from:"mark"

On Thu, 5 Mar 2020 at 18:21, Chris Laprise  wrote:

> On 3/5/20 7:31 AM, Mark Fernandes wrote:
> > I want to get a genuine copy of Qubos, from here in the UK (United
> Kingdom).
> >
> > The only way described on the Quebos website at present, appears to be
> > to download the ISO.
> >
> > I have the classic security problem described on the website
> > <https://www.qubes-os.org/doc/install-security/>, where not having a
> > trust-worthy machine, means that I have a never-ending chain of trust
> > issues for each machine that I use in the obtaining of the software.
>
> Many of us work with a threat model that assumes at least some computers
> available by retail are not compromised "out of the box", or else if
> compromised then not at the BIOS/UEFI firmware level. For this model,
> verifying the Qubes ISO with gpg is acceptable.
>
>
Hello Chris,

I've only heard of gpg as a binary running over an operating system. Is it
available as something you can run directly off boot-able media?

In any case, you still need to ensure that gpg hasn't been compromised. If
it has to run off an OS, that OS needs to have not been compromised. If you
need to download gpg, the OS which you use for downloading gpg has to be
not compromised. The website doesn't appear to address these issues. The
security Qubes OS offers may be great. But getting from a position where
you don't have Qubes OS at all, to having Qubes OS installed, appears to be
a serious security concern.


You can also qualify the model somewhat and say that an attacker cannot
> successfully infect all of your (hopefully diverse) computers, so that
> makes checking a signature on several different computers a form of
> reassurance.
>
> OTOH, you may have decided to discard the above threat model because of
> some intent or capability known to you. In that case, I think the Qubes
> community has only two answers: Find a trusted service that can flash a
> known good/uncompromised firmware suite onto one of your machines, or
> find a system vendor like Insurgo or NitroKey that sell re-flashed
> systems and uses anti-interception measures (like tamper-evident
> packaging and signatures) in addition to offering Qubes pre-installed.
>
-- 
> Chris Laprise, tas...@posteo.net
> https://github.com/tasket
> https://twitter.com/ttaskett
> PGP: BEE2 20C5 356E 764A 73EB  4AB3 1DC4 D106 F07F 1886
>
>
 Thanks for these tips. They are valuable.


Mark Fernandes

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/CANJMFk8DUVciwtjFs%3DRJQf9EPNHgU1cRWE7N7NfreF9epqCtvA%40mail.gmail.com.

Re: [qubes-users] Obtaining genuine Qubos installer

I know what signatures and hashes are. I've just never needed to be so
bothered with them for my activities.  I studied Computer Science at degree
level

I was recently hacked and this is why I'm so concerned about my security.
I'd rather over-kill than under-kill at the moment, because later on, I'd
rather not have to worry about security.

Given that the operating system is such a fundamental aspect of conducting
computing activities, I hardly consider it painless *at all*, to compare
ISO images. I have no idea where you get the idea that doing so is
difficult?

>From what you have elaborated concerning signatures, you just give further
reason to have concerns over trusting signatures. With sufficient computing
power, sufficient time, it just seems absolutely reasonable to be able to
re-hack an OS image so that it produces the same signature but also
contains a security vulnerability. Or am I not enough informed (which I
admit might be the case)?

By the way, I consider that I am being completely reasonable with my threat
model, whilst also employing critical thinking. How hard is it to go to a
large PC store, and pick at random one Linux distribution, to take home, to
better ensure you have system integrity? As said above, the OS is very
important, and it's not as though people tend to install their OS
frequently.

I don't know what you mean about picotech, but I'm guessing you're probably
referring to hardware or devices happening on the picometre level? I
haven't said anything about such threats. but if they are reasonably
plausible (which may be the case), then perhaps certain individuals should
consider them. The diversification of work is oriented to all the different
aspects of it... security work is just another kind of work that sometimes
needs attention. If you can't do something securely, sometimes, you should
just not do it at all, and perhaps do something else, something altogether
different, etc.

