see: https://www.qubes-os.org/doc/templates/ubuntu/. Please redirect further off-topic discussion, Ubuntu to the qubes mailing list.

[adrelanos]

Do we still want to go for this ticket?

Did I rightly interpret this ticket to change Whonix VM

• konsole -> gnome-terminal
• dolphin -> nautilus

etc. @mfc?

We also have to check these new default applications for privacy issues. So it would be good to have a final list.

I can understand why @bnvk made the argument that the KDE desktop environment with its settings complexity provides worse usability than GNOME and therefore suggested to port Qubes to gnome. (#1806) However, has the argument been made, that GNOMEish applications generally have better usability than KDEish applications?

The argument was made, that all templates should use the same default applications to simplify Qubes. But must it be GNOME everything?

(With the exception for Whonix VMs, where some exceptions such as Icedove and Tor Browser are justified for stronger, for privacy reasons.)

• konsole is better than gnome-terminal (where one needs a keyboard combination for something as simple as opening another tab).
• kgpg has actual encryption/decryption/signature/verification functionality over gnome-keyring, so we'd like to at least keep some KDEish application for Whonix.
• I prefer dolphin over nautilus because it is simpler by using drag and drop to add a new favorite folder to the left bar.
• vlc > totem

@unman:

I don't see much point in standardizing applications across the distros - if you do that what's the point in having different offerings at all?

As for Debian vs Fedora, indeed. The improved usability choice would be if by default Fedora would be exposed nowhere to the user, i.e. have dom0 Debian based (#1919) and also use Debian for sys-net / sys-firewall. Then one would not have to learn two base distributions, debian based vs fedora based.

[unman]

I don't think that #1919 is still a target. In any case it seems to me that most users should be kept well away from dom0 and so what is running there is irrelevant. If anyone has the nous to tinker in dom0 then they should be able to handle the differences.

[andrewdavidwong]

at the adminvm/dom0 level, XFCE comes with a GUI file manager thunar while KDE does not come with any file manager. Depending on dependencies maybe thunar can be added to KDE.

It should be the opposite. Thunar should be removed from dom0, because the user should never run it there, and right now it is very, very easy to accidentally do so.

[andrewdavidwong]

Do we still want to go for this ticket?

A lot of things in this ticket are obsolete given the recent changes to dom0 (KDE -> Xfce4) and templates.

Also, a lot of it is just people pushing to make their personal preferences the default with little or no objective justification for doing so. That's a waste of everyone's time. The goal should be maximizing the user's freedom to choose.

Did I rightly interpret this ticket to change Whonix VM

When it comes to Whonix VMs, privacy is always the top priority. UX and "app uniformity" don't even come close. If the alternatives are equal with respect to privacy, I suppose people can argue about which should be used, but that seems like a waste of time that would be better spent elsehwere (see above).

[unman]

@mfc There seems to be little interest in pursuing this, although the thinking behind it is good.

On an immediate question, the default Debian template has no file manager.(#2967).
I am not inclined to install anything and to allow users to install whatever they like.
If you think we should provide one by default, then my inclination would be to install xfe, or, perhaps thunar - default Xfce file manager. We dont currently have plugins (qvm-move etc) for xfe, but could provide them.

I would consider asking on the mailing lists but I'm sure it would just come down to pushing personal preferences.

Thoughts?

[cfcs]

@unman most of the file managers open up large security holes, so having one installed in e.g. sys-usb could be pretty disastrous. Maybe leave it like it is, and perhaps add documentation that explains how to install one?

[unman]

@cfcs I'm happy with the situation as it is now in Debian, but I'll be guided by @mfc and others.
New users are sometimes thrown by the absence of a file manager in Debian templates, and if it's decided that that should be corrected, fine.
Otherwise #2967 becomes a doc task.

[cfcs]

I can see the dilemma, I don't know what a good solution would be. Ideally there'd be a safer file manager available that didn't try to automount everything and display thumbnails and parse PDFs and whathaveyou, but I do not know of any such application that fits the bill.

I can see how the lack of a file manager would confuse regular users, but OTOH if you're using the debian templates then I guess you're already doing things in the terminal, so it would make sense to have a link to such documentation on the same page as the one that has the debian installation instructions.

[mfc]

folks this is not really a useful conversation -- it is clear that having a file manager is not a security issue given it exists in the Fedora 28 templates (which is the default template that sys-usb is based on) and all previous templates ever in Qubes.

so this is not a security issue from Qubes dev perspective, it is a UX issue specific to Debian templates because it was forgotten during Debian 9 template building.

regarding which file manager to include in Debian, the same as in Fedora would make sense from a UX and functionality perspective, which is Files/Nautilus. I think this was previously included in previous Debian templates (such as 8).

[cfcs]

@mfc I think it's clear that having a file manager is a security issue, giving the existence of these CVEs:

• pretty much all file managers (CVE-2017-14604): https://bugzilla.xfce.org/show_bug.cgi?id=13329 (+x bit can be set by malicious filesystem in USB thumbdrive etc)
• nautilus + wine (CVE-2017-11421): https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=868705
• evince command exec (CVE-2017-1000083): https://www.debian.org/security/2017/dsa-3911

Your position (that fedora-28 is a completely bulletproof operating system) seems rather weak given that tons of bugs are still being found in file managers and dependencies pulled in by file managers.

