Whonix ™ Project Activities[edit]

Innovation[edit]

Table: Whonix ™ Innovation

Category	Description
Anonymity	Thinking hard about obscure attacks on anonymity such as clock correlation deanonymization attacks and developing countermeasures; see TimeSync. Adding support for multiple anonymity networks to cater to different user bases.
Invent mechanisms for rapid Debian packaging	genmkfile ^[archive] - easy and turbo packaging of scripts and configuration files. Demonstrating how to write hassle free man pages. For example, the following methodology is used for all related Whonix ™ packages. Written in markdown. Just three lines of packaging is required. https://github.com/Whonix/tor-ctrl/blob/master/man/tor-ctrl.8.ronn ^[archive] https://github.com/Whonix/tor-ctrl/blob/a12d73ed01068baf32db067811c208034ced87fd/debian/control#L9 ^[archive] https://github.com/Whonix/tor-ctrl/blob/1c326b232b1f328a6542ae51f3f3afa3e1e44a55/debian/rules#L17-L18 ^[archive]
Holistic focus	Focusing on the anonymity and privacy field, without getting into unimportant details. Understanding issues regular users are experiencing and creating a better user experience.
Develop concepts	Emergency Security News Notification Permanent Takedown Attack Defender, proposal to defend against a permanent takedown threat apt-revoker Check for Revocation Certificates before running `apt-get` Package manager update security on/off switch ^[archive] And much more.
Miscellaneous	Maintaining a general interest in security matters, scrutinizing solutions, and connecting people. ^[1]

Cooperation[edit]

Table: Whonix ™ Cooperation

Category	Description
Issue/bug reports	Reporting issues or bugs at other projects, such as: Qubes ^[archive] VirtualBox ^[archive]
The Tor Project	Successfully communicate issues in the Tor ecosystem and do so whenever we find something. Some suggestions have been implemented and others accepted: https://trac.torproject.org/projects/tor/query?reporter=proper&col=id&col=summary&col=status&col=type&col=priority&col=milestone&col=component&order=priority ^[archive] https://trac.torproject.org/projects/tor/query?reporter=adrelanos&col=id&col=summary&col=type&col=status&col=priority&col=milestone&col=component&order=priority ^[archive] Reporting any security/privacy/anonymity issues discovered, including some which could lead to deanonymization. Please press on expand on the right for a list of references. do something about TLS HELLO gmt_unix_time ^[archive] get independent from host clock time / insecure NTP ^[archive] use Valid-Until field to prevent downgrade attacks for deb.torproject.org ^[archive] use sha256 or sha512 instead of sha1 for deb.torproject.org ^[archive] deactivate Check for new messages on startup ^[archive] deactive submit performance data ^[archive] deactivate Check for new messages every 10 minutes ^[archive] enable connection security by default ^[archive] Remove "This Plugin is Disabled" click-through ^[archive] set plugin.expose_full_path to false ^[archive] Adapt Tor installer to allow users to avoid connecting to the public tor network ^[archive] Add warning related to Identity correlation through circuit sharing ^[archive] spoof history.length - browser.sessionhistory.max_entries ^[archive] Linux TCP Initial Sequence Numbers may aid correlation ^[archive]
Other collaborative efforts/contributions	kloak ^[archive] - Keystroke Anonymization Tool ^[2] https://secure-os.org/pipermail/desktops/ ^[archive] zuluCrypt ^[3]
Developer community	Coordination of an active developer community, see: Whonix ™ contributors. Whonix ™ contributions: founder adrelanos ^[archive] developer troubadour ^[archive] developer madaidan ^[archive] former developer 0brand ^[archive] developer HulaHoop ^[archive] developer Jason Ayala ^[archive] developer Algernon ^[archive] developer Sirus Shahini ^[archive] incomplete list
Miscellaneous	Flexible packaging to allow cherry-picking of functionality by privacy and non-privacy distributions alike: https://github.com/Whonix/anon-meta-packages/blob/master/debian/control ^[archive] Providing all Whonix ™ improvements to Debian as reusable (by others) packages split by functionality: https://github.com/Whonix ^[archive] Use many packages developed by Whonix ™ with Debian too. Timely review and merging of contributions.

Mentoring[edit]

Education[edit]

Whonix ™ undertakes a broad range of educational activities, including:

Extensive Documentation covering technical aspects and operational security.
- Security and anonymity matters are documented in detail, including unique material not covered elsewhere. ^[4]
- Technical documentation is also provided, for example: Configuration Files.
Whonix ™ answers are seldom disputed; for example see answers by Patrick Schleizer ^[archive] on Tor Stack Exchange ^[archive].
Operating a responsive forum ^[archive], providing user support for the community.
Debian derivative development documentation, for example: About Debian Packaging

Maintenance[edit]

Whonix ™ maintenance activities are wide in scope and include:

Following developments in anonymity, security and privacy and formulating solutions. For example this apt bug ^[archive] led to the posting of a news item ^[archive] and instructions to safely resolve the matter.
Maintaining various components.
Ongoing development:
- Refer to this subset list of Whonix ™ git commits ^[archive]; and
- ~ 85 Whonix ™ source code repositories ^[archive].
Keeping the whonix.org server safe and up-to-date with various webapps (website, wiki, forums and issue tracker).
Testing new packages.
Calling for testers, then reviewing and processing feedback from testers.
Creating downloadable Whonix ™ builds.
Keeping the community informed about recent developments at Whonix ^[archive].
Porting to the next stable version of Debian. ^[5]