Nostr notes by linux_privacy

Похоже я нашел новую любовь - openSUSE ...

2026-10-27T11:02:30Z

Похоже я нашел новую любовь - openSUSE Tumbleweed #linux

Yes

2026-10-18T04:02:56Z

In reply to nevent1q…2weh
_________________________

Yes

See https://www.whonix.org/wiki/Telegram

2026-10-17T20:06:15Z

In reply to nevent1q…t9al
_________________________

See https://www.whonix.org/wiki/Telegram

:anarchy: #nevent1q…qafn

2026-10-17T18:36:15Z

:anarchy:

quoting
nevent1q…qafn
У меня на белых списках работают только wss://adre.su, wss://relay.snort.social, и wss://nostr.twinkle.lol. Берите на заметку

NIP-04 NIP-17 Iris Marmot Concord Cordn Anagram ... Post-Quantum ...

2026-10-16T13:58:26Z

In reply to nevent1q…fmaj
_________________________

NIP-04
NIP-17
Iris
Marmot
Concord
Cordn
Anagram
...
Post-Quantum Signal chats with Kryptos https://github.com/swisslite/Kryptos

Шах и мат аметисты #nevent1q…pqrz

2026-10-14T16:20:59Z

Шах и мат аметисты

quoting
nevent1q…pqrz
#Amethyst v1.19.0: A New Login, Remote Signers on Android, Wayland, and Marketplace Cards

Highlights:

- Redesigns the **login and sign-up screens** around signers: your signer
app or a remote signer first, then the key field, on every platform.
- Adds **NIP-46 remote signer login on Android**, and makes it work with
Opal and other signers that percent-encode their bunker addresses.
- Opens **gift wraps in parallel** for remote-signer accounts: a cold start
that waited ~85s using a remote signer for DMs now takes ~20s.
- Gives the **desktop first-class key storage**: a status card in Key
Backup, a password file when there is no system keyring, and an opt-out.
- Draws **natively on Wayland** in every Linux release, with the
compositor's own title bar where it has one.
- **Compresses videos on desktop** through the system's ffmpeg, with the
same quality table as Android.
- Honors **relay rate limits**: a relay's `rate-limited:` back-off now holds
and re-sends the refused commands instead of losing them.
- Adds cards for **NIP-15 marketplaces**, NIP-85 trust assertions, Trusted
Lists, decentralized lists and NIP-29 group metadata.

## New Features

### Login and Sign-up

- Redesigns the login, sign-up and remote-signer screens on one shared frame:
the logo over a soft glow, rounded fields and buttons, Tor settings as a
chip, and a brand-and-card split on windows 840 dp and wider.
- Shows the same order everywhere: the signer app where one is installed,
the remote signer wherever it works, then "or", then the key field.
- Names and draws the installed signer app ("Login with Amber" and its
icon), or says "a signer app" when there are several.
- Lights up Login once a key is typed, and Create Account once there is a
name, and puts the terms checkbox at the top, gating every way in.
- Puts each error right under what it is about: the key field, the password
field, the signer app's button or the remote signer's button.
- Fits the logged-off screens and the remote-signer dialog on small phones,
and keeps the Add New Account bar above the form, not over it.
- Uses white and frosted cards instead of grey for the login, remote-signer,
key-storage and Key Backup surfaces.

### Remote Signers (NIP-46)

- Logs in with a NIP-46 remote signer on Android too: paste a `bunker://`
or show the `nostrconnect://` code.
- Hands the code to a signer app with Open signer, from an in-app menu when
several take it, never to Amethyst itself.
- Shows the code in a large frame ringed by the logo's colors while it
waits, with Copy, Open signer and the relays as pills.
- Lets you pick the relay your signer uses, or one of your inbox relays,
when it can't reach the defaults.
- Uses relay.nip46.com, nrs.primal.net and bucket.coracle.social, the relays
Amber and Opal default to, instead of relay.nsec.app, which stopped
answering.
- Reads percent-encoded bunker addresses, as Opal writes them, and fails
with an error instead of spinning forever.
- Accepts only an answer that carries the code's secret. Anyone who saw the
code could reply first and pose as the signer.
- Resends the same request on a retry, so a signer that queues requests for
approval (Amber) no longer asks twice.
- Waits five minutes for the signer instead of two, and introduces each
platform by its own name and icon.
- Opens gift wraps, seals and drafts up to 8 at a time ahead of the indexer.
With Amber over NIP-46, a desktop cold start opened its 118 wraps in
~20 s instead of ~85 s.
- Tries remote-signer accounts last when decrypting push notifications, so
an offline bunker no longer holds every other account's notifications.

### Desktop Key Storage

- Shows where your keys live in a status card at the top of Key Backup,
with Try again when the keychain refuses and Unlock when the key file is
locked.
- Keeps keys in a password-protected NIP-49 file (`keys.ncryptsec`) when the
computer has no system keyring, asking for the password once per launch.
- Adds "Remember my key on this device": turn it off and the key is asked
for at each launch.
- Adds Save keys to take back this run's "Don't save".
- Stops rewriting the private key to the macOS Keychain on every settings
save, which brought the Keychain password prompt back over and over.
- Fixes view-only, bunker and signer-app logins failing to load after a
restart on Windows and Linux.
- Fixes the Linux OS keyring in release builds (deb, rpm, AppImage and
Flatpak), which always fell back to the password file.
- Treats KWallet's missing item as absent, so a fresh KWallet no longer
shows "Keychain error" on every launch.
- Upgrades a read-only session when you Unlock, Try again or log in again
with the nsec.
- Reports a key the vault could not keep once per run, instead of on every
settings save.
- Keeps the `nostrconnect://` secret out of the logs.

### Desktop Video Compression

- Compresses videos through the system's ffmpeg at the quality slider's
level, with Android's resolution and bitrate table, HEVC when asked, and
H.264 otherwise.
- Strips video metadata by remuxing the original when it is the one going
up, and asks before uploading if the strip fails.
- Names the picked video and its target on the slider, such as
"High · 4K video → 2160p, 8 Mbps".
- Hides the H.265 and GIF-to-MP4 switches without ffmpeg, showing an
install hint instead.
- Tells you when an encode was discarded for not being smaller.
- Finds Homebrew and other package-manager installs of ffmpeg when the app
is launched from Finder.

### Marketplaces (NIP-15)

- Adds cards for stalls, products, marketplaces, auctions, bids and bid
confirmations, which showed as raw JSON or not at all.
- Shows a product's gallery, price, stock, stall, specs and a Message
seller button that drafts a DM with the listing.
- Shows an auction's starting bid, its start and end with the merchant's
extensions, an Upcoming/Live/Ended badge, and its highest bid and bid
count.
- Reads marketplace events leniently (prices as strings, missing ids, tag
form auctions from hash21 and mkauction), and keeps other apps' records
on the same kinds out.

### Trust and List Cards

- Adds one card for NIP-85 trusted assertions (30382-30385): what it scores,
the rank, hops, every other metric as a tile, timestamps as dates, and the
provider.
- Shows a kind 10040's designated providers, with the services each serves.
- Adds cards for Trusted Lists (30392-30395) with members best first and
their scores.
- Adds cards for decentralized list headers and items (9998/9999,
39998/39999), loading a header's items while it is on screen, with `url`,
`tel` and `email` fields as links.
- Adds a card for NIP-29 group metadata (39000) that opens the group.
- Renders hashtags, links and people in bookmark lists and sets, and quotes
pinned notes instead of printing raw `nevent` strings.
- Pages long rosters (3, then 50 per Show more) and caps chip rows with a
"+N more" chip, since event authors decide how many tags a card gets.

### Feeds and Cards

- Adds an info button to each feed filter that explains what it shows, and
on the Notifications screen, what it does to notifications.
- Loads the relay lists of people-list members you don't follow, so list
feeds, follow packs and All Follows find their notes.
- Draws live streams with their summary, start time, viewer count, and a
Watch recording button over the cover once ended.
- Shows a classified's location and a Sold badge, a zap goal's end
countdown, a calendar event's own time zone, and a long-form article's
reading time and topics.
- Renders every kind as the thread's main note the way the feed does:
RSVPs, calendars, lists, chess, live activities and more drew nothing or
plain text there.
- Resolves NIP-30 custom emoji on reaction notification cards, and draws an
untagged `:shortcode:` reaction as text instead of an empty image.
- Plays Blossom's `.mpga` audio files and Podcasting 2.0 trailers.
- Draws a kind 31337 as a music track only when it has a file to play, and
leaves the rest (ad-skip data, game state) out of the feeds.

## Performance

- Makes the outbox's delivery state mutable under its lock: a publish cost
O(relays²) in copies, ~3,400 ns per relay at 100 relays, now ~150 ns.
- Makes a screen's subscription invalidation lock-free: 1.1 ns instead of
up to 8,300 ns while an update is running.
- Returns at once when pruning frees a note that is not a zap.

## Improvements and Bug fixes

- Shows a relay that refused a post with a back-off as retrying while the
client waits it out.
- Stops one relay's hang-up during a publish retry from reconnecting the
whole relay pool.
- Fixes acks from different relays being lost, which kept an event in the
outbox and re-sent it on every reconnect.
- Fixes a forged copy of a note getting the real one dropped as its
duplicate, and deleting an addressable's old version removing the
current one.
- Downloads the Web of Trust network in ~10 s and 39 MB instead of minutes
and 380 MB: it no longer fetches every deletion the provider signed, and
learns of retracted cards over NIP-77.
- Routes the Web of Trust provider's relays like your own: clearnet by
default instead of through Tor.
- Stops a Web of Trust download on mobile data when it is not allowed,
keeps it through list updates, and checkpoints it so an interruption
loses less.
- Fixes the zoom animation for images scrolled partly out of the feed or
under the bars, and makes GIFs shrink back into their thumbnail.
- Fixes tapping a quoted reply in a chat scrolling to the wrong message.
- Stops the like icon crossfading from an empty heart on every scroll.
- Stops demoting the threads of audio rooms and video playback, which made
audio stutter under load.
- Stops an audio room's service restarting after the app was killed and
holding audio focus and a wake lock for a room that was gone.
- Stops any app from controlling picture-in-picture video playback.
- Reads timestamps written in milliseconds as seconds, which made goals
and live streams end in "54,000 years".
- Keeps the Git Repositories search's `kind:git` chip out of the Namecoin
and `.bit` lookups.
- Gives a room's name width before its label in Messages, so a Cordn group
no longer shows only its coordinator.
- Follows the testls.space ElectrumX port swap for Namecoin.

## Desktop

- Draws natively on Wayland in every Linux package, with the JetBrains
Runtime. Set `AMETHYST_X11=1` to stay on XWayland.
- Uses the compositor's title bar on KDE, sway, Hyprland, COSMIC and niri;
GNOME keeps the GTK one.
- Fixes video playback on Windows, which said "Video playback unavailable"
in 1.18.0, and on macOS release builds.
- Keeps the chart library intact in release builds, which ProGuard broke.
- Lets the `.deb` install on Ubuntu 22.04, Debian 12 and their derivatives.
- Fixes `.deb` and `.rpm` installs and removals failing on systems without
`/usr/share/desktop-directories`, and upgrades that removed the menu
entry.
- Requires the system libraries and a font in the `.rpm`, so minimal Fedora
and openSUSE installs launch.
- Renames the Flatpak app ID to `com.vitorpamplona.amethyst.Amethyst`, so it
doesn't share the Android package's listing in Nostr app stores. See
`BUILDING.md` to move your v1.18.0 data.
- Fixes the Web of Trust download, which never started on desktop, and
keeps Cordn's group state on disk.
- Drops the image viewer's URL tooltip and click-to-copy; Copy URL stays in
its menu.
- Removes the Intel macOS options from the README: only Apple Silicon is
built.

## Cli

- Fixes `amy` 1.18.0's self-contained bundles crashing on every command with
`NoClassDefFoundError: java/lang/management/ManagementFactory`.
- Lists relays `amy fetch --paginate` could not page under `unpaged_relays`,
and warns that the result may be partial.
- Adds `retry_after_ms` to `rejected_by` entries.
- Fetches all of a search such as `include:spam` on search.brainstorm.world:
`amy fetch` returned 5,000 of 35,578 events, and `amy sync` none.

## Quartz

- Implements NIP-01 rate-limit back-offs (nostr-protocol/nips#2498):
`OkMessage` and `ClosedMessage` carry `params` and `retryAfterMs`.
- Holds a relay's refused commands on its connection (`RateLimitGate`) and
re-sends them when the back-off passes, across reconnects and pool
changes, with the subscription's current filters.
- Adds `RateLimiter` and `RateLimitPolicy` for relays, with
`PolicyResult.Rejected.rateLimited`.
- Pages a NIP-50 search with no words to rank, keeps `observer:` searches on
one page, and carries the search on `fetchByIds`.
- Re-asks a page cut short inside its boundary second instead of reporting
DRAINED.
- Fixes a decoder hang on short OK, CLOSED and NEG-ERR frames, a truncated
JSON object looping, and a field like `jE` replacing an event's `id`.
- Fixes `subscribeAsFlow` and `fetchAsFlow` dropping the newest list on a
burst.
- Fixes `QuicReader` overflowing on a peer-chosen length, and a bad datagram
escaping to the crash handler.
- Reads NIP-15 marketplace events leniently, with `isWellFormed()`,
`AuctionData.endsAt()` and `AuctionBidSummary`.
- Adds `AssertionMetric` readers, Trusted List accessors and D-list
`fieldDeclarations()`, `displayHints()` and `listImage()`, with `tel` and
`email` field types.
- Adds `TimeUtils.toUnixSeconds` for millisecond timestamps.
- `EmojiUrlTag.decode` returns null unless both shortcode and url are present.

## Geode

- Adds a `[rate_limits]` section for events and REQs per client per minute,
answering with the NIP-01 back-off and 429 with `Retry-After` over NIP-FE.
Off by default.
- Counts an IPv6 client by its /64.
- Caps WebSocket frames at 1 MiB by default; one header could cost 2 GB.

## Build & Documentation

- Fails the desktop release if ProGuard strips a JNI native method, a
D-Bus transport or leaves a stale jar signature.
- Fails the `amy` build when its runtime lacks a JDK module its jars use.
- Self-tests the OS keyring on every packaged desktop build in CI.
- Speeds up `.deb` post-processing from 156 s to 51 s.
- Splits the iOS CI jobs and caches the Kotlin/Native toolchain, so they
finish under their timeout.
- Adds `tools/desktop-run` to run and screenshot the shared UI headless, and
asks agents to look at a UI change before calling it done.
- Clears the build and lint warnings across modules, and removes 125 unused
Android strings and 10 unused drawables.
- Publishes the Flatpak to Orchard.
- States that issue bounties are not a promise of payment.

## Contributors

- VitorPamplona (nprofile…vhl6)
- ⚡ Dee Kay ⚡ (nprofile…kcfw)
- mstrofnone (nprofile…znmg)

## Translations

- Czech, German, Swedish, and Brazilian Portuguese by ⚡ Dee Kay ⚡ (nprofile…kcfw)
- Hindi by राज (nprofile…z0lu)
- Hungarian by summoner (nprofile…ns2l)
- Polish by Polak (nprofile…8c53)

About telegram: https://www.whonix.org/wiki/Telegram ...

2026-10-14T03:43:07Z

In reply to nevent1q…y3md
_________________________

About telegram:
https://www.whonix.org/wiki/Telegram
https://rys.io/en/179.html

Do you like it when your messages can be read on the server? Do ...

2026-10-14T03:40:33Z

In reply to nevent1q…kpmz
_________________________

Do you like it when your messages can be read on the server? Do you like having Google services built into Telegram? Do you like it when your internet provider can track you through an unencrypted id?

Signal encryption without servers, phone number, email and login. ...

2026-10-10T04:40:15Z

In reply to nevent1q…pz4x
_________________________

Signal encryption without servers, phone number, email and login. This keyboard works perfectly with White Noise and all nostr apps.
https://github.com/swisslite/Kryptos

New 0xChat Release!! ...

2026-10-01T15:53:09Z

New 0xChat Release!!

https://github.com/0xchat-app/0xchat-app-main/releases

@nprofile…8v88 очень крут, большой ...

2026-09-24T21:28:19Z

nostrich (nprofile…8v88) очень крут, большой потенциал. Рекомендую следить за обновлениями

Новый потенциально очень крутой ...

2026-09-23T04:59:22Z

Новый потенциально очень крутой клиент Nostr. Пока у него идет активная разработка, атакуйте пожеланиями в комментариях: просите нормальный переводчик, стабильные уведомления, приватные подписки, музыку, видео и тд. Не скромничайте.

quoting
nevent1q…2aqe
Nostrich is a new, 100% free, and best-in-class Nostr client for web, iOS, Android & Mac. We’re web-only right now but native apps are launching soon. Your content. Your feed. Your experience.

https://nostrich.org

## Супер обновление Kryptos! Клавиатура ...

2026-09-21T06:35:54Z

## Супер обновление Kryptos!

Клавиатура стала офигенно удобной и теперь можно делать бэкап чатов - переписка не потеряется при покупке нового телефона! Качайте, обновляйте и общайтесь с шифрованием Signal везде: в любых мессенджерах, соцсетях, в nostr и даже по смс. #privacy #security #signal #encryption

https://github.com/swisslite/Kryptos

Круто, когда приложуха постоянно ...

2026-09-17T19:51:52Z

Круто, когда приложуха постоянно развивается

quoting
nevent1q…7259
#Amethyst v1.16.0: My Fitness, BOLT12 Payments, and a Leaner Core

Highlights:

- Adds **My Fitness**, a dashboard over everything you have trained.
- Moves **BOLT12 offers** into the profile payment rail, and zaps over BOLT11
when a wallet refuses one.
- Opens the **zapped note** from wallet history.
- Fixes **Blossom uploads**, broken on most servers since 1.15.0.
- Takes **~40 MB off every `amy` distribution**.
- Stops counting a relay that hung up as connected.
- Updates **Arti to 2.6.0** for two medium-severity fixes.

## New Features

### My Fitness

- Adds a training dashboard, reached from the drawer or a pinned bottom-bar slot.
- Builds it from both sources: Health Connect, and the kind 1301 workouts you
published. Neither is required.
- Summarises four weeks: this week against last, weekly averages, a breakdown by
activity, best efforts, active days and a day streak.
- Shows distance, calories, steps, climb and heart rate only when a workout
carries them.
- Offers to share a workout only when it is not already published.
- Prefers the Health Connect copy when the same effort appears in both sources —
it carries the heart rate, steps and climb the published event drops.
- Filters the Workouts feed by **Mine** from the top nav.
- Reads workouts in the POWR dialect, which carry `start`/`end` and no `duration`.

### Payments

- Renders each BOLT12 offer as a chip in the profile payment rail. Offers were
already payable, but only through a small button in the profile header.
- Removes both header wallet buttons. The rail lists everything they reached.
- Shows the zap bolt to recipients who publish an offer and no lightning address.
The send path already paid them; the picker just never offered it.
- Falls back to a BOLT11 zap when a wallet refuses an offer and the recipient also
publishes a lightning address.
- Retries only refusals that mean nothing was attempted. A `PAYMENT_FAILED` can
still settle later, so retrying it could pay twice.
- Reports a timeout when a wallet never answers, instead of hanging the zap.
- Opens the zapped note when you tap a zap in wallet history.

## Performance

- Stops emptying the media connection pool on every client rebuild. Both HTTP
clients share one pool, so the proxy check misread every rebuild as a route
change.
- Drops pooled connections once per real Tor route change instead.
- Stops `debugState()` walking the whole cache on every backgrounding. Its nine
scans were built eagerly and then discarded unread.
- Signs one Blossom read-auth token per server, not one per racing caller.

## Improvements and Bug fixes

- Sends the Blossom authorization token as standard padded Base64 again. Deployed
servers reject 1.15.0's unpadded base64url, so roughly two uploads in three
failed.
- Points the Sovbit default Blossom server at `files.sovbit.host`.
- Answers a relay's WebSocket CLOSE frame, in both the shared and the Android
socket. Without it a closed socket looked connected for up to four minutes,
silently discarding everything sent.
- Counts connected relays from the pool's connected flow, which the pool now
clears itself whenever it drops a relay.
- Renders a GIF with no `imeta` as a loading placeholder. It used to collapse the
whole note to a gap in the feed until the fetch finished.
- Drains the event-sync outbox before closing the client. Events from the final
page were reported Done and never delivered.
- Fixes 34 bugs found auditing `commons` and `commonsUI`. Among them: AES-GCM
initialised with a spec every JDK rejects; an `Onion-Location` header from any
host re-pointing Tor traffic for 24 hours; a bundled insert wedged after one
exception; a URL validator backtracking exponentially per keystroke.
- Uses `https` in preview data and image-URL placeholders.

## Desktop

- Stops a silent account wipe on macOS. One Deny on the Keychain prompt rotated
the encryption key and orphaned every saved account.
- Consolidates the keychain into a single `vault-v1` item, so a cold boot prompts
once.
- Allows first-launch key bootstrap on Linux and Windows.

## Cli

- Ships ~40 MB lighter, now that `amy` no longer drags Compose UI and Skiko behind
`commons`.
- Fails fast when a buzz-agent wrapper cannot be made executable.

## Quartz

- Answers a duplicate `EVENT` with `OK true`, per NIP-01, and a superseded
replaceable the same way. Clients used to get raw SQLite text they could not
classify, and retried forever.
- Gives each socket adapter its own session, removing the pool's locking and
identity checks.

## Build & Documentation

- Updates Arti 2.3.0 → 2.6.0, the JNI crate to 0.22, the NDK to r30 and Rust to
1.98.1. Picks up TROVE-2026-24 and TROVE-2026-27, both reachable in normal use.
- Splits Compose UI out of `commons` into a new `commonsUI` module. 236 files
moved and no consumer import changed.
- Bumps LightCompressor-enhanced to 2.2.3.
- Drops the unused Guardian Project Maven repository.
- Runs relay-backed tests against geode instead of external relays.
- Clears the compiler, Android Lint and Gradle 10 deprecation warnings.
- Bumps `appCode` to 461.

## Contributors

- VitorPamplona (nprofile…vhl6)
- ⚡ Dee Kay ⚡ (nprofile…m3sx)
- mstrofnone

## Translations

- Polish by Polak (nprofile…8c53)
- Hindi by राज (nprofile…z0lu)
- Hungarian by summoner (nprofile…ns2l)

Крутая штука #ai ...

2026-09-12T14:01:50Z

Крутая штука #ai

https://zapstore.dev/apps/naddr1qqykz6fwdeuk6cn0wsq3samnwvaz7tmjv4kxz7fw0fshqum5daex2tnyv4mqygx5n2gz8gsahgdneqcxegmfhuey8k95fw8skmg3jes877cfjragmupsgqqq0c9s9k0jdp

Please add Follow Lists with private following, like in Amethyst

2026-09-07T05:12:32Z

In reply to nevent1q…5gm3
_________________________

Please add Follow Lists with private following, like in Amethyst

@nprofile…c34r When will you add private lists for hidden ...

2026-09-04T15:34:08Z

In reply to nevent1q…6k7v
_________________________

Jumble (nprofile…c34r) When will you add private lists for hidden subscriptions (as in amethyst and wisp)?

By the way, this keyboard will protect against chat-control ...

2026-09-03T18:55:44Z

By the way, this keyboard will protect against chat-control #chat-control

quoting
nevent1q…ve7l
Супер-клавиатура kryptos с шифрованием signal и стеганографией обновилась и стала еще круче! И кнопки стали больше - удобно быстро печатать. Качайте себе и друзьям на случай тотального чебурнета

https://github.com/swisslite/Kryptos

Maybe you could add a browser for nostr web clients, with ...

2026-09-03T15:20:30Z

In reply to nevent1q…fddp
_________________________

Maybe you could add a browser for nostr web clients, with clearing of cookies and history? Users could chats safely on Vector and use nostr as a social network.

Супер-клавиатура kryptos с шифрованием ...

2026-09-03T13:02:30Z

Супер-клавиатура kryptos с шифрованием signal и стеганографией обновилась и стала еще круче! И кнопки стали больше - удобно быстро печатать. Качайте себе и друзьям на случай тотального чебурнета

https://github.com/swisslite/Kryptos

@nprofile…wywf sets high standards for #nostr, and I love it. ...

