Main Article - TorBOX TOC(noheading, depth=0)

ArchivedDiscussion

INFRASTRUCTURE

Delete or keep resolved tickets? [INFRASTRUCTURE]

• (proper) This are some topics were I feel, that we never need them again. They are solved and not of interest to be discussed ever again by anyone. Reasons: either fully covered in other tickets or already inside the documentation articles.
• (proper) Can we delete all the following tickets? Alternative we could move them to another page but I don't think that is necessary. Of course if you feel any of the tickets shouldn't be deleted you can move them back.
• (anonymous) no harm in keeping them
• (anonymous) see other discussion...

Personal Updates [INFRASTRUCTURE]

• (smarm @ 03.06.12) Out of action (or very low key) for the time being. Got some grad school things to prepare for, move to the location, getting up to speed with program, etc. Will check in very occasionally, as time permits. Will update here or provide further updates / thoughts / discussion points / questions as the need arises to the main thrust of the TorBox project.
• (proper) Thanks for the update. Nice to know, that you are still on board. Good luck with things. See you around.

spoilers [INFRASTRCUTURE] [REJECTED: Not possible]

• (proper) A spoiler is a text box, where you can hide text, which will be revealed after clicking on it. Spoilers could dramatically improve the readability of the article. The article could be made very "clean". Only the commands which have to be inputted and the text boxes would need to stay visible. Almost everything else (technical explanation) could be hidden in spoilers. Users could set up the gateway fast, begin to like it, and maybe become interested in the backgrounds and read what they have just done step by step. Most implementations of spoilers need JavaScript, due to the privacy issues with JavaScript it would be nice, if a JavaScript-free solution were possible. JavaScript must not be a nogo, if it's hosted on torproject.org, torproject.org has to be trusted so or so. However, I found two JavaScript-free implementations.
• (proper) JavaScript-free spoiler #1 - go over with the mouse, see the text, it's a live demo, you can see the source (right click, view page source)
• (proper) JavaScript-free spoiler #2 - looks even better, text stays visible after mouse pointer has been removed, perfect so far, to see the code in action, copy it into a file, rename to something.html and open with browser
• (proper) Biggest drawback so far, for unknown reason I doesn't work inside this wiki with the #!html tag. possible help: list of all commands, trac wiki WikiHtml, or here (links unfortunately down)
• (anonymous) I'm strictly against a JS requirement though, sometimes I use a text browser on a headless server.
  • (proper) Ok, let's not use JS. There has to remain a javascript-free version.
• (proper) I asked in the trac users mailing list. Let's see.
• (proper) There has been some progress, got a very good answer. And someone close to the torproject told me in private mail that the chances to get such a feature are greatest, if I request a feature regarding trac using the tracker, providing a plugin and instructions how to use it. I am waiting for a live demo then I ask and hope all that will be convincing enough for the webmaster to add it.
• (proper) Request has been made. My first trac ticket. #5240 (moved)
• (proper) Request denied. One last chance (last message) remaining.
• (proper) No way. We won't see spoilers on torproject.org. Therefore IMPOSSIBLE as long we stay here.

Roadmap to TorBOX 1.0 [INFRASTRUCTURE]

• (anonymous) Once we've closed the current 4 critical issues I think we can call the project a version 1.0. The time sync issue can probably closed soon, then there are the two testing tickets which aren't much of an obstacle. The last one will take more effort. This is how I envision TorBOX release 1.0: It consists of a ClientVM.ova and a TorBOXShellScript.sh. Not shipping the gateway preconfigured as an ova as well has one reason: trust. Why should people trust anonymous people on the internet. They mustn't and they shouldn't! By installing a distro of their choice and converting it to a T-G, using the script they can easily audit, they do not have to trust us for the security and integrity of T-G. The ClientVM by design doesn't have to be trusted. Even if backdoored it couldn't unmask the identity or IP of a careful user. In the future there might be a T-G ova gpg-signed by an official Tor developer, for now I think this is the compromise we need to make. Setting up the T-G only takes a few minutes anyway and people lacking the required (low) skills maybe shouldn't rely on Tor in the first place for they most likely will also not understand the numerous ways they can still compromise themselves.

