/pol/ - Politically Incorrect

its great if you are a dealer but works too slow for ordinary daily use

Freedom and privacy is what human means.

>>13651952

>its great if you are a dealer but works too slow for ordinary daily use

Fake news. Been daily driving it for years. It helps to have something newer than a 15 year old EFI-reflashed stinkpad.

Here's a couple nickels kid, buy yourself a system with at least 128GB RAM.

WARNING WARNING WARNING

Google sits on the peering interconnections between most ISPs and data centers, at minimum collecting netflow data.

YOU NEED SOMETHING LIKE MULLVAD DAITA, OR ANY OTHER MAYBENOT OBFUSCATION SYSTEM!

It needs to be installed onto a small dedicated device, ideally with two ethernet RJ-45 ports (though one could be used, with advanced router firmware like OpenWRT doing VLANing). Without DAITA or maybenot, Google sees your traffic hops nearly transparently. Tor has circuit padding, but plain VPN users (even multihop) are exposed without this on their WAN uplink.

>>13651951

>FEDora

>soystemd

has anyone forked it yet? also what happened to headsOS, why did development stop

>>13652247

>fingerprinting will stop if I use linux

>>13652250

If you use openrc instead of systemd what are they gonna do? Gentoo is a source-based distro. You can install it on a MilkV SBC and bypass the vendor level systemd checks.

>>13651951

I use debian. Im noob though.

>>13652247

Qubes needs to be rebased onto Gentoo.

Qubetoo GNU/Linux.

>>13651951

whatever happened to headsOS? did the dev get killed by glowniggers for not having systemd on the project? seems weird how there's no fork of tailsOS that uses a systemd-free init

>>13652475

based

There was a Qubes thread on >>>4/g/ recently. It disgusted me how quick a glownigger hopped in and began a concern-troll campaign, gaslighting OP that he must be schizophrenic to want to use Qubes OS. Be safe out there, frens; they're trying to psyop you into avoiding good tools. AI-assisted security penetration is already growing at a quickening pace, Qubes OS is a prudent choice for your everything-but-gaming daily needs.

Anyone needing a Windows TemplateVM is implored to choose Windows Server Evaluation, which you will then convert to full Datacenter edition with the dism command, then use the massgrave KMS activator; follow the Qubes OS project's instructions for installing Qubes Windows Tools into the TemplateVM; open wf.msc and delete inbound and outbound all rules; open gpedit.msc and delete all inbound and outbound rules, set inbound and outbound to Block [All] for Domain, Public, and Private profiles in the Windows Firewall properties (in gpedit.msc), and while setting Block [All] settings be sure to click Customize right next to "Specify settings that control Windows Defender Firewall Behavior" and make sure both Rule Merging settings are set to No (SO STRONGLY IMPLORED, IT'S ALMOST A REQUIREMENT HERE!), then add the tab-separated rules I will paste below and make sure they are DISABLED; Enable "Turn Off KMS Client Online AVS Validation" under Administrative Templates in gpedit.msc.

Firewall rules (Tab Separated Values):

