Does Qubes have or intend to have I2P update Servers?

User Support
1

Does Qubes have i2p update servers?

I would like to update over i2p sys-net without outproxy instead of sys-whonix because:

  1. Sys-whonix can be very very slow.
  2. I think I2p is a more safe protocol and less targeted or sus.
    Thanks.
1 Like
2

There is this thread

But It did not come to any conclusions.
I am getting ok speeds over i2p → Outproxy _> clearnet compared to tor. But would be much better if it was within the i2p network

3

I would separate two things here: transport privacy and update integrity. Qubes updates are signed, so the update path should not be trusted for integrity, but it can still leak metadata such as timing, size and that you are updating Qubes/Fedora/Debian/Whonix.

I am not aware of official Qubes I2P update mirrors. Using an I2P outproxy to reach normal clearnet repos would mostly move trust/metadata to that outproxy, not give the same properties as an in-network mirror. For a high-risk threat model I would stick to the documented update paths, usually sys-whonix or a VPN update proxy you control, and avoid unofficial mirrors unless you are comfortable with their availability and logging behavior.

1 Like
4

Thanks, I know a lot of Qubes devs/users use i2p so I was just putting it out there while in frustration at the update speeds over tor, basically hoping if tor was like it was (its not this slow all the time but every now and then) Then i2p would be reliable alternative.

5

Not that I know of, but you can mirror them yourself. Could be a great Community Guides Post!
Did it myself for Artix over i2p.

You just need to find out how apt and dnf will be compatible.

1 Like
6

Thanks! Good to know.
I would have thought that would be something the Qubes team would need to organize, (signing and all that stuff) but I think its promising you did it for Artix!

Arix is a really great distro btw. I have been recently looking at building an Artix Template for QubesOS actually.
The work done on Devuan and Alpine re non-systemd Qubes integration looks promising, but Qubes Builderv2 fails for me every time (The same errors you had on your post as I see you are also struggling with this .)
I think that is beyond my capabilities atm. but I am trying to learn.

1 Like
7

I am not to keen on updating over vpn or the i2p outproxy for various reasons. The outproxy can see all activity and needs to be trusted, and I dont want to mix vpn accounts with qubes updates as it would flag that stream / account as a qubes user and also I am not to trusting of vpn’s in general, who knows what they could do to poison that update stream!. I think Tor or i2p protocols are much more suited for this.

8

There is a mirror but not an update server.
http://iue4ubnjvskey5gop7n3odkylyjvelb5sl7z4cx6xjwdnthv2hba.b32.i2p/qubes/

We could look at providing this if demand.

I never presume to speak for the Qubes team.
When I comment in the Forum I speak for myself.

2 Likes
9

thanks @unman I would vote for that.