2026-09-03T06:10:23Z

amethyst (nprofile…wywf) sets high standards for #nostr, and I love it. Nostr is no longer just Twitter — it’s a powerful social network. Other clients should take inspiration from Amethyst, otherwise, users will end up with a basic Twitter without cool features like calls, podcasts, music, browser, private lists, and more. Another client with high standards is Ditto. And it’s great that we can now use Ditto directly in Amethyst through the built-in browser.

Проект выглядит интересно. Следим и ...

2026-09-01T20:31:44Z

Проект выглядит интересно. Следим и просим разраба добавить крутые функций, пока у него энтузиазма море

quoting
nevent1q…kd0p
LibreNostr 0.1.5 is out.

Feeds, notifications and DMs were losing events past ~4 relays: the socket flow was unbuffered, so one slow collector blocked every relay behind it, and queries finished on the first EOSE. Buffered now, and a query waits for a quorum instead of a winner.

Follow/unfollow bots (HiveMind, Tzongocu, Football whateverwasitsname) were flooding notifications. Not a spam problem — a key problem: a kind 3 list is republished in full on every change, so each cycle carries a new event id, and rows were keyed by event id. One account, seven identical rows in a minute. Follows are keyed by who and what day now.

Plus: notifications and DMs fetched at session start, old DMs backfilled, an undo countdown before a note goes out, and a relay list rebuilt by probing instead of by reputation.

Get the new release on Zapstore (npub10r8…t2p8) as usual
or from github:
https://github.com/Lwb89dev/librenostr/releases/tag/v0.1.5

Свежак для любителей антидетек ...

2026-08-24T19:40:31Z

Свежак для любителей антидетек браузеров
#privacy #anti-detect #antidetect

https://github.com/nullnullseven/camoufox-gui-center

Он примерно раз в месяц делает ...

2026-08-23T05:11:14Z

In reply to nevent1q…6pn8
_________________________

Он примерно раз в месяц делает новые статьи.

Уже прошла четвертая атака. Никогда ...

2026-08-03T04:44:29Z

In reply to nevent1q…n7q4
_________________________

Уже прошла четвертая атака. Никогда не ленитесь увеличивать энтропию и проверяйте ее при выборе кошелька + добавляйте 25 слово. Сейчас лучший вариант - создать новый кошелёк на старом оффлайн телефоне с помощью Airgap Vault и отправить всё туда. Можно купить старый дешевый pixel 3a, установить туда линукс Droidian (очень легко устанавливается), и затем в нем запустить overlayfs в tmpfs или в эфемерно-зашифрованном контейнере, затем запустить Waydroid, который не сохранит никаких следов на диске после перезагрузки, поставить туда Airgap Vault и вырубить интернет, создать кошелек, сохранить адрес и сид фразу, и перезагрузиться. Итого, кошелек будет создан безопасно + на телефоне об этом не останется никаких следов и никакая криминалистическая экспертиза не сможет получить данные о кошельке.

Там блочат всё, что можно, чего даже ...

2026-08-01T20:30:55Z

In reply to nevent1q…5acu
_________________________

Там блочат всё, что можно, чего даже официально нет в списках запрещенки. Поэтому надо подбирать реле, чтоб всё работало норм. Популярные реле могут вообще не работать во многих регионах.

Amethyst бомба! #nevent1q…7mhj

2026-07-29T11:09:36Z

Amethyst бомба!

quoting
nevent1q…7mhj
#Amethyst v1.13.0: Web Apps, Concord, Buzz, Log in with Amethyst, Git, Bolt12 and lots more.

Highlights:

- Adds an **in-app Browser** for Nostr WebApps
- Adds support for **napplets (NIP-5D)** and **nsites (NIP-5A)**
- Adds **Concord Support (Armada)**.
- Adds **NIP-29 Groups (Flotilla)**.
- Adds **Buzz workspaces, with agents**.
- Adds a **Remote Signer (NIP-46)**.
- Adds **Git Clone Support (NIP-34)**.
- Adds **Relay Auth permissions (NIP-42)**.
- Adds **BitChat Geo-channels**.
- Adds **Blossom file display and sync**.
- Adds **Podcasting 2.0**.
- Adds **BOLT12 payments and zaps (NIP-B1)**.
- Adds **proof-of-work (NIP-13)** publishing.
- Redesigns **chat messages**.
- Redesigns **accent colors**.
- Redesigns **push notifications**

## New Features

### Web Apps, Sites & the Browser

- Opens Nostr web apps (NIP-5D napplets) and static websites (NIP-5A nSites)
directly inside Amethyst, rendered in an isolated, keyless sandbox process that
cannot reach your private key, storage, or data.
- Adds an in-app Browser — a drawer entry and pinnable bottom-bar tab — with an
omnibox address bar, autocomplete, history, favorites, recents, and captured
favicons. The address bar is drawn by Amethyst, never by the page, so its URL
cannot be spoofed.
- Adds "Log in with Amethyst": nSites open with a NIP-07 `window.nostr`
provider, so standard Nostr web apps can sign in and request signatures as your
active account — consent-gated, sign-only, and scoped per site.
- Lets web apps, with your permission, pay through your wallet (NWC), run live
relay subscriptions and queries, and read your identity (profile, lists, zaps,
badges) — every capability brokered and permission-gated (once / this session /
always). Payments always prompt with the amount shown.
- Pins favorite web apps to the bottom bar as embedded, swap-in-place tabs that
stay warm between visits.
- Discovers web apps: the empty browser suggests a curated list plus nSites and
napplets published by people you follow, and profiles gain an "Apps & Sites"
tab.
- Adds a Connected Apps / permissions screen to review and revoke what each app
can do.
- Routes nSite web traffic through Tor by default when Tor is active, with a
per-site onion/globe toggle.
- Gives each account its own web storage — cookies, logins, and site data no
longer leak between the accounts on your device. Sites you were already signed
into are signed out once; signing back in stores the session under the account
you are using, and switching away and back keeps it.
- Scopes granted permissions per account too, so each app asks once more under
each account you use it with. A grant by one account no longer applies to the
others.

### Communities (Concord)

- Adds Concord: an end-to-end-encrypted communities protocol with channels,
membership, invites, roles, moderation, and history — reachable from a hub in
the drawer and pinnable to the bottom nav.
- Creates and edits communities with encrypted icon/banner, relay editing, and
channel management.
- Invites and joins via minted invites with QR codes, tappable invite links,
paste-to-redeem from Search, deep links, and direct member invites.
- Chats in channels with a rich composer (@mentions, custom-emoji autocomplete,
reply preview), encrypted image messages, reactions, replies, and typing
indicators.
- Adds threaded replies (inline or minichat modes) and delivery ticks for your
own messages.
- Groups channels by community in Messages with last-message previews, unread
dots, facepiles, live typing, and per-type load toggles.
- Adds moderation: ban/unban with read-time enforcement, role grants, a "Make
admin" toggle, and a full member roster. A ban hides a member's posts for
everyone else; removing their access to the community's keys takes a
Refounding.
- Backfills channel history across epochs, paging back to the true start of a
channel.
- Surfaces Concord replies and reactions on the Notifications tab with a
community pill.
- Lets authors edit their own channel messages (kind 3302). Latest edit wins,
and it is non-destructive, so reactions and replies stay attached. Only the
original author's edits take effect.

### Git Collaboration (NIP-34)

- Browses Nostr git repositories in-app: a Git Repositories feed and a per-repo
screen with README and Code tabs.
- Reads code with branch/tag switching, file search, image preview, commit
history, syntax highlighting, and word-level diff highlighting.
- Reviews patches and pull requests with computed diffs and status actions; PR
updates surface on the repo screen. The code browser needs a repository with an
http(s) clone URL.
- Manages issues: Issues and Patches & PRs tabs split by open/closed, issue
labels with filtering, and a full-screen New Issue composer.
- Edits a repository announcement from the repo screen, bookmarks repositories,
and filters the feed to your own repos.
- Adds a project-home dashboard with stats, languages, recent activity, and
last-commit rows.

### Location Channels

- Adds Location Channels: geohash-based public rooms that interoperate with
BitChat, browsable from a dedicated drawer list and pinnable to the bottom nav.
- Posts under an unlinkable per-area anonymous identity, or opt in to post as
your real account. An optional nickname survives restarts, but it is a single
handle reused in every area — setting one links your posts across areas.
- Teleports to any place from a map picker or the feed-filter dialog to read and
post to distant rooms, and follows a teleported place to keep its feed.
- Reacts, zaps, and replies on location messages, with a "live near you" bubble
on Home surfacing nearby rooms.
- Adds a "pick on map" location picker to the short-note and all other composers.

### Groups (NIP-29)

- Adds relay groups: group chat, a discovery feed with a top-bar filter and
favorites, and join / leave / create / invite actions.
- Adds subgroups (parent/child hierarchy), custom roles (kind 39003), threads,
and message pinning.
- Shares groups via `naddr` and invite links with one-tap join; inline group
links render as self-loading cards.
- Adds a map-based location picker when creating a group, and lets pinned group
tabs act as bottom-nav roots.

### Buzz (Agent Workspaces)

- Adds Buzz: a self-hosted workspace where humans and AI agents build together on
a relay you own, built on the NIP-29 relay-group family with plaintext content
so the relay can run search, audit, and workflows. Reachable from a "Buzz
Workspaces" bottom-nav tab and the drawer Feeds list.
- Renders workspace channels natively and composes messages; sections a community
into Channels, Forums, inline DMs, and an Agent Console; and renders forum posts
as Concord-style threads with the full chat composer.
- Adds an agent-owner console with cost and personas tabs, an agent-fleet cost
aggregator, live observer telemetry, persona create/edit, and NIP-OA attestation
issuance.
- Adds live typing indicators, presence dots, collapsible sections with unread and
stars, a workspace canvas viewer and edit composer, and a bot "Working…"
indicator.
- Invites people to a channel or community and mints invite links; redeems invite
links (intercepted into the in-app browser) and auto-invites mentioned
non-members.
- Wires Buzz direct messages end to end, titles a DM by its participant, and
surfaces Buzz DMs in the Notification feed rendered as messages.
- Discovers workspaces and DMs via the relay's own kinds, imports workspace
channels from a relay in "Find groups", and routes Tor workspaces to clearnet
when needed.
- Adds a shared **Agent Work board**. Any channel member files a task, upvotes
to reprioritize it, and watches the workspace's agent carry it to a pull
request. Jobs that ship directly and gated workflow runs fold into one board,
grouped by Needs approval / Working / Up next / Shipped.
- Approves or denies a gated run in place. The "Approve & open PR" step
authorizes a push and PR, but never merges or deploys. Adds a confirm step, an
approver and workflow-definition picker, and Buzz Agent Persona editors for
model, provider, and runtime.
- Asks before adding you to a channel someone else put you in (Accept / Ignore /
Leave). Narrates channel changes as plain-language system lines: "Bob added
Alice", topic, visibility, and TTL changes, and more.
- Notifies the requester when their agent job finishes or fails. Lets a
self-hosted geode relay be the private Buzz workspace via a member-and-agent
membership policy.

### Chat & Messages

- Redesigns message rendering across every chat — DMs, public chats, groups, and
communities — with modern bubbles, swipe-to-reply, send motion and press
feedback, per-author name colors, jumbo emoji, day headers drawn above the
messages they introduce, and a timestamp on the last message of each author
run.
- Replaces the message 3-dot menu with a compact two-stage long-press sheet that
unpacks wrapping reactions and zap-amount presets in place.
- Renders channel admin events as centered system messages, and hides a reply
quote when it targets the message directly above.
- Replaces the Messages FAB speed-dial with a full-screen, color-coded
new-conversation chooser, and adds a Messages settings screen with a
grouped-by-relay view and per-type load toggles.
- Warns about DMs from senders reported by people you follow: flags a reported
counterpart on the chat-list row and inside the room, with a per-user
report-warning flow.

### Notifications

- Redesigns push notifications into per-kind, observable, richly-rendered
notifications that resolve inline @npub mentions to display names, render an
inline image link as the big picture, and attribute a reply's parent to its real
author.
- Adds push notifications for Buzz DMs and for bare reactions and reposts to your
notes, with repost-mute parity. Auto-dismisses a tray notification once its
event is read in-app.
- Rebuilds the in-app Notifications tab with infinite-scroll paging via a
look-ahead buffer, time-based history paging with in-feed load markers, and
auto-retry of stalled or faulty relays with an actionable relay detail.

### Remote Signer & Security

- Lets other apps and websites sign through Amethyst for the first time
(NIP-46): connect by scanning or pasting a `nostrconnect://` code, and keep
signing in the background — whether your key is stored directly in Amethyst or
delegated to an external signer like Amber (NIP-55).
- Asks for informed consent before authorizing an app — showing its name and
icon, which account will sign, the exact permissions, and an event preview —
with per-account sheets and one-tap batched approval.
- Manages connected apps from a dedicated screen with per-app relay list, live
health, time-bound grants, and instant "forget this app".
- Adds interactive relay login prompts (NIP-42): choose Once / Always / Never
per relay, with venue-aware prompts for public chats, communities, and live
streams, and one-tap rules to trust relays used by people you follow. Apps
connected through the remote signer now ask before signing a relay login,
instead of approving it automatically under "Let's be reasonable".

### Web of Trust (GrapeRank)

- Discovers Web-of-Trust score providers via NIP-85 and shows hop distance and
follower count on trust cards. Computing the scores — crawling the social graph,
reverse-follower crawling, and publishing NIP-85 cards — is done by the `amy`
command-line tool, not the app; see the Cli section.

### Publishing & Sync

- Adds proof-of-work (NIP-13) publishing: a fire-and-forget mining queue with
per-account difficulty and per-category settings, scheduled-post mining, and
per-post overrides, shielded by a foreground service and mined across half the
device's cores.
- Adds NIP-77 negentropy sync as a first-class capability, with deletion
(NIP-09/62) propagation so scoped syncs no longer strand deletions.
- Shows PoW mining progress, and surfaces PoW, OpenTimestamps, and location
markers as tap-to-explain pills in the note header.

### Podcasts

- Adds Podcasting 2.0: renders shows in detail and thread views, surfaces
episodes in the merged podcast feed, and plays trailers.
- Shows person credits as real Nostr profiles, soundbites, in-app chapters, a
transcript viewer, and a Top Supporters leaderboard.
- Adds per-episode reactions and NIP-22 comments, a Podcast Bookmarks screen, and
value-for-value Lightning splits paid per-minute during real playback.
- Adds in-app podcast authoring: create and edit shows, episodes, and trailers
from an authoring hub, with a value-for-value split editor that adds Nostr
recipients by search. Verifies NIP-F4 podcast authors against their kind-10064
counter-claims.

### BOLT12 Payments & Zaps (NIP-B1)

- Adds BOLT12 zaps: self-verifying kind-9736 events that prove a real BOLT12
Lightning payment. They carry a settlement proof instead of relying on an
LNURL receipt. They fold into the same zap total and reactions row as Lightning
zaps, with anonymous and receiptless (pay-only) variants. Only cryptographically
verified proofs count toward the total.
- Publishes and edits your own BOLT12 offer list (kind 10058) from an in-app
editor. The list is cached, kept live, and restored across restarts.
- Pays a recipient's published offer. Hand it to an external wallet as a
`bitcoin:?lno=` (BIP21) intent, or pay in-app over a NWC wallet that supports
it.
- Sends zaps over NWC, using the new `pay`/`receive` methods
(nostr-wallet-connect/nwc#2). Prefers BOLT12 over Lightning when the recipient
offers it and the wallet supports it, and falls back to a Lightning zap
otherwise.
- Verifies payer proofs cryptographically: payment-hash preimage, invoice and
proof signatures, and BOLT12 merkle reconstruction of selectively disclosed
fields. Dims and does not count a proof that can't be bound to the offer.

### Wallet & Payments

- Adds a Cashu wallet setup wizard: find-or-create with cross-relay discovery,
mint suggestions, and a CashuMints screen; the wallet auto-publishes on mint
add/remove.
- Claims P2PK-locked Cashu tokens (NUT-11). Matches the lock against your wallet
or identity key, and redeems all-or-nothing. Gives a clear error when a token
is locked to a key this wallet can't sign for.
- Adds a setting to hide the on-chain (Bitcoin) wallet, including from zap
buttons.
- Prefers NIP-44 encryption for NWC when the wallet advertises it. Adds a NWC-07
deep-link pairing helper. Posts a tray notification for incoming non-zap
Lightning payments.

### Battery, Data & Background Service

- Adds a resource-usage ledger: on-device battery and data accounting across
relay connections, media, HTTP, proof-of-work, Tor, calls, decrypts, and
remote signs, with per-screen foreground time and reconnect-churn tracking.
Optional NIP-17 reports mail the summary to yourself.
- Presents it on a usage screen with stat tiles, a trend chart, proportion bars,
cellular-first bars, a Tor card, actionable insights, and a live memory card.
- Adds a master switch for the always-on background notification service with
per-account participation, a cost card that links to notification settings,
and a distinct status-bar icon.
- Scales `LocalCache` pruning to the OS memory-pressure level, and trims feed
lists, rich-text/robohash/relay-info caches, the image cache, and the player
warm pool under pressure.

### Look, Media & Navigation

- Adds theme customization: pick an accent color (with a swatch picker), font,
and font size. The accent now drives Material 3 containers, buttons, FABs,
switches, unread dots, selected-reaction highlights, verified NIP-05 / image
marks, and the Following badge.
- Redesigns UI Preferences into grouped in-screen options with live font
previews, and adds a settings search filter in the app bar.
- Adds a Blossom media file manager: browse and manage stored blobs with per-file
controls, mirror and `/media` toggles, an app-level "Sync all" with progress,
and BUD-07 confirm-then-pay mirroring for paid servers.
- Extends the Blossom manager with a gallery grid (video thumbnails and a
full-screen zoomable viewer) and a per-file detail sheet. Adds an importer that
copies blobs from other Blossom servers into yours. Falls back to a verified
download-and-reupload when a target has no `/mirror`.
- Redesigns the Media Servers screen as a single auto-saving canvas with a
reorderable priority list and cached health probes.
- Redesigns the bottom-bar setup with a live preview, drag-to-reorder, and real
favicons; the default bar becomes Home, Messages, Wallet, Browser,
Notifications.
- Adapts the app shell to large screens: tier-scaled navigation transitions, a
reading-column width cap on wide panes, and a two-pane Messages layout.
- Nicknames people with NIP-85 contact cards (kind 30382) signed by your account
key. The nickname shows above their real display name on the profile and
supports custom emoji.
- Adds fitness support: renders POWR strength workouts (kind 1301) and exercise
templates (kind 33401) as cards, and merges close-by Health Connect sessions of
the same type.
- Renders Birdstar bird detections (kind 2473) with common-name titles and
Wikidata links, surfaces Birdex life lists on home and profile, and renders PS1
memory-card saves (kind 38192) with an animated BIOS icon.
- Adds a compose signature pre-filled in text-based post screens, and an optional
subject/title field in the short-note composer.
- Renders NIP-30 custom-emoji reactions as an avatar badge, a lone zap/nutzap as
a large activity card, and NIP-84 highlights from web highlighter clients.
- Supports NIP-51 mute-list hashtag entries and public-chat reply notifications.
- Modernizes the Privacy, Profile UI, Home Tabs, and Calendar Reminder settings
screens into grouped in-screen options.
- Adds "Share as QR" for a note, with a choice of `note` or `naddr` payload and an
image thumbnail for image-only notes.
- Resolves NIP-05 identifiers (including Namecoin `.bit`) in the @-mention
popover, wiring them to `nostr:` mentions.

## Performance

- Speeds up napplet/nSite opens by overlapping WebView init, prefetching blobs in
parallel, and fast-serving content-addressed blobs from cache.
- Substantially faster GrapeRank crawls (background IO, mass pre-connect with
cached DNS, batched contact reads, parallel outbox fetches, early dead-relay
pruning) and faster scoring via Gauss-Seidel sweeps over a compact integer
graph.
- Speeds up NIP-77 reconcile with direct-built wire frames (~2.5x), O(1) range
fingerprints, a live negentropy index, and an allocation-free idle watchdog.
- Prefetches media and pre-parses note text ahead of the viewport, adds a k-way
merge for the home feed, and pins indexes for multi-author queries.
- Adopts a caching event decoder across Android/Desktop/CLI, batches Schnorr
verification off the receive path, and keeps light/dark resolution O(1) after
an accent change.
- Parallelizes Blossom "Sync all", prefetches a joined group's history, and mines
proof-of-work on half the device's cores.
- Orders NIP-50 relay search by bm25 relevance and scales search and tag-watcher
queries with corpus size, picking the SQLite filesystem driver by cost and
materializing indexes at runtime.
- Removes live-path allocations in `LiveEventStore` and `FilterIndex` (and on the
frame/search paths), and snapshots `FilterIndex` with a persistent map.

## Improvements and Bug fixes

- Normalizes accent theming: contrast-picks onPrimary so filled buttons/FABs stop
washing out, bases light/dark on background luminance, and fixes accent
regressions.
- Keeps live HLS streams playing and caches only proven on-demand HLS; shows a
browser-fallback overlay when a decoder stalls and pauses looping videos after
5 plays.
- Adds an HTTP/2 keepalive ping to stop stale-connection image stalls.
- Hardens the relay client: enforces blocked relays on every REQ/COUNT/publish,
backs off from REQs relays repeatedly refuse, drops relays that fail hard
during crawls, caches each relay's advertised LIMITS, and fixes reconnect
backoff on network/transport changes.
- Shows and edits Marmot (MLS) group icons in the feed and in group metadata,
interoperable with other Marmot clients.
- Opens zaps and reactions in their own thread view, turns Notify chips into bell
mute-toggles that list every thread member, and replies with kind 1111 to
Amethyst's own kind-1 thread roots.
- Adds search, a local filter, and a top-nav feed filter to the App
Recommendations screen, and shows a website's favicon and domain across every
browser-connected app view.
- Fixes nutzap relay routing to receive/advertise on inbox/DM (kind 10019)
relays instead of outbox.
- Fixes Concord invite handling (revocation, keyless CORD-05, clearer failure
copy, no hang on bad links, skip re-join) and channel rows stuck on "No
messages yet".
- Persists the Concord community list and loads pinned communities from their own
relays so cold boot no longer refetches, shows channels on Messages as soon as
the control plane folds, warms channel previews so the list fills without opening
each channel, and rank-gates the Ban/Remove affordances (CORD-04).
- Sizes the video player box so live streams stop rendering black bars, and
enforces the decoder budget when acquiring players.
- Stops stamping our client tag on someone else's event template so external
signers sign it unchanged.
- Keeps calendar RSVP buttons on a single line, drops dead top padding on Home
when there are no live bubbles, and modernizes the Zap the Devs donation card.
- Rejects NIP-29 group state not signed by the relay, opens group posts in the
group chat, and fixes subgroup edit safety and pinned-message jump.
- Makes tapping a message timestamp open delivery info instead of toggling the
time format, and right-aligns your own messages.
- Recovers a media file's type from its extension when the imeta MIME is
malformed, and moves several disk reads (boot receiver, signer policy) off the
main thread.
- Serializes account construction so concurrent loaders can't build duplicate
accounts.
- Routes Onion-Location through the Android app's HTTP clients and maps Tor/Arti
errors to accurate SOCKS reply codes.
- Extracts the rich-text renderer and many event cards (calendar/RSVP, podcast
atoms/splits, relay discovery, code snippet, ecash mint, activity, Git
diff/status, and more) into shared commons so Desktop and Android render
identically.
- Sends pictures in minichat thread replies (encrypted in Concord, plaintext in
public chats). Resolves @-mentions in the minichat composer and tray
quick-replies. Adds `p` tags for people cited in kind 9/11/1111 and Buzz stream
messages, so mentions notify and resolve.
- Stops the inline audio player from painting over the note below it. Marks
every room type read from the Messages "mark as read" action.
- Fixes numeric HTML entities in link-preview meta tags. Routes kind-39005 by tag
shape, so Buzz thread summaries no longer parse as NIP-29 pin lists.
- Shortens over-long translated strings across 23 locales and fixes duplicate
and CDATA translation issues.