Thanks,

Mark Fernandes

On Thu, 5 Mar 2020 at 17:26,  wrote:

> On Thu, Mar 05, 2020 at 03:56:55PM +, Mark Fernandes wrote:
> > Well that's an idea. But still what if the software you are being 'fed'
> is
> > all tampered software, so that after replacing the computer, as soon as
> you
> > use software, you are compromised again?
> > Purchasing a new computer can also be expensive, and still in any case,
> you
> > might find that any software pre-installed on it may have already been
> > compromised.
>
> welcome to "supply chain security is hard".
> please have a seat next to that person posting here in the last days
> how he doesnt trust chips from china...
>
> the end result is still:
> as long as you dont have a computer you trust, the whole rest
> of this is pointless.
> if you have a computer you trust, verifying a signature is a lot
> more useful than variations of "i bought it in a shop while wearing
> a fake beard, so it is certainly legit".
> (which applies to the hardware too!)
>
> and the point of using different sources of info on the master key
> is that an attacker who wants to fool you has to intercept every
> single one of them. if he misses even one, the game is off.
> and getting the master key fingerprint from many different
> directions/sources seems a lot more realistic than doing the same
> for an iso image...
>
> and you dont have to trust any one of these sources, but if you
> add up enough of these untrusted sources, you can still trust
> the end result as long as your threat model doesnt include every
> single of the sources conspiring against you, or being compromised
> by the same attacker...
>
>
> > Eg. suppose you are a person like Edward Snowden, and that you are a
> > targeted individual. Then such intensive manipulation is perhaps entirely
> > plausible.
>
> i am reasonably sure you are not ed snowden.
> (if you are: sorry. i assumed ed snowden to know what a hash and
>  signature are.)
>
> but here is another headache:
> (warning: nerd-sniping and messing-with-tinfoilhats ahead)
>
> you are of course right that checking hashsums or signatures isnt
> 100% safe. what if there are alien quantum computers involved.
>
> lets run numbers, the "basic math" kind:
> the qubes 4.0.3 iso is 38646317056 bits in size.
> the signature is against a 256 bit hash (over 1056 bits of intermediate
> hashes plus some metadata).
>
> so there are about 2**38646316800 different iso images of the same size
> that will match this signature. or 2**38646316000 to match the intermediate
> hashes so you wouldnt have to bother faking the sigfile.
> thats close enough to "infinitely many" for me to not actualy calculate it.
> (hint: thats several times the estimated number of atoms in the universe)
>
> wait. who said the e

Re: [qubes-users] Obtaining genuine Qubos installer

On Thu, 5 Mar 2020 at 15:42,  wrote:

> On Thu, Mar 05, 2020 at 03:30:26PM +0000, Mark Fernandes wrote:
>
> > So if your computer has been compromised, the methods you suggest may be
>
> if your computer has been compromised to the point where
> you dont trust it to verify a signature, you need a new
> computer to install qubes on.
>
> once you have a computer you trust enough to install qubes on,
> you can use it to verify the signature.
>
>
Well that's an idea. But still what if the software you are being 'fed' is
all tampered software, so that after replacing the computer, as soon as you
use software, you are compromised again?

Purchasing a new computer can also be expensive, and still in any case, you
might find that any software pre-installed on it may have already been
compromised.

Eg. suppose you are a person like Edward Snowden, and that you are a
targeted individual. Then such intensive manipulation is perhaps entirely
plausible.


Thanks,


Mark Fernandes

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/CANJMFk9nq6N6eHNh4s18RpOx4SfJnXO3%3DFB%2B8jVavydCd%2BVErA%40mail.gmail.com.