• (proper) The trust issue persist even if we provide only the ClientVM.ova. If the ClientVM.ova were backdoored the repercussions for the user and torproject.org would be fatal. (passwords of anonymous users could be stolen, even if their real IP would remain hidden, it would be very bad press for torproject.org) I am not sure if we are allowed to call the project TorBOX. As of right now it hasn't received much attention but the term "Tor" is protected and not everyone allowed to use it in it's name. When you look through the similar projects, you'll see that there are even closed source projects. For example the project from 'ra'. He never supplied instructions how to build it oneself and on the other hand loads of people seamed to have downloaded, used and discussed the project - binary only. I don't want to offend him and I have no reason to distrust him. What he has done and what we have done with TorBOX, could also have been the work of a full time employed government affiliate. Not everyone is as paranoid as me and guesses so much. So what we have to find out, is torproject.org's policy on naming, official projects and binary builds trust. So let's gather some more information, develop further and then introduce the project and ask the remaining questions. Of course I can't hold off anyone with anything - I have no power over the site. =) I think this here is unique (a wiki article evolves into a software project).

• (anonymous) No repercussions because the ova "1.0" wouldn't be hosted or supported by torproject... We'd need to do that ourselves. Also I doubt this project will ever be "official" because it's just a tor "distro", we haven't coded a single line so far (note that Tails isn't hosted here either). It's all just configuration and documentation and in the future maybe packaging. People do not have to trust us because we are just presenting the building steps and everyone can download the official releases and configure them according to our guides. An ova build would be handled the same way. We document everything we do. Anyone can build their own ova and just diff the two and would detect any differences between what we claim to be doing and what we are actually doing.

  What "ra" projects are you referring to? I haven't noticed any closed source parts so far. About the name: TorBOX already has the problem that there is TorBox.net, a torrent search engine.

• (proper) I am referring to "Easy and secure anonymous internet usage by ra; anonymous author; binary only" (link under similar projects). Since he is mixing different open source software together, he is creating something new. Many of the used software wants the publisher to deploy the source code over same same mechanism like the binary. The programming language is shell scripting and "linux sys admin". He would have to publish all commands he has done. People in the comments asked him how he has done it, he promised to do it, but has not done it yet.

• (proper) Why this can't TorBOX become an official project? Maybe it IS already an official project? =) Tor VM is currently already hosted on torproject.org click 1, click 2. The Tor VM development stopped. We gave it a new name, forked it, started again, developed it further. I started writing TorBOX because JanusVM/TorVM (and most other projects) were outdated, insecure, not well documented and new development wasn't to be expected. The question to ask is, will they accept us and our work to takeover the old, outdated VM project. - atagar advised me (the topic wasn't about TorBOX, but about volunteering to Tor in general), to drive by on IRC or to mail tor-assistants@. Maybe it's not as difficult to get in touch as I thought.

• (anonymous) I sure wouldn't object. I'm just saying "don't count on it". The current priorities of the torproject are going into different directions it seems and they (IMO) already have too many projects going on and not enough man power (judging from the security related tickets I've opened that haven't been solved in many weeks).

• (anonymous) ANSWERED. Further discussions are at Dev\ClientVM

are you comfortable? [INFRASTRUCTURE] [ANSWERED]

• (proper) So far I recognize smarm and cyptherpunks/anonymous (which I believe to be just one person) supervising me and contributing to TorBOX. I am thankful for your help, without you, TorBOX wouldn't be so far like it is. What I am sure about is, that I do not want to loose you, because of enforcing any stupid decision. So I am asking you to complain, if needed, before you leave.

• (anonymous) ;)

• (proper) The problem with this wiki software is, that it's not possible to edit only a small portion. You always get to see the whole source. On the ToxBOX front page I have "outsourced" the more or less important stuff to new articles. I had the feeling, that the article has grown to big. Scaring new users and not attracting new contributors. To reliably being able to read and edit TorBOX, the size just didn't "feel good" anymore. Also the TorBOX/dev sub page might have grown to big.