## Desktop

- Redesigns notifications with a reworked inbox and native OS toast
notifications.
- Adds NIP-42 relay AUTH with an inline Once / Always / Never approval banner and
persisted grants.
- Makes NIP-17 private DMs reliable: resolves recipient inbox relays, fetches DM
relay lists and account/Blossom config from outbox relays, and stops falling
back to connected relays.
- Adds Web-of-Trust score badges, Follow Packs (NIP-51) discovery with one-tap
follow, note scheduling, opt-in NIP-37 draft sync, and a hashtag-spam filter.
- Adds a Privacy Lock: gate the Messages and Wallet columns behind a password,
with an auto-lock timeout. It is a screen gate, not encryption at rest —
messages continue to sync while it is locked.
- Renders rich text through the shared core (removes the desktop-only fork) and
ships as a Flatpak bundle.
- Adds moderation & safety: mute/block and NIP-56 report actions in the note menu
with feed, thread, and profile enforcement (previously a silent no-op), NIP-36
content-warning blur with tap-to-reveal, a sensitive-content toggle, and
management screens — with snackbar feedback and zero-relay send warnings.
- Adds NIP-88 polls (render, vote, create) with a "Polls" search facet, and
unifies the note ⋮ overflow and right-click menus.
- Fixes a desktop-cache race that could wipe the follow list, and makes sidebar
navigation replace the detail overlay instead of hiding behind it.

## Cli

- Adds nak-style primitives: `amy decode`/`encode` (NIP-19/21), `verify`, `key`
(generate/public/encrypt/decrypt/validate, NIP-49), and `filter`.
- Adds query verbs: `amy fetch` (one-shot with code-mode outbox resolution),
`subscribe` (live NDJSON), `count` (NIP-45), and `outbox USER` (NIP-65).
- Adds `amy sync` — NIP-77 negentropy reconcile with deletion propagation — and
`amy event` / `amy publish` for raw and pre-signed events.
- Adds `amy encrypt`/`decrypt` (NIP-44/04) and `amy gift wrap`/`unwrap` (NIP-59).
- Adds `amy blossom` (upload/download/list/delete/check/mirror, NIP-B7) with a
live interop smoke test.
- Adds `amy git` (NIP-34), `amy podcast` and `amy podcast20` (Podcasting 2.0 with
V4V splits).
- Rounds out `amy git` to full NIP-34 parity: `browse`/`cat`/`log` over
smart-HTTP, `init` from a local checkout, `label` (NIP-32), `apply` a patch to
the working tree, and `grasp list`/`set` (GRASP server list, kind 10317).
- Adds `amy buzz` for block/buzz workspaces (channels, DMs, invite-link
redemption), verified against a live Buzz relay.
- Turns `amy` into the Buzz workflow/agent runner. `buzz agent serve`/`up`/
`doctor` run gated or parallel-backlog agents in isolated git worktrees that
open PRs. `buzz workflow trigger`/`run`/`approve`/`deny` drive the human
approval gate.
- Adds `amy bolt12` (NIP-B1): decode offers and payer proofs, verify a zap,
get/set a kind-10058 offer list, and a two-step intent → zap send.
- Adds the `amy cashu` wallet (NIP-60/61): wallet lifecycle, balance, mint,
receive/send (LN / token / nutzap), and maintenance.
- Adds `amy admin` (NIP-86 relay moderation) and `amy serve` (run a relay by
embedding geode).
- Adds NIP-46 remote signing: `amy bunker` server, `amy login bunker://…`, and
`amy login --nostrconnect`, gated with `--perms` and interactive approval.
- Adds the `amy graperank` suite (crawl/score/publish/followers/rank/…),
account-less crawl/score, and NIP-85 card publishing.
- Adds `amy fof` (follows-of-follows, renamed from `amy wot`), `amy concord`
(encrypted communities), `amy relaygroup` (NIP-29), and `amy geochat`
(BitChat-interoperable geohash channels).
- Adds NIP-13 proof of work (`amy pow`, `--pow` on posts), `amy kind`, `amy nip`,
`amy namecoin`, `amy status`, and `amy logoff`.
- Expands `amy nsite`/`napplet` with `publish`, `serve`, and `list`.
- Switches the default event store to SQLite and hardens the output contract:
single-line `--json`, exit codes 0/1/2/124, publish results carry each relay's
rejection reason, and read-only verbs run without an account.

## Quartz

- Adds NIP-77 negentropy sync (pipelined worker pool, multi-connection fan-out,
bounded-memory streaming, `LiveNegentropyIndex`) and NIP-09/62 deletion
propagation.
- Adds NIP-13 proof-of-work publishing: a cooperative-cancellation miner and a
`PoWNostrSigner` decorator that composes with any signer, plus NIP-59
gift-wrap mining on the outer wrap only.
- Adds NIP-66 `RelayReachabilityStore` — a durable, shareable dead-relay cache
backed by kind:30166 events.
- Adds the Concord/CORD protocol foundation (key derivation, envelope layer,
authority resolver, roles/moderation, CORD-05/06/07) and the NIP-5D/5A
trust-boundary core (capability model, permission ledger, broker, wire
protocol).
- Implements Marmot (MLS-over-Nostr) group icons byte-for-byte with the
mdk/whitenoise scheme, and fixes SecretTree ratchet preservation across
restore.
- Adds an OutboxDispatcher to fetch profile/contact events via each author's
outbox relays, and richer NIP-89 app-handler parsing.
- Adds the Buzz protocol surface (~78 event kinds spanning NIP-OA owner
attestation, NIP-AM agent turn metrics, personas/teams/managed agents, streams,
DMs, forums, presence, and moderation), verified against vectors generated by
Buzz's own Rust reference.
- Adds the BOLT12 zaps protocol layer (NIP-B1): kind-9736 zaps, kind-9737 zap
intents, kind-10058 offer lists, full spec validation, and a payer-proof
verifier with BOLT12 merkle reconstruction. NWC gains `pay`/`receive` methods.
- Widens NIP-50 search indexing to more event kinds and tag-borne text. Indexes
only the public petname and summary on contact cards (kind 30382), never the
encrypted fields.

## Geode (standalone relay)

- Adds relay-to-relay mirroring with strfry-router parity: a two-phase model
(NIP-77 negentropy sync catch-up plus a live REQ tail), `down` / `up` / `both`
directions, per-upstream mirror filters, and relay-to-relay trust.
- Keeps mirrors alive across upstream restarts with a retry pump and ping
keepalive, and advances the since-watermark correctly on reconnect.
- Adds `import` / `export` NDJSON verbs and an optional no-full-text-search mode
(`--no-search`) for lighter deployments.
- Adds `[database]` tuning knobs with periodic `PRAGMA optimize`, and validates
config knobs and mirror filters at boot.
- Runs embedded in the CLI via `amy serve`.
- Serves full-set negentropy NEG-OPENs from a live index and streams mirror
catch-up IDs instead of materializing them.
- Adds relayBench, a head-to-head benchmark harness (geode vs strfry vs any
relay) measuring ingest, query, and NIP-77 sync over a shared corpus.
- Enables a combined tag+kind+pubkey index, a cost-based filesystem-driver pick,
and runtime index materialization, with new tag∩author and driver-selection
relayBench shapes.
- Ships a release pipeline: a GHCR Docker image, `.deb`/`.rpm` packages with a
bundled JRE and systemd unit, a portable jlink'd tarball, and a Homebrew
formula. Adds `--version`/`--help` and a boot smoke test in CI.
- Lets operators pick any Quartz `IEventStore` backend via `[database].backend`:
SQLite (default), filesystem, or a custom store loaded by class name.

## Build & Documentation

- Rebuilds the Tor/Arti native library for the SOCKS reply-code fix, ships a
Homebrew formula for `amy`, and seeds the Gradle distribution from a verified
mirror in the web sandbox.
- Adds NIP-29 group-chat test coverage across every assembler, filter shape, and
relay integration.
- Targets JVM 17 for Quartz, upgrades AGP, and replaces the abandoned
android-test-report action with `mikepenz/action-junit-report`.
- Adds a coding standard banning raw invisible/bidirectional Unicode in source
(Trojan-Source, CVE-2021-42574) and replaces existing occurrences with `\u`
escapes.

## Contributors

- VitorPamplona (nprofile…vhl6)
- ⚡ Dee Kay ⚡ (nprofile…m3sx)
- beefenergy (nprofile…94k8)
- v (nprofile…mjk6)
- greenart7c3 (nprofile…xcpk)
- Gigi (nprofile…9ccm)
- roguehashrate
- LubuSeb

## Translations

- Czech, German, Brazilian Portuguese, and Swedish by ⚡ Dee Kay ⚡ (nprofile…m3sx)
- Spanish (Spain, Mexico, and US) by ⚡₿it₿y₿it⚡ (nprofile…yhdq)
- French by DuPainEtDesJeux (nprofile…d26f)
- Hungarian by summoner (nprofile…ns2l)
- Dutch by Bartus (nprofile…ge6h)
- Hindi by राज (nprofile…z0lu)
- Polish by Polak (nprofile…8c53)
- Slovenian by StellarStoic (nprofile…406e)
- Chinese Simplified by hypnotichemionus4
- German by crowdin.pretended462

:locked: 1. Ephemeral Encrypted Volatile DVMs (for devices up to ...

2026-07-19T13:04:49Z

In reply to nevent1q…vhtk
_________________________

:locked: 1. Ephemeral Encrypted Volatile DVMs (for devices up to 16 GB RAM)

Script deploys a systemd service that creates a fresh LUKS-encrypted LVM thin pool on every boot, clones all DVM templates into it as ephemeral -ephemeral variants, and completely destroys the pool - including all VM volumes, encryption keys, and the underlying image file - on shutdown. This guarantees that all DVM session data resides exclusively on encrypted volatile storage that is cryptographically irrecoverable after poweroff, leaving no forensic traces on disk.

This solution does not impose any additional memory load, which is critical for devices with less than 16 GB of RAM. My friends with 16 GB devices experienced severe issues when running DVMs entirely in RAM - DVMs would crash unexpectedly, or dom0 would start glitching: panel and app menu artifacts, cursor freezes.

Make sure there is sufficient free space (more than 4 GB) in dom0. You can resize dom0 these commands:

sudo lvresize --size 4G /dev/mapper/qubes_dom0-root
sudo resize2fs /dev/mapper/qubes_dom0-root
sudo lvresize -L +4G qubes_dom0/root-pool

Run this simple script in dom0 terminal:

#!/bin/bash

sudo tee /etc/systemd/system/ephemeral-pool.service << 'EOF'
[Unit]
Description=Fresh ephemeral encrypted LVM pool with DVM auto-clone
After=local-fs.target qubesd.service
Requires=qubesd.service
Before=qubes-vm@sys-net.service qubes-vm@sys-firewall.service

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStartPre=-/usr/local/bin/ephemeral-pool-destroy.sh
ExecStart=/usr/local/bin/ephemeral-pool-create.sh
ExecStop=/usr/local/bin/ephemeral-pool-destroy.sh

[Install]
WantedBy=multi-user.target
EOF

sudo tee /usr/local/bin/ephemeral-pool-create.sh << 'EOF'
#!/bin/bash
set -uo pipefail

POOL_NAME="ephemeral_pool"
MOUNT_BASE="/var/tmp/ephemeral"
KEY_FILE="/dev/shm/ephemeral.key"
IMG_FILE="${MOUNT_BASE}/pool.img"
LUKS_NAME="ephemeral_crypt"
POOL_SIZE="4G"

ROOT_DEV=$(findmnt -n -o SOURCE / 2>/dev/null || echo "")

if echo "$ROOT_DEV" | grep -qE "(overlay|/dev/zram0)"; then
echo "[*] Detected amnesiac mode: $ROOT_DEV"
echo " Destroying old ephemeral VMs and artifacts..."

for vm in $(qvm-ls --raw-list --running 2>/dev/null); do
if qvm-volume list "$vm" 2>/dev/null | grep -q "${POOL_NAME}"; then
echo " -> Stopping: $vm"
qvm-shutdown --wait --timeout 10 "$vm" 2>/dev/null || \
qvm-kill "$vm" 2>/dev/null || true
fi
done

for vm in $(qvm-ls --raw-list 2>/dev/null); do
if qvm-volume list "$vm" 2>/dev/null | grep -q "${POOL_NAME}"; then
echo " -> Removing VM: $vm"
qvm-remove --force "$vm" 2>/dev/null || true
fi
done

qvm-pool remove "${POOL_NAME}" 2>/dev/null || true
vgchange -an ephemeral_vg 2>/dev/null || true
vgremove -f ephemeral_vg 2>/dev/null || true
cryptsetup close "${LUKS_NAME}" 2>/dev/null || true
rm -f "${KEY_FILE}" "${IMG_FILE}"

echo "[+] Cleanup completed. Pool creation skipped in amnesiac mode."
exit 0
fi

for vm in $(qvm-ls --raw-list 2>/dev/null); do
if qvm-volume list "$vm" 2>/dev/null | grep -q "${POOL_NAME}"; then
echo " -> Removing VM: $vm"
qvm-kill "$vm" 2>/dev/null || true
sleep 1
qvm-remove --force "$vm" 2>/dev/null || true
sleep 1
fi
done

qvm-pool remove "${POOL_NAME}" 2>/dev/null || true
sleep 1
vgchange -an ephemeral_vg 2>/dev/null || true
vgremove -f ephemeral_vg 2>/dev/null || true
cryptsetup close "${LUKS_NAME}" 2>/dev/null || true
rm -f "${KEY_FILE}" "${IMG_FILE}"

mkdir -p "${MOUNT_BASE}"
install -m600 /dev/null "${KEY_FILE}" && dd if=/dev/urandom bs=1 count=4096 of="${KEY_FILE}" iflag=fullblock
truncate -s "${POOL_SIZE}" "${IMG_FILE}"
LOOP_DEV=$(losetup -f --show "${IMG_FILE}")
cryptsetup luksFormat -q --key-file "${KEY_FILE}" "${LOOP_DEV}"
cryptsetup open --key-file "${KEY_FILE}" "${LOOP_DEV}" "${LUKS_NAME}"
pvcreate "/dev/mapper/${LUKS_NAME}"
vgcreate "ephemeral_vg" "/dev/mapper/${LUKS_NAME}"
lvcreate -T -n "thin_pool" -l +100%FREE "ephemeral_vg"
losetup -d "${LOOP_DEV}" || true

if qvm-pool list 2>/dev/null | grep -q "^${POOL_NAME}"; then
qvm-pool remove "${POOL_NAME}" 2>/dev/null || true
sleep 1
fi
qvm-pool add "${POOL_NAME}" lvm_thin --option volume_group=ephemeral_vg --option thin_pool=thin_pool 2>/dev/null || \
qvm-pool add "${POOL_NAME}" lvm_thin -o volume_group=ephemeral_vg,thin_pool=thin_pool

echo "[*] Copying DVM templates..."
qvm-ls --raw-list 2>/dev/null | grep -i 'dvm' | grep -v '\-ephemeral$' | while read vm; do
[ -n "$vm" ] || continue
clone_name="${vm}-ephemeral"
qvm-check -q "$clone_name" 2>/dev/null && {
qvm-kill "$clone_name" 2>/dev/null || true
qvm-remove --force "$clone_name" 2>/dev/null || true
}
echo " -> $vm -> ${clone_name}"
qvm-clone -P "${POOL_NAME}" "$vm" "$clone_name" && {
qvm-prefs "$clone_name" template_for_dispvms True 2>/dev/null || true
qvm-prefs "$clone_name" autostart False 2>/dev/null || true
}
done

echo "[+] Done!"
EOF

sudo tee /usr/local/bin/ephemeral-pool-destroy.sh << 'EOF'
#!/bin/bash
set -uo pipefail

POOL_NAME="ephemeral_pool"
LUKS_NAME="ephemeral_crypt"
KEY_FILE="/dev/shm/ephemeral.key"
IMG_FILE="/var/tmp/ephemeral/pool.img"

for vm in $(qvm-ls --raw-list 2>/dev/null); do
if qvm-volume list "$vm" 2>/dev/null | grep -q "${POOL_NAME}"; then
qvm-kill "$vm" 2>/dev/null || true
sleep 1
qvm-remove --force "$vm" 2>/dev/null || true
sleep 1
fi
done

qvm-pool remove "${POOL_NAME}" 2>/dev/null || true
sleep 1
qvm-pool remove "${POOL_NAME}" 2>/dev/null || true
vgchange -an ephemeral_vg 2>/dev/null || true
vgremove -f ephemeral_vg 2>/dev/null || true
cryptsetup close "${LUKS_NAME}" 2>/dev/null || true
for loop in $(losetup -j "${IMG_FILE}" 2>/dev/null | cut -d: -f1 || true); do
[ -n "$loop" ] && losetup -d "$loop" 2>/dev/null || true
done
rm -f "${KEY_FILE}" "${IMG_FILE}"
EOF

sudo chmod +x /usr/local/bin/ephemeral-pool-create.sh
sudo chmod +x /usr/local/bin/ephemeral-pool-destroy.sh
sudo systemctl daemon-reload
sudo systemctl enable --now ephemeral-pool.service

To remove pool and disable the systemd service:

sudo systemctl stop ephemeral-pool.service
sudo systemctl disable ephemeral-pool.service

Start the service and pool again:

sudo systemctl enable --now ephemeral-pool.service

:card_index_dividers: 2. RAM-based DVMs on a Zram disk (for devices with 20-24 GB of RAM)

This script creates a compressed RAM disk (zram) that acts as a super-fast ephemeral storage pool for your DVMs. On every boot, it sets aside a portion of your RAM - compressed with lz4 algorithm to save space - builds an LVM thin pool on top of it, and clones all your DVM templates there as -ephemeral variants. When you shut down the system, everything in that RAM disk vanishes instantly without ever touching your physical disk. The key advantage of zram is built-in compression: your 3 GB pool can hold 6-7 GB of actual VM data, giving you more usable space than raw RAM would allow. It is also significantly faster than disk-based storage, so DVMs launch and run with near-native speed. Unlike tmpfs, zram does not compete with your system memory for cache.

First, increase the maximum dom0 memory in this file
sudo nano /etc/default/grub
edit this value dom0_mem=max:4096M to dom0_mem=max:6144M,
update GRUB sudo grub2-mkconfig -o /boot/grub2/grub.cfg and reboot Qubes OS.

Run this simple script in dom0 terminal:

#!/bin/bash

sudo tee /etc/systemd/system/zram-pool.service << 'EOF'
[Unit]
Description=ZRAM Ephemeral Pool
After=qubesd.service
Before=qubes-vm@sys-net.service

[Service]
Type=oneshot
ExecStart=/usr/local/bin/zram-pool-create.sh
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target
EOF

sudo tee /usr/local/bin/zram-pool-create.sh << 'EOF'
#!/bin/bash
set -euo pipefail

POOL_NAME="zram_pool"
ZRAM_SIZE="4G"
VG_NAME="zram_vg"

EXTRA_VMS=(
#"whonix"
#"sys-whonix"
)

ROOT_DEV=$(findmnt -n -o SOURCE / 2>/dev/null || echo "")

if echo "$ROOT_DEV" | grep -qE "(overlay|/dev/zram0)"; then
echo "[*] Detected amnesiac mode: $ROOT_DEV"
echo " Cleaning up old VMs..."

for vm in $(qvm-ls --raw-list --running 2>/dev/null); do
if qvm-volume list "$vm" 2>/dev/null | grep -q "${POOL_NAME}"; then
echo " -> Stopping: $vm"
qvm-shutdown --wait --timeout 10 "$vm" 2>/dev/null || \
qvm-kill "$vm" 2>/dev/null || true
fi
done

for vm in $(qvm-ls --raw-list 2>/dev/null); do
if qvm-volume list "$vm" 2>/dev/null | grep -q "${POOL_NAME}"; then
echo " -> Removing: $vm"
qvm-remove --force "$vm" 2>/dev/null || true
fi
done

qvm-pool remove "${POOL_NAME}" 2>/dev/null || true
vgchange -an "${VG_NAME}" 2>/dev/null || true
vgremove -f "${VG_NAME}" 2>/dev/null || true

for dev in /dev/zram*; do
[ -b "$dev" ] || continue
zramctl --reset "$dev" 2>/dev/null || true
done

echo "[+] Cleanup completed."
exit 0
fi

if [ "$EUID" -ne 0 ]; then
echo "[!] Root privileges required"
exit 1
fi

echo "[*] Creating zram device (${ZRAM_SIZE})..."
modprobe zram 2>/dev/null || true

ZRAM_DEV=""
for dev in /dev/zram*; do
[ -b "$dev" ] || continue
if ! zramctl "$dev" 2>/dev/null | grep -q "mounted\|active"; then
ZRAM_DEV="$dev"
break
fi
done

if [ -z "$ZRAM_DEV" ]; then
ZRAM_DEV=$(zramctl --find --size "$ZRAM_SIZE" --algorithm lz4)
else
zramctl --reset "$ZRAM_DEV" 2>/dev/null || true
ZRAM_DEV=$(zramctl --find --size "$ZRAM_SIZE" --algorithm lz4)
fi

echo " Device: $ZRAM_DEV"

echo "[*] Removing VMs from pool ${POOL_NAME}..."
for vm in $(qvm-ls --raw-list --running 2>/dev/null); do
if qvm-volume list "$vm" 2>/dev/null | grep -q "${POOL_NAME}"; then
echo " -> Stopping: $vm"
qvm-shutdown --wait --timeout 30 "$vm" 2>/dev/null || {
echo " -> Force killing: $vm"
qvm-kill "$vm" 2>/dev/null || true
}
fi
done

for vm in $(qvm-ls --raw-list 2>/dev/null); do
if qvm-volume list "$vm" 2>/dev/null | grep -q "${POOL_NAME}"; then
echo " -> Removing: $vm"
qvm-remove --force "$vm" 2>/dev/null || true
fi
done

echo "[*] Cleaning up old infrastructure..."
qvm-pool remove "${POOL_NAME}" 2>/dev/null || true
vgchange -an "${VG_NAME}" 2>/dev/null || true
vgremove -f "${VG_NAME}" 2>/dev/null || true

# Detach old loops on zram
for loopdev in $(losetup -a 2>/dev/null | grep "$ZRAM_DEV" | cut -d: -f1); do
echo " -> Detaching loop: $loopdev"
losetup -d "$loopdev" 2>/dev/null || true
done

echo "[*] Creating loop on ${ZRAM_DEV}..."
LOOP_DEV=$(losetup -f --show "$ZRAM_DEV")
echo " Loop: $LOOP_DEV"

echo "[*] Creating LVM on ${LOOP_DEV}..."
pvcreate -q "$LOOP_DEV"
vgcreate -q "${VG_NAME}" "$LOOP_DEV"
lvcreate -q -T -n "thin_pool" -l +100%FREE "${VG_NAME}"

echo "[*] Registering pool ${POOL_NAME}..."
if qvm-pool list 2>/dev/null | grep -q "^${POOL_NAME}"; then
qvm-pool remove "${POOL_NAME}" 2>/dev/null || true
sleep 1
fi

qvm-pool add "${POOL_NAME}" lvm_thin --option volume_group="${VG_NAME}" --option thin_pool=thin_pool 2>/dev/null || \
qvm-pool add "${POOL_NAME}" lvm_thin -o volume_group="${VG_NAME}",thin_pool=thin_pool

echo " Pool created:"
qvm-pool info "${POOL_NAME}"

echo "[*] Cloning VMs into ephemeral pool..."

echo " [DVM templates]"
qvm-ls --raw-list 2>/dev/null | while read -r vm; do
[ -n "$vm" ] || continue

is_dvm=$(qvm-prefs "$vm" template_for_dispvms 2>/dev/null || echo "False")
[ "$is_dvm" = "True" ] || continue

if qvm-volume list "$vm" 2>/dev/null | grep -q "${POOL_NAME}"; then
continue
fi

clone_name="${vm}-ephemeral"

if qvm-ls --raw-list 2>/dev/null | grep -q "^${clone_name}$"; then
echo " -> Removing old copy: ${clone_name}"
qvm-kill "$clone_name" 2>/dev/null || true
qvm-remove --force "$clone_name" 2>/dev/null || true
fi

echo " -> Cloning: $vm -> ${clone_name}"

if qvm-clone -P "${POOL_NAME}" "$vm" "$clone_name"; then
qvm-prefs "$clone_name" template_for_dispvms True 2>/dev/null || true
qvm-prefs "$clone_name" autostart False 2>/dev/null || true
echo " [+] OK"
else
echo " [!] ERROR"
fi
done

if [ ${#EXTRA_VMS[@]} -gt 0 ]; then
echo " [Extra VMs]"
for vm in "${EXTRA_VMS[@]}"; do
if ! qvm-ls --raw-list 2>/dev/null | grep -q "^${vm}$"; then
echo " [!] VM not found: $vm"
continue
fi

if qvm-volume list "$vm" 2>/dev/null | grep -q "${POOL_NAME}"; then
echo " -> Skipping (already in zram): $vm"
continue
fi

clone_name="${vm}-ephemeral"

if qvm-ls --raw-list 2>/dev/null | grep -q "^${clone_name}$"; then
echo " -> Removing old copy: ${clone_name}"
qvm-kill "$clone_name" 2>/dev/null || true
qvm-remove --force "$clone_name" 2>/dev/null || true
fi

echo " -> Cloning: $vm -> ${clone_name}"

if qvm-clone -P "${POOL_NAME}" "$vm" "$clone_name"; then
qvm-prefs "$clone_name" template_for_dispvms False 2>/dev/null || true
qvm-prefs "$clone_name" autostart False 2>/dev/null || true
echo " [+] OK"
else
echo " [!] ERROR"
fi
done
fi
EOF

sudo chmod +x /usr/local/bin/zram-pool-create.sh
sudo systemctl daemon-reload
sudo systemctl enable --now zram-pool.service

To remove zram pool and disable the systemd service run this script:

#!/bin/bash

# Step 1: Stop and disable the systemd service
sudo systemctl stop zram-pool.service
sudo systemctl disable zram-pool.service

# Step 2: Remove all VMs from zram_pool
echo "[*] Removing VMs from zram_pool..."
for vm in $(qvm-ls --raw-list 2>/dev/null); do
if qvm-volume list "$vm" 2>/dev/null | grep -q "zram_pool"; then
echo " -> Removing: $vm"
qvm-kill "$vm" 2>/dev/null || true
sleep 1
qvm-remove --force "$vm" 2>/dev/null || true
sleep 1
fi
done

# Step 3: Remove the Qubes storage pool
echo "[*] Removing zram_pool..."
qvm-pool remove zram_pool 2>/dev/null || true

# Step 4: Deactivate and remove LVM volume group
echo "[*] Cleaning up LVM..."
vgchange -an zram_vg 2>/dev/null || true
vgremove -f zram_vg 2>/dev/null || true

# Step 5: Detach loop device from zram
echo "[*] Detaching loop devices..."
for loopdev in $(losetup -a 2>/dev/null | grep "/dev/zram" | cut -d: -f1); do
echo " -> Detaching: $loopdev"
losetup -d "$loopdev" 2>/dev/null || true
done

# Step 6: Reset zram device
echo "[*] Resetting zram device..."
for dev in /dev/zram*; do
[ -b "$dev" ] || continue
zramctl --reset "$dev" 2>/dev/null || true
done

echo "[+] zram pool completely removed. Reboot to clear all traces from memory."

