I’ve been seeing ~500KB/s download, ~15KB/s upload in sys-whonix while running nyx. I closed everything except sys-net, sys-firewall, sys-whonix, and sys-usb, but the traffic’s still going. My update proxy’s set to sys-whonix—could Qubes just be doing background updates without saying anything? If it is a hack, why’d it need to download stuff over Tor anyway?
Qubes updates (at least mine) are normally larger. But if whonix is your update proxy that information needs to come from somewhere correct? I would post a question in the user help forum if Qubes does background updates?