UpdateVM system defaults should only list NetVMs and ProxyVMs

[mfc]

Currently in Qubes VM Manager > System > System defaults > UpdateVM, it lists all VMs as possibilities for UpdateVM. It should only list netvms and proxyvms. Probably the same should be done for ClockVM.

[marmarek]

Why? It is perfectly fine to have any AppVM set there. For example a VM behind Tor, or VPN, to be sure that yumdownloader/ntpdate will not see real IP.

[marmarek]

Why? It is perfectly fine to have any AppVM set there. For example a VM behind Tor, or VPN, to be sure that yumdownloader/ntpdate will not see real IP.

[mfc]

For example a VM behind Tor, or VPN, to be sure that yumdownloader/ntpdate will not see real IP.

those VMs are ProxyVMs, no?

[mfc]

For example a VM behind Tor, or VPN, to be sure that yumdownloader/ntpdate will not see real IP.

those VMs are ProxyVMs, no?

[mfc]

Why?

I can't think of a single use-case where a user should be putting their network traffic through a "qube" (AppVM) or a template, rather than a ProxyVM.

[mfc]

Why?

I can't think of a single use-case where a user should be putting their network traffic through a "qube" (AppVM) or a template, rather than a ProxyVM.

[marmarek]

those VMs are ProxyVMs, no?

But those ProxyVMs itself see the real IP. Only VMs behind are are really isolated. I think Whonix gateway is some exception here - it also torify traffic originating directly from it.

(I agree templates are useless on that list)

[marmarek]

those VMs are ProxyVMs, no?

But those ProxyVMs itself see the real IP. Only VMs behind are are really isolated. I think Whonix gateway is some exception here - it also torify traffic originating directly from it.

(I agree templates are useless on that list)

[adrelanos]

Marek Marczykowski-Górecki:

I think Whonix gateway is some exception here - it also torify traffic originating directly from it.

Yes.

[adrelanos]

Marek Marczykowski-Górecki:

I think Whonix gateway is some exception here - it also torify traffic originating directly from it.

Yes.

[bnvk]

But those ProxyVMs itself see the real IP. Only VMs behind are are really isolated. I think Whonix gateway is some exception here - it also torify traffic originating directly from it.

So, then perhaps the solution I think @mfc is after (making this selection process more simple + safe for users) is to only show AppVMs, or Whonix gateway so as to not allow users to accidentally leak their real IP

[bnvk]

But those ProxyVMs itself see the real IP. Only VMs behind are are really isolated. I think Whonix gateway is some exception here - it also torify traffic originating directly from it.

So, then perhaps the solution I think @mfc is after (making this selection process more simple + safe for users) is to only show AppVMs, or Whonix gateway so as to not allow users to accidentally leak their real IP

[andrewdavidwong]

Probably the same should be done for ClockVM.

IIUC, this part is much more complicated. See:

• https://www.whonix.org/wiki/Dev/Qubes#Time_Sync
• https://www.whonix.org/wiki/Dev/TimeSync
• https://groups.google.com/forum/#!msg/qubes-devel/YHK_rAUm0s0/ARrBPHrf0fkJ
• https://groups.google.com/d/msg/qubes-users/AqZV65yZLuU/Lh8T7ZL6tdIJ
• https://groups.google.com/d/msg/qubes-devel/XN6JrEXVOVA/c1S07O8VpfMJ
• https://groups.google.com/d/topic/qubes-users/3QNzrcoRyMI/discussion

[andrewdavidwong]

Probably the same should be done for ClockVM.

IIUC, this part is much more complicated. See:

• https://www.whonix.org/wiki/Dev/Qubes#Time_Sync
• https://www.whonix.org/wiki/Dev/TimeSync
• https://groups.google.com/forum/#!msg/qubes-devel/YHK_rAUm0s0/ARrBPHrf0fkJ
• https://groups.google.com/d/msg/qubes-users/AqZV65yZLuU/Lh8T7ZL6tdIJ
• https://groups.google.com/d/msg/qubes-devel/XN6JrEXVOVA/c1S07O8VpfMJ
• https://groups.google.com/d/topic/qubes-users/3QNzrcoRyMI/discussion

[qubesos-bot]

Automated announcement from builder-github

The package qubes-manager-4.0.19-1.fc25 has been pushed to the r4.0 testing repository for dom0.
To test this update, please install it with the following command:

sudo qubes-dom0-update --enablerepo=qubes-dom0-current-testing

Changes included in this update

[qubesos-bot]

Automated announcement from builder-github

The package qubes-manager-4.0.19-1.fc25 has been pushed to the r4.0 testing repository for dom0.
To test this update, please install it with the following command:

sudo qubes-dom0-update --enablerepo=qubes-dom0-current-testing

Changes included in this update