Difference between revisions of "ISXUbuntu"

Revision as of 21:40, 7 February 2010

Introduction

ISXubuntu is a project of ISOC-NY to create a Linux live CD, based on Ubuntu Linux, which has been optimized for security and privacy while online. The global Internet Society has provided a grant to cover development costs and so that a number of CD's may be distributed free of charge.

Features

ISXubuntu will feature anonymous web browsing using Tor, ad blocking with Privoxy, encrypted email with Enigmail, encrypted instant messaging with OTR and the ability to store a personal home directory and other configuration settings on an encrypted USB flash drive.

Project Status - August 2009

Re-evaluating the scope of the project

I do not understand the significance of the hardware as a solution to the stated problem. It seems to me that the essential issue is that non-hierarchal (i.e. non-centralized) "externally"-managed web hosting does not exist. Users want web-hosting but don't have, nor should they require, the inclination or capacity to manage a web-server themselves.

A "specialized" piece of hardware to do this is superfluous; it can be done and done better in software using existing computers. Moreover, it is not resilient enough: If my hardware or connection go offline I want my hosted content to persist throughout the downtime. If we are trying sell convenience I doubt that we will beat the status quo using something strictly less hands-off.

In effect, what is required is a encrypted distributed data store (the "people's cloud") that is accessible over HTTP. It is here where effort should be directed. Potential data-mining can be mitigated by having only your friends (and possibly friends-of-friends) host your data.

All of these ideas have existed for years in Freenet and other overlay networks. Adoption of these previous networks have been hampered by their anonymity-preserving design requirements which exacts a significant transfer rate penalty. An overlay network which does not require anonymity is not subject to these problems.

Two additional benefits are of note: The first is censorship resistance. Centrally hosted sites are single points of failure and easy targets to effectively suppress information. Wikileaks is the notable exception that has survived only by localizing in a sympathetic country. However, wikileaks itself has noted that this venue shopping will be a short-lived solution. Worse it has not prevented the people behind wikileaks from being at high risk from retaliation from various nation states. Replicating content to thousands or millions of sites automatically makes the application of censorship absurd.

The second benefit is amortization of hosting costs of public-service websites. Some sites, like wikipedia, have enormous hosting costs that are unsustainble at their current growth rates. Charitable donations will soon become inadequate. A more cynical point is that these hosting costs are often used as a pretense to obtain increased salary funding for executives of these organizations. If the data were (read-only) cached in a distributed data store the technical costs would again become manageable (trivial?), funding could be put to use elsewhere and the application of funding more transparent.

David Solomonoff

Project Status - August 2008

• New developer page created, with project schedule and documentation outline

Project Status - June 2008

• Permalink established: http://isoc-ny.org/isxubuntu
• A CVS has been initiated: http://www.isoc-ny.org/cvs/
• An early alpha version without documentation, based on Ubuntu 7.10 can now be downloaded: http://isoc-ny.org/xubuntu-7.10-desktop-i386-custom_CD.iso
• Joseph Shraibman & Alicia Gibb joined the project

Volunteers are needed to help with project.

The project involves bundling and configuring existing software and then testing everything to make sure it works. Skills required to assist with the project include solid familiarity with the Linux/Unix environment and package management tools, and shell scripting with bash. Other scripting languages such as Perl, Python or Ruby would also be helpful.

If you'd like to help with the project you can subscribe to the mailing list: http://lists.isoc-ny.org/listinfo.cgi/isxubuntu-isoc-ny.org h