Re: [qubes-users] Obtaining genuine Qubos installer

On Thu, 5 Mar 2020 at 15:01, Mike Keehan  wrote:

> On 3/5/20 2:40 PM, Mark Fernandes wrote:
> > On Thu, 5 Mar 2020 at 13:30, Mike Keehan  > <mailto:m...@keehan.net>> wrote:
> >
> > On 3/5/20 12:31 PM, Mark Fernandes wrote:
> >  > I want to get a genuine copy of Qubos, from here in the UK
> > (United Kingdom).
> >  >
> >  > The only way described on the Quebos website at present, appears
> > to be
> >  > to download the ISO.
> >  >
> >  > I have the classic security problem described on the website
> >  > <https://www.qubes-os.org/doc/install-security/>, where not
> having a
> >  > trust-worthy machine, means that I have a never-ending chain of
> > trust
> >  > issues for each machine that I use in the obtaining of the
> software.
> >  >
> >  > I suggest that the hyper-linked web-page above, be updated to
> > provide
> >  > further guidance as to how to ensure you have a genuine copy of
> the
> >  > Qubos software. *_Also, can anyone in this news group provide any
> > such
> >  > guidance for myself (and others?)_*
> >  >
> >  >
> >  >
> >  > (Solely) some thoughts on how to help ensure possession of a
> > genuine
> >  > copy of Quebos:
> >  >
> >  >  1. If Quebos is distributed through PC magazine DVDs, users
> can
> >  > purchase a few copies of a particular magazine having
> such a
> >  > DVD, at random, from different stores, in widely different
> >  > locations (different counties, etc.) Users can then
> > compare the
> >  > copies to make sure they are identical.
> >  >  2. Purchase Quebos from a randomly chosen big PC store, that
> has
> >  > perhaps 100 copies of the software on its shelves, on a
> day
> >  > picked at random, by selecting one of the copies at
> > random from
> >  > the shelves.
> >  >  3. If a user believes they are being tracked, what they can
> > do, is
> >  > schedule in their mind (or otherwise), to make such a
> > purchase
> >  > over the next few months, and then when they are doing
> some
> >  > activity (for example visiting a friend in the city),
> > they can
> >  > just as an aside go and purchase a copy of the software.
> >  >  4. Purchase the Quebos software from an online retailer,
> > that uses
> >  > special tamper-evident packaging
> > <https://www.jwproducts.co.uk>,
> >  > and then compare the copy obtained in this way, with
> software
> >  > downloaded from the Quebos website.
> >  >  5. Obtain software in several ways, then compare copies to
> make
> >  > sure they're identical.
> >  >
> >  >
> >  >
> >  > Thanks,
> >  >
> >  >
> >  > Mark Fernandes
> >  >
> >  >
> >
> > Have you read the documentation at
> > https://www.qubes-os.org/doc/installation-guide/ ??
> >
> >
> > I previously skim read what appeared to be the relevant parts from the
> > guide. Just now, I read from the beginning till the following text in
> > the guide:
> >
> > /Once the ISO has been verified as authentic, you should.../
> >
> >
> > The text after that point appears to be irrelevant.
> >
> > The only thing relevant to this topic in the guide, appears to be the
> > information on verifying signatures (which is of course standard
> > practice). In reading information on the Quebos website, there was
> > implicit mention that users may be operating under oppressive
> > regimes/circumstances. With this in mind, I just feel that more guidance
> > is needed on how to obtain authentic copies of the Quebos software. I've
> > hinted at some ideas as to how to do this, in my starting post for this
> > topic.
> >
> >
> > Thanks,
> >
> >
> > Mark Fernandes
> >
>
> And did you thoroughly read the linked "our guide on verifying
> signatures" page?
>
> https://www.qubes-os.org/security/verifying-signatures/
>
> It shows you how to verify that the ISO you download was actually
> created by the

Re: [qubes-users] Obtaining genuine Qubos installer

On Thu, 5 Mar 2020 at 13:30, Mike Keehan  wrote:

> On 3/5/20 12:31 PM, Mark Fernandes wrote:
> > I want to get a genuine copy of Qubos, from here in the UK (United
> Kingdom).
> >
> > The only way described on the Quebos website at present, appears to be
> > to download the ISO.
> >
> > I have the classic security problem described on the website
> > <https://www.qubes-os.org/doc/install-security/>, where not having a
> > trust-worthy machine, means that I have a never-ending chain of trust
> > issues for each machine that I use in the obtaining of the software.
> >
> > I suggest that the hyper-linked web-page above, be updated to provide
> > further guidance as to how to ensure you have a genuine copy of the
> > Qubos software. *_Also, can anyone in this news group provide any such
> > guidance for myself (and others?)_*
> >
> >
> >
> > (Solely) some thoughts on how to help ensure possession of a genuine
> > copy of Quebos:
> >
> >  1. If Quebos is distributed through PC magazine DVDs, users can
> > purchase a few copies of a particular magazine having such a
> > DVD, at random, from different stores, in widely different
> > locations (different counties, etc.) Users can then compare the
> > copies to make sure they are identical.
> >  2. Purchase Quebos from a randomly chosen big PC store, that has
> > perhaps 100 copies of the software on its shelves, on a day
> > picked at random, by selecting one of the copies at random from
> > the shelves.
> >  3. If a user believes they are being tracked, what they can do, is
> > schedule in their mind (or otherwise), to make such a purchase
> > over the next few months, and then when they are doing some
> > activity (for example visiting a friend in the city), they can
> > just as an aside go and purchase a copy of the software.
> >  4. Purchase the Quebos software from an online retailer, that uses
> > special tamper-evident packaging <https://www.jwproducts.co.uk>,
> > and then compare the copy obtained in this way, with software
> > downloaded from the Quebos website.
> >  5. Obtain software in several ways, then compare copies to make
> > sure they're identical.
> >
> >
> >
> > Thanks,
> >
> >
> > Mark Fernandes
> >
> >
>
> Have you read the documentation at
> https://www.qubes-os.org/doc/installation-guide/ ??
>
>

I previously skim read what appeared to be the relevant parts from the
guide. Just now, I read from the beginning till the following text in the
guide:

*Once the ISO has been verified as authentic, you should...*


The text after that point appears to be irrelevant.

The only thing relevant to this topic in the guide, appears to be the
information on verifying signatures (which is of course standard practice).
In reading information on the Quebos website, there was implicit mention
that users may be operating under oppressive regimes/circumstances. With
this in mind, I just feel that more guidance is needed on how to obtain
authentic copies of the Quebos software. I've hinted at some ideas as to
how to do this, in my starting post for this topic.


Thanks,


Mark Fernandes

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/CANJMFk8hfkvRHfBNEJFzxX5fNjM_0cNkFbcw10mAxPt3UsQsHQ%40mail.gmail.com.

[qubes-users] Obtaining genuine Qubos installer

I want to get a genuine copy of Qubos, from here in the UK (United Kingdom).

The only way described on the Quebos website at present, appears to be to
download the ISO.

I have the classic security problem described on the website
<https://www.qubes-os.org/doc/install-security/>, where not having a
trust-worthy machine, means that I have a never-ending chain of trust
issues for each machine that I use in the obtaining of the software.

I suggest that the hyper-linked web-page above, be updated to provide
further guidance as to how to ensure you have a genuine copy of the Qubos
software. *Also, can anyone in this news group provide any such guidance
for myself (and others?)*

(Solely) some thoughts on how to help ensure possession of a genuine copy
of Quebos:

1. If Quebos is distributed through PC magazine DVDs, users can purchase
a few copies of a particular magazine having such a DVD, at random, from
different stores, in widely different locations (different counties,
etc.)
Users can then compare the copies to make sure they are identical.
2. Purchase Quebos from a randomly chosen big PC store, that has
perhaps 100 copies of the software on its shelves, on a day picked at
random, by selecting one of the copies at random from the shelves.
3. If a user believes they are being tracked, what they can do, is
schedule in their mind (or otherwise), to make such a purchase over the
next few months, and then when they are doing some activity (for example
visiting a friend in the city), they can just as an aside go and purchase
a
copy of the software.
4. Purchase the Quebos software from an online retailer, that uses
special tamper-evident packaging <https://www.jwproducts.co.uk>, and
then compare the copy obtained in this way, with software downloaded from
the Quebos website.
5. Obtain software in several ways, then compare copies to make sure
they're identical.