Name	Group	Profile	Enabled	Action	Override	Program	Local Address	Remote Address	Protocol	Local Port	Remote Port	Authorized Computers	Authorized Local Principals	Local User Owner	PolicyAppId	Application Package	
Core Networking [custom] - DNS (UDP-Out) (RESTRICTIVE)		All	Yes	Allow	No	%systemroot%system32svchost.exe	Any	10.139.1.1-10.139.1.2	UDP	Any	53	Any	Any	Any	None	Any	
Core Networking - Dynamic Host Configuration Protocol (DHCP-Out)	Core Networking	All	No	Allow	No	%SystemRoot%system32svchost.exe	Any	Any	UDP	68	67	Any	Any	Any	None	Any	
Core Networking Diagnostics - ICMP Echo Request (ICMPv4-Out)	Core Networking Diagnostics	All	No	Allow	No	System	Any	Any	ICMPv4	Any	Any	Any	Any	Any	None	Any	
Ping ICMPv4 +Administrator		All	No	Allow	No	c:windowssystem32ping.EXE	Any	Any	ICMPv4	Any	Any	Any	COMPUTERNAMEAdministrator	Any	None	Any	
PowerShell ALL TCP +Administrator		All	No	Allow	No	%SystemRoot%system32WindowsPowerShellv1.0powershell.exe	Any	Any	TCP	Any	Any	Any	COMPUTERNAMEAdministrator	Any	None	Any	
PowerShell ALL TCP +User		All	No	Allow	No	%SystemRoot%system32WindowsPowerShellv1.0powershell.exe	Any	Any	TCP	Any	Any	Any	COMPUTERNAMEUser	Any	None	Any	
PowerShell ALL UDP +User		All	No	Allow	No	%SystemRoot%system32WindowsPowerShellv1.0powershell.exe	Any	Any	UDP	Any	Any	Any	COMPUTERNAMEUser	Any	None	Any	
PowerShell UDP +Administrator		All	No	Allow	No	%SystemRoot%system32WindowsPowerShellv1.0powershell.exe	Any	Any	UDP	Any	Any	Any	COMPUTERNAMEAdministrator	Any	None	Any	
Self ALL TCP +ALL		All	No	Allow	No	Any	127.0.0.0/8	127.0.0.0/8	TCP	Any	Any	Any	Any	Any	None	Any	
Self ALL UDP +ALL		All	No	Allow	No	Any	127.0.0.0/8	127.0.0.0/8	UDP	Any	Any	Any	Any	Any	None	Any	
SVCHOST 80+443 TCP		All	No	Allow	No	c:windowssystem32svchost.exe	Any	Any	TCP	Any	80, 443	Any	Any	Any	None	Any	
SVCHOST 80+443 UDP		All	No	Allow	No	c:windowssystem32svchost.exe	Any	Any	UDP	Any	80, 443	Any	Any	Any	None	Any	
SVCHOST ALL ALL		All	No	Allow	No	c:windowssystem32svchost.exe	Any	Any	Any	Any	Any	Any	Any	Any	None	Any	

>>13652695

You will also most likely need the following Powershell script in the TemplateVM, set in taskschd.msc to execute every 60 seconds from startup, in order to ensure your AppVMs based on the template configure proper network settings:

$newipAddress = (c:windowssystem32qubesdb-cmd.exe -c read /qubes-ip).Trim()
$newgateway = (c:windowssystem32qubesdb-cmd.exe -c read /qubes-gateway).Trim()
$newdns1 = (c:windowssystem32qubesdb-cmd.exe -c read /qubes-primary-dns).Trim()
$newdns2 = (c:windowssystem32qubesdb-cmd.exe -c read /qubes-secondary-dns).Trim()
$newdnsServers = @($newdns1, $newdns2)
$macAddress = (c:windowssystem32qubesdb-cmd.exe -c read /qubes-mac).Trim()
$macAddressDash = $macAddress.Replace(":", "-")
# Check if an adapter with the specified MAC address exists
$adapter = Get-WmiObject -Class Win32_NetworkAdapter | Where-Object { $_.MACAddress -eq $macAddress }
$config = Get-WmiObject -Class Win32_NetworkAdapterConfiguration | Where-Object { $_.MACAddress -eq $macAddress }
Write-Host "Check for adapter."
if ($adapter) {
    # Get current IP configuration
    $currentipAddresses = (Get-NetIPAddress -InterfaceIndex $adapter.InterfaceIndex).IPAddress
    # Get current gateway configuration
    $currentgateways = $config.DefaultIPGateway
    # Get current DNS configuration
    $currentdnsServers = (Get-DnsClientServerAddress -InterfaceIndex $adapter.InterfaceIndex).ServerAddresses
    if ($newipAddress -ne $currentipAddresses -or $newgateway -ne $currentgateways) {
        Write-Host "Address mismatch found."
        Disable-NetAdapterBinding -Name $adapter.NetConnectionID -ComponentID ms_tcpip6
        Set-NetIPInterface -InterfaceIndex $adapter.InterfaceIndex -Dhcp Disabled
        # Remove existing IP addresses
        foreach ($ip in $currentipAddresses) {
            Remove-NetIPAddress -InterfaceIndex $adapter.InterfaceIndex -IPAddress $ip -Confirm:$false
        }
        # Set the IP address and subnet mask using WMI methods
        $config.EnableStatic($newipAddress, "255.255.255.0")
        # Set the default gateway using WMI methods
        $config.SetGateways($newgateway)
    }
    Write-Host "Setting DNS servers."
    # Set the DNS servers using WMI methods
    $config.SetDNSServerSearchOrder($newdnsServers)
}
# Exit cleanly
Write-Host "Script execution completed."

