Hi Denis,

Thanks very much for your explanation. I am understanding a bit more.

The best would be to run Guix System and to use Tor browser in it, if 
needed.

I have already
  (service tor-service-type) in my config.scm and Tor runs inside Icecat.

I have installed
Guix System,
GNUinOS
and Ubuntu (Ubuntu was installed when I bought the laptop, but I don't 
use it, for safety reasons I left it).

So in my case:
to use the Tor browser itself, as far as I understand it right now would 
be to use a virtual machine software and in it to install Tails.
Is that possible?

Because then Tails has already safety measures and hopefully Guix is 
going to develope in future something to use the Tor browser somehow.

Gottfried


Am 01.09.22 um 16:27 schrieb Denis 'GNUtoo' Carikli:
> On Tue, 30 Aug 2022 18:32:26 +0000
> Gottfried <gottfried@posteo.de> wrote:
> 
>> As far as I understand you I can delete the package:
>> tor-client and tor-socks, because I have tor installed.
>> Am I right?
> tor is just a daemon that somehow connects your machine to the
> tor-network but it doesn't automatically route any traffic through that
> network.
> 
> And to start it you either need to run it manually or configure it in
> your list of services in your system.scm with something that looks like
> that:
>> (service tor-service-type
>>          (tor-configuration))
> 
> The tor-client only contains some utilities that are not very
> interesting.
> 
> As for torsocks, it's an application to enable other applications to
> route their traffic through Tor, but in an extremely unreliable way.
> 
> The Tor project documentation has been advising people not to rely on
> torsocks because some of the times it doesn't work at all and the
> application doesn't use Tor at all, even with torsocks.
> 
> And in many cases, with torsocks, very important private information
> (like DNS querries) do not go through the Tor network.
> 
> The alternative is to configure each applications to talk to the tor
> daemon through the socks5 protocol.
> 
> And even that is not perfect because if you do that with a browser, the
> browser will still not be anonymous because of browser fingerprinting.
> But at least your location will be hidden which is already something
> good.
> 
> Tails works by preventing almost all applications from accessing the
> Internet directly, and they are configured for using the Tor daemon.
> 
> So if there is any application misbehaving, it's not that problematic
> because the only way the applications can send data is through Tor.
> 
> To have something like that in Guix we would need to package the ferm
> firewall tool Tails used to implement this, and have users adapt the
> Tails ferm configuration for their usage and/or enable users to use a
> default configuration that is very restrictive (and so doesn't work for
> everybody).
> 
> I've managed to relatively easily reproduce something like that on
> Parabola (because ferm is packaged there), but not yet to have a fully
> functional system with it because I didn't manage yet to run the
> tor-browser as another user yet, which is required for that setup to
> work.
> 
> The issue is that we obviously need to put more resources on things
> like that (by funding the tor-project, having more people work on that,
> etc), but resources are also not easy to find.
> 
> Denis.