Thanks,

Mark Fernandes

#installation #installer #media #DVD #ISO #tamper #genuine #intercept
#man-in-the-middle-attack #MITM

--
You received this message because you are subscribed to the Google Groups
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/qubes-users/1d4543f7-b4cf-47c9-9926-6ce9a21360d2%40googlegroups.com.

[qubes-users] Re: Which qube is most secure for internet use?

2019-08-20 Thread Mark Newman

On 8/16/19 12:17 PM, O K wrote:
Well I'm not as concerned about people monitoring/intercepting the 
content of my communications, just about identifying information about 
the hardware of my computer being accessible.  I know it's not easy to 
acquire info about someone's computer from the internet, and if the 
computer's running Qubes I would imagine it's harder, but I think it can 
be done (definitely Mac address but possibly more info).

On Friday, August 16, 2019 at 11:57:19 AM UTC-4, 799 wrote:

On Fri, 16 Aug 2019 at 16:52, O K
> wrote:
 > Which qube is most secure when it comes to keeping any
identifying info about my computer
 > invisible from anyone on the internet (or if not completely,
which qube does this the best)?  Thanks.
I would say that the safest way to assume, that there is no
invisibility.
But using a Whonix DVM -> whonix-dvm-ws-14-dvm will likely be a good
option.
You might want to learn about this here:
https://www.whonix.org/wiki/Qubes/DisposableVM

Addtionally you might want to ask yourself: What are the threads
your protecting against?
And then try to figure out what is the weakest part in your setup.

[799]

--
Actually it is VERY easy to "acquire info about someone's computer from 
the internet".  Also unfortunately, while Whonix does a good job of 
masking your IP address (your location), it does NOT protect you against 
the website you visit from taking and keeping your browser 
"fingerprint".  For more information on your browser fingerprint see:

https://panopticlick.eff.org/
Whether any of this "fingerprint" data is actually gathered depends on 
the website that you are visiting.  It is also possible that a 
well-intentioned website could be unknowingly hacked by a government 
entity to collect just such information.  Further the website could be 
placing a cookie on your machine.
The usual actions here are to make your browser settings more common so 
your "fingerprint" is not unique.  Also using a temporary qube and 
deleting it after use will erase any cookies.

--
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/qj7ulf%2463qf%241%40blaine.gmane.org.

[qubes-users] Re: coreboot on modern hardware?

2019-04-09 Thread Mark Newman

On 3/23/19 3:03 PM, jrsmi...@gmail.com wrote:

Spent several hours yesterday trying to track down what I would need to do to
install coreboot on all of my computers, starting with my Qubes box: a Levnovo
Thinkpad T480.

The bottom line from what I can tell is that if you have an Intel CPU made
since 2008 (any that have Boot Guard) or an AMD CPU made since 2013 (any that
have PSP), you are out of luck. Libreboot spells this out in their docs. I'm
not sure if that is because of coreboot itself or something specific to
Libreboot. I was stuck by how they seemed perfectly fine walling themselves off
from the present and the future.

I could find nothing indicating that anyone had even tried, much less
succeeded, in installing coreboot on a T480 and everything I did find was for
much older hardware.

I read through the coreboot docs where they just wave their hands at the end of the build
process and say "now go flash". I also read through the heads docs, which say
more or less the same thing.

Hackaday has an article on the horrors of installing coreboot on a Toshiba
laptop. Not only do they neglect to say which model they used, at the end of
the article they had it working.

The gist is that the information that's out there is out of date, incomplete,
misleading, and sometimes just incompetent.

I'm hoping that someone here has first-hand knowledge and can advise me (and
others who read this).