>>13652696

Ultimately, the idea with this whole setup above is to ensure Windows has no network access by default when it comes up in an AppVM that does have network, because Windows Firewall is fascistly blocking everything. Any internet-using application you install into the TemplateVM must also have a corresponding default-disabled rule added in gpedit.msc that would give it outbound access to the internet, and when you start an AppVM you need to launch gpedit.msc, navigate to the outbound Firewall rules, and specifically enable DNS (line 1 in my rules list above) and whatever application rules you intend to immediately use. The only internet connected application I use is TradeStation, otherwise I have a second Windows TemplateVM I use for applications (CS6, Maya, SolidWorks, Maxwell Render, Wolfram Mathematica, and more) that sees no internet whatsoever, even from the Qubes OS netvm configuration perspective.

Follow standard Qubes guidelines for TemplateVMs, in DO NOT HAVE THEM CONNECTED TO THE INTERNET; there is one exception: the rare times you want to run Windows Updates. You will connect the TemplateVM using `qvm-prefs TEMPLATENAME netvm FIREWALLNAME`, then enable the DNS and SVCHOST rules, then run your updates, then disable the rules (do not forget this, or your AppVMs come up with those rules enabled), and then do `qvm-prefs TEMPLATENAME netvm none` to disconnect the TemplateVM. The only telemetry the update system could give is the state of the TemplateVM (installed applications, settings, etc), but *not* anything in your AppVMs unless you fucked up on the firewall settings (or Windows one day just disregards its own firewall). I have an idea for using a separate clean TemplateVM that would run WSUS configured to keep its data files on Q:, so that a combination of AppVM+disposable_template use (to get updates) and DispVM use (to apply updates to other Windows TemplateVMs, in a ratchet-way that would prevent any possible downstream telemetry being exfiltrated through WSUS, but is beyond the scope of this post.

Sorry I took forever to begin posting instructions for building a similar Qubes system to mine. I wanted to get the Windows TemplateVM post out of the way here first so the Windows-reliant can migrate away from native Windows and onto a safer environment.

>>13652695

Fucking masonmoot fix your goddamn site, your [code] blocks are treating backslashes as escape sequences!

>>13652696

God damn I'm going to need to repaste everything like an idiot…

$newipAddress = (c:\windows\system32\qubesdb-cmd.exe -c read /qubes-ip).Trim()
$newgateway = (c:\windows\system32\qubesdb-cmd.exe -c read /qubes-gateway).Trim()
$newdns1 = (c:\windows\system32\qubesdb-cmd.exe -c read /qubes-primary-dns).Trim()
$newdns2 = (c:\windows\system32\qubesdb-cmd.exe -c read /qubes-secondary-dns).Trim()
$newdnsServers = @($newdns1, $newdns2)
$macAddress = (c:\windows\system32\qubesdb-cmd.exe -c read /qubes-mac).Trim()
$macAddressDash = $macAddress.Replace(":", "-")
# Check if an adapter with the specified MAC address exists
$adapter = Get-WmiObject -Class Win32_NetworkAdapter | Where-Object { $_.MACAddress -eq $macAddress }
$config = Get-WmiObject -Class Win32_NetworkAdapterConfiguration | Where-Object { $_.MACAddress -eq $macAddress }
Write-Host "Check for adapter."
if ($adapter) {
    # Get current IP configuration
    $currentipAddresses = (Get-NetIPAddress -InterfaceIndex $adapter.InterfaceIndex).IPAddress
    # Get current gateway configuration
    $currentgateways = $config.DefaultIPGateway
    # Get current DNS configuration
    $currentdnsServers = (Get-DnsClientServerAddress -InterfaceIndex $adapter.InterfaceIndex).ServerAddresses
    if ($newipAddress -ne $currentipAddresses -or $newgateway -ne $currentgateways) {
        Write-Host "Address mismatch found."
        Disable-NetAdapterBinding -Name $adapter.NetConnectionID -ComponentID ms_tcpip6
        Set-NetIPInterface -InterfaceIndex $adapter.InterfaceIndex -Dhcp Disabled
        # Remove existing IP addresses
        foreach ($ip in $currentipAddresses) {
            Remove-NetIPAddress -InterfaceIndex $adapter.InterfaceIndex -IPAddress $ip -Confirm:$false
        }
        # Set the IP address and subnet mask using WMI methods
        $config.EnableStatic($newipAddress, "255.255.255.0")
        # Set the default gateway using WMI methods
        $config.SetGateways($newgateway)
    }
    Write-Host "Setting DNS servers."
    # Set the DNS servers using WMI methods
    $config.SetDNSServerSearchOrder($newdnsServers)
}
# Exit cleanly
Write-Host "Script execution completed."

