I said:
- I think that using the Tor network as a proxy to then access a site over HTTPS doesn’t provide any meaningful benefit over an onion service when you are not concerned with hiding the location of the server, provided the HTTPS is not masqueraded by the tor exit node.
- HTTPS masquerading can happen when an onion service redirects to a clearnet website that uses HTTPS, and that is most certainly a privacy concern, which is why I do not want anyone using my onion address to log into the forum!
Here’s what I will add to that:
- @unman is to be commended for his work towards the Qubes Project. It is second to none, and nobody outside ITL even comes close. Hands down.
- I have had SourceHut up for a month now, and I have received ZERO contributions from “the community” (even though it crashed a few times
- Nobody has created an account (which is identical to how you get a Mullvad VPN account, no data collection)
- I have received quite a lot of spam about all sorts of types of porn and crypto, though…
- The “Unofficial” Qubes OS Forum onion address has been up for the same amount of time, and has received a view hits, but some people were stupid enough to log in
- I have contacted those members individually and recommended that they change their passwords…
- “Talk is cheap. Show me the code”.
Security is the ability to determine what your computer does and what it doesn’t do, as opposed to a third party.
Privacy is the ability to reveal information to a third party on your own terms, should you even wish to reveal it at all.
They are both functions of control over your machine, which Qubes OS provides through compartmentalisation. One does not necessarily imply the other, but they are most certainly not mutually-exclusive.
The definitions of the two are also wildly different from person to person (I mean, look at OnlyFans models. I’m sure their definition of “privacy” would differ greatly to other peoples’…).
Because of this, when you try and force people into a “privacy mould” instead of allowing them to carve one out themselves, you create a force of habit, which can lead to resentment.
People are more likely to retain things they’ve built themselves over something they just “acquired”, and privacy is no different.
Not only this, Qubes OS can most definitely be used as a non-private operating system.
I have Qubes OS installations on my employees work machines that not only tell me everything that employees do, but also give me the ability to issue remote salt commands to them. Why? Because they’re MY machines, not theirs, which I think is fair.
Do I tell them everything their work machines are doing? Absolutely. I’m very transparent about that. I tell them that it spies on them. I tell them not to do anything non-work-related on them. I tell them that I can see their keystrokes.
I tell them because I want to be transparent with them, while also protecting MY company assets…
(A lot of them are deployed in hostile environments where theft and seizure are common, so I want to actually know what happens to them if they go missing)
Are their work machines “private”? HELL NO!
Are they secure? HELL YES!
This is a strong case against branding Qubes OS an explicitly "private* operating system.
Maybe a good slogan would be:
Qubes OS. WIth security through compartmentalisation, your operating system allows your computer to be what you want it to be.