• (anonymous) Exactly how I felt. The only tradeoff, we (the contributors) need to check more wiki pages for changes. More pages perhaps means less collisions. I hate collisions.

• (proper) Things like Application Warnings And Notes, it's questionable, it's not required for setting up a transparent proxy but on the other hand, anyone who set up a transparent proxy, should be aware of, for example, not to use the normal Firefox, because of browser fingerprinting, TBB patches.

• (anonymous) Absolutely, the set up looks daunting while in reality it isn't all that difficult. Presenting everything and the kitchen sink in one page scares of potential users.

• (proper) The project must look user friendly, even if it's a lot stuff, and complicated stuff to tell. It's best to educate the user in small proportions. I am thinking about an even better structure, like disclaimer, news, abstract, installation, usage.

• (proper) Another issue with the layout of the article is, that this wiki currently does not support spoilers (small boxes which can hide text, which will be shown with one click). Spoilers would help to shrink the size of the article. Would it make sense, to migrate the article to a media wiki or have chances, to ask the webmaster to install the spoiler plugin?

• (anonymous) I'd prefer if it was still hosted here. Spoiler plugin would be very welcome.

• (anonymous) UPDATE: As you can see, I've reworked the whole /TorBOX wiki. I started at one end and just couldn't stop midway. Hope you are OK with the changes. Should we have discussed such large changes first?

  • (proper) Very nice! I like it very much. Now we got a tiny and friendly front page. And I am very okay with it. We should discuss it before, but actually we have discussed it before. I proposed such changes and you did not object. You were just much faster. :)

• (proper) Let's wait perhaps one more week, if smarm has to add something. If nothing comes up, then we close it.

• (anonymous) I've now also attacked the last remaining page, this one ;). I think it's best to keep everything on one page even though it's become unwieldy in such short time. But being able to quickly ctrl+f the whole page makes up for that and very useful for those who may have questions that are already answered.

  Closed several tickets, please reopen if I was too eager.

Feedback collector [INFRASTRUCTURE] [REJECTED]

• (proper) We could add a small application on T-W where the user would only see a small text box and a send button. The feedback would be send to us. E-mail would make sense, but any other suitable method will do. There are open questions about user privacy. Should we encrypt that message? Should we normally send over the Tor network or should we add another layer of protection such as remailing? Or simply send over Tor and tell the user to switch circuit afterwards? How do we answer the users? Are there existing applications for this task or would we have to develop it ourselves? Does this make sense at all?
• (anonymous) I really think that's overkill neither Tor nor Ubuntu has that, why should we - we just configure the two?
• (proper) Agreed.

== Evil developer attack [INFRASTRUCTURE] [ANSWERED] ==

• (anonymous) https://trac.torproject.org/projects/tor/wiki/doc/TorBOX/SecurityAndHardening#evildeveloperattack that does sound a bit drastic. I already wrote about trust. TorBOX doesn't distribute any new source code or binaries, only redistribute unmodified upstream binaries. That's what we claim, but it's a lot easier to verify than if we were distributing our own binaries from source code we wrote. Users should worry about the motives and internal security of everyone contributing to TPO, all of the distro devs and maintainers and the hundreds of upstream devs and contributors. TCB size of a modern OS today is so ridiculously big and so many people are involved I'd be really surprised if none of the "bugs" were intentional. And then there's the hardware. You think that even AMD could understand an Intel chip or vice versa? Of course one can't compare an anonymous contributor with no investment but time with a multi-national company. On the other hand, detection here is just ridiculously simple (diff the hash sums), while finding and then proving that something is not a bug but a backdoor in a compiler, well designed source code let alone a CPU is impossible. Anonymous or not no longer matters these days. We are in a more or less open "cyber war" or that's what media and lawmakers want us to believe. Fact is, today players are backed by goverments, they can use their real identities without fear of repercussion, fake IDs can be created, trustworthy people can be coerced into giving up their gpg and ssh keys if projects even make use of any strong authentication. Judging by the lack of signatures on many open source upstream and even downstream downloads I'm sure many lack any internal security enforcement and still trust DNS to provide authenticity and clear text to provide integrity. About open source, yeah, you can bet Apple, Google and Microsoft have better internal security than the global open source community. However that doesn't make their code trustworthy or says anything about whether closed or open is more secure...
• (proper) I agree with your post here. After a few tweaks it can be moved right away to security and hardening as well. I am not sure it's too drastic. The main message was "it's a community project by anonymous authors, no less/more secure than trusting any other anonymous software project, if you want better security you must build (everything) from source". Feel free to edit it to be more accurate. I though you were concerned most about evil developer attack? (Search this site for "Biggest issue was trust".)
• (anonymous) It's not about that trust isn't an "issue". It's about perspectives, the real risks and the tough choices people have to make. The TorBOX packaging is a minor one and I thought the quick comment on the download page would suffice. I'm not for removing your comments as they are still true, we'll need to rework both and what ever new things this very discussion brought up into one single section, new page with links from security, disclaimer and download?
• (proper) Yes, we can make a new page. Some of the stuff discussed there is not a part of "hardening". Some of this stuff is, as of right now, only hypothetical. Things which the average geek can not solve in the next few years. No real instructions given, no knowledge which you should always keep in mind at all times. I suggest to separate the the practical/important stuff from the hypothetical part. It's still important to keep the hypothetical part somewhere, otherwise people criticize us for not informing about it. Tor also keeps all that stuff itself upfront.

