[qubes-users] Re: qubes-devel Google Group Web Interface: Banned Content Warning

2017-08-29 Thread Andrew Morgan
On 08/29/2017 12:22 AM, Andrew Morgan wrote: > On 08/28/2017 10:27 PM, Reg Tiangha wrote: >> FYI, trying to view the qubes-devel Google Group on a web browser >> currently displays this message: >> >> Banned Content Warning >> The group that you are attempting to view (qubes-devel) has been >> iden

[qubes-users] Re: to firejail or not to firejail

2017-08-29 Thread pixel fairy
On Monday, August 28, 2017 at 10:46:22 PM UTC-7, Eric wrote: > The question as always is, what are you protecting? If it's your user data, > compartmentalize differently. If it's some kind of root privilege escalation, > that's a lost cause, as the vm sudo page explains. If it's some kind of > m

Re: [qubes-users] Re: to firejail or not to firejail

2017-08-29 Thread pixelfairy
just remembered, a couple other ssh exploits, and googled for them, found a couple others. so that does come up once in a while. On Tue, Aug 29, 2017 at 12:54 AM pixel fairy wrote: > On Monday, August 28, 2017 at 10:46:22 PM UTC-7, Eric wrote: > > The question as always is, what are you protecti

Re: [qubes-users] ubuntu template

2017-08-29 Thread kushaldas
On Wednesday, June 28, 2017 at 6:14:07 AM UTC+5:30, Unman wrote: > > I think you need to work on your search skills :-) > The same question was asked on this list 3 days ago. > The mount error arises because 'mount' isn't on the path - copy the > export PATH statement from template_debian/vars.sh

Re: [qubes-users] Options for securing /boot

2017-08-29 Thread cooloutac
On Monday, August 28, 2017 at 6:36:08 PM UTC-4, Leo Gaspard wrote: > Just encrypting /boot would bring little, as it would still be possible > to modify the unencrypted part of GRUB (that decrypts /boot) to have it > overwrite the /boot with malicious kernel images (or even to not use the > ones pr

[qubes-users] Re: Options for securing /boot

2017-08-29 Thread cyberian
I dont dual boot, as implied earlier. I have had suspicious activity happen before in Qubes3.2 at a certain location several times; errors from Xen saying that my machine is not returning all of its memory and while viewing Xen logs I have seen the creation of domains which I surely did not do

Re: [qubes-users] Options for securing /boot

2017-08-29 Thread cyberian
Leo Gaspard, I have read about AEM but have never used it, it seems like it is geared towards protecting from USB's with malicious firmware on them. Does AEM actually verify the integrity of /boot before using? This is what I am looking for, either a method of encrypting /boot or even better,

Re: [qubes-users] Options for securing /boot

2017-08-29 Thread Patrik Hagara
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On 08/29/2017 04:50 PM, cyberian@national.shitposting.agency wrote: > Leo Gaspard, > > I have read about AEM but have never used it, it seems like it is > geared towards protecting from USB's with malicious firmware on > them. > > Does AEM actually

Re: [qubes-users] Options for securing /boot

2017-08-29 Thread cyberian
Thank you for the detailed description, Patrik. That sounds like exactly what I am looking for. Much appreciated. -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email

[qubes-users] Re: Options for securing /boot

2017-08-29 Thread cooloutac
On Tuesday, August 29, 2017 at 10:47:14 AM UTC-4, cybe...@national.shitposting.agency wrote: > I dont dual boot, as implied earlier. I have had suspicious activity happen > before in Qubes3.2 at a certain location several times; errors from Xen > saying that my machine is not returning all of i

[qubes-users] Re: Options for securing /boot

2017-08-29 Thread cooloutac
On Tuesday, August 29, 2017 at 12:18:45 PM UTC-4, cooloutac wrote: > On Tuesday, August 29, 2017 at 10:47:14 AM UTC-4, > cybe...@national.shitposting.agency wrote: > > I dont dual boot, as implied earlier. I have had suspicious activity > > happen before in Qubes3.2 at a certain location several

Re: [qubes-users] Options for securing /boot

2017-08-29 Thread cooloutac
On Tuesday, August 29, 2017 at 11:38:59 AM UTC-4, Patrik Hagara wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA256 > > On 08/29/2017 04:50 PM, cyberian@national.shitposting.agency wrote: > > Leo Gaspard, > > > > I have read about AEM but have never used it, it seems like it is > > geared

Re: [qubes-users] Options for securing /boot

2017-08-29 Thread cooloutac
On Tuesday, August 29, 2017 at 12:25:51 PM UTC-4, cooloutac wrote: > On Tuesday, August 29, 2017 at 11:38:59 AM UTC-4, Patrik Hagara wrote: > > -BEGIN PGP SIGNED MESSAGE- > > Hash: SHA256 > > > > On 08/29/2017 04:50 PM, cyberian@national.shitposting.agency wrote: > > > Leo Gaspard, > > >

Re: [qubes-users] Options for securing /boot

2017-08-29 Thread Patrik Hagara
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On 08/29/2017 06:25 PM, cooloutac wrote: > On Tuesday, August 29, 2017 at 11:38:59 AM UTC-4, Patrik Hagara > wrote: On 08/29/2017 04:50 PM, cyberian@national.shitposting.agency > wrote: Leo Gaspard, I have read about AEM but have nev