Thanks,
John Smiley

I don't think Libreboot is "fine with walling themselves off from the
future", I just think they would rather not have a back door open that
they cannot close. See:

https://libreboot.org/faq.html#intel (scroll down for AMD) and
https://www.eff.org/deeplinks/2017/05/intels-management-engine-security-hazard-and-users-need-way-disable-it
For myself, I also only use AMD CPUs prior to 2013. If this means I
can't run Qubes 4, much as I would like to, I will have to take other
security precautions, especially since I read that Joanna Rutkowska said
that using IOMMU does not protect from this remote management attack.
(Sorry I can't find that reference).

--
You received this message because you are subscribed to the Google Groups
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit
https://groups.google.com/d/msgid/qubes-users/3c008fc0-316d-b34a-93c6-463c48d03272%40yandex.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Confused about virtualization's protections

2019-04-05 Thread Mark Newman

I understand how Xen works to compartmentalize one VM from another. What I 
don't understand is how or if it can help protect from things like rootkits, 
key loggers and especial the Intel Management Engine backdoor. (See:
https://www.eff.org/deeplinks/2017/05/intels-management-engine-security-hazard-and-users-need-way-disable-it)
I am not a security professional, and am hoping someone can explain so I can 
understand.
Thanks,

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/18782191554494400%40myt3-c573aa6fc782.qloud-c.yandex.net.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Tweak Tool not working as expected after upgrade to Fedora 26

2018-01-03 Thread Mark Malcom

Well guys, just trying to see if anyone is facing the same issue here:

I downloaded fedora-26 template and after that my gnome-tweak-tool is 
completely ignored: no themes, no windows scaling anymore. Not just the Tweak 
Tool, but if I try to change the scale factor with gnomesettings, that is also 
ignored.
This is true for new and existing appVMs and also, an upgrade from Fedora 25 to 
26 with subsequent qubes trimming yields the same result.

It is really annoying as I have a 4K display and now had to downgrade the 
resolution and still getting very small windows.

Maybe could anyone shed a light what can be done to get these settings back 
again? I'm not sure if there is any other package that needs installed and 
configured for the Tweak Tool to work, plus gnome scaling settings.

Thanks everyone.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/4f535a74-f604-47a0-bca8-bd9252a0248d%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

Re: [qubes-users] Getting Flash Player to work

2017-09-11 Thread Mark Eubanks

I finally got it to work in Firefox
I tried Chromium but it didn't work and still doesn't work in Chromium
Thanks

On Mon, Sep 11, 2017 at 7:31 PM pixel fairy  wrote:

> try installing google chrome. it has a built in flash engine that chromium
> doesnt come with
>
> --
> You received this message because you are subscribed to a topic in the
> Google Groups "qubes-users" group.
> To unsubscribe from this topic, visit
> https://groups.google.com/d/topic/qubes-users/H4YcmUJz1wk/unsubscribe.
> To unsubscribe from this group and all its topics, send an email to
> qubes-users+unsubscr...@googlegroups.com.
> To post to this group, send email to qubes-users@googlegroups.com.
> To view this discussion on the web visit
> https://groups.google.com/d/msgid/qubes-users/62127ea8-7219-4657-b5eb-653ca424f05f%40googlegroups.com
> .
> For more options, visit https://groups.google.com/d/optout.
>

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/CANn5qsB5vUO0bxJjP1Na%2B_2UdUXnjsPgxTQw9cuNVqkD2YJ_Bw%40mail.gmail.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Re: VM:ERROR: insufficient memory