TorBOX Updater / TorBOX repository [INFRASTRUCTURE] [ANSWERED]

• (proper) How do we keep our users informed about news? The /var/lib/tor issue was quite severe. It's not really neat to expect users to check by our site every day. We need timely updates. What would we inform about? Only security related issues, new features, new versions, nothing or everything? And how could we implement it? We could develop or use an existing update informer (if any for linux). Or something simple like rss could do.
• (proper) Or what about a TorBOX repository? I imagine it like this: The user installs two VMs, T-G and T-W. He adds our custom (launchpad) repository to both VMs. Then he runs 'apt-get install t-g' on T-G and 'apt-get install t-w' on T-W. And if there are any updates, they would be done when the user runs 'apt-get upgrade'.
• (anonymous) would be nice but don't count on me, I'm really only interested in configuration and documentation, not distribution, especially not so disto specific.
• (proper) A repository is nice, but the amount of skill and time needed is very high.
• (proper) About the updater... What about a simple mailing list? A free mailing list service. People can decide themselves if they sign up with their anonymous e-mail address or not and unsubscribe at any time. We would inform about critical security issues and depending on our mood, also about new features/versions.
• (anonymous) there is a default home page for every torbox user pointing to tb/readme. This is a place where they are guaranteed to notice any critical updates. I think that's sufficient given our current status.
• (proper) Ok, sounds reasonable. We only should figure out, where to place the news and what to use as start page, /TorBOX or TorBOX/Readme. News in two places is bad. And what about check.torproject.org? Do simply override it?
• (anonymous) It's crucial that people read the Readme... Anyway, we can assume they already saw the homepage when downloading. News about critical issues needs to be in both places, link is not enough. check.torproject.org is linked, I thought about using both the tor check and torbox/readme as the default home page so they are opened by default in two tabs, but either I couldn't figure it out right away or thought it's not necessary because we already ensure that t-w only works behind a correctly configured t-g (by using the torbox internal network and a non-standard proxy port). If people misconfiguration things it's because they used the "build from source" instructions and it would be their responsibility to test their set up.
• (proper) Okay, all agreed. What we can do, is make the TorBOX start page a bit more pretty. We could separate the "one time readme" from the "project news TorBOX start page". What do you think?
• (anonymous) The read me is not "one time", it is a constant reminder to run apt-get update and keep TBB up to date. only the parts about keymap, password, time sync are one time. We definitely need everything important in one place, one time stuff could be moved somewhere else and linked from the build instructions and download page but I fear that will result in it being overlooked. Critical news can also only be available on readme, it's pretty much guaranteed every TorBOX user will see it.
• (proper) Done?