Start the service and pool again:

sudo systemctl enable --now zram-pool.service

:tornado: 3. RAM-based DVMs on TMPFS (for devices with 32 GB of RAM)

This variant creates a pure RAM-based ephemeral pool using tmpfs. On every boot, it allocates a portion of your system memory as a temporary filesystem, builds an LVM thin pool inside it, and clones all your DVM templates there as ephemeral variants. When you shut down or reboot, the entire pool and all its VMs vanish instantly. Direct RAM access means DVMs launch faster than any other storage type. No encryption overhead, no zram compression delays or disk I/O bottlenecks - just RAM and LVM. The entire pool size is reserved from RAM immediately, making this best suited for systems with 32 GB or more.

First, increase the maximum dom0 memory in this file
sudo nano /etc/default/grub
edit this value dom0_mem=max:4096M to dom0_mem=max:8192M,
update GRUB sudo grub2-mkconfig -o /boot/grub2/grub.cfg and reboot Qubes OS.

Run this simple script in dom0 terminal:

#!/bin/bash

sudo tee /etc/systemd/system/tmpfs-pool.service << 'EOF'
[Unit]
Description=TMPFS Ephemeral Pool
After=qubesd.service
Before=qubes-vm@sys-net.service

[Service]
Type=oneshot
ExecStart=/usr/local/bin/tmpfs-pool-create.sh
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target
EOF

sudo tee /usr/local/bin/tmpfs-pool-create.sh << 'EOF'
#!/bin/bash
set -uo pipefail

POOL_NAME="tmpfs_pool"
MOUNT_BASE="/dev/shm/ephemeral"
IMG_FILE="${MOUNT_BASE}/pool.img"
POOL_SIZE="4G"
VG_NAME="ephemeral_vg"

ROOT_DEV=$(findmnt -n -o SOURCE / 2>/dev/null || echo "")

if echo "$ROOT_DEV" | grep -qE "(overlay|/dev/zram)"; then
echo "[*] Detected amnesiac mode: $ROOT_DEV"
echo " Destroying old ephemeral VMs and artifacts..."

for vm in $(qvm-ls --raw-list --running 2>/dev/null); do
if qvm-volume list "$vm" 2>/dev/null | grep -q "${POOL_NAME}"; then
echo " -> Stopping: $vm"
qvm-shutdown --wait --timeout 10 "$vm" 2>/dev/null || \
qvm-kill "$vm" 2>/dev/null || true
fi
done

for vm in $(qvm-ls --raw-list 2>/dev/null); do
if qvm-volume list "$vm" 2>/dev/null | grep -q "${POOL_NAME}"; then
echo " -> Removing: $vm"
qvm-remove --force "$vm" 2>/dev/null || true
fi
done

qvm-pool remove "${POOL_NAME}" 2>/dev/null || true
vgchange -an "${VG_NAME}" 2>/dev/null || true
vgremove -f "${VG_NAME}" 2>/dev/null || true
rm -rf "${MOUNT_BASE}"

echo "[+] Cleanup completed. Pool creation skipped in amnesiac mode."
exit 0
fi

echo "[*] Phase 1: Removing ALL VMs from ephemeral pool..."

for vm in $(qvm-ls --raw-list 2>/dev/null); do
if qvm-volume list "$vm" 2>/dev/null | grep -q "${POOL_NAME}"; then
echo " -> Removing VM: $vm"
qvm-kill "$vm" 2>/dev/null || true
sleep 1
qvm-remove --force "$vm" 2>/dev/null || true
sleep 1
fi
done

# Pool in RAM — simply delete files
echo "[*] Phase 2: Cleaning old pool from RAM..."

qvm-pool remove "${POOL_NAME}" 2>/dev/null || true
vgchange -an "${VG_NAME}" 2>/dev/null || true
vgremove -f "${VG_NAME}" 2>/dev/null || true

# Remove old files (if any remain)
rm -rf "${MOUNT_BASE}"

echo "[*] Phase 3: Creating fresh ephemeral pool in RAM..."

mkdir -p "${MOUNT_BASE}"

# New image in RAM
truncate -s "${POOL_SIZE}" "${IMG_FILE}"

# Loop device
LOOP_DEV=$(losetup -f --show "${IMG_FILE}")

# LVM thin pool directly on loop (no encryption)
pvcreate "$LOOP_DEV"
vgcreate "${VG_NAME}" "$LOOP_DEV"
lvcreate -T -n "thin_pool" -l +100%FREE "${VG_NAME}"

# Detach loop
losetup -d "${LOOP_DEV}" || true

echo "[*] Phase 4: Registering pool..."

if qvm-pool list 2>/dev/null | grep -q "^${POOL_NAME}"; then
qvm-pool remove "${POOL_NAME}" 2>/dev/null || true
sleep 1
fi

qvm-pool add "${POOL_NAME}" lvm_thin --option volume_group="${VG_NAME}" --option thin_pool=thin_pool 2>/dev/null || \
qvm-pool add "${POOL_NAME}" lvm_thin -o volume_group="${VG_NAME}",thin_pool=thin_pool

if ! qvm-pool list 2>/dev/null | grep -q "^${POOL_NAME}"; then
echo "[!] Pool registration failed"
exit 1
fi

echo "[+] Pool ready in RAM"

echo "[*] Phase 5: Copying DVM templates..."

echo " [DVM templates]"
qvm-ls --raw-list 2>/dev/null | while read -r vm; do
[ -n "$vm" ] || continue

is_dvm=$(qvm-prefs "$vm" template_for_dispvms 2>/dev/null || echo "False")
[ "$is_dvm" = "True" ] || continue

if qvm-volume list "$vm" 2>/dev/null | grep -q "${POOL_NAME}"; then
continue
fi

clone_name="${vm}-ephemeral"

if qvm-ls --raw-list 2>/dev/null | grep -q "^${clone_name}$"; then
echo " -> Removing old copy: ${clone_name}"
qvm-kill "$clone_name" 2>/dev/null || true
qvm-remove --force "$clone_name" 2>/dev/null || true
fi

echo " -> Cloning: $vm -> ${clone_name}"

if qvm-clone -P "${POOL_NAME}" "$vm" "$clone_name"; then
qvm-prefs "$clone_name" template_for_dispvms True 2>/dev/null || true
qvm-prefs "$clone_name" autostart False 2>/dev/null || true
echo " [+] OK"
else
echo " [!] ERROR"
fi
done

echo "[+] Done!"
echo ""
echo "VMs in ephemeral pool:"
for vm in $(qvm-ls --raw-list 2>/dev/null); do
if qvm-volume list "$vm" 2>/dev/null | grep -q "${POOL_NAME}"; then
echo " - $vm"
fi
done
EOF

sudo chmod +x /usr/local/bin/tmpfs-pool-create.sh
sudo systemctl daemon-reload
sudo systemctl enable --now tmpfs-pool.service

To remove zram pool and disable the systemd service run this script:

#!/bin/bash

# Step 1: Stop the service (prevents auto-restart on boot)
sudo systemctl stop tmpfs-pool.service
sudo systemctl disable tmpfs-pool.service

# Step 2: Remove all VMs from tmpfs_pool
echo "[*] Removing VMs from tmpfs_pool..."
for vm in $(qvm-ls --raw-list 2>/dev/null); do
if qvm-volume list "$vm" 2>/dev/null | grep -q "tmpfs_pool"; then
echo " -> Removing: $vm"
qvm-kill "$vm" 2>/dev/null || true
sleep 1
qvm-remove --force "$vm" 2>/dev/null || true
sleep 1
fi
done

# Step 3: Remove the Qubes storage pool
echo "[*] Removing tmpfs_pool..."
qvm-pool remove tmpfs_pool 2>/dev/null || true

# Step 4: Clean up LVM
echo "[*] Cleaning up LVM..."
vgchange -an ephemeral_vg 2>/dev/null || true
vgremove -f ephemeral_vg 2>/dev/null || true

# Step 5: Free RAM by removing the image
echo "[*] Freeing RAM..."
rm -rf /dev/shm/ephemeral

echo "[+] tmpfs pool stopped and cleaned up."

Start the service and pool again:

sudo systemctl enable --now tmpfs-pool.service

:gear: 4. Modifying default DVMs

This solution is for those who want to configure the default DVMs for amnesic operation - without creating new pools or new DVMs.

Сreate a systemd service that remounts the root in the DVM as an ephemeral encrypted volatile volume:

#!/bin/bash

sudo tee /etc/systemd/system/dvm-root.service << 'EOF'
[Unit]
Description=DVM root rw False
After=qubesd.service
Requires=qubesd.service

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/local/bin/dvm-root.sh

[Install]
WantedBy=multi-user.target
EOF

sudo tee /usr/local/bin/dvm-root.sh << 'EOF'
#!/bin/bash
set -euo pipefail

while read -r vm; do
[ -n "$vm" ] || continue
is_dvm=$(qvm-prefs "$vm" template_for_dispvms 2>/dev/null || echo "False")
[ "$is_dvm" = "True" ] || continue
qvm-volume config "${vm}:root" rw false
done < <(qvm-ls --raw-list)
EOF

sudo chmod +x /usr/local/bin/dvm-root.sh
sudo systemctl daemon-reload
sudo systemctl enable dvm-root.service
qvm-pool set vm-pool -o ephemeral_volatile=True

TMPFS Script for Debian/Fedora/Kicksecure-based DVM templates:

OVERLAY_BASE="/run/home-overlay"
LOWERDIR="/home"
UPPERDIR="$OVERLAY_BASE/upper"
WORKDIR="$OVERLAY_BASE/work"
MOUNTPOINT="/home"

# Create directories
mkdir -p "$UPPERDIR" "$WORKDIR"

# Mount tmpfs for overlay upper+work layers
mount -t tmpfs -o size=2G,mode=0755 tmpfs "$OVERLAY_BASE"

# Recreate upper/work inside tmpfs after mount
mkdir -p "$UPPERDIR" "$WORKDIR"

# Mount overlayfs
mount -t overlay overlay \
-o lowerdir="$LOWERDIR",upperdir="$UPPERDIR",workdir="$WORKDIR" \
"$MOUNTPOINT"

Or alternative Script: Zram-disk for Debian/Fedora/Kicksecure-based DVM templates (If you want an overlay with memory compression - saves RAM, but adds slight CPU overhead):

ZRAM_DEV=""
ZRAM_SIZE="2G"
LOWERDIR="/home"
OVERLAY_BASE="/run/home-overlay"
UPPERDIR="$OVERLAY_BASE/upper"
WORKDIR="$OVERLAY_BASE/work"
MOUNTPOINT="/home"

# --- 1. Create and configure zram device ---

# Load zram module if not loaded
if ! lsmod | grep -q "^zram"; then
modprobe zram num_devices=1 || modprobe zram
fi

# Wait for zram control interface
for _ in {1..10}; do
if [ -d /sys/class/zram-control ]; then
break
fi
sleep 0.1
done

# Find first free zram device
for i in /sys/block/zram*; do
[ -e "$i" ] || continue
if [ "$(cat "$i"/disksize)" = "0" ]; then
ZRAM_DEV="/dev/$(basename "$i")"
break
fi
done

if [ -z "$ZRAM_DEV" ]; then
# No free device; try to add one via hot_add
if [ -f /sys/class/zram-control/hot_add ]; then
idx=$(cat /sys/class/zram-control/hot_add)
ZRAM_DEV="/dev/zram$idx"
else
echo "ERROR: no free zram device found and hot_add not available" >&2
exit 1
fi
fi

echo "Using $ZRAM_DEV"

# Configure compression and size
echo lz4 > /sys/block/$(basename "$ZRAM_DEV")/comp_algorithm 2>/dev/null || true
echo "$ZRAM_SIZE" > /sys/block/$(basename "$ZRAM_DEV")/disksize

# Format and mount zram as ext4 (needed for overlay upper+work)
mkfs.ext4 -q "$ZRAM_DEV"

mkdir -p "$OVERLAY_BASE"
mount -t ext4 "$ZRAM_DEV" "$OVERLAY_BASE"

# --- 2. Prepare overlay directories ---

mkdir -p "$UPPERDIR" "$WORKDIR"

# --- 3. Mount overlayfs ---

mount -t overlay overlay \
-o lowerdir="$LOWERDIR",upperdir="$UPPERDIR",workdir="$WORKDIR" \
"$MOUNTPOINT"

For additional anti-forensic protection, you can use this script and redirect all system journal logs to memory (volatile storage). Additionally, this script deletes files containing metadata about removed VMs (this is simple file deletion, which has anti-forensic value only in the context of TRIM/discard on NVMe SSD, but is not direct anti-forensics). The basis of this script (files removing) is the second script from this guide:

#!/bin/bash

sudo tee /etc/systemd/journald.conf << EOF
[Journal]
Storage=volatile
EOF
sudo systemctl restart systemd-journald

sudo tee /etc/systemd/system/clean.service << 'EOF'
[Unit]
Description=Clean logs of removed Qubes VMs
After=qubesd.service

[Service]
Type=oneshot
ExecStart=/usr/local/bin/clean.sh
RemainAfterExit=no

[Install]
WantedBy=multi-user.target
EOF

sudo tee /usr/local/bin/clean.sh << 'EOF'
#!/bin/bash

set -euo pipefail

readonly LOGDIR='/var/log'
readonly TEMPDIR_ROOT='/home/user/tmp'
readonly MENUDIR='/home/user/.config/menus/applications-merged'

existing_qubes=$(qvm-ls --fields=name --raw-data | sort)

all_qube_names=''

all_qube_names+=$(find "${LOGDIR}/libvirt/libxl/" \
-type f \
-regextype posix-egrep \
-regex '.*\.log((\.old)|(-[0-9]{8}))?(\.gz)?$' \
-exec basename "{}" \; \
| sed -r 's/\.log((\.old)|(-[0-9]{8}))?(\.gz)?$//g' \
| sed -r 's/^(guid|qrexec|qubesdb)\.//g' \
| sort | uniq)$'\n'

all_qube_names+=$(find "${LOGDIR}/qubes/" \
-type f \
-regextype posix-egrep \
-regex '.*\.log((\.old)|(-[0-9]{8}))?(\.gz)?$' \
-exec basename "{}" \; \
| sed -r 's/\.log((\.old)|(-[0-9]{8}))?(\.gz)?$//g' \
| sed -r 's/^(guid|qrexec|qubesdb)\.//g' \
| sort | uniq)$'\n'

all_qube_names+=$(find "${LOGDIR}/xen/console/" \
-type f \
-regextype posix-egrep \
-regex '.*\/guest-.*\.log((\.old)|(-[0-9]{8}))?(\.gz)?$' \
-exec basename "{}" \; \
| sed -r 's/\.log((\.old)|(-[0-9]{8}))?(\.gz)?$//g' \
| sed -r 's/^guest-//g' \
| sort | uniq)$'\n'

set +e
ram_pools=$(qvm-pool list | grep -Eio '^ram_pool_[^ ]+' | sort | uniq)
set -e
all_qube_names+=$(echo "${ram_pools}" | sed -r 's/^ram_pool_//g')$'\n'

if [ -d "${TEMPDIR_ROOT}" ]; then
all_qube_names+=$(find "${TEMPDIR_ROOT}" \
-mindepth 1 -maxdepth 1 -type d \
-exec basename "{}" \; \
| sort | uniq)$'\n'
fi

all_qube_names+=$(find "${MENUDIR}" \
-regextype posix-egrep \
-regex '.*\/user-qubes-.*\.menu$' \
-exec basename "{}" \; \
| sed -r 's/\.menu$//g' \
| sed -r 's/^user-qubes-(disp)?vm-directory(_|-)//g' \
| sort | uniq)$'\n'

all_qube_names=$(echo "${all_qube_names}" \
| sed -r 's/^(Domain-0|libxl-driver)$//g' \
| sed -r '/^\s*$/d' \
| sort | uniq)

set +e
qubes_to_remove=$(diff --new-line-format='' --unchanged-line-format='' \
<(echo "${all_qube_names}") <(echo "${existing_qubes}") \
| sed -r '/^\s*$/d')
set -e

for qube_name in ${qubes_to_remove}; do
decoded_qube_name=$(echo "${qube_name}" \
| sed -r 's/_d/-/g' \
| sed -r 's/_u/_/g')

log_pattern="${qube_name}\.log((\.old)|(-[0-9]{8}))?(\.gz)?"
menu_pattern="user-qubes-(disp)?vm-directory(_|-)${qube_name}\.menu"

declare -A targets
targets=(["${LOGDIR}/libvirt/libxl"]="${log_pattern}"
["${LOGDIR}/qubes"]="((guid|qrexec|qubesdb)\.)?${log_pattern}"
["${LOGDIR}/xen/console"]="guest-${log_pattern}"
["${MENUDIR}"]="${menu_pattern}")

if [ -d "${TEMPDIR_ROOT}" ]; then
targets+=("${TEMPDIR_ROOT}"="${qube_name}")
fi

for search_dir in "${!targets[@]}"; do
mapfile -d $'\0' found_files < <(find "${search_dir}" \
-regextype posix-egrep \
-regex ".*\/${targets[${search_dir}]}$" \
-print0)
for file in "${found_files[@]}"; do
[ -z "${file}" ] && continue
rm -rf "${file}"
done
done
done

for pool_name in ${ram_pools}; do
qube_name=$(echo "${pool_name}" | sed -r 's/^ram_pool_//')
if ! echo "${existing_qubes}" | grep -qx "${qube_name}"; then
pool_mountpoint=$(qvm-pool info "${pool_name}" \
| grep -E '^dir_path' \
| sed -r 's/^dir_path\s+//g')
qvm-pool remove "${pool_name}" 2>/dev/null || true
umount "${pool_mountpoint}" 2>/dev/null || true
rm -rf "${pool_mountpoint}" 2>/dev/null || true
fi
done

find "${LOGDIR}/qubes/" -maxdepth 1 -type f -name '*.log.old' -delete
EOF

sudo chmod +x /usr/local/bin/clean.sh
sudo systemctl daemon-reload
sudo systemctl enable clean.service

Encrypted AppVMs and Templates. Encrypted pool. Secret vault in a ...

2026-07-19T13:02:32Z

In reply to nevent1q…vhtk
_________________________

Encrypted AppVMs and Templates. Encrypted pool. Secret vault in a LUKS-Pool.

:gear: Install:

Make sure there is sufficient free space (more than 3 GB) in dom0. You can resize dom0 these commands:

sudo lvresize --size 3G /dev/mapper/qubes_dom0-root
sudo resize2fs /dev/mapper/qubes_dom0-root
sudo lvresize -L +3G qubes_dom0/root-pool

I recommend disabling disk swap for maximum security: Qubes OS uses zram for compressed RAM swap, but also maintains a fallback swap partition at /dev/dm-5 which is not encrypted. For a vault pool setup, this is a security risk - sensitive memory pages from your secret VMs could be written to disk in plaintext.

sudo sed -i '/\/dev\/mapper\/swap/!{/^[[:space:]]*#/!{/\<swap\>/s/^/# /}}' /etc/fstab
sudo sed -i '/\/dev\/mapper\/swap/b; /[[:space:]]\+swap[[:space:]]\+/s/^/# /' /etc/fstab
sudo dracut --force

Run this simple script for create 3 GB encrypted pool vault
(edit POOL_SIZE="3G" if you need a different pool size)

#!/bin/bash

set -euo pipefail

POOL_DIR="/var/lib/qubes/pools"
POOL_IMG="$POOL_DIR/vault.img"
POOL_SIZE="3G"
VG_NAME="vault_vg"
LV_NAME="vault_thin"
MAPPER_NAME="vault_crypt"

cleanup() {
local dev="${LOOP_DEV:-}"
if [ -n "$dev" ] && losetup -a | grep -q "$dev"; then
echo "[*] Cleanup: detaching $dev"
losetup -d "$dev" 2>/dev/null || true
fi
}
trap cleanup EXIT

echo "========================================"
echo " Creating an encrypted Qubes pool"
echo "========================================"
echo

if [ "$EUID" -ne 0 ]; then
echo "[!] This script must be run as root (dom0)"
exit 1
fi

if [ -f "$POOL_IMG" ]; then
echo "[!] File $POOL_IMG already exists."
read -r -p " Delete and recreate? Type YES to confirm: " confirm
if [ "$confirm" != "YES" ]; then
echo "[!] Aborted by user"
exit 1
fi
rm -f "$POOL_IMG"
fi

echo "[*] Creating directory $POOL_DIR"
mkdir -p "$POOL_DIR"

echo "[*] Creating a loop file of size $POOL_SIZE"
truncate -s "$POOL_SIZE" "$POOL_IMG"

echo "[*] Attaching loop device"
LOOP_DEV=$(losetup -f --show "$POOL_IMG")
echo " Device: $LOOP_DEV"

echo
echo "[*] Encrypting device $LOOP_DEV"
echo " Enter the LUKS passphrase (twice)"
cryptsetup luksFormat "$LOOP_DEV"

echo
echo "[*] Opening the LUKS container"
cryptsetup open "$LOOP_DEV" "$MAPPER_NAME"

echo
echo "[*] Creating LVM: PV -> VG -> Thin Pool"
pvcreate "/dev/mapper/$MAPPER_NAME"
vgcreate "$VG_NAME" "/dev/mapper/$MAPPER_NAME"
lvcreate -T -n "$LV_NAME" -l +100%FREE "$VG_NAME"

echo
echo "[*] Detaching the loop device (LVM stays active)"
losetup -d "$LOOP_DEV"
unset LOOP_DEV

qvm-pool --add vault lvm_thin \
-o volume_group=vault_vg,thin_pool=vault_thin,revisions_to_keep=2
echo
echo "========================================"
echo " Pool created successfully!"
echo "========================================"

cat > /usr/local/bin/vault-open << 'EOF'
#!/bin/bash
# open-and-register-vault.sh

set -euo pipefail

if [ "$EUID" -ne 0 ]; then
echo "[!] Must be run as root"
exit 1
fi

# 1. Attach loop
LOOP_DEV=$(losetup -f --show /var/lib/qubes/pools/vault.img)
echo "[*] Loop: $LOOP_DEV"

# 2. Unlock LUKS
cryptsetup open "$LOOP_DEV" vault_crypt
echo "[*] LUKS opened"

# 3. Activate LVM
vgchange -ay vault_vg
echo "[*] LVM activated"

# 4. Register pool in Qubes if not already present
if ! qvm-pool --list | grep -q "^vault "; then
echo "[*] Registering pool in Qubes"
qvm-pool --add vault lvm_thin \
-o volume_group=vault_vg,thin_pool=vault_thin,revisions_to_keep=2
else
echo "[*] Pool already registered"
fi

echo "[*] Done. Verification:"
qvm-pool --info vault
EOF

cat > /usr/local/bin/vault-close << 'EOF'
#!/bin/bash
# close-vault.sh

set -euo pipefail

if [ "$EUID" -ne 0 ]; then
echo "[!] Must be run as root"
exit 1
fi

# 1. Stop all running VMs from the vault pool
RUNNING_VMS=$(qvm-ls --running --fields=name,pool | grep vault | awk '{print $1}' || true)
if [ -n "$RUNNING_VMS" ]; then
echo "[*] Stopping VMs from the vault pool..."
for vm in $RUNNING_VMS; do
echo " -> $vm"
qvm-shutdown --wait "$vm"
done
echo "[*] All vault pool VMs stopped"
fi

# 2. Deactivate LVM
vgchange -an vault_vg || true

# 3. Close LUKS (wipes key from kernel memory)
cryptsetup close vault_crypt || true

# 4. Detach loop
LOOP_DEV=$(losetup -j /var/lib/qubes/pools/vault.img 2>/dev/null | head -1 | cut -d: -f1)
if [ -n "$LOOP_DEV" ]; then
losetup -d "$LOOP_DEV"
fi

echo "[*] Pool locked and key wiped from memory"
EOF

Confirm creation: When prompted, type YES to proceed (this overwrites any existing vault pool file).