My completely subjective and unproven opinion (if this is the style of debate you want here) is that experience shows us that the more code we bring in to be automatically executed on untrusted inputs, the more security flaws we will have. File managers, with all their automatic mounting, thumbnail generation, indexing, .desktop files, and what-have-you, fall squarely into this category.
That the Fedora templates shipped by Qubes already exposes users to these dangers is no argument that it would be safe to do so in the Debian templates too. I can appreciate the UX argument, but saying that it doesn't increase attack surface is just incorrect.

• honorable mentions: nice remote command exec in dhcp in fedora (hello sys-net): (CVE-2018-1111) https://bugzilla.redhat.com/show_bug.cgi?id=1578362
  • and this (CVE-2018-5732) https://bugzilla.redhat.com/show_bug.cgi?id=1549960

[unman]

@mfc - That's a really disappointing response. The stated aim of this ticket is to suggest/remove default applications in official templates

It is not clear that "having a file manager is not a security issue". There's always a trade off between usability and security, and it's a valid question whether that trade off should be made in this case.
The fact that a file manager exists in the Fedora-28 template doesn't preclude questioning whether it should be included in templates to be used by system qubes, which was the question raised by @cfcs

There are at least 3 questions, none of which have been much discussed, all of which can be fairly readily dealt with in the current framework.

1. Should system qubes have file managers, web browsers, etc.?
2. Should the default (full) templates have the same applications, or equivalent applications? (Whonix already carries dolphin rather than nautilus.)
   As @adrelanos has said in a related discussion(no longer install emacs and vim by default #4195):

Why offer different templates when then making them as uniform as possible?

3. If the answer to 2 is "Yes", which applications? (You clearly have a preference for gnome apps, and the UX guidelines continue to say that Gnome is the desktop target.)

Fairly simple solutions would be to ship minimal templates and give the user the opportunity to choose one and configure it for use in system qubes on installation, with a fallback default install as currently.
After installation, on first boot, open a tasksel window in the default template, allowing user to choose what packages and meta-packages to install. (Just like on installing Debian.) Again, the default would be as current.

I use all Debian templates, and I use minimal templates for system qubes. That's how I set up Qubes for others. I don't use a file manager, but I install dolphin in the extended Debian templates for others. But that's just me: I'm not inclined to dictate to any one else.

I will close #2967 by including nautilus in Debian-9 to match the Fedora templates.

I don't think any of this is bikeshedding.
If you do, you should close this issue, since it serves no purpose, and just put a specification in the development docs.

[SvenSemmler]

@unman wrote:

Should system qubes have file managers, web browsers, etc.?

Do we have a dedicated ticket to this question? (I couldn't find one) Maybe there should be extremely minimal dedicated system templates for sys-net/usb?

[andrewdavidwong]

Maybe there should be extremely minimal dedicated system templates for sys-net/usb?

That's what fedora-minimal is supposed to be for (among other uses). It gets increasingly bloated over time because people keep lobbying to have their favorite applications added to it by default. If fedora-minimal isn't minimal enough, it should be stripped back down. We shouldn't keep introducing more and more "minimal" successors as the old ones get bloated.

[mfc]

I think what we are finding from this discussion is that there is interest in a Debian-minimal template, and then maybe folks will be more comfortable with the Debian template being similar to the Fedora template in expected functionality of default applications. See Marek's comment on this point.

[unman]

It's already possible to build a Debian minimal and #2716 proposes adding it to the official repository

[adrelanos]

Fairly simple solutions would be to ship minimal templates and give the user the opportunity to choose one and configure it for use in system qubes on installation, with a fallback default install as currently.
After installation, on first boot, open a tasksel window in the default template, allowing user to choose what packages and meta-packages to install. (Just like on installing Debian.) Again, the default would be as current.

That is an interesting solution. Certainly the one with most flexibility with most choice. It would be cool to have such an option from my enthusiast perspective.

However from a usability perspective choice by itself is bad, confusing and leading to user errors (speak: lower adaption). I conclude that from studying the basics in usability from the Qubes page on UX, especially the excellent video Aral Balkan: Superheroes & Villains in Design.

I will close #2967 by including nautilus in Debian-9 to match the Fedora templates.

I am ok with that.

But please remind me, where's the policy to "Debian-9 to match the Fedora templates" or "templates should be uniform" if that exists?

I think what we are finding from this discussion is that there is interest in a Debian-minimal template,

Yes, a Debian-minimal template could be the base for Whonix. I'd like that.

and then maybe folks will be more comfortable with the Debian template being similar to the Fedora template in expected functionality of default applications.

See Marek's comment on this point. - Yes, that's just perfect.

cleaning up packages_*.list + tasksel is the perfect implementation of the policy.

However, at what point Marek's comment suggested Debian template being similar to the Fedora?

I think the ticket title Meta-ticket: suggest/remove default applications in official templates is a invalid to begin with due to the policy and agree it should be closed.

To progress beyond the policy, that is to provide better Qubes default applications for better usability than Debian/Fedora/etc. distributions, while avoiding bikeshedding, we'd need:

• A) (a) usability designer(s) and/or
• B) usability studies.

[andrewdavidwong]

To progress beyond the policy, that is to provide better Qubes default applications for better usability than Debian/Fedora/etc. distributions, while avoiding bikeshedding, we'd need:

• A) (a) usability designer(s) and/or
• B) usability studies.

I'm inclined to agree. This policy does not concern the security of Qubes, so I think we're open to changing it. However, I agree that decisions about which applications to include and exclude should be based on evidence about what will best serve our users, not people's personal preferences.

I think the ticket title Meta-ticket: suggest/remove default applications in official templates is a invalid to begin with due to the policy and agree it should be closed.

Closing. If anyone strongly objects, please leave a comment, and we can reconsider.