Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tails is a portable OS that protects against surveillance and censorship

tails.net

Post reply on HN
Print view View original

151–160 of 192 posts

Re: Tails is a portable OS that protects against surveillance and censorship

#151

Post by brightlancer »

Synaesthesia wrote: post #14
jacknews wrote: post #10

I might be wrong but I think this was a project originated by one of the branches of the US armed forces or security services? In which case, it should be pretty secure. Although, there's the obvious 'honeypot' concern. But maybe I'm thinking of another distro, that ran from RAM and didn't write anything to disk.

I know the TOR project was started by the US navy, and that now I2Pnis the preferred method of browsing the darknet, because many people believe it has been compromised.

The TOR software is likely no more compromised than GNU/Linux generally -- the TOR _network_ is likely compromised by flooding it with honeypot servers that can track users by monitoring origins and destinations.

Re: Tails is a portable OS that protects against surveillance and censorship

#152

Post by macinjosh »

codethief wrote: post #148
omani wrote: post #52

Earlier quoted context omitted.

Same here. Dont understand why not more ppl switched to alpine on the desktop. It is my daily driver. Plus LXD for stuff I must do (typically spawn ubuntu, etc.) my whole PDE (Personal Developer Environment) is within a container. Need python? Shell into (via dmenu) python container. All with complete neovim setup. Need a GUI? No problem. Spawn a container. My lxd profile is set up for this. Use chezmoi for heavy aut…

Do you have a separate neovim instance (config and all) in every container? Or a single neovim instance on the host which can access all container volumes? What about shell instances?

I containerized my neovim setup and I share my projects/ directory with it. Containers get a shared volume like projects/project/.

From my neomvim container I can use the local terminal or I can ssh to the host to run my other containers.

Re: Tails is a portable OS that protects against surveillance and censorship

#153

Post by coppsilgold »

bsdnoob wrote: post #55
omani wrote: post #52

Earlier quoted context omitted.

Same here. Dont understand why not more ppl switched to alpine on the desktop. It is my daily driver. Plus LXD for stuff I must do (typically spawn ubuntu, etc.) my whole PDE (Personal Developer Environment) is within a container. Need python? Shell into (via dmenu) python container. All with complete neovim setup. Need a GUI? No problem. Spawn a container. My lxd profile is set up for this. Use chezmoi for heavy aut…

By any chance can you share how you do this practically?

I also use alpine as the main/root environment. But I rarely use any applications from alpine. For that I have Arch, Fedora and Debian rootfs dirs into which I pivot_root with the help of bubblewrap (bwrap) in shell scripts. There is no overhead and the GPU can be easily attached. You can also dynamically attach ro/rw CWD and target paths (`for arg in "$@"`).

Everything that I care about just works and I get a separation of concerns. Use of network namespaces allows further flexibility. For example, I have a netns that is forced through a Tor gateway such that any traffic originating in it can only go through Tor.

This type of setup is not hardened against kernel vulnerabilities, the kernel treats applications running in namespaces as if they are isolated from other namespaces but those applications can still interact with broad surfaces of the kernel and therefore potentially exploit it.

For kernel safety applications must be denied direct access to the host kernel, this is usually achieved with virtual machines.

Re: Tails is a portable OS that protects against surveillance and censorship

#154

Post by fluidcruft »

criddell wrote: post #144
fluidcruft wrote: post #26

Earlier quoted context omitted.

It's a Tor client. Bypassing censorship is one of Tor's design goals.

Is there anything Tails does to actively bypass censorship, or is it simply a result of the increased anonymity? To me, it seems like it can only have limited utility in this regard. For example, Tails (and Tor) isn't going to help you avoid private sector censorship on services like X or Facebook or YouTube, right? It won't help you get a book published or reach an audience with a video.

I'm not really sure what you understand the word "bypass" to mean here?

Tor/Tails can certainly help someone who is experiencing censorship to publish a book or distribute a video in a different region where that censorship does not exist. That bypasses the censorship. For example someone experiencing censorship could contact a publisher or distributor in a different location and transmit the book or video to them.

If censorship exists on Twitter, publishing items to Twitter isn't bypassing Twitter's censorship. You may be bypassing automated censorship or some mechanism but Twitter would still be censored.

The same goes for books. There's no tool that is going to keep a book on the shelves of a library that wants to burn the book. Bypassing the library's censorship means getting the book to readers despite the library's censorship.