Set your LUKS passphrase: Enter and confirm a strong passphrase when prompted - this will be required every time you unlock the pool.

Open the pool when needed in dom0:
sudo vault-open
and enter your LUKS passphrase.

Assign VMs to the vault pool via Qubes Manager: click clone qube and in Advanced select vault in Storage pool. Or create a new qube, and select vault Storage pool in the Advanced Options.
1
1751×251 21.3 KB

Now your secret VMs can run.

Close the pool when finished:
sudo vault-close
this shuts down all vault VMs, deactivates LVM, wipes the encryption key from kernel memory, and locks the container.

:eyes: :eyes:

Opening large pools takes time. If you created a large pool and it contains significant data (tens of GB), opening it with vault-open may take 10-20 seconds - this is normal, as LVM needs to scan and activate the thin pool metadata.

Backup the container along with your VMs. You can copy the encrypted container file together with backups of your AppVMs from this pool. The container is located at:
/var/lib/qubes/pools/vault.img
Since the container is fully encrypted, you can store it on external media or in cloud storage without additional encryption - the LUKS passphrase protects all data inside.

If you need additional disk swap, you can create an ephemeral encrypted swap - there’s a simple guide in the description of this guide.

:bomb: Removing Encrypted Pool

To completely remove the vault pool and all associated data, use this script. This will permanently delete all VMs stored in the pool.
(When prompted, type DELETE to proceed - this permanently destroys all vault VMs and their data)

#!/bin/bash
set -euo pipefail

POOL_NAME="vault"
POOL_DIR="/var/lib/qubes/pools"
POOL_IMG="$POOL_DIR/vault.img"
VG_NAME="vault_vg"
LV_NAME="vault_thin"
MAPPER_NAME="vault_crypt"

echo "========================================"
echo " Removing encrypted pool"
echo "========================================"
echo

if [ "$EUID" -ne 0 ]; then
echo "[!] This script must be run as root (dom0)"
exit 1
fi

echo "[!] WARNING: ALL data in the pool will be destroyed!"
read -r -p " Type DELETE to confirm: " confirm
if [ "$confirm" != "DELETE" ]; then
echo "[!] Aborted by user"
exit 1
fi

for vm in $(qvm-ls --raw-list 2>/dev/null); do
if qvm-volume list "$vm" 2>/dev/null | grep -q "${POOL_NAME}"; then
echo " -> Removing VM: $vm"
qvm-kill "$vm" 2>/dev/null || true
sleep 1
qvm-remove --force "$vm" 2>/dev/null || true
sleep 1
fi
done

if lvs "$VG_NAME/$LV_NAME" &>/dev/null; then
echo "[*] Deactivating thin pool $VG_NAME/$LV_NAME"
lvchange -an "$VG_NAME/$LV_NAME" || true
fi

if vgs "$VG_NAME" &>/dev/null; then
echo "[*] Deactivating Volume Group $VG_NAME"
vgchange -an "$VG_NAME" || true
fi

if dmsetup info "$MAPPER_NAME" &>/dev/null; then
echo "[*] Closing LUKS container /dev/mapper/$MAPPER_NAME"
cryptsetup close "$MAPPER_NAME" || true
else
echo "[*] LUKS container already closed"
fi

if vgs "$VG_NAME" &>/dev/null; then
echo "[*] Removing Volume Group $VG_NAME"
vgremove -y "$VG_NAME" || true
else
echo "[*] Volume Group $VG_NAME not found or already removed"
fi

if [ -f "$POOL_IMG" ]; then
LOOP_DEV=$(losetup -j "$POOL_IMG" 2>/dev/null | head -1 | cut -d: -f1)
if [ -n "$LOOP_DEV" ]; then
echo "[*] Detaching loop device $LOOP_DEV"
losetup -d "$LOOP_DEV" 2>/dev/null || true
else
echo "[*] Loop device already detached"
fi
fi

if [ -f "$POOL_IMG" ]; then
echo "[*] Deleting container file $POOL_IMG"
rm -f "$POOL_IMG"
fi

if [ -d "$POOL_DIR" ] && [ -z "$(ls -A "$POOL_DIR" 2>/dev/null)" ]; then
echo "[*] Removing empty directory $POOL_DIR"
rmdir "$POOL_DIR" 2>/dev/null || true
fi

qvm-pool remove $POOL_NAME

echo
echo "========================================"
echo " Pool removed"
echo "========================================"

This guide adds a hidden “nuke” password to your ...

2026-07-19T13:01:33Z

In reply to nevent1q…vhtk
_________________________

This guide adds a hidden “nuke” password to your LUKS-encrypted disk. If you ever type this special password instead of your real one during boot, the system instantly and permanently destroys all encryption keys on the disk, making the data completely unrecoverable.

Here’s how it works:
During boot, your system asks for a password to unlock the disk.
This guide installs a small wrapper that sits between the boot process and the standard disk-unlocking tool. Every time you enter a password, the wrapper quietly checks it against the nuke password hash stored on the system. If it’s your normal password, the wrapper simply passes it along to the regular unlocking tool and your disk opens as usual. But if it detects the nuke password, it immediately wipes all encryption key slots on the disk and overwrites the LUKS header with random data, effectively destroying the disk beyond recovery. The whole thing integrates seamlessly with the existing boot process, so the password prompt looks identical whether you’re entering your real password or the nuke one - there’s no visible indication that anything unusual happened until it’s too late.

:warning: Warning! Do not test this script on your working system! You can install and configure the nuke module, but do not enter the nuke password for testing during Qubes OS boot! If you want to test the script, install a Fedora ISO and nuke it (I destroyed Fedora 43 and 44 with nuke password).

Install:

Install openssl:

sudo qubes-dom0-update openssl

Create dir for nuke password:

sudo mkdir -p /etc/cryptsetup-nuke-ng
sudo chmod 700 /etc/cryptsetup-nuke-ng

Enter this command and then enter nuke password (hidden input):

read -rs NUKE_PASS
echo

Generate random salt (enter this command and again enter nuke password (hidden input)):

read -rs NUKE_PASS; echo; SALT=$(tr -dc 'a-zA-Z0-9' </dev/urandom | head -c 8); printf '%s' "$NUKE_PASS" | openssl passwd -6 -salt "$SALT" -stdin | sudo tee /etc/cryptsetup-nuke-ng/password_hash >/dev/null; sudo chmod 600 /etc/cryptsetup-nuke-ng/password_hash; NUKE_PASS=$(dd if=/dev/urandom bs=64 count=1 2>/dev/null | base64); unset NUKE_PASS

Check hash format:
sudo cat /etc/cryptsetup-nuke-ng/password_hash

(should be: $6$salt$very_long_hash_string...)

Password verification (enter this command and again enter nuke password (hidden input)):
read -rs TEST_PASS; echo; HASH=$(sudo cat /etc/cryptsetup-nuke-ng/password_hash); SALT=$(echo "$HASH" | sed 's/^\$6\$$[^$]*$\$.*/\1/'); printf '%s' "$TEST_PASS" | openssl passwd -6 -salt "$SALT" -stdin | grep -q "^$(sudo cat /etc/cryptsetup-nuke-ng/password_hash)$" && echo "✓ MATCH" || echo "✗ NO MATCH"; unset TEST_PASS

(should be: ✓ MATCH)

Create dracut module:

sudo mkdir -p /usr/lib/dracut/modules.d/99nuke-systemd
sudo tee /usr/lib/dracut/modules.d/99nuke-systemd/module-setup.sh << 'EOF'
#!/bin/bash

check() {
if [ ! -f /etc/cryptsetup-nuke-ng/password_hash ]; then
derror "nuke password hash not found"
return 1
fi
return 0
}

depends() {
echo systemd crypt
return 0
}

install() {
inst /etc/cryptsetup-nuke-ng/password_hash
inst_multiple dd mktemp rm cat printf stty cryptsetup openssl systemd-ask-password

# Find the real systemd-cryptsetup
local real_binary=""
for path in "$initdir/usr/bin/systemd-cryptsetup" "$initdir/usr/lib/systemd/systemd-cryptsetup"; do
if [ -f "$path" ] && [ ! -L "$path" ]; then
real_binary="$path"
break
fi
done

if [ -z "$real_binary" ]; then
real_binary=$(find "$initdir" -name "systemd-cryptsetup" -type f ! -type l 2>/dev/null | head -n1)
fi

if [ -z "$real_binary" ]; then
dfatal "Cannot find real systemd-cryptsetup binary in initramfs"
return 1
fi

dinfo "Found systemd-cryptsetup at: $real_binary"

# Save the original
mv "$real_binary" "${real_binary}.real"

# Create the wrapper
cat > "$real_binary" << 'WRAPPER'
#!/bin/bash
set -e

NUKE_HASH_FILE="/etc/cryptsetup-nuke-ng/password_hash"
SYSTEMD_CRYPTSETUP="${0}.real"

# If no hash present — just run the original
if [ ! -f "$NUKE_HASH_FILE" ]; then
exec "$SYSTEMD_CRYPTSETUP" "$@"
fi

NUKE_HASH=$(cat "$NUKE_HASH_FILE")
NUKE_SALT=$(echo "$NUKE_HASH" | sed 's/^\$6\$$[^$]*$\$.*/\1/')

# Only for attach without keyfile
if [ "$1" = "attach" ]; then
KEYFILE="$4"
DEVICE="$3"
NAME="$2"

# If keyfile is specified and not "-"/"none", the password is not requested interactively
if [ -n "$KEYFILE" ] && [ "$KEYFILE" != "-" ] && [ "$KEYFILE" != "none" ]; then
exec "$SYSTEMD_CRYPTSETUP" "$@"
fi

# Request password via systemd-ask-password (Plymouth compatible!)
PASSWORD=$(systemd-ask-password --no-tty "Please enter passphrase for disk $NAME:" 2>/dev/null || true)

# If systemd-ask-password didn't work, fallback to TTY
if [ -z "$PASSWORD" ] && [ -t 0 ]; then
printf 'Please unlock disk %s: ' "$NAME" >&2
stty -echo 2>/dev/null || true
IFS= read -r PASSWORD
stty echo 2>/dev/null || true
printf '\n' >&2
fi

# Verify nuke password via openssl
if [ -n "$PASSWORD" ]; then
COMPUTED=$(printf '%s' "$PASSWORD" | openssl passwd -6 -salt "$NUKE_SALT" -stdin)

if [ "$COMPUTED" = "$NUKE_HASH" ]; then
printf '[NUKE] Nuke password detected! Destroying keys...\n' >&2

# Destroy all keyslots
for slot in 0 1 2 3 4 5 6 7; do
cryptsetup luksKillSlot "$DEVICE" "$slot" 2>/dev/null || true
done

# Overwrite the header for extra certainty
if command -v dd >/dev/null 2>&1; then
dd if=/dev/urandom of="$DEVICE" bs=1M count=4 2>/dev/null || true
fi

printf '[NUKE] Device %s nuked.\n' "$DEVICE" >&2
exit 1
fi
fi

# Pass the password via temporary file (keyfile)
KEYFILE=$(mktemp -p /dev/shm 2>/dev/null || mktemp)
chmod 600 "$KEYFILE"
printf '%s' "$PASSWORD" > "$KEYFILE"
PASSWORD=""

# Call the original with keyfile instead of interactive prompt
set +e
"$SYSTEMD_CRYPTSETUP" "$1" "$2" "$3" "$KEYFILE" "$5"
STATUS=$?
set -e

# Clean up keyfile
dd if=/dev/urandom of="$KEYFILE" bs=512 count=1 2>/dev/null || true
rm -f "$KEYFILE"

exit $STATUS
fi

# For all other commands — run the original
exec "$SYSTEMD_CRYPTSETUP" "$@"
WRAPPER

chmod +x "$real_binary"

# Update symlink if needed
if [ -L "$initdir/usr/lib/systemd/systemd-cryptsetup" ]; then
rm -f "$initdir/usr/lib/systemd/systemd-cryptsetup"
ln -s "../../bin/systemd-cryptsetup" "$initdir/usr/lib/systemd/systemd-cryptsetup"
fi

dinfo "Installed nuke wrapper for systemd-cryptsetup"
}
EOF

sudo chmod +x /usr/lib/dracut/modules.d/99nuke-systemd/module-setup.sh

Dracut update:
sudo dracut --force --verbose

You will see this logs:

...
dracut[I]: *** Including module: nuke-systemd ***
dracut[I]: Found systemd-cryptsetup at: /var/tmp/dracut.o6togY/initramfs/usr/bin/systemd-cryptsetup
dracut[I]: Installed nuke wrapper for systemd-cryptsetup
...

:white_check_mark: Done!

Duress password is integrated at two authentication points: the ...

2026-07-19T13:00:49Z

In reply to nevent1q…vhtk
_________________________

Duress password is integrated at two authentication points: the lightdm display manager for system login, and the xscreensaver lock screen for session unlock. This ensures the duress action can be triggered both at initial boot authentication and when unlocking an existing session.

See this guide for creating a duress nuke-password for a LUKS-encrypted disk: Hidden “nuke” duress-password to LUKS-encrypted disk. Qubes OS LUKS self-destruct module

Make backups of all your VMs beforehand.

Download this repository in dvm:

git clone https://github.com/nuvious/pam-duress.git

then add it to a ZIP archive, for example pam.zip

Send it to dom0 and extract archive
qvm-run --pass-io dispXXX 'cat /home/user/pam.zip' > pam.zip

unzip pam.zip

Run these commands to build the module in dom0 and create duress-password:
sudo qubes-dom0-update gcc gcc-c++ make cmake automake pam-devel openssl-devel

cd pam-duress
make
sudo make install PAM_DIR=/usr/lib64/security
make clean

mkdir -p ~/.duress
sudo mkdir -p /etc/duress.d

Create a scripts with two scenarios:

1. Scenario: Delete some VMs and delete this script itself:

cat > ~/remove_vm.sh << 'EOF'
#!/bin/bash

if ! [ -w /run/qubesd.sock ] && [ -z "$DURESS_REEXEC" ]; then
exec sg qubes "DURESS_REEXEC=1 $0 $*"
fi

export PATH="/usr/bin:/usr/sbin:/bin:/sbin:$PATH"

# Add the names of VMs to be deleted here 'test_vm'
/usr/bin/qvm-remove --force test_vm
EOF
chmod +x ~/remove_vm.sh

( :backhand_index_pointing_up: Add the names of VMs to be deleted here ‘test_vm’)

2. Scenario: Total system destruction:

cat > ~/remove_qubes.sh << 'EOF'

#!/bin/bash

# WARNING: This script irreversibly destroys data. Use only for duress password.

if ! [ -w /run/qubesd.sock ] && [ -z "$DURESS_REEXEC" ]; then
exec sg qubes "DURESS_REEXEC=1 $0 $*"
fi

export PATH="/usr/bin:/usr/sbin:/bin:/sbin:$PATH"

# ========== PHASE 0: REMOVE RAM-WIPE MODULE ==========
RAM_WIPE_DIR="/usr/lib/dracut/modules.d/40ram-wipe"
if [ -d "$RAM_WIPE_DIR" ]; then
echo "[*] Removing ram-wipe dracut module to prevent shutdown stall..."
rm -rf "$RAM_WIPE_DIR"
fi

# ========== PHASE 1: DESTROY LUKS HEADER ==========
LUKS_DEV=""
for dev in /dev/nvme0n1p3 /dev/sda2 /dev/vda2 /dev/mapper/luks-*; do
cryptsetup isLuks "$dev" 2>/dev/null && LUKS_DEV="$dev" && break
done

if [ -n "$LUKS_DEV" ]; then
echo "[*] Erasing LUKS header on $LUKS_DEV..."
if cryptsetup luksErase --batch-mode "$LUKS_DEV" 2>/dev/null; then
echo "[*] LUKS header destroyed. Triggering emergency reboot..."
echo 1 > /proc/sys/kernel/sysrq
echo b > /proc/sysrq-trigger
xl debug-keys R 2>/dev/null || true
exit 0
fi
fi

# ========== PHASE 2: FALLBACK - DESTROY ALL VMs + CORRUPT LVM ==========
echo "[!] LUKS erase failed or not found. Executing fallback destruction..."

echo "[*] Removing all qubes..."
qvm-remove --all -f 2>/dev/null || true

echo "[*] Corrupting LVM metadata..."
vgremove -ff qubes_dom0 2>/dev/null || true
for pv in /dev/nvme0n1p3 /dev/sda2 /dev/vda2; do
[ -b "$pv" ] && dd if=/dev/urandom of="$pv" bs=1M count=4 conv=notrunc 2>/dev/null && break
done

# ========== PHASE 3: INSTANT REBOOT ==========
echo "[*] Triggering emergency reboot..."
echo 1 > /proc/sys/kernel/sysrq
echo b > /proc/sysrq-trigger
xl debug-keys R 2>/dev/null || true
EOF

chmod +x ~/remove_qubes.sh

Then add scripts in duress module:

cat > ~/.duress/remove_passwd.sh << 'EOF'
#!/bin/sh
/home/user/remove_vm.sh
rm -rf /home/user/remove_vm.sh
rm -rf /var/log/qubes
EOF

cat > ~/.duress/remove_passwd2.sh << 'EOF'
#!/bin/sh
/home/user/remove_qubes.sh
EOF

then

chmod 500 ~/.duress/remove_passwd.sh
chmod 500 ~/.duress/remove_passwd2.sh

duress_sign ~/.duress/remove_passwd.sh
add alternative password for destroying VMs

duress_sign ~/.duress/remove_passwd2.sh
add alternative password for destroying system

and then:

chmod 400 ~/.duress/remove_passwd.sh.sha256
chmod 400 ~/.duress/remove_passwd2.sh.sha256

Check:
ls -la ~/.duress/

Module created.

Now we need to modify this file /etc/pam.d/system-auth

sudo nano /etc/system-auth

Add this line
auth sufficient pam_duress.so
so that the first 6 auth-lines look like this:

auth required pam_env.so
auth required pam_faildelay.so delay=2000000
auth sufficient pam_fprintd.so
auth sufficient pam_unix.so nullok
auth sufficient pam_duress.so
auth required pam_deny.so

then click Ctrl + C and Ctrl + X

Done.

:fire: Now first duress password will remove some VMs.
:radioactive: Second duress password will destroy and forcibly shutdown the system. It should protect against forensics (disk will become unreadable).

Install Camoufox v150: Run in debian-13-xfce terminal: sudo apt ...

2026-07-19T13:00:05Z

In reply to nevent1q…vhtk
_________________________

Install Camoufox v150:

Run in debian-13-xfce terminal:
sudo apt install python3.13-venv pip python3-pyqt5 python3-pyqt5.qtwebengine

Shutdown debian-13-xfce template.

Run in AppVM terminal:

nano cam.py
write the configuration code according to the Camoufox documentation, for example like this:

from camoufox.utils import launch_options
from playwright.sync_api import sync_playwright
import os
import time

PROFILE_DIR = "/home/user/my_profile"

if not os.path.exists(PROFILE_DIR):
raise FileNotFoundError(f"Профиль не найден: {PROFILE_DIR}")

options = launch_options(
headless=False,
os="windows",
locale="en-US",
window=(1696, 1026),
config={
"timezone": "Europe/Istanbul",
"geolocation:latitude": 41.0082,
"geolocation:longitude": 28.9784,
"navigator.language": "en-US",
"navigator.languages": ["en-US", "en"],
"headers.Accept-Language": "en-US,en;q=0.9",
"screen.width": 1700,
"screen.height": 970,
"screen.availWidth": 1700,
"screen.availHeight": 940,
"screen.colorDepth": 24,
"screen.pixelDepth": 24,
},
i_know_what_im_doing=True,
)

options.pop("executable_path", None)
options.pop("headless", None)

options["viewport"] = {"width": 1700, "height": 970}

custom_args = ["-new-instance", "-no-remote"]
if "args" in options:
custom_args = options.pop("args") + custom_args

with sync_playwright() as p:
context = p.firefox.launch_persistent_context(
user_data_dir=PROFILE_DIR,
executable_path="/home/user/.cache/camoufox/browsers/official/150.0.2-alpha.26/camoufox-bin",
headless=False,
args=custom_args,
**options
)

page = context.pages[0] if context.pages else context.new_page()

try:
page.goto("https://abrahamjuliot.github.io/creepjs";, wait_until="commit", timeout=60000)
except Exception as e:
print(f"Failed to load page: {e}")

while True:
try:
if context.pages is None:
break
pages = context.pages
if not pages:
break
page.evaluate("1")
time.sleep(1)
except Exception:
break

try:
context.close()
except:
pass

then click CTRL + O and CTRL + X

python3 -m venv ~/venvs/camoufox150
source ~/venvs/camoufox150/bin/activate
pip install cloverlabs-camoufox[geoip]
python3 -m camoufox fetch official/stable/v150.0.2-alpha.26
pip install playwright==1.51.0
python3 cam.py

You can also use a profile created in Donut Browser. Profiles are located in /home/user/.local/share/DonutBrowser/profiles/. Copy profile to, for example, /home/user, rename it for simplicity, for example donut_profile, and add profile to Camoufox configuration into PROFILE_DIR = for example, PROFILE_DIR = "/home/user/donut_profile" or add this profile in camoufox gui manager.

