Can somebody clarifies how qubes-update-check service works and how dom0 gets update notifications for TemplateVMs that are never powered on?

[adw]

@Insurgo

@adw: This needs to be confirmed as said in previous post, but as of today, I think vault (airgapped qube, right?) is actually downloading packages lists per parents Template’s defined repositories through its defined update proxy and actually is a dom0 update notifier.

I guess you mean “trying to download,” right? If it’s an offline qube, it can’t download anything from the internet. I don’t see why that’s a security problem, as long as it isn’t trying to exfiltrate your data via a covert channel or anything. I suppose it would be slightly inefficient to have an offline qube vainly trying to check for updates when it has no network access, but it’s probably just a very minor waste of CPU activity at most, right?

(Also, regarding the portion of my post that you quoted, keep in mind that if you have a template, and you’re using a vault qube that’s based on that template, then you do have an actively-used qube based on that template.)

@enmus

That is why I really think several words @adw will eventually add to the docs would definitely increase liability if nothing else.

I am confused, as I already added the words before you posted this. Did you miss that, or is this a way of saying that what I added did not cover it?

@enmus

Using outdated with the bugs yet to be discovered KeepassXC in my offline vault is something not only me, but anyone would want to avoid at all costs, and if that’s not the risk, than we should actually completely turn off updates.

I could be missing something, but I’m not sure why that would be a significant security risk by itself. If KeePassXC itself were compromised (e.g., package or source code), then it wouldn’t matter whether it’s up-to-date or not. (Updating to newer malicious code would probably just help the attacker.) And if Qubes VM separation as a security boundary were violated, then KeePassXC being patched would provide only minimal protection if KeePassXC were still being unlocked and used for stuff. You certainly wouldn’t want to rely on that, so this definitely doesn’t seem like something that’s important to “avoid at all costs.”

@enmus

Fom, post:5, topic:14096

Then, you say “offline Debian mini-pc” which is “cable tether”-ed

Whoops, terminology failure, my bad. By offline I meant “not directly connected to the internet ”, after a short trip to an online dictionary I now realize that’s not exactly what offline means.

probably would be a good idea this to be emphasized somewhere in the docs, too.

I don’t understand the suggestion, and this is too vague to be actionable for me. If something is unclear in the docs, please provide, at minimum:

1. An exact quotation of the unclear passage currently in the docs
2. Why you think it’s unclear

If you think something is missing, please provide, at minimum:

1. Example text of what you think should be added (or at least the start of it)
2. Why you think it should be added (e.g., the motivation for adding it, who it would help, or what problem it solves)

Alternatively, feel free to open a doc PR yourself.

Also, casual asides in forum posts are easily missed, so if there is actually something important that needs to be updated or fixed in the docs, the best way is to either open a doc PR or open an issue.