Hello! This is a discussion to solicit ideas and feedback on what feels like a usability problem in Qubes. The primary “problem,” being too much forced-abstraction for newer users, in getting a basic handle on how their internet traffic is routed—and, on networking permissions.
The problem for me, began when I was having a discussion with a security trainer who recently traveled abroad with their Qubes laptop. In order to randomize their MAC address as others on shared networks might see it, and in order to create a “name” for themselves other than “Qubes OS Device,” they had to jump through a number of technical hoops. Both such things, feel to me like they should be easily surface-able and editable by users, in a UI somewhere.
Second, when I began to dig around in my own Qubes laptop’s networking, what the individual Qube Settings panel showed me for my sys-net and sys-firewall qubes, felt confusing and counter to what I understood of both. It took me a lot of time and mental gymnastics to understand how what both said, maps to reality. I am filing a separate bug on GitHub, to at least improve the language in both places.
HOWEVER… for a longer-term “solution” for less-technical high-risk users (so, yes, journalists and human rights defenders), I’d like to have some sort of a global “Network” settings pane in the TBD Qubes Global Settings pane.
The framework for the below pane, was created in response to the need to surface RPC policies in the UI (presented in this Forum thread). The framework on this screen, is the running solution for that; an overhaul of today’s Global Settings screen, with a left-nav for users to manage inter-qube permissions across a number of policy things.
Thoughts on the below? Does this make zero sense, do folks have concrete ideas for iteration, or other ideas, generally? Pink text = my annotations… on the below, just notes right now, spitballing what I envision for different areas.
EDIT: Tweaked the below image, so may be different than what shows-up in folks’ email.