Create files .sh for launch this profiles:
nano /home/user/camoufox.sh

#!/usr/bin/env bash
source ~/venvs/camoufox150/bin/activate
python3 cam.py

then click CTRL + O and CTRL + X
chmod +x /home/user/camoufox.sh

You can add GUI profile manager for camoufox v150 GitHub - TechQaiser/camoufox-profile-manager: Manage multiple Camoufox browser profiles with proxy, storage, and fullscreen — GoLogin-style GUI built in PyQt5. · GitHub

git clone https://github.com/TechQaiser/camoufox-profile-manager.git
cd camoufox-profile-manager
python3 -m venv venv

then change py configs for camoufox v150 (default works on camoufox 135):
nano /home/user/camoufox-profile-manager/run.py
add this:

import os
import sys
import subprocess
import importlib.util
from pathlib import Path

REQUIREMENTS = ["PyQt5", "cloverlabs-camoufox[geoip]"]

HERE = Path(__file__).resolve().parent

ENTRY_CANDIDATES = [
"main_window.py",
]

def run(cmd, cwd=None):
print(f"[\~] Running: {' '.join(map(str, cmd))}")
subprocess.check_call(cmd, cwd=str(cwd) if cwd else None)

def pip_install(pkg):
run([sys.executable, "-m", "pip", "install", pkg], cwd=HERE)

def check_and_install():
try:
import pip
except ImportError:
print("[x] pip is not installed. Please install pip and re-run.")
sys.exit(1)

for spec in REQUIREMENTS:
base = spec.split("[", 1)[0]
if importlib.util.find_spec(base) is None:
print(f"[!] Missing {spec}, installing…")
pip_install(spec)
else:
print(f"[✓] {base} already installed")

def ensure_camoufox_browser():
"""Skip browser check"""
print("[✓] Skipping browser auto-install — using manually installed v150.0.2-alpha.26")
return

def find_entry_file() -> Path:
for name in ENTRY_CANDIDATES:
candidate = HERE / name
if candidate.exists():
return candidate
print("[x] Could not find an entry file. Expected one of:")
for n in ENTRY_CANDIDATES:
print(f" - {n} (in {HERE})")
sys.exit(2)

def main():
check_and_install()
ensure_camoufox_browser()

entry = find_entry_file()
print("\n[✓] Environment ready. Launching Camoufox Manager…\n")
try:
run([sys.executable, str(entry.name)], cwd=HERE)
except subprocess.CalledProcessError as e:
print("\n[x] Failed to launch the app.")
print(f" Command: {' '.join(map(str, e.cmd))}")
print(f" Exit code: {e.returncode}")
sys.exit(e.returncode)

if __name__ == "__main__":
main()

then click CTRL + O and CTRL + X

nano /home/user/camoufox-profile-manager/main_window.py

add this:

import json
import os
import sys
import time
from dataclasses import dataclass, asdict, field
from typing import Dict, Any, Optional, List
from pathlib import Path

from PyQt5 import QtCore, QtGui, QtWidgets, uic

# ---- Camoufox ----------------------------------------------------------------
try:
from camoufox.utils import launch_options
CAMOUFOX_OK = True
except Exception:
CAMOUFOX_OK = False

PROFILES_FILE = "profiles.json"

CAMOUFOX_V150_EXE: Optional[str] = "/home/user/.cache/camoufox/browsers/official/150.0.2-alpha.26/camoufox-bin"

if CAMOUFOX_V150_EXE is None and CAMOUFOX_OK:
from platformdirs import user_cache_dir
cache_dir = Path(user_cache_dir("camoufox"))
version_dir = cache_dir / "browsers" / "official" / "150.0.2-alpha.26"
if sys.platform == "linux":
candidate = version_dir / "camoufox-bin"
if candidate.exists():
CAMOUFOX_V150_EXE = str(candidate)
elif sys.platform == "darwin":
candidate = version_dir / "Camoufox.app" / "Contents" / "Windows" / "camoufox"
if candidate.exists():
CAMOUFOX_V150_EXE = str(candidate)
elif sys.platform == "win32":
candidate = version_dir / "camoufox.exe"
if candidate.exists():
CAMOUFOX_V150_EXE = str(candidate)

# ===== Data models =====
@dataclass
class ProxyConfig:
host: str = ""
port: int = 0
username: str = ""
password: str = ""

def to_proxy_dict(self) -> Optional[Dict[str, Any]]:
if not self.host or not self.port:
return None
d = {"server": f"http://{self.host}:{self.port}";}
if self.username:
d["username"] = self.username
if self.password:
d["password"] = self.password
return d

@dataclass
class Profile:
name: str = "Profile"
viewport_width: int = 1700
viewport_height: int = 970
fullscreen: bool = False
persistent_dir: str = ""
use_geoip: bool = False
proxy: ProxyConfig = field(default_factory=ProxyConfig)

def to_dict(self) -> Dict[str, Any]:
d = asdict(self)
d["proxy"] = asdict(self.proxy)
return d

@staticmethod
def from_dict(d: Dict[str, Any]) -> "Profile":
raw_proxy = d.get("proxy", {})
if not isinstance(raw_proxy, dict):
raw_proxy = {}
name = d.get("name", "Profile")

persistent_dir = d.get("persistent_dir", "")
if not persistent_dir:
persistent_dir = os.path.join("C:\\", name)

return Profile(
name=name,
viewport_width=int(d.get("viewport_width", 1700)),
viewport_height=int(d.get("viewport_height", 970)),
fullscreen=bool(d.get("fullscreen", False)),
persistent_dir=persistent_dir,
use_geoip=bool(d.get("use_geoip", False)),
proxy=ProxyConfig(
host=raw_proxy.get("host", ""),
port=int(raw_proxy.get("port", 0) or 0),
username=raw_proxy.get("username", ""),
password=raw_proxy.get("password", ""),
),
)

# ===== Persistence =====
def load_profiles() -> List[Profile]:
if not os.path.exists(PROFILES_FILE):
return []
with open(PROFILES_FILE, "r", encoding="utf-8") as f:
raw = json.load(f)
return [Profile.from_dict(x) for x in raw]

def save_profiles(profiles: List[Profile]) -> None:
with open(PROFILES_FILE, "w", encoding="utf-8") as f:
json.dump([p.to_dict() for p in profiles], f, indent=2)

# ===== Worker thread =====
class CamoufoxWorker(QtCore.QThread):
started_ok = QtCore.pyqtSignal(str)
error = QtCore.pyqtSignal(str)
stopped = QtCore.pyqtSignal(str)

def __init__(self, profile: Profile, launch_size: Optional[tuple[int, int]] = None, parent=None):
super().__init__(parent)
self.profile = profile
self.launch_size = launch_size
self._stop = False
self._context = None
self._playwright = None

def run(self):
if not CAMOUFOX_OK:
self.error.emit(
"Camoufox Python package not available.\n"
"Install: pip install -U 'cloverlabs-camoufox[geoip]'"
)
return

if not CAMOUFOX_V150_EXE or not os.path.exists(CAMOUFOX_V150_EXE):
self.error.emit(
f"Camoufox v150 executable not found.\n"
f"Expected at: {CAMOUFOX_V150_EXE or '<auto-detect failed>'}\n\n"
f"Please set CAMOUFOX_V150_EXE in the script to the correct path.\n"
f"Find it with: python3 -m camoufox list installed --path\n"
f"Or: ls ~/.cache/camoufox/browsers/official/"
)
return

try:
from playwright.sync_api import sync_playwright

VIEWPORT_W, VIEWPORT_H = 1700, 970

options = launch_options(
headless=False,
os="windows",
locale="en-US",
window=(1696, 1026),
config={
"timezone": "Europe/Berlin",
"navigator.language": "en-US",
"navigator.languages": ["en-US", "en"],
"headers.Accept-Language": "en-US,en;q=0.9",
"screen.width": 1700,
"screen.height": 970,
"screen.availWidth": 1700,
"screen.availHeight": 940,
"screen.colorDepth": 24,
"screen.pixelDepth": 24,
},
i_know_what_im_doing=True,
)

options.pop("executable_path", None)
options.pop("headless", None)

options["viewport"] = {"width": VIEWPORT_W, "height": VIEWPORT_H}

custom_args = ["-new-instance", "-no-remote"]
if "args" in options:
custom_args = options.pop("args") + custom_args

user_data_dir = None
if self.profile.persistent_dir:
user_data_dir = os.path.abspath(self.profile.persistent_dir)
os.makedirs(user_data_dir, exist_ok=True)

px = self.profile.proxy.to_proxy_dict()
if px:
options["proxy"] = px

with sync_playwright() as p:
self._playwright = p
self._context = p.firefox.launch_persistent_context(
user_data_dir=user_data_dir,
executable_path=CAMOUFOX_V150_EXE,
headless=False,
args=custom_args,
**options
)

page = self._context.pages[0] if self._context.pages else self._context.new_page()

try:
page.set_viewport_size({"width": VIEWPORT_W, "height": VIEWPORT_H})
except Exception:
pass

try:
page.goto("https://abrahamjuliot.github.io/creepjs";, wait_until="commit", timeout=60000)
except Exception:
pass

if self.profile.fullscreen:
try:
page.keyboard.press("F11")
except Exception:
pass

self.started_ok.emit(f"Session started for '{self.profile.name}'.")

while not self._stop:
time.sleep(0.2)

self._context.close()

except Exception as e:
self.error.emit(f"Failed to start Camoufox: {e}")
finally:
if self._context is not None:
try:
self._context.close()
except Exception:
pass
self.stopped.emit(f"Session stopped for '{self.profile.name}'.")

def request_stop(self):
self._stop = True

# ===== MainWindow Controller =====
class MainWindow(QtWidgets.QMainWindow):
def __init__(self):
super().__init__()
uic.loadUi("camoufox_manager.ui", self)

self.profileList: QtWidgets.QListWidget
self.newProfileButton: QtWidgets.QPushButton
self.deleteProfileButton: QtWidgets.QPushButton
self.nameEdit: QtWidgets.QLineEdit
self.spinW: QtWidgets.QSpinBox
self.spinH: QtWidgets.QSpinBox
self.fullscreenCheck: QtWidgets.QCheckBox
self.proxyHostEdit: QtWidgets.QLineEdit
self.proxyPortSpin: QtWidgets.QSpinBox
self.proxyUserEdit: QtWidgets.QLineEdit
self.proxyPassEdit: QtWidgets.QLineEdit
self.geoipCheck: QtWidgets.QCheckBox
self.storageEdit: QtWidgets.QLineEdit
self.browseStorageButton: QtWidgets.QPushButton
self.saveButton: QtWidgets.QPushButton
self.launchButton: QtWidgets.QPushButton
self.stopButton: QtWidgets.QPushButton

self.profiles: List[Profile] = load_profiles()
self.current_index: int = -1
self.worker: Optional[CamoufoxWorker] = None

self.profileList.itemSelectionChanged.connect(self._on_select_profile)
self.newProfileButton.clicked.connect(self._new_profile)
self.deleteProfileButton.clicked.connect(self._delete_profile)
self.saveButton.clicked.connect(self._save_changes)
self.browseStorageButton.clicked.connect(self._browse_storage)
self.launchButton.clicked.connect(self._launch)
self.stopButton.clicked.connect(self._stop)

self.launchButton.setObjectName("primary")
self.stopButton.setObjectName("danger")

self._refresh_list()
if self.profiles:
self.profileList.setCurrentRow(0)
self._set_running(False)

QtWidgets.QApplication.setStyle("Fusion")
self._apply_palette()
self.statusbar.showMessage("Ready")

def _apply_palette(self):
p = QtGui.QPalette()
base = QtGui.QColor(248, 249, 251)
text = QtGui.QColor(33, 37, 41)
highlight = QtGui.QColor(76, 110, 245)
p.setColor(QtGui.QPalette.Window, base)
p.setColor(QtGui.QPalette.Base, QtGui.QColor(255, 255, 255))
p.setColor(QtGui.QPalette.AlternateBase, QtGui.QColor(245, 246, 248))
p.setColor(QtGui.QPalette.WindowText, text)
p.setColor(QtGui.QPalette.Text, text)
p.setColor(QtGui.QPalette.ButtonText, text)
p.setColor(QtGui.QPalette.Highlight, highlight)
p.setColor(QtGui.QPalette.HighlightedText, QtGui.QColor(255, 255, 255))
self.setPalette(p)

def _refresh_list(self):
self.profileList.clear()
for p in self.profiles:
self.profileList.addItem(p.name)

def _current(self) -> Optional[Profile]:
if 0 <= self.current_index < len(self.profiles):
return self.profiles[self.current_index]
return None

def _populate_form(self, p: Optional[Profile]):
if not p:
self.nameEdit.setText("")
self.spinW.setValue(1700)
self.spinH.setValue(970)
self.fullscreenCheck.setChecked(False)
self.proxyHostEdit.setText("")
self.proxyPortSpin.setValue(0)
self.proxyUserEdit.setText("")
self.proxyPassEdit.setText("")
self.geoipCheck.setChecked(False)
self.storageEdit.setText("")
return
self.nameEdit.setText(p.name)
self.spinW.setValue(p.viewport_width)
self.spinH.setValue(p.viewport_height)
self.fullscreenCheck.setChecked(p.fullscreen)
self.proxyHostEdit.setText(p.proxy.host)
self.proxyPortSpin.setValue(p.proxy.port)
self.proxyUserEdit.setText(p.proxy.username)
self.proxyPassEdit.setText(p.proxy.password)
self.geoipCheck.setChecked(p.use_geoip)
self.storageEdit.setText(p.persistent_dir)

def _gather_form(self) -> Profile:
p = self._current() or Profile()
p.name = self.nameEdit.text().strip() or "Profile"
p.viewport_width = int(self.spinW.value())
p.viewport_height = int(self.spinH.value())
p.fullscreen = self.fullscreenCheck.isChecked()
p.proxy.host = self.proxyHostEdit.text().strip()
p.proxy.port = int(self.proxyPortSpin.value())
p.proxy.username = self.proxyUserEdit.text().strip()
p.proxy.password = self.proxyPassEdit.text().strip()
p.use_geoip = self.geoipCheck.isChecked()
s = self.storageEdit.text().strip()
if not s:
s = os.path.join("C:\\", p.name)
p.persistent_dir = s
return p

def _set_running(self, running: bool):
self.launchButton.setEnabled(not running)
self.stopButton.setEnabled(running)
for w in [
self.profileList, self.newProfileButton, self.deleteProfileButton,
self.nameEdit, self.spinW, self.spinH, self.fullscreenCheck,
self.proxyHostEdit, self.proxyPortSpin, self.proxyUserEdit, self.proxyPassEdit,
self.geoipCheck, self.storageEdit, self.browseStorageButton, self.saveButton
]:
w.setEnabled(not running)

def _on_select_profile(self):
self.current_index = self.profileList.currentRow()
self._populate_form(self._current())

def _new_profile(self):
p = Profile(name=f"Profile {len(self.profiles)+1}")
p.persistent_dir = os.path.join("C:\\", p.name)
self.profiles.append(p)
save_profiles(self.profiles)
self._refresh_list()
self.profileList.setCurrentRow(len(self.profiles)-1)
self.statusbar.showMessage("New profile created", 3000)

def _delete_profile(self):
row = self.profileList.currentRow()
if row < 0:
return
name = self.profiles[row].name
if QtWidgets.QMessageBox.question(self, "Confirm Delete", f"Delete profile '{name}'?") != QtWidgets.QMessageBox.Yes:
return
del self.profiles[row]
save_profiles(self.profiles)
self._refresh_list()
self._populate_form(None)
self.current_index = -1
self.statusbar.showMessage(f"Deleted '{name}'", 3000)

def _save_changes(self):
if self.current_index == -1:
self._new_profile()
return
self.profiles[self.current_index] = self._gather_form()
save_profiles(self.profiles)
self._refresh_list()
self.profileList.setCurrentRow(self.current_index)
self.statusbar.showMessage("Profile saved", 3000)

def _browse_storage(self):
d = QtWidgets.QFileDialog.getExistingDirectory(self, "Select Storage Directory")
if d:
self.storageEdit.setText(d)

def _launch(self):
if self.worker and self.worker.isRunning():
self.statusbar.showMessage("A session is already running", 3000)
return
if self.current_index == -1:
QtWidgets.QMessageBox.information(self, "No profile", "Create or select a profile first.")
return

prof = self._gather_form()
self.profiles[self.current_index] = prof
save_profiles(self.profiles)

if not CAMOUFOX_OK:
QtWidgets.QMessageBox.warning(
self, "Camoufox not available",
"Install with:\n pip install -U 'cloverlabs-camoufox[geoip]'"
)
return

if not CAMOUFOX_V150_EXE or not os.path.exists(CAMOUFOX_V150_EXE):
QtWidgets.QMessageBox.warning(
self, "Camoufox v150 not found",
f"Executable not found at:\n{CAMOUFOX_V150_EXE or '<auto-detect failed>'}\n\n"
f"Set CAMOUFOX_V150_EXE in the script, or run:\n"
f" python3 -m camoufox list installed --path\n"
f"to find the correct path."
)
return

if prof.fullscreen:
screen = QtWidgets.QApplication.primaryScreen().availableGeometry()
launch_size = (screen.width(), screen.height())
else:
launch_size = (1700, 970)

self.worker = CamoufoxWorker(prof, launch_size)
self.worker.started_ok.connect(lambda m: self.statusbar.showMessage(m, 5000))
self.worker.error.connect(lambda m: QtWidgets.QMessageBox.critical(self, "Session Error", m))
self.worker.stopped.connect(self._on_stopped)
self.worker.start()
self._set_running(True)

def _stop(self):
if self.worker and self.worker.isRunning():
self.worker.request_stop()
self.worker.wait(5000)
self.statusbar.showMessage("Stopping session…", 3000)
else:
self.statusbar.showMessage("No session to stop", 3000)

def _on_stopped(self, msg: str):
self.statusbar.showMessage(msg, 5000)
self._set_running(False)

def apply_qss(app, path="dark.qss"):
full = os.path.abspath(path)
if not os.path.exists(full):
raise FileNotFoundError(f"QSS not found: {full}")
with open(full, "r", encoding="utf-8") as f:
app.setStyleSheet(f.read())

def main():
QtCore.QCoreApplication.setAttribute(QtCore.Qt.AA_EnableHighDpiScaling, True)
QtCore.QCoreApplication.setAttribute(QtCore.Qt.AA_UseHighDpiPixmaps, True)
app = QtWidgets.QApplication(sys.argv)
apply_qss(app, "dark.qss")
win = MainWindow()
win.show()
sys.exit(app.exec_())

if __name__ == "__main__":
main()

then click CTRL + O and CTRL + X

then run:

source venv/bin/activate
pip install PyQt5

Create launch file for GUI manager:

nano camoufox_gui.sh

#!/usr/bin/env bash
cd camoufox-profile-manager
source venv/bin/activate
python3 run.py

then click CTRL + O and CTRL + X

chmod +x /home/user/camoufox_gui.sh

Set this proxy value in user.js to enable internet access in the donor profile:
user_pref("network.proxy.type", 0);

Installation of AmneziaVPN app. Create a debian‑12-xfce or ...

2026-07-19T12:59:00Z

In reply to nevent1q…vhtk
_________________________

Installation of AmneziaVPN app.

Create a debian‑12-xfce or debian‑13-xfce template

Open Start → Settings → Qubes Tools → Qubes Template Manager.
Install the debian‑13‑xfce template
After installation, update the template via Qubes Update

If servers for Qubes are blocked in your country, use Whonix with Snowflake bridges: Tor Control Panel → Configure → Bridges type → snowflake

Install Required Packages in the Template

Launch a terminal inside the debian‑13‑xfce template.
Run:

sudo apt install libxcb-cursor0 libxcb-xinerama0 libnss-resolve iptables

Download AmneziaVPN

Open a browser in the default‑dvm (a disposable VM).
Download the Linux version of AmneziaVPN:
Releases · amnezia-vpn/amnezia-client · GitHub
Mirror

Copy the Downloaded File to the Debian Template

Right‑click the downloaded file, choose Copy to other qube, then select the target VM debian‑13‑xfce.
In the debian‑13‑xfce VM, open Thunar.
Navigate to your home directory → QubesIncoming → the folder whose name starts with disp…. Inside you’ll find the AmneziaVPN archive.
Extract the archive and run the installer.

Refresh the Application Menu

Open Qube Manager (click the blue cube icon on the panel).
Select debian‑13‑xfce, then click App Shortcuts at the top.
Click Refresh Applications to update the menu list.
Shut down debian‑13‑xfce (right‑click → Shutdown).

Create a new VPN AppVM

In Qube Manager, create a new AppVM based on the debian-13-xfce template. Name it sys‑vpn or sys-amnezia.
Go to App Shortcuts for sys‑vpn and move AmneziaVPN and Thunar to the right side.

Install AmneziaVPN in the sys‑vpn VM

Copy the AmneziaVPN installer file (the one you downloaded earlier) into sys‑vpn.
Extract the archive again inside sys‑vpn and run the installer (Otherwise, AmneziaVPN might fail to start).

Launch and configure AmneziaVPN

AppMenu → sys‑vpn → AmneziaVPN

Click + and activate the VPN using a key, a configuration file, a connection to your own VPS, or use the free and premium VPN by Amnezia.
1
1376×637 34.6 KB

Enable VLESS protocol in settings.

Set up autostart if desired.

Set Up a Kill Switch (Manual Configuration)

The built‑in kill switch in the AmneziaVPN app does not work under Qubes OS, so configure it manually in sys‑vpn

Open a terminal in sys‑vpn and start Thunar with root privileges:

sudo thunar

Edit the file /rw/config/qubes-firewall-user-script and append the following rules at the bottom:

nft add rule ip qubes custom-forward tcp flags syn / syn,rst tcp option maxseg size set rt mtu
# Prevent the qube from forwarding traffic outside of the VPN
nft add rule qubes custom-forward oifname eth0 counter drop
nft add rule ip6 qubes custom-forward oifname eth0 counter drop

(The first command fixes slow connection issues on Linux by adjusting the MTU).

Route Traffic Through the VPN

Assign sys‑vpn as the Net qube for sys‑whonix and for any other AppVMs where you want to hide the IP address.

Edit Global Update Settings

Open Global Settings → Updates.
Enable “Disable checking for updates for all existing qubes.”
In the “Except for following qubes, for which checking for updates will be enabled” field, add sys‑vpn and sys‑whonix.

Remember that new AppVMs will be added to the exceptions list for update checks. You’ll need to manually delete any unnecessary AppVMs (with the real IP).

a
a1572×1236 104 KB

You can also use regular WireGuard config file and add it to the AmneziaVPN GUI application:

Click + into AmneziaVPN app,
Then select “File with connection settings”,
Select wg.conf file and click “enable WireGuard obfuscation” option.

awg
awg1186×756 94.5 KB

:white_check_mark: Done!

Сelf‑host installation of AmneziaVPN.

Buy a server (VPS), if you don’t have one
Minimum system requirements for VPS:
Operating System - Linux, suitable for Ubuntu 22.04 or Debian 11.
Supported processor architecture - x86-64.
Virtualization - KVM.
IPv4 address support
Random Access Memory (RAM) - recommended 2 GB, but not less than 1 GB.
Pre-installed software and control panel are not required.

To make it more convenient for you, we have selected several hosting providers. Choose a suitable server from the options provided below and follow the step-by-step instructions. You can also choose any other VPS provider at your discretion. All servers are provided as examples.

:warning: Servers on Reg.ru and Yandex Cloud are not suitable for installing VPN with Amnezia

:exclamation: These hosting providers are provided as an example, we do not take responsibility for the quality of services provided by these companies and for potential risks.
The best VPS for Amnezia: https://amnezia.host/en

You will receive an email from the hosting provider

The email should include the IP address, User name or User ID, and Password. You will need these for setting up the VPN on the server in the next step.

|100%xauto
|100%xauto2000×738 38.6 KB

:warning: Some hosting providers do not send server details via email. In such cases, you can usually find the server information in your hosting provider’s account dashboard. If you encounter difficulties, contact their support.

Download the AmneziaVPN app and enter the server details

After installation, launch the application.

On the first screen, select “I have connection details”, then “Set up your own server”, and enter the data from the email sent by the hosting provider.

Press “Continue” for automatic installation and wait a moment.

You can also choose the manual installation method - it’s just as easy! Click “Manual” and continue.

Select the protocol. The best options are AmneziaWG for very fast speeds or X‑Ray to counter aggressive internet blocking.

Then specify the port - you can keep the default port 443.

Finally, click Install and wait a few minutes.

That’s all!

If you want to add other protocols, click your server, then the gear :gear: icon, and select additional protocol.