Outstanding issues

1. Existing documentation should be developed into a functioning script that allows further customization and a complete build of a new .iso file.
2. Boot time is still too slow on older hardware. This may have to do with the X Window autoconfig.
3. Permanently installing the OS to a hard drive doesn't provide the same features and configuration as booting from the CD.
4. Currently OpenDNS is used to prevent DNS spoofing. When you attempt to go to a URL that doesn't exist you are redirected to a page of theirs. Disabling this requires setting up a free account with OpenDNS and having a static IP - or a domain name and registering with DynDNS. We need to discuss this further.
5. AbiWord - the preferred word processor because it's smaller - does not have a redaction feature. If a user is not careful and gives a file to someone else, it's possible to retrieve all deleted material by hitting "undo".
6. Develop a security auditing procedure which includes penetration testing with Nessus and checking file permissions. I've done this but a standard procedure needs to included in the build process.
   1. What else?
7. A number of the apps and Mozilla extensions which add the security and privacy features are not signed - this is a developer issue but we should look into it. If we had a lot of resources (like time and money) we could develop our own secure ports of everything we were concerned about the way OpenBSD does.
8. Tor is still blocked by some firewalls (such as the NYU campus firewall). How to get around this?
9. Email (Enigmail for Thunderbird) and IM (OTR for Pidgin) encryption is installed but not tested
10. On-screen keyboard to block keystroke loggers. Is this enough - what else can be done'?
11. Apps and OS have been updated recently but Firefox and Thunderbird extensions have not been. Command line installation of Mozilla extensions has been broken in Ubuntu for as long as I've been working on this project so this needs to be done within a running system -- a major nuisance. I'll detail the solutions I've found when I expand this
12. Scripts for encrypted home directory on a flash drive need work
    1. GUI
    2. Combine scripts to create filesystem, mount and unmount encrypted drive
    3. Menu to choose device - currently the first mounted flash drive is used.
    4. Switch from mcrypt to TrueCrypt and add hidden filesystem
13. Review licensing and copyright issues for all software and documentation
14. Need artwork including logo, splash screens and CD/DVD label
15. Privoxy doesn't block all ads - beyond the actual ad blocking it's necessary to block tracking of a users web activity through DNS requests.
16. NoScript blocks all Javascripts by default - do we want to create a whitelist of safe sites?
17. Check out Free Access Plus (not currently installed) which circumvents state censorship of popular websites
18. Similar projects - most don't seem active at this time - we should check them out and see what features we can appropriate
    1. AnonymOS andOlive OpenBSD- live CD versions of OpenBSD - not active
    2. ParanoidLinux - a project that's still in the discussion stage
    3. Rubberhose - a steganographic filesystem, not an OS but some interesting concepts we could consider
    4. Incognito - very similar but based on KDE and Gentoo Linux
    5. Mozilla Weave - active but in a very early stage of development. Additional privacy and security for Web 2.0
    6. Knoppix-3.2 MiB-11b Privacy Edition- if this were an active project ISXubuntu wouldn't be necessary - but it's not

Project Status - December 2007

1. Name of Project: Develop security and privacy documentation bundled with software optimized for online security and privacy for end users
2. Amount of funds awarded: $10000
3. Amount received to date:$3000 - Additional funds for the purchase of a server have not been necessary as one has been obtained for free
4. Project Manager: David Solomonoff
5. Brief description of project: Develop a bootable Linux CD with privacy-enhancing software preinstalled.
6. Progress to date: Produced working prototype, a bootable Linux CD with Tor and other privacy-enhancing software installed. The prototype used Ubuntu Linux version 6.06. Currently working on a new version using Ubuntu 7.10.
7. Lessons learned: The original proposal was written very quickly without enough research to determine: a) The technical difficulty of completing the project. Because little or no new software was being developed it seemed much easier than it proved to be. b) Identifying which distribution of Linux to use and then identifying all components to be added. Several other Linux distributions were tried before choosing Ubuntu.
8. Issues to overcome: One of the the two project leaders ceased all activity in the organization soon after the grant was received due to personal issues. Since the project manager is also President of the Chapter he has limited time to spend on the project. Additionally, documentation for customizing Ubuntu to the extent we wanted was hard to come by at the time. It has become easier more recently.
9. Benefits of the project: Few nontechnical computer users grasp basic online security and privacy issues, particularly problems when used public Wi-Fi hotspots or public computers in places such as libraries. Some of the software to enhance privacy and security is difficult to find and install.
10. Anticipated conclusion date: The next version will be completed at the beginning of the new year. It is hoped that additional developers will be recruited. It is seen as an ongoing project and further sources of funding will be possibly be found.
11. Anticipated impact in the internet community: Many additional privacy and security issues are created with the use of Web 2.0 services. The goal is for this project to evolve into a complete Linux distribution that addresses those issues on an ongoing basis.