>>13652695

Name	Group	Profile	Enabled	Action	Override	Program	Local Address	Remote Address	Protocol	Local Port	Remote Port	Authorized Computers	Authorized Local Principals	Local User Owner	PolicyAppId	Application Package	
Core Networking [custom] - DNS (UDP-Out) (RESTRICTIVE)		All	Yes	Allow	No	%systemroot%\system32\svchost.exe	Any	10.139.1.1-10.139.1.2	UDP	Any	53	Any	Any	Any	None	Any	
Core Networking - Dynamic Host Configuration Protocol (DHCP-Out)	Core Networking	All	No	Allow	No	%SystemRoot%\system32\svchost.exe	Any	Any	UDP	68	67	Any	Any	Any	None	Any	
Core Networking Diagnostics - ICMP Echo Request (ICMPv4-Out)	Core Networking Diagnostics	All	No	Allow	No	System	Any	Any	ICMPv4	Any	Any	Any	Any	Any	None	Any	
Ping ICMPv4 +Administrator		All	No	Allow	No	c:\windows\system32\ping.EXE	Any	Any	ICMPv4	Any	Any	Any	COMPUTERNAME\Administrator	Any	None	Any	
PowerShell ALL TCP +Administrator		All	No	Allow	No	%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe	Any	Any	TCP	Any	Any	Any	COMPUTERNAME\Administrator	Any	None	Any	
PowerShell ALL TCP +User		All	No	Allow	No	%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe	Any	Any	TCP	Any	Any	Any	COMPUTERNAME\User	Any	None	Any	
PowerShell ALL UDP +User		All	No	Allow	No	%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe	Any	Any	UDP	Any	Any	Any	COMPUTERNAME\User	Any	None	Any	
PowerShell UDP +Administrator		All	No	Allow	No	%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe	Any	Any	UDP	Any	Any	Any	COMPUTERNAME\Administrator	Any	None	Any	
Self ALL TCP +ALL		All	No	Allow	No	Any	127.0.0.0/8	127.0.0.0/8	TCP	Any	Any	Any	Any	Any	None	Any	
Self ALL UDP +ALL		All	No	Allow	No	Any	127.0.0.0/8	127.0.0.0/8	UDP	Any	Any	Any	Any	Any	None	Any	
SVCHOST 80+443 TCP		All	No	Allow	No	c:\windows\system32\svchost.exe	Any	Any	TCP	Any	80, 443	Any	Any	Any	None	Any	
SVCHOST 80+443 UDP		All	No	Allow	No	c:\windows\system32\svchost.exe	Any	Any	UDP	Any	80, 443	Any	Any	Any	None	Any	
SVCHOST ALL ALL		All	No	Allow	No	c:\windows\system32\svchost.exe	Any	Any	Any	Any	Any	Any	Any	Any	None	Any	

I evangelize Qubes OS as much as I can on 4cuck, using Leto's owo dot vg domain (-ecker) so I can post anonymously over Tor.

If you don't know about owo and are just finding out, you really need to use Tor browser and treat it like a functional honeypot; functional in the sense that it does as advertised (evades bans, permits VPN & Tor use) but also as a sticky trap (/cumg/ lives on its own boards, avoid these at all costs). Never ever visit Leto's domains with a clearnet browser, and I strongly encourage use of Qubes OS to guard against potential browser exploits. Leto was full name doxed by Kiwifarms, he has a jewish name, and days before Operation Epstein's Fury he closed the gate on free posting (until reopening again recently). Treat as an 8200 honeypot, use extreme caution!

Gather around lads, and I will tell you about a whole new level of paranoia.

>There are no secure mobile phones.

>There are no secure Windows computers.

>There are no secure Apple computers.

>There are no secure Andriod computers.

I say these things not from anger or ideology but from my experience.

The world is full of ignorant people who think that if they have a 10 character password that contains a couple of special characters then nobody can get into their computer. Such people are severely mistaken.

Most people know what a "software backdoor" is. Now let me introduce you to the concept of an "exploit". An "exploit" is a software bug that functions like a "backdoor". An attacker can connect to your machine and then take advantage of the "exploit" to backdoor your machine.

