From: ng0 <contact.ng0@cryptolab.net>
To: whonix-devel@whonix.org
Cc: guix-devel@gnu.org
Subject: Re: [Whonix-devel] GNU Guix Questions
Date: Mon, 6 Mar 2017 17:15:04 +0000 [thread overview]
Message-ID: <20170306171504.q3upjno6bzbqeeqc@abyayala> (raw)
In-Reply-To: <c90c6a2238126ffc507f83180fc4e6a0@openmailbox.org>
Hi bancfc,
On 17-03-06 16:14:08, bancfc@openmailbox.org wrote:
> Hi Guix devs, I am a privacy distro dev and we are looking at using Guix in
> our OS. I have a few questions:
>
> * Is the Guix package archive available from a Tor hidden service? There are
> many advantages of updating a system over Tor such as preventing a target
> adversary from fingerprinting and targeting hosts that run vulnerable
> packages and protecting systems in case the package manager has a security
> bug. Debian and Tor now provide onion mirrors for their packages. Can you
> please consider doing the same?
As far as I know this might be discussed currently at GNU sysadministration level,
at least that's the last info I got when I suggested this last week to
RMS.
There is an onion mirror which is run by another community. It doesn't
mirror alpha.gnu.org yet (where guix binaries are located), but it plans
to do so. I need to get in touch with the community to ask wether they
would be okay with more bandwidth.
Do you have an estimation on how high your usage would be for the guix
download from the onion mirror?
>
> * Does Guix defend against the variety of attacks described in the TUF
> threat model document? (described in link below) How resilient is it against
> key compromise? (TUF was designed from the ground up to provide a highly
> resilient and secure update framework as a drop in replacement to crappy
> standalone updaters - a problem that's become very serious for proprietary
> OSes. The security research and implementation behind it are an excellent
> rubric that one can apply to any updater/package manager.)
>
> https://github.com/theupdateframework/tuf/blob/develop/SECURITY.md
>
>
> * How does one setup a third part package archive? After looking at the
> manual I believe its as simple as fetching source from one's git repo?
>
> Thanks
> _______________________________________________
> You are receiving this e-mail because you subscribed Whonix-devel mailing list. To unsubscribe visit https://www.whonix.org/cgi-bin/mailman/listinfo/whonix-devel or mail "unsubscribe" to Whonix-devel-unsubscribe@whonix.org.
>
> Sie erhalten diese E-Mail, weil Sie die Whonix-devel Mailingliste aboniert haben. Zum abbestellen besuchen Sie https://www.whonix.org/cgi-bin/mailman/listinfo/whonix-devel oder mailen Sie "unsubscribe" an Whonix-devel-unsubscribe@whonix.org.
next prev parent reply other threads:[~2017-03-06 16:06 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-03-06 15:14 GNU Guix Questions bancfc
2017-03-06 17:15 ` ng0 [this message]
2017-03-07 0:59 ` [Whonix-devel] " bancfc
2017-03-07 11:05 ` ng0
2017-03-07 19:31 ` bancfc
2017-03-10 10:44 ` ng0
2017-03-13 22:42 ` bancfc
2017-03-14 13:45 ` Ludovic Courtès
2017-03-07 13:57 ` Ludovic Courtès
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
List information: https://guix.gnu.org/
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170306171504.q3upjno6bzbqeeqc@abyayala \
--to=contact.ng0@cryptolab.net \
--cc=guix-devel@gnu.org \
--cc=whonix-devel@whonix.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
Code repositories for project(s) associated with this public inbox
https://git.savannah.gnu.org/cgit/guix.git
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).