TorBOX binary builds - downloads - metadata - GPG [INFRASTRUCTURE]

• (proper) Trust issue, official project, naming conflict is all covered in other threads. Binary builds are not a high priority yet, as we have to sort out the critical stuff. Just brainstorming. (TorBOX/Download)
• (proper) This thread is about the technical side. We want to stay anonymous but uploading a binary build could make us identifiable (meta data, info for packagers). I have no experience with offering stuff for download. No idea which meta data (possibly computer name and stuff like that) is added when creating virtual machines. Maybe the risk could be reduced when building the virtual machine inside another virtual machine. It would be great if someone else, perhaps someone who doesn't want to stay anonymous would join the project. I asked ra by e-mail as he stated once in the comments, that he wants to make his "Easy and secure anonymous internet usage" to an official to project. Because our goals are very similar I asked him, unfortunately there was no reply.
• (proper) Only brainstorming: We may either ship only Tor-Gateway.ova and Tor-Workstation.ova. For Windows hosts there exists the possibility to deploy a single pre-configured portable VirtualBox including both ova's. Not sure if that is possible on Linux as well. In the future we could possibly also provide .deb packages. (And what you said before: on Bare Metal we recommend to use VMs anyway due to hardware serial numbers - this also eliminates the need to deploy and Client.VM.iso)
• (anonymous) Added trust section to TB/Download. That's all we can do for now and it should suffice. Who really uses WOT when verifying gpg keys anyway? about metadata: there's another ticket still open.

Personal comment by the anonymous/"cypherpunk" author of the 0.1 alpha builds [INFRASTRUCTURE] [ANSWERED]

I've created these alpha ova images as a proof of concept. This does not indicate I will continue to update them and create new builds. I've absolutely no interest in Windows anything (see proposal for portable VBox) I also have no interest in making this project user-friendly in the sense of making it suited point and click anonymity. One reason is that it's my view that this is pointless anyway - the user is always the weakest link in technology. without user education reasonably strong anonymity, privacy or security is impossible to achieve. Not to mention that such user would be absolutely dependent on trusting us which I couldn't expect from someone reasonable paranoid and people without that mindset have no business in running Tor in the first place. Another reason: TorBOX VM is only as secure as the host. If it's too easy to install TorBOX on an existing untrusted host it encourages unsafe usage.

That's all just my personal opinion of course and I wouldn't stand in the way of anyone taking TorBOX into that direction. I will also continue reviewing and improving the existing scripts and guides. But I want to make it clear that I have no time and inclination to create AND maintain binary downloads.

PS: proper has access to the sourceforge torbox account if anyone else wants to upload something. Or post your contact here and I'll get in touch.

• (proper) Question about "see proposal for portable VBox" - I see no new comment there.
• (anonymous) I meant I don't have interest in doing a portable virtualbox bundle for windows (replace "see proposal" with "e.g. the proposed portable VBox)
• (proper) And about the Windows thing... I have very low interest in Windows as well. Keep in mind the following. Windows users boost the awareness of any software project. More users, more press, more review, more developers, more testing, more features... A good example is Firefox. Linux wouldn't have this browser, so advanced. The Windows world helped to promote and push it with money and developers.
• (anonymous) Sure but that's what TBB is for. TorBox is too complicated for "those" users and is designed for user cases where building on top of an ordinary windows host defeats most of the purpose of using multiple VMs. What I'm trying to say: I'm not against it but I don't see much of a point in doing it.
• (proper) You are right. The only point would be to boost the project. Anyway, we shouldn't feel impelled do to things, we do not like.

TorBOX/Dev site size exceeded [INFRASTRUCTURE] [DONE]

