Recommendation against "qubes-dom0-update" (use "Qubes Updater" instead)

[adw]

@fiftyfourthparallel

So there are issues in both the Salt and the regular CLI versions of dom0 updates. The latter might actually be more severe (I think), but Salt provides the additional security checks, so it might be the lesser of two evils.

For now, I’m just running both: qubesctl (Salt / Qubes Updater) first in case it does any Salty things, then the old qubes-dom0-update in case the first one missed anything.

@fiftyfourthparallel

Either way, I think the case could be made for a website that lists dates on which dom0 packages were updated, sorted by date (so like a calendar) where cautious users get an easy resource to check if they suspect anything is off. Just another (low-cost) layer of protections, like an invisible pocket protector.

I understand why you want this, but I believe it would be the wrong solution to the problem. Instead, the entire update system should be set up in such a way that you don’t feel the need to manually double-check its work. The fact that a user feels the need to make sure that the system is doing its job is a sign that there is something wrong with the system (or possibly with the user’s expectation). The solution is to fix that problem (or realign the user’s expectations), not turn the user into a micromanager of mundane machine monotony.

@fiftyfourthparallel

Also, is there a way to make a signature that’s added to every post I make? That thing kids in old-timey forums use to decorate their posts with flashy banners to show off.

@deeplow might know the answer to this.