On Tuesday, September 5, 2017 at 7:55:44 PM UTC-4, cez...@gmail.com wrote:
> Den tirsdag den 5. september 2017 kl. 23.48.08 UTC skrev Mark Eubanks:
> > On Tuesday, September 5, 2017 at 12:06:28 PM UTC-4, Mark Eubanks wrote:
> > > Can someone explain why I can start the work VM but when I start the 
> > > personal I get the ERROR: insufficient mem .  Even though the memory 
> > > settings are the same 
> > > 
> > > 
> > > thanks
> > 
> > I have 16 gig of ram but if I do a free -m it only shows a total of 1058 
> > used 364 free 26 . I'm not doing anything on any of the VM's its pretty 
> > much a new install and I can't open the personal vm .Anyone have any ideas
> 
> ah, you did this in Dom0 terminal right?
> The reason is because Qubes attempts to automatically balance which AppVM 
> gets more RAM than the other. If you right click on each AppVM in the Qubes 
> Manager (Qubes 3.2), you can see the automatic memory setting under the 
> Advanced tab, near the RAM amount fields. 
> So since each AppVM gets their fair share of the RAM portion, Dom0 will have 
> less memory for itself. This might change dynamically, for example if you run 
> a lot of AppVM's, the amount of RAM Dom0 has may shrink. Wnile not many 
> AppVM's are running, or after a fresh boot, Dom0 should have more memory. 
> If you open the Qubes Manager in Qubes 3.2, you can see the allocated memory 
> to Dom0 and each the VM's. If it isnt visible, then you can make it visible 
> at the top in the "View" menu. 
> 
> Also note that automatic memory dyanamics does not work if a VM has a PCI 
> card passed through. So if you have any with automatic memory dynamics 
> disabled, be careful you don't give it too much of your RAM resources. 16GB 
> is a good amount, but it can still quickly run you if you have the wrong 
> settings, or run unusual memory hungry and intensive programs.

Yes, this was in Dom0 term 

I tried lowering the mem usage per vm and it seem to take care of the problem 
but I rebooted and it was again not allowing any other vm's to start other Dom0 
mem shows 1092 mb sys-net shows 401 mb, sys-firewall 151 mb ( I lowered it) 
sys-whonix, 151 mb ( which I lowered it as well) which comes no where close to 
16 MEG
What's a good number to run the vm's at for mem min and max ? I'm just not sure 
whats taking up all the mem.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/fefa52c0-b6f8-463e-bdc0-7f473761eb47%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Re: VM:ERROR: insufficient memory

On Tuesday, September 5, 2017 at 12:06:28 PM UTC-4, Mark Eubanks wrote:
> Can someone explain why I can start the work VM but when I start the personal 
> I get the ERROR: insufficient mem .  Even though the memory settings are the 
> same 
> 
> 
> thanks

I have 16 gig of ram but if I do a free -m it only shows a total of 1058 
used 364 free 26 . I'm not doing anything on any of the VM's its pretty much a 
new install and I can't open the personal vm .Anyone have any ideas

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/8b657ef2-72ca-4ff1-aa43-e873596c27cd%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Re: VM:ERROR: insufficient memory

On Tuesday, September 5, 2017 at 12:06:28 PM UTC-4, Mark Eubanks wrote:
> Can someone explain why I can start the work VM but when I start the personal 
> I get the ERROR: insufficient mem .  Even though the memory settings are the 
> same 
> 
> 
> thanks

Ok.. you can ignore my newb Qubes questions 

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/1baa4759-ba27-4570-87d4-87b2cf22e513%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] VM:ERROR: insufficient memory

Can someone explain why I can start the work VM but when I start the personal I 
get the ERROR: insufficient mem .  Even though the memory settings are the same 


thanks 

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/fc84ef91-834f-4475-8753-f6fa8b63fab4%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Re: Connecting a usb nic and another laptop

Thanks for responding.  I'm sure its a firewall issue of some sorts.  it 
doesn't matter which nic I use, the onboard one or the usb I can ping from 
either to the private network outside the vmNETwork fine pinging the adaptors 
connected to the Dom0 doesn't get a reply.  It should be a routing issue that 
the link you sent might fix but the funny thing is that I have Qubes plugged 
into my modem switch and I can see it in the arp table , which you would think 
I could ping it