• (proper) Gotta move some stuff to Dev/ArchivedDiscussion. Wiki failure: "Warning: The wiki page is too long (must be less than 262144 characters)". That's only a temporary solution. What do we do as a long term solution? We can try ask if we get our own torproject.org component in trac. Or we can finally move on to our own hosting (extra thread).
• (anonymous) What about: answered/archived goes into a new pages as needed, split by months?
• (proper) Split by months will make it pretty hard to find stuff again after a few months. Archived stuff is better but will also spread around multiple places after a while and make it hard to find stuff again. This may be the only alternative as long it's here. Hosting in the wiki was quite good, new edits are seen in the history link and all could be searched with the browser very fast, that wouldn't be possible with a forum (most recent stuff gets bumped up but older contents falls down and searching is harder). Tracker, never seriously worked with one, you are informed about new changes by mail but searching is also hard. When I get to setup a new wiki I try to lift restrictions (afaik 2 MB by default for mediawiki).
• (anonymous) what about splitting archive into topics instead of time?
• (proper) That's certainly the better alternative. Btw we had this before. ;) Ok, no one could expect, that the site size is limited. We can do it again.
• (anonymous) you mean the dev/clientvm page? Not really, all open tickets should be in one page now (let's just hope they never exceed the limit...)
• (proper) Yes.
• (anonymous) do you approve of the change, should we move ALL closed tickets into relevant subpages I prepared?
• (proper) Can do.
• (anonymous) you or me? the other should stop editing any archive* page in the meantime or the merge will be horrible...
• (proper) You can do it. In meanwhile I will not edit and dev* related pages. I am working on the VPN stuff.
• (anonymous) done
• (proper) I like it.

web forums [INFRASTRUCTURE] [CLOSED]

• (proper) Only a few people are aware of TorBOX and those who are (people talking about TorBOX; 77 Downloads (March 2012) on sf.net so far), do not leave feedback. They don't seem to like to login using the public password account and editing the wiki. I suggest to add a forum. No hidden server (someone had to run the server, slow, need Tor or tor2web to access it). Some free hoster. Rules: anonymous postings allowed, no registration required, optional registration possible, no spam allowed, discussion of similar projects allowed, critique allowed, any TorBOX related talk allowed, off topic talk will be deleted (warez, porn, politics, can be discussed else were, for our own and the projects protection). Even if guest postings are allowed, it needs a reliable spam protection (like the Tails forum). SSL required (otherwise admin password can be stolen). Do you support the idea? Any suggestions about which service we may use?
• (anonymous) tpo is said to get its own forum one of these days. let's wait for them and then ask if we can get a subforum for torbox.
• (proper) That would be optimal. I missed discussion #3592 (moved). Two things: 1. the decision for tpo to start a forum isn't made yet, and the discussion doesn't look very promising. How many months is is going to take? 2. Even if tpo made a forum, how probable is it, that they give us a TorBOX sub forum? There are important people who probable do no "like" TorBOX. Transparent Proxy Version 61 rransom: "this page exists to give step-by-step instructions for transparent proxying" - and he deleted the link to TorBOX! You added the TorBOX link again. Please do not challenge him (edit war). I am not sure how much acceptance TorBOX has for hosting on tpo. After all TorBOX has Tor in it's name. Okay, there exist other non top affiliated projects with Tor inside their name (for example TorChat), and until now, they did never complain. They could fear, that any failure in TorBOX, will create bad press and/or support requests for tpo.
• (anonymous) rransom rightly pointed out an issue or two in TorBOX 0.1, 0.1.3 fixed them. I don't think he looked into this project more than cursory and maybe jumped to some further conclusion and I do not think he'd find much to criticize in the latest version. If he did we'd fix it again and thank him for the report. I agree with his edit of the TransparentProxy wiki page. It would have been nice of him to make the wording more accurate instead of removing the link but he's certainly busy with other, more important things. I'm sure this won't end in a "war", no need to worry about that ;) For the tpo devs there isn't much to complain about TorBOX tainting their name. TorBOX IS Tor, in a certain configuration, and a documentation project. Nothing we do is discouraged by official statements or can be constituted as improper use of Tor. If there's a security problem with TorBOX it will be because of Canonical, Oracle or TPO screwing up or because of the documentation lacking. We don't write code, we just configure things in an automated way. Back to the actual topic: I don't like the idea of moderating a forum, no matter how simple that may be (using a host that takes care of security and spam) it's still 'some' work I'd rather not have to do. Our target audience shouldn't have troubles using this wiki (or asking elsewhere and finding out the answers) If we had a Windows Vbox bundle that would be different.
• (proper) Okay, convinced, solved for now.
• (anonymous) close? move?
• (proper) We get that together with torbox.org.