Re: [qubes-users] Options for securing /boot

2017-08-29 Thread Leo Gaspard
On 08/29/2017 04:01 PM, cooloutac wrote: > On Monday, August 28, 2017 at 6:36:08 PM UTC-4, Leo Gaspard wrote: >> Just encrypting /boot would bring little, as it would still be possible >> to modify the unencrypted part of GRUB (that decrypts /boot) to have it >> overwrite the /boot with malicious k

Re: [qubes-users] Options for securing /boot

2017-08-29 Thread David Hobach
On 08/29/2017 06:32 PM, cooloutac wrote: On Tuesday, August 29, 2017 at 12:25:51 PM UTC-4, cooloutac wrote: On Tuesday, August 29, 2017 at 11:38:59 AM UTC-4, Patrik Hagara wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On 08/29/2017 04:50 PM, cyberian@national.shitposting.agency wrote:

Re: [qubes-users] Options for securing /boot

2017-08-29 Thread Patrik Hagara
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 On 08/29/2017 07:38 PM, David Hobach wrote: > On 08/29/2017 06:32 PM, cooloutac wrote: >> On Tuesday, August 29, 2017 at 12:25:51 PM UTC-4, cooloutac >> wrote: >>> On Tuesday, August 29, 2017 at 11:38:59 AM UTC-4, Patrik Hagara >>> wrote: -B

[qubes-users] Re: HOWTO: Compiling Kernels for dom0

2017-08-29 Thread Yethal
W dniu niedziela, 13 sierpnia 2017 14:17:33 UTC+2 użytkownik Epitre napisał: > Le dimanche 13 août 2017 09:41:53 UTC+2, Foppe de Haan a écrit : > > On Sunday, August 13, 2017 at 9:38:06 AM UTC+2, Epitre wrote: > > > Le dimanche 13 août 2017 09:19:25 UTC+2, Epitre a écrit : > > > > Le dimanche 13 ao

[qubes-users] Re: python3-dnf-plugins-qubes-hooks-3.2.18-1.fc23.x86_64: checksum doesn't match

2017-08-29 Thread Pete Howell
I switched to the new FC25 template and now get a checksum doesn't match on xen-libs-4.6.6-29.fc25.x86_64. Anyone have any ideas? On Wednesday, August 23, 2017 at 2:35:29 PM UTC-6, Pete Howell wrote: > Running a fresh install of Qubes-R3.2, and when doing an FC23 update, all the > packages down

[qubes-users] A worrisome threat?

2017-08-29 Thread Sandy Harris
Does Qubes block this? If not, should it? In either case, how? -- Forwarded message -- From: Henry Baker Date: Tue, Aug 29, 2017 at 7:51 AM Subject: Re: [Cryptography] How to find hidden/undocumented instructions To: cryptogra...@metzdowd.com FYI -- http://blog.ptsecurity.com/20

[qubes-users] Re: A worrisome threat?

2017-08-29 Thread Sandy Harris
As I probably should have known, Qubes developers are already well aware of this. See for example: https://blog.invisiblethings.org/papers/2015/x86_harmful.pdf -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and sto

[qubes-users] Re: Qubes 4.0rc1 - Resize HVM disk size

2017-08-29 Thread cyberian
Just wanted to bump this. How are HVM disks resized on Qubes 4.0rc1? -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qubes-users+unsubscr...@googlegroups.com. To

[qubes-users] qvm-block doesn't list dom0 loop devices

2017-08-29 Thread nicholas roveda
I'm using R4.0 rc1. I wanted to install a Linux distro inside a disk image located in dom0 home, using QEMU in an AppVM. I've created a new disk image in dom0, set it up (dos partition label and a primary ext4 partition) and attached with `kpartx` to loopX, but `qvm-block` doesn't list in the

[qubes-users] qvm-block doesn't list/expose dom0 loop devices

2017-08-29 Thread nicholas roveda
I'm using R4.0 rc1. I wanted to install a Linux distro inside a disk image located in dom0 home, using QEMU in an AppVM. I've created a new disk image in dom0, set it up (dos partition label and a primary ext4 partition) and attached it with `kpartx` to loopX, but `qvm-block` doesn't list it i

Re: [qubes-users] Options for securing /boot

2017-08-29 Thread Steve Coleman
If your laptop contains an active TPM and a TCG Opal 2.0 compliant SED (SSD or spinning platter) drive, then you can create a range, install the bootstrap/OS, and then mark that range as read-only. After doing that *nothing* will be able to write to that area without the password unlocking tha

[qubes-users] Re: Qubes 4.0rc1 - Resize HVM disk size

2017-08-29 Thread cyberian
Solved: Resizing disks is now done in GUI from the Qubes drop-down menu in dom0 under [MyHVM] > VM Settings -- You received this message because you are subscribed to the Google Groups "qubes-users" group. To unsubscribe from this group and stop receiving emails from it, send an email to qube

[qubes-users] Qubes 4.0rc1 Bug: adding programs to the VM's quickstart menu not functioning

2017-08-29 Thread cyberian
[MyHVM] > VM Settings > Applications no longer will add selected applications to the dom0 VM drop down menu in Qubes 4.0 Expected: going into VM preferences and choosing programs to appear in the Qubes drop down menu for selected VM should cause the applications to be added to the quickstart t

Re: [qubes-users] Re: A worrisome threat? Kinda...

2017-08-29 Thread Alex
On 08/29/2017 11:02 PM, Sandy Harris wrote: > As I probably should have known, Qubes developers are already well > aware of this. See for example: > https://blog.invisiblethings.org/papers/2015/x86_harmful.pdf Exactly. To give a little more context: * Intel ME is a totally independent, totally op