Re: Tails is a portable OS that protects against surveillance and censorship

#155

Post by MetaWhirledPeas »

l0new0lf-G wrote: post #133

I know it sounds weird, but unless you reviewed the source code AND built the binary from it, no open source software is to be trusted. The versions ready for download may be based on code slightly different than the one in the repo -either deliberetely, or because the NSA managed to redirect the download link to its' servers. There is always a probability that an anonymity product will be proved to be a honeypot. Ev…

> I know it sounds weird, but unless you reviewed the source code AND built the binary from it, no open source software is to be trusted.

That's probably true, but if you want to be really paranoid you'd also want to be sure to compile it with a machine, operating system, and compiler that they are unlikely to have tampered with. Maybe something really old or esoteric or both?

Re: Tails is a portable OS that protects against surveillance and censorship

#156

Post by matrix12 »

fullstick wrote: post #71
londons_explore wrote: post #54

There have been quite a few exploits in tails. I suspect you're better off with a more obscure project, because then your adversary is less likely to have a 'ready to go' exploit.

Wouldn't that be security through obscurity? Which is bad security and a good way to be exploited. I thought that having more eyes on a system made it more secure because people find the exploits.

Security through minority actually.

Re: Tails is a portable OS that protects against surveillance and censorship

#157

Post by aqfamnzc »

fullstick wrote: post #71
londons_explore wrote: post #54

There have been quite a few exploits in tails. I suspect you're better off with a more obscure project, because then your adversary is less likely to have a 'ready to go' exploit.

Wouldn't that be security through obscurity? Which is bad security and a good way to be exploited. I thought that having more eyes on a system made it more secure because people find the exploits.

As always, depends on the threat model.

Re: Tails is a portable OS that protects against surveillance and censorship

#158

Post by wrs »

chickenpotpie wrote: post #74
wrs wrote: post #44

Earlier quoted context omitted.

Not sure what you’re saying there…the Internet grew out of ARPANet, it’s not a separate thing. Is the oak tree “inspired” by the acorn?

I think that's an incorrect oversimplification. The Internet didn't grow from ARPANET like a seed grows into a tree. ARPANET didn't become bigger and bigger until it became the Internet. The Internet was the merger of many networks and many of them never communicated with any computer in ARPANET and we're developed with absolutely zero funding from the United States government.

I guess it’s a matter of interpretation. Of course every computer connected to the internet is not government-funded. But in this context we’re talking about the origin of the technology and protocols that allowed the network to exist at all. By the time the internet got bigger than ARPANet, CSNET, and NSFNET (all government funded), the protocols were pretty much settled, and that’s what everyone else’s network used to become part of the internet. If the government hadn’t gotten it to that point, there would be no internet.

Re: Tails is a portable OS that protects against surveillance and censorship

#159

Post by [deleted] »

dmwilcox wrote: post #30

Love Tails, but I haven't used it in ten years. I have had Tails and Qubes disposable VMs on my mind though. I switched off of Qubes last year to my own Alpine chroot with a hand crafted kernel and initrd that lives only in memory. I find turning off the computer when I'm finished and having it forget everything to be a very peaceful way to compute. I owe the internet a write up. I feel like ramfs for root filesystem…

[deleted]

Re: Tails is a portable OS that protects against surveillance and censorship

#160

Post by tlavoie »

justin_oaks wrote: post #37
dmwilcox wrote: post #30

Love Tails, but I haven't used it in ten years. I have had Tails and Qubes disposable VMs on my mind though. I switched off of Qubes last year to my own Alpine chroot with a hand crafted kernel and initrd that lives only in memory. I find turning off the computer when I'm finished and having it forget everything to be a very peaceful way to compute. I owe the internet a write up. I feel like ramfs for root filesystem…

> I owe the internet a write up. I would definitely be interested in reading more about this. I love the idea of being able to prevent an application from writing all over my disk to random places. If I can't prevent it, I can at least remedy it by having all those changes go away with a reboot. One of the things I love about Docker containers is that they can be ephemeral or persistent, short or long term, have full…

Ages ago, I tried out Puppy Linux, that ran from a burned CD. If I made updates, it wrote another filesystem extent to the disc, and I think the loading process just used those to over-write files as needed until the boot completed.

I was thinking of it for a home firewall at the time, but in any case, it made for a very ephemeral system.

Post reply on HN