There is a narcissistic halfwit in Finnland named Linus Torvalds. Like the other charismatic midwits of our era like Steve Jobs, Linus has assembled a collection of midwit retards around himself who think that he is a "genius" for his "accomplishment" of writing a piece of software that is replete with kernel exploits. Only a "genius" could do such a thing.

This is what you need to do if you want security:

> Build your own computer from individual parts.

> Download QubesOS and confirm that that the file is signed correctly.

> Install QubesOS then reconfigure grub2 so that during boot-time a script copies dom0 to ram and then runs dom0 from memory. This way, if someone gets into your machine, whatever they do is erased when you reboot the machine.

> Configure your qubes so that most programs run in an offline-qube that never has access to the internet. Limit internet access to a fully volatile whonix-workstation-qube. In the whonix-workstation-qube the only program you should run is the tor-browser.

> Create a fully volatile sys-router qube. instead of using a router, connect your motherboard to wan. Direct your internet traffic through a fully-volatile sys-router qube with an IPS that updates on boot.

>>13658013

Once you have done this, the psycho bitches who are stalking you will start doing other things.

Imagine that there is a website you visit each week called supermarket.com. They will then learn that this website doesn't allow tor-browser logins. They will then hack into supermarket.com and install a service that alerts them to the fact that you just logged into supermarket.com which sends them your IP adress. Now they have deanonymised you. They have taken away the whonix-level of security.

They'll set up hidden cameras that watch you leaving your house and then, as you drive down the street, they will call people down the street, people who are lousy at acting, people who will lazily pretend to be on phone calls and then put the camera to their ears and slowly rotate their heads as you drive past so that their cameras point towards you as you are passing by.

They'll also set up hidden cameras around your house. Whenever you leave your house you are on candid-camera. There is one camera watching your front door and a second camera watching your back door. There is a third camera at the end of the road. There are at least two cameras to record you as you walk to the bus-stop. And so on. Etcetera.

They'll also hack into the security cameras at bus stops you go to. Modern day buses connect to the internet. They will hack into whatever bus you are on and stare at you through the cameras on your way to work.

Zero of the women doing this care about the psychological impact this has on the men that they are torturing.

>inb4 muh

Rest assured anon. There will be no future posts in which I attempt to explain my experience and my feelings to women. That was the final one.

>>13658015

Or maybe I should say that that was the second-to-final one.

Once they've done all of that, they'll start hacking into your next-door neighbour's mobile phones and smart devices and then listen to you through the windows at night.

Plus they'll hack into the mobile phones and computers of anybody that you have contact with during the day.

Every time that you go outside you are under constant surveillance. First the cameras will watch you leave your house, then the cameras will wtach you walk to the bus, then the cameras on the bus will watch you look out the window, then you get to use a bugged laptop at work …

You will have zero privacy for years. Literally years.

Then, after womenkind has done all these things, they'll cynically whinge about some feminist concept called "consent". As if they actually cared about such a concept.

FYI "Justice" is something that only stupid people believe in. If you want to know the truth, here is is: "Justice" is a privilege of wealth. If you are wealthy and can afford to hire a team of lawyers, and someone wrongs you, you can get your team of lawyers to go after that person. Then you get to enjoy justice. Ordinary people have that privilege.

>>13658016

> Ordinary people have that privilege.

typo. obviously i meant

> Ordinary people don't have that privilege.

Let me tell you the story of the panopticon.

A prison was built that consisted of a huge tower where the guards lived a and watched over the cells, which were arranged in a circle around the tower all of them facing the tower.

This allowed the guards to see into every cell at all times, there was never a time when the prisoners were being observed. At least that was the intention.

Practically speaking, there were very few guards to prisoners, and while a major feature of the panopticon was that no prisoner would ever be able to tell where the guards were looking, it wasn't long before they started running the numbers in their minds.

Not of what the guards could see, of what the guards could have their focus be applied to at any moment. If they could see everything, all at once, then they would need to know where to put their attention, while being bombarded with so much information at once from all the prisoners that any one prisoners activities just sort of blended into the background.

and that meant that so long as the prisoners weren't doing anything too blatantly attention grabbing, they were likely not being kept track of in their activities. Knowing this, the prisoners realized they could prepare for a revolt and set up a riot where they could overpower the guards and break out of the place.

Yes, it wasn't long before the basic design of the panopticon became its own undoing. The prisoners managed to do all the things they needed to do to fight back against their jailors and escape the perfect prison, all from things they did in full view of the guards meant to keep them imprisoned.

So, tell me, given this story, why did the panopticon prison fail?