thanks for trying 


On Monday, September 4, 2017 at 12:37:03 PM UTC-4, cez...@gmail.com wrote:
> Den mandag den 4. september 2017 kl. 13.11.49 UTC skrev Mark Eubanks:
> > On Monday, September 4, 2017 at 8:15:29 AM UTC-4, Mark Eubanks wrote:
> > > I have created a NETVM and I have connect the usb nic to the vm and is 
> > > working. It shows up in Connection manager and I can give it a static IP 
> > > . So I've also connected a different physical laptop with a cross over 
> > > cable to the usb nic going to the NETVM. Both nics are on the same 
> > > network and I can ping from the NETVM to the physical but I don't get a 
> > > reply from the NETVM. I can see both in both arp tables . Any ideas why 
> > > the physical doesn't get a reply?
> > 
> > I agree it sounds like a firewall but I see that it shows allow imcp 
> > traffic. What I'm trying to do is make Qubes a passthrough firewall.. so I 
> > need 2 nics on the laptop
> 
> Apologies for late reply, had a short leave for work.
> 
> I'm not the most knowledgeable on this topic, especially the Qubes firewalls. 
> However I believe NetVM must have a default firewall too, to block 
> unauthorized requests, otherwise it would be quite simple and too easy to 
> attack the NetVM. 
> So it seems to me that the NetVM has a default firewall, (routor firewall 
> behavior like), blocking unauthorized incoming signals. 
> 
> To solve that (Assuming it is indeed the problem), I believe 
> https://www.qubes-os.org/doc/firewall/ might be quite helpful, down in the 
> port forwarding section. Here it seems you should be able to poke a hole for 
> your connection in the NetVM. 
> 
> You separated all this from your other networks right? As far as I know, it 
> should be secure enough if this has no internet connection, while on a 
> separate Qubes network.

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/c47fa9d2-fe87-4725-aaba-b27b44a15cc0%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Re: Connecting a usb nic and another laptop

On Monday, September 4, 2017 at 8:15:29 AM UTC-4, Mark Eubanks wrote:
> I have created a NETVM and I have connect the usb nic to the vm and is 
> working. It shows up in Connection manager and I can give it a static IP . So 
> I've also connected a different physical laptop with a cross over cable to 
> the usb nic going to the NETVM. Both nics are on the same network and I can 
> ping from the NETVM to the physical but I don't get a reply from the NETVM. I 
> can see both in both arp tables . Any ideas why the physical doesn't get a 
> reply?

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/38fdcc9e-1d2a-4aad-9820-719852b53558%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Re: Connecting a usb nic and another laptop

BUMP -- anyone know why the virtual can ping out but the outside can't ping in? 

On Monday, September 4, 2017 at 8:15:29 AM UTC-4, Mark Eubanks wrote:
> I have created a NETVM and I have connect the usb nic to the vm and is 
> working. It shows up in Connection manager and I can give it a static IP . So 
> I've also connected a different physical laptop with a cross over cable to 
> the usb nic going to the NETVM. Both nics are on the same network and I can 
> ping from the NETVM to the physical but I don't get a reply from the NETVM. I 
> can see both in both arp tables . Any ideas why the physical doesn't get a 
> reply?

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/c8b98635-d699-41e7-93d9-21a17d59109f%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Re: Connecting a usb nic and another laptop

On Monday, September 4, 2017 at 8:15:29 AM UTC-4, Mark Eubanks wrote:
> I have created a NETVM and I have connect the usb nic to the vm and is 
> working. It shows up in Connection manager and I can give it a static IP . So 
> I've also connected a different physical laptop with a cross over cable to 
> the usb nic going to the NETVM. Both nics are on the same network and I can 
> ping from the NETVM to the physical but I don't get a reply from the NETVM. I 
> can see both in both arp tables . Any ideas why the physical doesn't get a 
> reply?

I agree it sounds like a firewall but I see that it shows allow imcp traffic. 
What I'm trying to do is make Qubes a passthrough firewall.. so I need 2 nics 
on the laptop  

-- 
You received this message because you are subscribed to the Google Groups 
"qubes-users" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to qubes-users+unsubscr...@googlegroups.com.
To post to this group, send email to qubes-users@googlegroups.com.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/qubes-users/a311db6a-c22b-4af1-946e-f8a7c48da834%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[qubes-users] Connecting a usb nic and another laptop