Updates check over clearnet instead of sys-whonix and other strange decisions

[adw]

@justwhy

First of all, it was impossible to actually choose “none” at the “Default update proxy” field at “Qubes OS Global Config”. The option is there, you can choose it, but it just not being saved, when you reopen Global Config you can see some other option chosen already.

@justwhy

1. If it’s not a bug, why even make possible to choose “none” as Default update proxy, when it can’t be really used?

Please feel free to open a bug report for this (if one doesn’t already exist).

@justwhy

2. Why automatically add all new qubes to exceptions, without even signaling to user, that it will happen? Isn’t it contradicts the very sense of “exceptions”?

It already does inform the user. In the screenshot below, it’s a red box containing a “red shield with exclamation point” icon next to text stating that it applies only to existing qubes and that new qubes will have update checking enabled by default:

(However, I’ve noted a problem with this.)

@justwhy

3. Why don’t enable updates check over sys-whonix when it is enabled for updates download? I found other people asking the same question on this forum without an answer.

Probably because no one has opened an issue for it yet. I searched the issue tracker and wasn’t able to find one, so I’ve just opened one:

Some users think that enabling updates over Tor in the installer will route all update checks over Tor

@justwhy

It deeply disappoints me, because as I understand, even if I choose everything to update through whonix, it will still check for updates over clearnet.

Not if you disable all update checks.

@justwhy

So if you can’t hide that you use QubesOS anyway, then I don’t see realistic scenarios where updating over TOR make sense.

Updating over Tor has specific security benefits:

Update check without sys-whonix

Downloading dom0 and template updates over Tor can provide specific security benefits by making it more difficult for you to be subject to targeted attacks involving malicious or withheld packages. For example: An attacker may have gained access to an authentic upstream package signing key. He can use this key to sign a malicious package that is intended only for you. If you download updates using Tor, you force him to distribute the malicious package to everyone instead of only to you, which…

@justwhy

[…] if devs wanted to go full Windows in this case […]

@Eric

I have deduced the devs want everyone to call home so they know how many users they have, at a minimum.

This is not accurate. For an accurate description of the situation, see: Privacy policy | Qubes OS

@justwhy

If it is really not possible/doesn’t make sense for the devs to make updates check through the whonixVM, it should be at least stated somewhere.

@Qubie

Qubes devs really messed this moment, by doing everything the way they did. They confused the users by giving them false feeling that they can hide Qubes presence by enabling that whonix proxy feature. They could at least somehow explain in their docs what really must be done for this purpose or explain in installer how really works whonix update proxy feature in order do not confuse users by this, because as we know with you - hiding presence of such OSes like Qubes can be really important thing for many users around the world.

@tanky0u

The OP issue has been bugging me for a few years as well. I noticed that even though I have set “Update Proxy” as sys-whonix in QubesOS global settings, so many times I noticed that I get “updates available” notification in the xfce-tray even though the sys-whonix wasn’t running (off, offline, shutdown). Imagine my shock and confusion.

Surprised so many people have had a problem with this for so long, yet no one has opened an issue for it (at least not that I was able to find)! Anyway, opened one now:

Some users think that enabling updates over Tor in the installer will route all update checks over Tor