Community Collaboration [INFRASTRUCTURE] [ANSWERED]

• (TorBox.org) One big limitation I’m noticing here on the TPO wiki is the poor collaboration features. It works technically, however... The usability is very low with having to edit through large existing pages to post something new. Also, the posts aren’t conveniently documented with timestamps or usernames, without analyzing the history diffs. Without a simple, straightforward, and convenient method for community contributions, it raises the bar of motivation needed for other people to get involved. And it also obfuscates the indicators of certainty & trust within the project’s historical public records. So I propose that we (I’m happy to do the work) implement some better software infrastructure for collaboration on the upcoming TorBox.org website. After thinking about it, some instructional information is best held in singular pages, like in a wiki or CMS, while other exchanges are more discussion/conversation oriented and potentially best handled in a forum style. I see that some aspects of this have been briefly mentioned on this page already. More detailed thought is needed, based on website specifics, but I wanted to point out the current limitations and establish the general plan/idea for including this now. I think this would be a core constraint for getting more people to join in throughout the upcoming months/years of TorBox development.
• (proper) I'll agree with all your points. As you have already noticed, I discussed this with the other main TorBOX developer, (anonymous). Without him TorBOX wouldn't be were it is right now. I am really serious about the last sentence. Perhaps TorBOX would be still only a manual configuration guide. That's why I don't want to loose him and it also were impolite. If he splits off, development will be slower and any of my mistakes/bugs will be fixed slower, also missing a control instance. I'll hope he answers here, that's why I spitted this important discussion up. I'll accept, that using a long term pseudonym is risky. Can we allow anonymous access? Anonymous, would you use the anonymous access or are you adamant about only posting on torproject.org?
  • (TorBox.org) Well understood. Very appreciative of the importance of Anonymous's work. And, yes, we could certainly seek to establish a solution that allows for anonymous contributions to get the best of both.
• (TorBox.org) Also, it would really help unify the domain that TorBox has its presence and functionality on, instead of always sending interested people to different ad-hoc websites to accomplish different tasks throughout the future.
  • (proper) What do you mean by unify the domain? The TorBOX Homepage of course will be replaced with torbox.org once ready enough. Once a wiki (or however we solve it) is hosted on torbox.org, we can move the content from the tpo wiki to torbox.org and the tpo wiki will be only a brief summary of TorBOX and link to the project page torbox.org
    • (TorBox.org) You read my mind proper... That's exactly what I meant with the current homepage and wiki. And, in general, hosting any new official informative or collaborative resources on the official TorBox.org domain. The main value here is in keeping the perception/awareness/usability clear for people, by having one official active domain and visual brand/style to keep up with and trust.
• (proper) And no matter what anonymous's answer will be, that shouldn't block you from starting a forum or some sort of issue tracker. We'll find a solution...
• (proper) I don't expect any more answers. As I said, I agree with all your points. Implement as you like.

[INFRASTRUCTURE] binary builds - downloads [DONE]

• (anonymous) So far there's no one willing to regularly build and upload binary builds. (Can't blame anyone, it's boring and time consuming depending on network speed).
• (adrelanos) Perhaps we'd be more motivated when we had fully automated builds?
• (adrelanos) Discussion in the website dev thread (about vps) revealed, that we have a realistic chance for a build machine (on the vps). Still need to think and talk about the details.
• (adrelanos) aos 0.2.0 will be still build "manually".
• (adrelanos) Perhaps we'd feel more safe about building them, if we could build them within a devoted Tor-Workstation to be sure, there are no leaks?
  • (adrelanos) It's possible to start virtualbox inside virtualbox. You have to change the host key in the global virtualbox settings.
  • (adrelanos) Only build T-G yet inside T-W but I don't see why building T-W in T-W shouldn't work.
• (adrelanos) I am going to create builds. Tickets tagged with [TorBOX 0.2.0] are tickets, were I feel, that they really should be fixed before aos 0.2.0 gets build. This one is solved so far, just in case general discussion is necessary.
• (adrelanos) Currently building, then a little testing. I try to find a few testers before posting advertising the builds on the front page.
• (adrelanos) 0.2. released. End of this monologue.