:white_check_mark: Done!

Installation of AWG – WG fork with the best obfuscation.

Install the kernel module in template
GitHub - amnezia-vpn/amneziawg-linux-kernel-module: AmneziaWG Linux kernel module · GitHub

Open terminal in template fedora-43-xfce or debian-13-xfce.
Use this guide for Manual build https://github.com/amnezia-vpn/amneziawg-linux-kernel-module:

http_proxy=http://127.0.0.1:8082 https_proxy=http://127.0.0.1:8082 git clone https://github.com/amnezia-vpn/amneziawg-linux-kernel-module.git
cd amneziawg-linux-kernel-module/src

Skip step 2 from github guide (you’re using the kernel from dom0).

make
sudo make install

Activate the module and check it.

sudo modprobe amneziawg
lsmod | grep amneziawg

Add module to autostart.

echo "amneziawg" | sudo tee /etc/modules-load.d/amneziawg.conf

Install amnezia-tools.
GitHub - amnezia-vpn/amneziawg-tools: Tools for configuring Amnezia-WG · GitHub

http_proxy=http://127.0.0.1:8082 https_proxy=http://127.0.0.1:8082 git clone https://github.com/amnezia-vpn/amneziawg-tools.git
cd amneziawg-tools/src

make

sudo make install

Now connect WireGuard configurations with awg and awg-quick tools for hide the VPN connection!

Create a configuration file for your WG server or in your VPN app, or generate a awg-WARP config using generators:
1 Перенаправление на проект
2 https://warp-generator.vercel.app/
3 WARP WireGuard Config Generator
4 https://warp-gen.vercel.app/
5 GitHub - ImMALWARE/bash-warp-generator: Генератор конфига Cloudflare WARP для AmneziaVPN · GitHub

Remane it to awg0.conf. Edit file if you use your wireguard (add awg options), The configuration for AWG looks like this:

[Interface]
PrivateKey = ...
S1 = 0
S2 = 0
Jc = 4
Jmin = 40
Jmax = 70
H1 = 1
H2 = 2
H3 = 3
H4 = 4
MTU = 1280
Address = ...
DNS = ...

[Peer]
PublicKey = ...
AllowedIPs = ...
Endpoint = ...

Move awg0.conf into the template and paste it into /etc/amnezia/amneziawg/ and then shutdown the template.

Create a sys-awg qube

Create a new AppVM based on the template with AWG, name it something like sys‑awg and enable the “Provides network” option. Then, in sys‑awg terminal enter:
sudo nano /rw/config/rc.local
and paste those commands:
sudo awg-quick up awg0
sudo systemctl enable --now awg-quick@awg0.service

Then set sys‑awg as the NetVM for the required appVMs. If the traffic isn’t being routed to appVMs, you need to add your awg’s DNS entry to /rw/config/rc.local in appVMs, for example:

sudo nano /rw/config/rc.local
and paste those commands:

echo 'nameserver 1.1.1.1' > /etc/resolv.conf
echo 'nameserver 1.0.0.1' > /etc/resolv.conf

Enter this command in sys-awg to test the connection to awg:

sudo awg show all

:white_check_mark: Done!

DNScrypt-proxy qube. sys-dns with Encrypted DNS 1. Install ...

2026-07-19T12:57:25Z

In reply to nevent1q…vhtk
_________________________

DNScrypt-proxy qube. sys-dns with Encrypted DNS

1. Install dnscrypt-proxy in the fedora-xfce template:

sudo dnf install -y dnscrypt-proxy
sudo systemctl enable dnscrypt-proxy

2. Add dnscrypt-proxy configuration in fedora-xfce template:

This setup enables DNSCrypt with anonymized DNS (via relays), enforces DNSSEC, no-logging, and no-filter policies, and disables DoH and Oblivious DoH:

sudo tee /etc/dnscrypt-proxy/dnscrypt-proxy.toml << 'EOF'
server_names = []
listen_addresses = ['127.0.0.1:53', '0.0.0.0:53', '[::1]:53']
max_clients = 250
ipv4_servers = true
ipv6_servers = false
dnscrypt_servers = true
doh_servers = false
odoh_servers = false
require_dnssec = true
require_nolog = true
require_nofilter = true
disabled_server_names = ['scaleway', 'scaleway-ams']
force_tcp = false
timeout = 5000
keepalive = 30
cert_refresh_delay = 240
bootstrap_resolvers = ['9.9.9.11:53', '8.8.8.8:53']
ignore_system_dns = true
log_files_max_size = 10
log_files_max_age = 7
log_files_max_backups = 1
block_ipv6 = false
block_unqualified = true
block_undelegated = true
reject_ttl = 10
cache = true
cache_size = 4096
cache_min_ttl = 2400
cache_max_ttl = 86400
cache_neg_min_ttl = 60
cache_neg_max_ttl = 600
lb_strategy = 'wp2'
lb_estimator = true

[sources.public-resolvers]
urls = [
'https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/public-resolvers.md';,
'https://download.dnscrypt.info/resolvers-list/v3/public-resolvers.md';,
'https://cdn.jsdelivr.net/gh/DNSCrypt/dnscrypt-resolvers@master/v3/public-resolvers.md';
]
cache_file = 'public-resolvers.md'
minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
refresh_delay = 73
prefix = ''

[sources.relays]
urls = [
'https://raw.githubusercontent.com/DNSCrypt/dnscrypt-resolvers/master/v3/relays.md';,
'https://download.dnscrypt.info/resolvers-list/v3/relays.md';,
'https://cdn.jsdelivr.net/gh/DNSCrypt/dnscrypt-resolvers@master/v3/relays.md';
]
cache_file = 'relays.md'
minisign_key = 'RWQf6LRCGA9i53mlYecO4IzT51TGPpvWucNSCh1CBM0QTaLn73Y7GFO3'
refresh_delay = 73
prefix = ''

[anonymized_dns]
routes = [
{ server_name='*', via=['anon-scaleway', 'anon-scaleway-ams', 'anon-kama', 'anon-tiarap'] }
]
skip_incompatible = true
EOF

Note: The 10.139.1.1 and 10.139.1.2 addresses are the standard Qubes OS DNS IPs assigned to downstream VMs. Binding to 0.0.0.0:53 ensures dnscrypt-proxy can accept queries on these interfaces.

3. Create and configure sys-dns qube:

Create fedora-based AppVM sys-dns and add option Provides network in Qube Manager (advansed settings)

The next commands are executed in the sys-dns terminal.

4. Disable systemd-resolved in sys-dns:

sudo tee /rw/config/rc.local << 'EOF'
#!/bin/bash

# Disable systemd-resolved to free up port 53
systemctl stop systemd-resolved 2>/dev/null
systemctl disable systemd-resolved 2>/dev/null
systemctl mask systemd-resolved 2>/dev/null

systemctl stop systemd-resolved-varlink.socket 2>/dev/null
systemctl disable systemd-resolved-varlink.socket 2>/dev/null
systemctl mask systemd-resolved-varlink.socket 2>/dev/null

systemctl stop systemd-resolved-monitor.socket 2>/dev/null
systemctl disable systemd-resolved-monitor.socket 2>/dev/null
systemctl mask systemd-resolved-monitor.socket 2>/dev/null

# Assign Qubes standard DNS IPs to eth0 for downstream VMs
# These IPs are dynamically provided to downstream qubes via Qubes mechanisms
ip addr add 10.139.1.1/32 dev eth0 2>/dev/null
ip addr add 10.139.1.2/32 dev eth0 2>/dev/null

# start dnscrypt-proxy (let's add it just in case)
systemctl start dnscrypt-proxy
EOF

5. Configure nftables (Accept Rules for DNS) in sys-dns:

sudo tee /rw/config/qubes-firewall-user-script << 'EOF'
#!/bin/bash

# Allow DNS queries from downstream qubes to 10.139.1.1/2
# vif* are interfaces for downstream qubes, group 2
nft add rule ip qubes custom-input iifgroup 2 ip daddr { 10.139.1.1, 10.139.1.2 } udp dport 53 accept 2>/dev/null
nft add rule ip qubes custom-input iifgroup 2 ip daddr { 10.139.1.1, 10.139.1.2 } tcp dport 53 accept 2>/dev/null
EOF

Restart sys-dns to apply all changes.

Qubes OS live mode. dom0 in RAM. Non-persistent Boot. RAM-Wipe. ...

2026-07-19T12:56:32Z

In reply to nevent1q…vhtk
_________________________

Qubes OS live mode. dom0 in RAM. Non-persistent Boot. RAM-Wipe. Protection against forensics. Tails mode. Hardening dom0. Root read‑only. Paranoid Security. Ephemeral Encryption

#!/bin/bash

# Qubes Dom0 Amnesic modes
# ⚠ Make backup before running! Run as root: sudo ./amnesic.sh
echo "=== Qubes Dom0 Live Boot Setup ==="

#BOOT_UUID
BOOT_UUID=$(findmnt -n -o UUID /boot 2>/dev/null || echo "AUTO_BOOT_NOT_FOUND")
if [ "$BOOT_UUID" = "AUTO_BOOT_NOT_FOUND" ]; then
BOOT_UUID=$(blkid -s UUID -o value -d $(findmnt -n -o SOURCE /boot 2>/dev/null))
fi

# LUKS_UUID
LUKS_DEVICE=$(blkid -t TYPE="crypto_LUKS" -o device 2>/dev/null | head -n1 || echo "")
if [ -n "$LUKS_DEVICE" ]; then
LUKS_UUID=$(sudo cryptsetup luksUUID "$LUKS_DEVICE" 2>/dev/null)
else
LUKS_UUID="AUTO_LUKS_NOT_FOUND"
fi

# Latest XEN_PATH
XEN_PATH=$(ls /boot/xen*.gz 2>/dev/null | sort -V | tail -1 | xargs basename 2>/dev/null || echo "/xen-4.19.4.gz")

# Latest kernel/initramfs
LATEST_KERNEL=$(ls /boot/vmlinuz-*qubes*.x86_64 2>/dev/null | grep -E 'qubes\.fc[0-9]+' | sort -V | tail -1 | xargs basename)
LATEST_INITRAMFS=$(echo "/initramfs-${LATEST_KERNEL#vmlinuz-}.img")

# Max memory dom0
system_total_mb=$(xl info | grep total_memory | awk '{print $3}')

if [ -n "$system_total_mb" ] && [ "$system_total_mb" -gt 0 ] 2>/dev/null; then
# 80% total_memory
DOM0_MAX_MB=$((system_total_mb * 80 / 100))
DOM0_MAX_GB=$((DOM0_MAX_MB / 1024))
DOM0_MAX_RAM="dom0_mem=max:${DOM0_MAX_MB}M"
DOM0_MAX_GBG="${DOM0_MAX_GB}G"
else
DOM0_MAX_RAM="dom0_mem=max:10240M"
DOM0_MAX_GB="10"
DOM0_MAX_GBG="10G"
fi

# qubes_dom0-root
Qubes_Root=$(findmnt -n -o SOURCE /)

# /home/user
if [ -n "$SUDO_USER" ] && [ "$SUDO_USER" != "root" ]; then
USER_HOME=$(getent passwd "$SUDO_USER" | cut -d: -f6)
else
USER_HOME="$HOME"
fi

if [ ! -d "$USER_HOME" ]; then
echo "home dir '$USER_HOME' not found!" >&2
exit 1
fi

# === dom0 resize ===

REQUIRED_FREE_GB=100
MIN_DOM0_SIZE_GB=40

get_dom0_size_gb() {
local size_bytes
size_bytes=$(df -B1 /dev/mapper/qubes_dom0-root 2>/dev/null | awk 'NR==2 {print $2}')
if [[ -z "$size_bytes" ]]; then
echo "Warning: failed to determine dom0 size" >&2
return 1
fi
echo "$((size_bytes / 1024 / 1024 / 1024))"
return 0
}

get_vg_free_gb() {
local lv_size data_pct
lv_size=$(lvs --noheadings --nosuffix --units b -o lv_size qubes_dom0/vm-pool 2>/dev/null | tr -dc '0-9')
data_pct=$(lvs --noheadings -o data_percent qubes_dom0/vm-pool 2>/dev/null | tr ',' '.' | tr -dc '0-9.')

if [[ -z "$lv_size" || -z "$data_pct" ]]; then
echo "Warning: failed to determine free space in vm-pool" >&2
return 1
fi

local free_gb
free_gb=$(awk "BEGIN { printf \"%.0f\", ($lv_size * (100 - $data_pct) / 100) / 1024 / 1024 / 1024 }")
echo "$free_gb"
return 0
}

main() {
if [[ "$EUID" -ne 0 ]]; then
echo "Warning: This script should be run as root (sudo)" >&2
# Changed from exit 1 to just warning
fi

local dom0_size_gb vg_free_gb
dom0_size_gb=$(get_dom0_size_gb) || dom0_size_gb="unknown"
vg_free_gb=$(get_vg_free_gb) || vg_free_gb="unknown"

echo "Current dom0 size: ${dom0_size_gb} GB"
echo "Free space in VM pool: ${vg_free_gb} GB"

if [[ "$vg_free_gb" != "unknown" ]] && ((vg_free_gb < REQUIRED_FREE_GB)); then
echo "Info: free space is less than ${REQUIRED_FREE_GB} GB (available: ${vg_free_gb} GB) - skipping resize"
# Changed from exit 0 to continue
elif [[ "$dom0_size_gb" != "unknown" ]] && ((dom0_size_gb >= MIN_DOM0_SIZE_GB)); then
echo "Info: dom0 size is already ${dom0_size_gb} GB (>= ${MIN_DOM0_SIZE_GB} GB) - skipping resize"
# Changed from exit 0 to continue
else
echo "Conditions met. Starting dom0 resize..."

if lvresize --size 40G /dev/mapper/qubes_dom0-root; then
resize2fs /dev/mapper/qubes_dom0-root
lvresize -L +20G qubes_dom0/root-pool
echo "Done. New dom0 size: $(get_dom0_size_gb) GB"
else
echo "Warning: dom0 resize failed - continuing with other commands"
fi
fi

echo "--- dom0 resize completed ---"
}

main "$@"

# === swapoff ===
sudo sed -i '/\/dev\/mapper\/swap/!{/^[[:space:]]*#/!{/\<swap\>/s/^/# /}}' /etc/fstab
sudo sed -i '/\/dev\/mapper\/swap/b; /[[:space:]]\+swap[[:space:]]\+/s/^/# /' /etc/fstab

# === harden autostart ===
mkdir -p "$USER_HOME/.config"
if [ ! -f "$USER_HOME/.config/harden.sh" ]; then
cat > "$USER_HOME/.config/harden.sh" << 'EOF'
#!/bin/bash
sleep 1
if findmnt -n -o SOURCE / | grep -qE "(overlay|/dev/zram0)"; then
notify-send --expire-time=20000 "Amnesic session is running" "dom0 mode: $(findmnt -n -o SOURCE /)" --icon=dialog-information
sleep 10
sudo sysctl -w kernel.sysrq=0
sudo sysctl -w kernel.perf_event_paranoid=3
sudo sysctl -w kernel.kptr_restrict=2
sudo sysctl -w kernel.panic=5
sudo sysctl -w fs.protected_regular=2
sudo sysctl -w fs.protected_fifos=2
sudo sysctl -w kernel.printk="3 3 3 3"
sudo sysctl -w kernel.kexec_load_disabled=1
sudo sysctl -w kernel.io_uring_disabled=2
sudo chattr +i /boot/grub2/grub.cfg
sudo chattr +i /boot
else
sudo chattr -i /boot/grub2/grub.cfg
sudo chattr -i /boot
fi
EOF
chmod 755 "$USER_HOME/.config/harden.sh"
echo "Created harden.sh"
else
echo "harden.sh already exists, skipping"
fi

# === autostart desktop entry ===
mkdir -p "$USER_HOME/.config/autostart"
if [ ! -f "$USER_HOME/.config/autostart/harden.desktop" ]; then
cat > "$USER_HOME/.config/autostart/harden.desktop" << EOF
[Desktop Entry]
Encoding=UTF-8
Version=0.9.4
Type=Application
Name=harden
Comment=
Exec=$USER_HOME/.config/harden.sh
OnlyShowIn=XFCE;
RunHook=0
StartupNotify=false
Terminal=false
Hidden=false
EOF
echo "Created harden.desktop"
else
echo "harden.desktop already exists, skipping"
fi

# === Dracut module directories ===
DIR_OVERLAY_CRYPT=/usr/lib/dracut/modules.d/90overlay-crypt
DIR_RAMBOOT=/usr/lib/dracut/modules.d/90ramboot
DIR_OVERLAY=/usr/lib/dracut/modules.d/90overlayfs-root
DIR_RAMWIPE=/usr/lib/dracut/modules.d/40ram-wipe

for d in "$DIR_RAMBOOT" "$DIR_OVERLAY" "$DIR_RAMWIPE" "$DIR_OVERLAY_CRYPT"; do
if [ ! -d "$d" ]; then
mkdir -p "$d"
echo "Created $(basename "$d")"
else
echo "$(basename "$d") already exists, skipping"
fi
done

# === 90overlay-crypt/module-setup.sh ===
if [ ! -f "$DIR_OVERLAY_CRYPT/module-setup.sh" ]; then
cat > "$DIR_OVERLAY_CRYPT/module-setup.sh" << 'EOF'
#!#!/bin/bash

check() {
require_binaries cryptsetup || return 1
require_binaries losetup || return 1
require_binaries mkfs.ext4 || return 1
return 0
}

depends() {
return 0
}

installkernel() {
hostonly='' instmods overlay 2>/dev/null || true
hostonly='' instmods dm-crypt 2>/dev/null || true
}

install() {
inst_multiple cryptsetup losetup mkfs.ext4 dd modprobe mount umount shred
inst_hook pre-pivot 10 "$moddir/overlay-crypt.sh"
}
EOF
chmod 755 "$DIR_OVERLAY_CRYPT/module-setup.sh"
echo "Created 90overlay-crypt/module-setup.sh"
else
echo "90overlay-crypt/module-setup.sh already exists, skipping"
fi

# === 90overlay-crypt/overlay-crypt.sh ===
if [ ! -f "$DIR_OVERLAY_CRYPT/overlay-crypt.sh" ]; then
cat > "$DIR_OVERLAY_CRYPT/overlay-crypt.sh" << 'EOF'
#!/bin/bash

. /lib/dracut-lib.sh

if ! getargbool 0 cryptovl ; then
return
fi

modprobe overlay 2>/dev/null || true
modprobe dm-crypt 2>/dev/null || true

#
mount -o remount,ro /sysroot 2>/dev/null || true

#
mkdir -p /live/image
mount --bind /sysroot /live/image
umount /sysroot

#
dd if=/dev/urandom bs=64 count=1 of=/dev/shm/overlay-key status=none
chmod 600 /dev/shm/overlay-key

# create 20 GB size (seek)
mkdir -p /var/lib
dd if=/dev/zero of=/var/lib/overlay-crypt.img bs=1M count=0 seek=20480 status=none

#
losetup -f
LOOP_DEV=$(losetup -f --show /var/lib/overlay-crypt.img)

#
cryptsetup luksFormat --type luks2 \
--cipher aes-xts-plain64 --key-size 512 \
--hash sha256 --pbkdf pbkdf2 --pbkdf-force-iterations 1000 \
--batch-mode --key-file /dev/shm/overlay-key "$LOOP_DEV"

#
cryptsetup open --type luks2 --key-file /dev/shm/overlay-key "$LOOP_DEV" overlaycrypt

#
mkfs.ext4 -F -L "overlaycrypt" /dev/mapper/overlaycrypt

#
mkdir -p /cow
mount -o noatime,nodiratime,nobarrier /dev/mapper/overlaycrypt /cow
mkdir -p /cow/work /cow/rw

#
mount -t overlay -o noatime,nodiratime,volatile,lowerdir=/live/image,upperdir=/cow/rw,workdir=/cow/work,default_permissions,relatime overlay /sysroot

#
mkdir -p /sysroot/live/cow /sysroot/live/image
mount --bind /cow/rw /sysroot/live/cow
mount --bind /live/image /sysroot/live/image

#
umount /cow 2>/dev/null || true
umount /live/image 2>/dev/null || true

#
shred -u /dev/shm/overlay-key 2>/dev/null || rm -f /dev/shm/overlay-key
EOF
chmod 755 "$DIR_OVERLAY_CRYPT/overlay-crypt.sh"
echo "Created 90overlay-crypt/overlay-crypt.sh"
else
echo "90overlay-crypt/overlay-crypt.sh already exists, skipping"
fi

# === 90ramboot/module-setup.sh ===
if [ ! -f "$DIR_RAMBOOT/module-setup.sh" ]; then
cat > "$DIR_RAMBOOT/module-setup.sh" << 'EOF'
#!/usr/bin/bash
check() {
return 0
}
depends() {
return 0
}
install() {
inst_simple "$moddir/zram-mount.sh"
inst_hook cleanup 00 "$moddir/zram-mount.sh"
}
EOF
chmod 755 "$DIR_RAMBOOT/module-setup.sh"
echo "Created 90ramboot/module-setup.sh"
else
echo "90ramboot/module-setup.sh already exists, skipping"
fi

# === 90ramboot/zram-mount.sh ===
if [ ! -f "$DIR_RAMBOOT/zram-mount.sh" ]; then
cat > "$DIR_RAMBOOT/zram-mount.sh" << EOF
#!/bin/sh

. /lib/dracut-lib.sh

if ! getargbool 0 rootzram ; then
return
fi

mkdir /mnt
umount /sysroot
mount -o ro $Qubes_Root /mnt
modprobe zram
echo $DOM0_MAX_GBG > /sys/block/zram0/disksize
/mnt/usr/sbin/mkfs.ext2 /dev/zram0
mount -o nodev,nosuid,noatime,nodiratime /dev/zram0 /sysroot
cp -a /mnt/* /sysroot
umount /mnt
exit 0
EOF
chmod 755 "$DIR_RAMBOOT/zram-mount.sh"
echo "Created 90ramboot/zram-mount.sh"
else
echo "90ramboot/zram-mount.sh already exists, skipping"
fi

# === 90overlayfs-root/module-setup.sh ===
if [ ! -f "$DIR_OVERLAY/module-setup.sh" ]; then
cat > "$DIR_OVERLAY/module-setup.sh" << 'EOF'
#!/bin/bash

check() {
[ -d /lib/modules/$kernel/kernel/fs/overlayfs ] || return 1
}

depends() {
return 0
}

installkernel() {
hostonly='' instmods overlay
}

install() {
inst_hook pre-pivot 10 "$moddir/overlay-mount.sh"
}
EOF
chmod 755 "$DIR_OVERLAY/module-setup.sh"
echo "Created 90overlayfs-root/module-setup.sh"
else
echo "90overlayfs-root/module-setup.sh already exists, skipping"
fi

# === 90overlayfs-root/overlay-mount.sh ===
if [ ! -f "$DIR_OVERLAY/overlay-mount.sh" ]; then
cat > "$DIR_OVERLAY/overlay-mount.sh" << 'EOF'
#!/bin/sh
. /lib/dracut-lib.sh

if ! getargbool 0 rootovl ; then
return
fi

modprobe overlay
mount -o remount,nolock,noatime $NEWROOT
mkdir -p /live/image
mount --bind $NEWROOT /live/image
umount $NEWROOT
mkdir /cow
mount -n -t tmpfs -o mode=0755,size=100%,nr_inodes=500k,noexec,nodev,nosuid,noatime,nodiratime tmpfs /cow
mkdir /cow/work /cow/rw
mount -t overlay -o noatime,nodiratime,volatile,lowerdir=/live/image,upperdir=/cow/rw,workdir=/cow/work,default_permissions,relatime overlay $NEWROOT
mkdir -p $NEWROOT/live/cow
mkdir -p $NEWROOT/live/image
mount --bind /cow/rw $NEWROOT/live/cow
umount /cow
mount --bind /live/image $NEWROOT/live/image
umount /live/image
umount $NEWROOT/live/cow
EOF
chmod 755 "$DIR_OVERLAY/overlay-mount.sh"
echo "Created 90overlayfs-root/overlay-mount.sh"
else
echo "90overlayfs-root/overlay-mount.sh already exists, skipping"
fi

