When devs install something instead of you yourself, it doesn’t get more secure, because the app is developed by a third party anyway. Code review should help though, and you should do it as much as possible with apps in dom0.
2 Likes
I imagine people like using Qubes at night so a blue light filter will help people sleep when they are done. That is more than a “nice feature” in my opinion. How to go about implementing this wouldn’t have to be constrained to the redshift app or code, anyways simply a suggestion for the devs to consider. I figured they would know better, cheers!
I figured devs would want to integrate this type of “night light” feature into the System Tools → Display like in GNOME as opposed to a separate app like redshift/redshift-gtk
Installing Redshift is the first sting I do when I install Qubes OS. I agree with @tjbbjt’s request while also agreeing with @enmus’ opinion that Dom’ should remain minimal.
Exactly. The more minimal, the less attack surface is.
Seems like a lot of people are installing redshift to dom0 as a blue light filter, is that less secure than implementing something similar to GNOME’s “night light” feature into System Tools → Display?
And a lot more people are using Windows…
Let me explain it this banal way: it looks like that these days first thing they enter the car, people call someone. Is it more convenient then to have a mobile phone holder in a car than not to have it (hands-free)? For sure it is. And, is it safer? Well, that convenience might lead me too look more at it and less on the road, which is more dangerous. So, if i step back and look at the things, what I do and I find it complying with Qubes philosophy is - I just don’t use mobile phone while driving.
And it’s “just” a piece of plastic… You could never realize how it can be misused and endanger people.
Those are some strange analogies @enmus! All I am saying here is that if a blue light filter can be implemented securely it is a feature worthy of the devs considering. If it can’t be integrated into dom0 securely then it shouldn’t be considered. Cheers!
It’s not analogy.
Now that Android, iOS, macOS and Windows all have this feature, it has become expected on a modern OS. I was pleasantly surprised that it was included in Gnome on PureOS, but I did not know what to do when I first installed QubesOS. Searching for instructions on how to install f.lux on QubesOS was one of the first things that I did. I found Redshift, but I was initially concerned about whether or not I should install it. As a first-time user of Qubes, I thought that I had no choice but to install Redshift into dom0 but that I was using Qubes incorrectly.
I think that having Redshift or something similar included in dom0 would help ease new users into QubesOS. Instead of immidiately searching for instructions on how to install programs into dom0, users would first learn the basics and ultimately be safer.
Another option is to include a simple button in the settings app that initiates the download and installation of Redshift (or similar program) into dom0. Would that be possible?
2 Likes
Why should devs spend less time on security improvements for convenient apps in dom0 that not everyone wants and simply increases attack surface? I believe you have good intentions, but in the end it’s very simple for users to install and use redshift. Config file isn’t even necessary.
sudo qubes-dom0-update redshift
redshift -b <between 0 and 1> -O <temperature>
@dom0 We all have to make our own choices about where to put apps in Qubes. Nothing new there… Have you read the section “Could you please make my preference the default” ?
For the same reason issues like this one exist: to improve the user experience and simplify the usage of Qubes for the new users.
Nobody is asking to make this preference the default. People are asking to have this preference available in the UI. Not everyone is or wants to be a command-line guru.
2 Likes
@fsflover those GUI improvements all center around Qubes OS specific things that wouldn’t and couldn’t be implemented upstream. Upstream being XFCE in this case. If XFCE where to add a blue light filter feature in their settings it would make it’s way automatically into a future Qubes OS version.
Additionally, through the introduction of the GUI domain redshift and similar solutions will no longer be required to be installed in dom0, so some of these security consideration would alleviated too.
4 Likes
Indeed, you are right. So the correct reference to the FAQ should be Why don’t you fix upstream bugs that affect Qubes OS?
I’ll send a feature request to XFCE for blue light filter integration into their UI too. @Sven why wouldn’t/couldn’t this be implemented upstream? Thanks for the discussion on this seemingly novel feature!
It probably could be implemented upstream, but keep in mind that xfce is an intentionally minimal desktop environment, so you may need to argue with them.
That was in reference to the UI related improvements @fsflover linked. They are specific to Qubes OS and wouldn’t make any sense in a vanilla XFCE environment (e.g. the Qubes App menu, tray menu, Qubes Settings dialogs etc).
In contrast your request is not Qubes OS specific in the least and something that ought to be implemented by the XFCE team upstream and simply integrated by the Qubes OS team downstream.
1 Like
Would be great but not gonna happen, probably. From the Qubes FAQ:
Also:
1 Like
Seems like support for control of blue light should be native to the OS, since the health benefits for the user are clearly established. It took me years of familiarity with Qubes before I was willing to install Redshift in dom0. It’s the only package I’ve considered to be worth the tradeoff between device security and, in this case, personal health. I now consider it a necessity for the latter.
While I’d like to see Redshift included in dom0 by default, it’s easy to understand why the Qubes team would choose not to include it. That being the case, perhaps a tutorial on installing the package should be included in the official Qubes documentation. This would have alleviated the anxiety I felt when installing the package myself, and I imagine would be a valuable supportive document for those who already use blue light filters on their other devices.
Technically speaking, it’s already there: How to install software in dom0 | Qubes OS
To install additional packages in dom0 (usually not recommended):
$ sudo qubes-dom0-update anti-evil-maid
2 Likes