[INFRASTRUCTURE] Our bug tracking system [WEBSITE] [ANSWERED]

• (anonymous) It's getting messier all the time, our high level tags don't make sense for everything. Links break constantly whenever tags are added/changed, the TOC truncates titles so we can't search tags quickly for an overview. I can't think of a simple workaround, we need a real bug tracking system eventually.
• (adrelanos) Yes. We'll get one with (trademarkdomain user disappeared). I don't know any temporary fix. Should we ask tpo if they give us a trac component? A good temporary solutoin should be able to be easily imported to (trademarkdomain user disappeared).
• (anonymous) For now, I want to deprecate the wait category because it's not really meaningful. tagging for Whonix releases is much more useful. Another thing we could do is to add category/release tags in front of the titles. Status tags can remain where they are. What do you think?
• (adrelanos) You made some valid comments to the waiting tickets. I'll answer them and answer again here.
• (adrelanos) You can tag like crazy. :) It won't help me, it won't hinder me. Feel free. For example time sync can be tagged as Whonix 0.2.0. I can't get it done in time so or so. I don't think removing the waiting category is of any help, but you are free to do it as well. If you feel better, if it helps the workflow, why not.
• (adrelanos) Ok, after seeing it, I must correct myself, it's useful.
• (anonymous) CLOSE? nothing we can do about till the domain is ready.

[INFRASTRUCTURE] Whonix 1.0 website [DONE]

(adrelanos) What is needed for Whonix 1.0?

• We need a real website.
  • Where no random trolls/crackers can modify anything important. (Such as malicious script edits). (See also evil Evil developer attack.)
  • Some webspace and sufficient traffic.
  • A wiki on that site (media wiki). (And spoilers.)
  • And need a free SSL certificate.
    • All parts off the website reachable over SSL without any warnings (we login over Tor).
      • sourceforge.net does not offer that (SSL warnings).
    • startssl.com offers free SSL certificates. You simply have to prove, that you have control over the domain - but that's not possible with subdomains.
  • Hosting and domain.
    • Censor resistant in sense of "Whonix will not get deleted."
    • Free - if that is possible. No one is willing to pay and in the beginning there are no donations.
  • Bonus points for having it reachable by a hidden service.
  • We allow guest/anonymous postings (bug report, feedback, etc.) and moderate it very non-restrictive. (Allow any critique. Only delete off topic talk such as warez.)
  • Tor friendly.
    • Permit to sign up and to use the page exclusively over Tor.
    • Last time I checked wikipedia (wikimedia) derivatives and wikia weren't Tor friendly.
  • It's still desired to have the less critical parts of the wiki open for guest edits.
  • We can either use free project hosting or own hosting.
    • Is there a free project hosting fulfilling all requirements?
  • Text mode browsers, Javascript and other browser technologies, anonymous use
    • Shouldn't all the important stuff anonymous guests want to do (reading documentation, downloading Whonix or the scripts) be possible without the requirement for javascript or fancy browser technologies? Also registration should always stay optional for reading and downloading.
• Comparison of open source software hosting facilities: interesting comparison. Google Code and sf.net are not suitable, because they block users from "Cuba, Iran, North Korea, Sudan, Syria", which is ridiculous. We better don't choice something based in non-free countries, such as US.
• Needs a wiki, a forum, a blog, a mailing list.
• Q/A forum or ordinary forum?
• Mailing list can stay on sf.net?
• Blog can stay on sf.net? Integration?

savannah

• (adrelanos) https://savannah.nongnu.org (with SSL) looked promising and I don't expect them to be gone soon or to do any other stupid stuff (banning countries etc.). They offer homepages, for example http://www.nongnu.org/qwe/ but I haven't seen subdomains (qwe.nongnu.org) with SSL (for nongnu.org). That's the minimum requirement.

github

• (adrelanos) Already using github as main git repository.
• (adrelanos) github.com offers sub domains, but they are not reachable over SSL. I can't believe, there are no open source project hosting services with web hosting and SSL.
• (adrelanos)

Update

• (adrelanos) Now using https://www.whonix.org as website.