# === ramboot dracut.conf ===
if [ ! -f /etc/dracut.conf.d/ramboot.conf ]; then
cat > /etc/dracut.conf.d/ramboot.conf << 'EOF'
add_drivers+=" zram "
add_dracutmodules+=" ramboot "
EOF
echo "Created ramboot.conf"
else
echo "ramboot.conf already exists, skipping"
fi

# === 40ram-wipe/module-setup.sh ===
if [ ! -f "$DIR_RAMWIPE/module-setup.sh" ]; then
cat > "$DIR_RAMWIPE/module-setup.sh" << 'EOF'
#!/bin/bash
# -*- mode: shell-script; indent-tabs-mode: nil; sh-basic-offset: 4; -*-
# ex: ts=8 sw=4 sts=4 et filetype=sh

## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

check() {
require_binaries sync || return 1
require_binaries sleep || return 1
require_binaries dmsetup || return 1
return 0
}

depends() {
return 0
}

install() {
inst_simple "/usr/libexec/ram-wipe/ram-wipe-lib.sh" "/lib/ram-wipe-lib.sh"
inst_multiple sync
inst_multiple sleep
inst_multiple dmsetup
inst_hook shutdown 40 "$moddir/wipe-ram.sh"
inst_hook cleanup 80 "$moddir/wipe-ram-needshutdown.sh"
}

installkernel() {
return 0
}
EOF
chmod +x "$DIR_RAMWIPE/module-setup.sh"
echo "Created 40ram-wipe/module-setup.sh"
else
echo "40ram-wipe/module-setup.sh already exists, skipping"
fi

# === 40ram-wipe/wipe-ram-needshutdown.sh ===
if [ ! -f "$DIR_RAMWIPE/wipe-ram-needshutdown.sh" ]; then
cat > "$DIR_RAMWIPE/wipe-ram-needshutdown.sh" << 'EOF'
#!/bin/sh

## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

type getarg >/dev/null 2>&1 || . /lib/dracut-lib.sh

. /lib/ram-wipe-lib.sh

ram_wipe_check_needshutdown() {
#local kernel_wiperam_setting

kernel_wiperam_setting="$(getarg wiperam)"

if [ "$kernel_wiperam_setting" = "skip" ]; then
force_echo "wipe-ram-needshutdown.sh: Skip, because wiperam=skip kernel parameter detected, OK."
return 0
fi

true "wipe-ram-needshutdown.sh: Calling dracut function need_shutdown to drop back into initramfs at shutdown, OK."
need_shutdown

return 0
}

ram_wipe_check_needshutdown
EOF
chmod +x "$DIR_RAMWIPE/wipe-ram-needshutdown.sh"
echo "Created 40ram-wipe/wipe-ram-needshutdown.sh"
else
echo "40ram-wipe/wipe-ram-needshutdown.sh already exists, skipping"
fi

# === 40ram-wipe/wipe-ram.sh ===
if [ ! -f "$DIR_RAMWIPE/wipe-ram.sh" ]; then
cat > "$DIR_RAMWIPE/wipe-ram.sh" << 'EOF'
#!/bin/sh

## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

## Credits:
## First version by @friedy10.
## https://github.com/friedy10/dracut/blob/master/modules.d/40sdmem/wipe.sh

. /lib/ram-wipe-lib.sh

drop_caches() {
sync
echo 3 > /proc/sys/vm/drop_caches
sync
}

ram_wipe() {
#local kernel_wiperam_setting

kernel_wiperam_setting="$(getarg wiperam)"

if [ "$kernel_wiperam_setting" = "skip" ]; then
force_echo "wipe-ram.sh: Skip, because wiperam=skip kernel parameter detected, OK."
return 0
fi

force_echo "wipe-ram.sh: RAM extraction attack defense... Starting RAM wipe pass during shutdown..."

drop_caches

force_echo "wipe-ram.sh: RAM wipe pass completed, OK."
}

ram_wipe
EOF
chmod +x "$DIR_RAMWIPE/wipe-ram.sh"
echo "Created 40ram-wipe/wipe-ram.sh"
else
echo "40ram-wipe/wipe-ram.sh already exists, skipping"
fi

# === ram-wipe dracut.conf ===
if [ ! -f /etc/dracut.conf.d/30-ram-wipe.conf ]; then
cat > /etc/dracut.conf.d/30-ram-wipe.conf << 'EOF'
add_dracutmodules+=" ram-wipe "
EOF
echo "Created 30-ram-wipe.conf"
else
echo "30-ram-wipe.conf already exists, skipping"
fi

# === ram-wipe-lib.sh ===
DIR_RAMWIPE_LIB=/usr/libexec/ram-wipe
if [ ! -d "$DIR_RAMWIPE_LIB" ]; then
mkdir -p "$DIR_RAMWIPE_LIB"
fi

if [ ! -f "$DIR_RAMWIPE_LIB/ram-wipe-lib.sh" ]; then
cat > "$DIR_RAMWIPE_LIB/ram-wipe-lib.sh" << 'EOF'
#!/bin/sh

## Copyright (C) 2023 - 2025 ENCRYPTED SUPPORT LLC <adrelanos@whonix.org>
## See the file COPYING for copying conditions.

if [ -z "$DRACUT_SYSTEMD" ]; then
force_echo() {
echo "<28>dracut INFO: $*" > /dev/kmsg
echo "dracut INFO: $*" >&2
}
else
force_echo() {
echo "INFO: $*" >&2
}
fi
EOF
chmod +x "$DIR_RAMWIPE_LIB/ram-wipe-lib.sh"
echo "Created ram-wipe-lib.sh"
else
echo "ram-wipe-lib.sh already exists, skipping"
fi

# Update INITRAMFS
dracut --verbose --force

# Create GRUB custom
echo "Creating GRUB custom ..."

cat > /etc/grub.d/40_custom << EOF
#!/usr/bin/sh
exec tail -n +3 \$0

menuentry 'Qubes Encrypted-Overlay Amnesic Mode' --class qubes --class gnu-linux --class gnu --class os --class xen \$menuentry_id_option 'xen-gnulinux-simple-/dev/mapper/qubes_dom0-root' {
insmod part_gpt
insmod ext2
search --no-floppy --fs-uuid --set=root $BOOT_UUID
echo 'Loading Xen ...'
if [ "\$grub_platform" = "pc" -o "\$grub_platform" = "" ]; then
xen_rm_opts=
else
xen_rm_opts="no-real-mode edd=off"
fi
insmod multiboot2
multiboot2 /$XEN_PATH placeholder console=none dom0_mem=min:1024M $DOM0_MAX_RAM ucode=scan smt=off gnttab_max_frames=2048 gnttab_max_maptrack_frames=4096 \${xen_rm_opts}
echo 'Loading Linux $LATEST_KERNEL ...'
module2 /$LATEST_KERNEL placeholder root=/dev/mapper/qubes_dom0-root ro rd.luks.uuid=$LUKS_UUID rd.lvm.lv=qubes_dom0/root rd.lvm.lv=qubes_dom0/swap plymouth.ignore-serial-consoles rhgb cryptovl quiet module.sig_enforce=1 bootscrub=on usbcore.authorized_default=0
echo 'Loading initial ramdisk ...'
insmod multiboot2
module2 --nounzip $LATEST_INITRAMFS
}

menuentry 'Qubes Zram-Live Amnesic Mode' --class qubes --class gnu-linux --class gnu --class os --class xen \$menuentry_id_option 'xen-gnulinux-simple-/dev/mapper/qubes_dom0-root' {
insmod part_gpt
insmod ext2
search --no-floppy --fs-uuid --set=root $BOOT_UUID
echo 'Loading Xen ...'
if [ "\$grub_platform" = "pc" -o "\$grub_platform" = "" ]; then
xen_rm_opts=
else
xen_rm_opts="no-real-mode edd=off"
fi
insmod multiboot2
multiboot2 /$XEN_PATH placeholder console=none dom0_mem=min:1024M $DOM0_MAX_RAM ucode=scan smt=off gnttab_max_frames=2048 gnttab_max_maptrack_frames=4096 \${xen_rm_opts}
echo 'Loading Linux $LATEST_KERNEL ...'
module2 /$LATEST_KERNEL placeholder root=/dev/mapper/qubes_dom0-root ro rd.luks.uuid=$LUKS_UUID rd.lvm.lv=qubes_dom0/root rd.lvm.lv=qubes_dom0/swap plymouth.ignore-serial-consoles rhgb rootzram quiet module.sig_enforce=1 bootscrub=on usbcore.authorized_default=0
echo 'Loading initial ramdisk ...'
insmod multiboot2
module2 --nounzip $LATEST_INITRAMFS
}
EOF

chmod 755 /etc/grub.d/40_custom

# Update GRUB
grub2-mkconfig -o /boot/grub2/grub.cfg

echo
echo "Done!"

Топовые гайды по Qubes OS в комментах ...

2026-07-19T12:55:25Z

Топовые гайды по Qubes OS в комментах (шпаргалка, чтоб не потерять)

Более крутой подход к режиму ...

2026-07-13T09:55:14Z

In reply to nevent1q…7605
_________________________

Более крутой подход к режиму несохранения - эфемерно зашифрованный dm-container вместо tmpfs. Это вообще не тратит ценную память телефона. Заранее установите sudo apt install e2fsprogs -y

#!/bin/bash
# заранее установите sudo apt install e2fsprogs -y
# === Конфигурация ===
UPPER_BASE="/mnt/overlay-persistent"
DMCRYPT_FILE="/var/lib/overlay-crypt.img"
DMCRYPT_SIZE_MB=10240
DMCRYPT_NAME="overlaycrypt"
STATE_FILE="/run/overlay-active"
TARGET_DIRS="/etc /var /home /root /usr /opt /userdata"

# === Проверка зависимостей ===
for cmd in cryptsetup losetup mkfs.ext4 mount umount; do
if ! command -v "$cmd" >/dev/null 2>&1; then
echo "ERROR: Missing $cmd"
exit 1
fi
done

# === Проверка, не активен ли уже ===
if [ -f "$STATE_FILE" ]; then
echo "Already active"
exit 0
fi

# === Создание sparse-файла ===
if [ ! -f "$DMCRYPT_FILE" ]; then
mkdir -p "$(dirname "$DMCRYPT_FILE")"
dd if=/dev/zero of="$DMCRYPT_FILE" bs=1M count=0 seek="$DMCRYPT_SIZE_MB" status=progress
fi

# === Loop-устройство ===
LOOP_DEV=$(losetup -f --show "$DMCRYPT_FILE")
echo "Loop device: $LOOP_DEV"

# === dm-crypt с случайным ключом ===
cryptsetup open --type plain --key-file /dev/urandom \
--cipher aes-xts-plain64 --key-size 512 \
--sector-size 4096 "$LOOP_DEV" "$DMCRYPT_NAME"

# === Форматирование ext4 ===
if ! blkid "/dev/mapper/$DMCRYPT_NAME" >/dev/null 2>&1; then
mkfs.ext4 -F -L "overlaycrypt" "/dev/mapper/$DMCRYPT_NAME"
fi

# === Монтирование контейнера ===
mkdir -p "$UPPER_BASE"
mount "/dev/mapper/$DMCRYPT_NAME" "$UPPER_BASE"

# === Overlay на каждую директорию ===
for dir in $TARGET_DIRS; do
name=$(echo "$dir" | tr '/' '-')
upper="$UPPER_BASE/$name-upper"
work="$UPPER_BASE/$name-work"
lower="$UPPER_BASE/$name-lower"

mkdir -p "$upper" "$work" "$lower"

mount --bind "$dir" "$lower"
mount --make-private "$lower"

mount -t overlay -o "lowerdir=$lower,upperdir=$upper,workdir=$work" overlay "$dir"

echo "Overlay active: $dir"
done

touch "$STATE_FILE"
echo "Overlay mode ON (dm-crypt ephemeral)"

Установка pam-duress на Droidian, чтобы ...

2026-07-09T16:36:42Z

In reply to nevent1q…ugu0
_________________________

Установка pam-duress на Droidian, чтобы создавать ложные пинкоды / пароли, которые уничтожат все опасные файлы и приложения при разблокировке телефона

sudo apt-get update
sudo apt-get install -y build-essential libpam0g-dev libssl-dev

git clone https://github.com/nuvious/pam-duress.git
cd pam-duress
make
sudo make install
make clean

mkdir -p ~/.duress
sudo mkdir -p /etc/duress.d

# сюда пишем аварийные команды для удаления / изменения
cat > ~/.duress/remove_test.sh << 'EOF'
#!/bin/sh
rm -rf /home/droidian/test
EOF

chmod 500 ~/.duress/remove_test.sh

duress_sign ~/.duress/remove_test.sh

chmod 400 ~/.duress/remove_test.sh.sha256

# проверка
ls -la ~/.duress/

# меняем полностью /etc/pam.d/common-auth
sudo nano /etc/pam.d/common-auth

# here are the per-package modules (the "Primary" block)
auth [success=2 default=ignore] pam_unix.so nullok
auth [success=1 default=ignore] pam_duress.so
# here's the fallback if no module succeeds
auth requisite pam_deny.so
# prime the stack with a positive return value if there isn't one already;
# this avoids us returning an error just because nothing sets a success code
# since the modules above will each just jump around
auth required pam_permit.so
# and here are more per-package modules (the "Additional" block)
auth optional pam_cap.so
# end of pam-auth-update config

# проверка
mkdir -p /home/droidian/test
touch /home/user/test/test_file.txt

допольнительные тулзы для помощи RAM ...

2026-07-07T16:39:41Z

In reply to nevent1q…duxy
_________________________

допольнительные тулзы для помощи RAM от перегрева.

# OOM-менеджер: earlyoom
sudo apt update
sudo apt install earlyoom
sudo systemctl enable --now earlyoom

Настройка в /etc/default/earlyoom:
EARLYOOM_ARGS="-m 8,8 -s 15,15 --prefer '(Web Content|Isolated Web|brave-browser|brave|firefox|firefox-esr|chromium|chromium-browser|waydroid|waydroid-full-ui)' --avoid '(phosh|phoc|systemd|ofono|NetworkManager|pulseaudio|lxc@android|gnome-session|dbus)' -r 3600"

# Скрипт периодического сброса кэша под давлением:

sudo nano /usr/local/bin/droidian-memory-guard.sh

#!/bin/bash
THRESHOLD=85
COOLDOWN=600

while true; do
MEM_USED=$(free | awk '/Mem:/ {printf "%.0f", ($2-$7)/$2*100}')
if [ "$MEM_USED" -gt "$THRESHOLD" ]; then
NOW=$(date +%s)
LAST=$(cat /run/droidian-memguard.last 2>/dev/null || echo 0)
if [ $((NOW - LAST)) -gt "$COOLDOWN" ]; then
sync
echo 3 > /proc/sys/vm/drop_caches
echo "$NOW" > /run/droidian-memguard.last
logger -t droidian-memguard "Caches dropped at ${MEM_USED}%"
fi
fi
sleep 60
done

sudo chmod +x /usr/local/bin/droidian-memory-guard.sh
sudo nano /etc/systemd/system/droidian-memguard.service

[Unit]
Description=Droidian Memory Guard
After=network.target

[Service]
Type=simple
ExecStart=/usr/local/bin/droidian-memory-guard.sh
Restart=always

[Install]
WantedBy=multi-user.target

sudo systemctl enable --now droidian-memguard

# Вырубим анимацию в Phosh

gsettings set org.gnome.desktop.interface enable-animations false

# Еще можно установить предел памяти для waydroid:

sudo nano /var/lib/waydroid/lxc/waydroid/config

lxc.cgroup.memory.limit_in_bytes = 900M

# Eсли хотите увеличить размер zram0, то:

sudo su
swapoff /dev/zram0
echo 1 > /sys/block/zram0/reset
echo 2500M > /sys/block/zram0/disksize
mkswap /dev/zram0
swapon /dev/zram0 -p 50 # или ставьте 100, если надо, чтобы zram0 работал на пределе без помощи swapfile

Режим работы в памяти уже ...

2026-07-07T16:32:01Z

In reply to nevent1q…3zqf
_________________________

Режим работы в памяти уже отличается сильно от мобиан - не получится просто так засунуть скрипт в initramfs, чтобы система, как в tails, запускалась в памяти при запуске. Поэтому будем пользоваться этим режимом в уже запущенной системе, создав переключатель, в котором надо будет просто ввести команду sudo overlay on. в скрипте в TARGET_DIRS можно указать либо весь корень, либо отдельные папки. Корень лучше не указывать, иначе swapfile не будет работать и напряг памяти увеличится. создайте скрипт в /usr/local/bin/overlay:

#!/bin/bash
# Toggle overlay mode for /etc and /var

UPPER_BASE="/mnt/overlay-persistent" # Change to tmpfs path for ephemeral
STATE_FILE="/run/overlay-active"
TARGET_DIRS="/etc /var /home /root /usr /opt"

toggle_on() {
[ -f "$STATE_FILE" ] && { echo "Already active"; exit 1; }

mkdir -p "$UPPER_BASE"
mount -t tmpfs -o size=50% tmpfs "$UPPER_BASE"

for dir in $TARGET_DIRS; do
local name=$(echo "$dir" | tr '/' '-')
local upper="$UPPER_BASE/$name-upper"
local work="$UPPER_BASE/$name-work"
local lower="$UPPER_BASE/$name-lower"

mkdir -p "$upper" "$work" "$lower"

# Bind-mount original to preserve access
mount --bind "$dir" "$lower"
mount --make-private "$lower"

# Mount overlay
mount -t overlay -o "lowerdir=$lower,upperdir=$upper,workdir=$work" overlay "$dir"

echo "Overlay active: $dir"
done

touch "$STATE_FILE"
echo "Overlay mode ON"
}

toggle_off() {
[ ! -f "$STATE_FILE" ] && { echo "Not active"; exit 1; }

for dir in $TARGET_DIRS; do
umount "$dir" 2>/dev/null || true
done

# Clean up bind mounts
for mnt in $(mount | grep "$UPPER_BASE" | awk '{print $3}' | tac); do
umount "$mnt" 2>/dev/null || true
done

rm -f "$STATE_FILE"
echo "Overlay mode OFF"
sync
reboot
}

show_status() {
if [ -f "$STATE_FILE" ]; then
echo "Overlay: ACTIVE"
echo "Upperdir location: $UPPER_BASE"
echo "Changes are stored on: $(df -T "$UPPER_BASE" | tail -1 | awk '{print $2}')"
else
echo "Overlay: INACTIVE"
fi
}

case "$1" in
on) toggle_on ;;
off) toggle_off ;;
status) show_status ;;
*) echo "Usage: $0 {on|off|status}" ;;
esac

Дополнительный зашифрованный swap на ...

2026-07-07T16:26:44Z

In reply to nevent1q…3zqf
_________________________

Дополнительный зашифрованный swap на 4 гига - для старых телефонов свопов много не бывает. Работать будет вместо с zram0:

#!/bin/bash
set -e

SWAP_SIZE="4G" # Reduced for eMMC longevity

echo "[*] Creating ${SWAP_SIZE} swap file..."

# Use dd instead of fallocate for better compatibility with encrypted filesystems
# fallocate may create holes that don't work well with encryption
dd if=/dev/zero of=/swapfile bs=1M count=4096 status=progress
chmod 600 /swapfile

echo "[*] Creating encrypted swap script..."

cat > /usr/local/bin/encrypted-swap.sh <<'SCRIPT'
#!/bin/bash
set -e

# Ждём, пока zram будет создан
for i in {1..30}; do
if [ -b /dev/zram0 ]; then
break
fi
sleep 1
done

# Отключаем существующие swap
swapoff /dev/zram0 2>/dev/null || true
swapoff /dev/mapper/swapfile 2>/dev/null || true
cryptsetup close swapfile 2>/dev/null || true
losetup -D 2>/dev/null || true
rm -f /run/encrypted-swap.loop

# Настраиваем loop для swapfile
LOOPDEV=$(losetup -f --show /swapfile)
echo "$LOOPDEV" > /run/encrypted-swap.loop

# Открываем с шифрованием
cryptsetup open --type plain \
--key-file /dev/urandom \
--cipher aes-xts-plain64 \
--key-size 256 \
"$LOOPDEV" swapfile

mkswap -f /dev/mapper/swapfile

# Активируем ОБА swap с ОДИНАКОВЫМ приоритетом
swapon -p 50 /dev/zram0
swapon -p 50 /dev/mapper/swapfile
SCRIPT

chmod +x /usr/local/bin/encrypted-swap.sh

echo "[*] Creating systemd service..."

cat > /etc/systemd/system/encrypted-swap.service <<'SERVICE'
[Unit]
Description=Encrypted Swap
After=local-fs.target
# Start after zram so we can set lower priority
After=zramswap.service
Wants=zramswap.service

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/usr/local/bin/encrypted-swap.sh
ExecStop=/bin/bash -c 'swapoff /dev/mapper/swapfile 2>/dev/null; cryptsetup close swapfile 2>/dev/null; LOOPDEV=$(cat /run/encrypted-swap.loop 2>/dev/null) && losetup -d $LOOPDEV 2>/dev/null || true; rm -f /run/encrypted-swap.loop'

[Install]
WantedBy=multi-user.target
SERVICE

echo "[*] Cleaning up crypttab and fstab..."
sed -i '/swap/d' /etc/crypttab 2>/dev/null || true
sed -i '/swap/d' /etc/fstab 2>/dev/null || true

echo "[*] Configuring swap preferences..."

# Moderate swappiness - let kernel decide, but prefer zram
cat > /etc/sysctl.d/99-swap.conf <<'EOF'
# Prefer zram over disk swap
vm.swappiness=100
vm.vfs_cache_pressure=200
EOF

echo "[*] Enabling encrypted swap service..."
systemctl daemon-reload
systemctl enable encrypted-swap.service

echo "[*] Activating encrypted swap..."
/usr/local/bin/encrypted-swap.sh

echo ""
echo "[*] Verification:"
swapon --show
cryptsetup status swapfile 2>/dev/null || echo "cryptsetup status failed, checking lsblk:"
lsblk | grep -i swap || true
free -h | grep -i swap

echo ""
echo "[*] Encrypted swap setup complete."
echo "[*] New random key generated at each boot."
echo "[*] Swap data is unrecoverable after shutdown."
echo "[*] WARNING: Disk swap on eMMC wears storage. Consider larger zram instead."

Droidian сидит на андроид-ядре, поэтому ...

2026-07-07T16:21:22Z

In reply to nevent1q…3zqf
_________________________

Droidian сидит на андроид-ядре, поэтому там, в отличие от мобиан, iptables. значит запуск всего трафика через тор будет по этому скрипту (у waydroid будет свой трафик и туда можно амнезию поставить):

#!/bin/bash

# Flush ALL iptables rules completely (be careful if remote!)
sudo iptables -F
sudo iptables -X
sudo iptables -t nat -F
sudo iptables -t nat -X
sudo iptables -t mangle -F
sudo iptables -t mangle -X
sudo iptables -P INPUT ACCEPT
sudo iptables -P FORWARD ACCEPT
sudo iptables -P OUTPUT ACCEPT

# Verify clean state
sudo iptables -L -v

echo "[*] Installing Tor..."
sudo apt update
sudo apt install -y tor

echo "[*] Configuring Tor..."

# Backup original torrc
sudo cp /etc/tor/torrc /etc/tor/torrc.backup

# Configure Tor for transparent proxy
sudo tee /etc/tor/torrc > /dev/null << 'EOF'
SocksPort 127.0.0.1:9050
TransPort 127.0.0.1:9040
DNSPort 127.0.0.1:9053
VirtualAddrNetworkIPv4 10.192.0.0/10
AutomapHostsOnResolve 1
RunAsDaemon 1
EOF

echo "[*] Restarting Tor..."
sudo systemctl restart tor
sleep 2

echo "[*] Checking Tor ports..."
sudo ss -tlnp | grep -E ':(9050|9040|9053)'

echo "[*] Setting up iptables rules..."

# IMPORTANT: First check if rules already exist to avoid duplicates
# Flush existing rules in our custom chains (or create them)
sudo iptables -t nat -F 2>/dev/null || true

# Create new chain for Tor (or flush if exists)
sudo iptables -t nat -N TOR_REDIRECT 2>/dev/null || sudo iptables -t nat -F TOR_REDIRECT

# Redirect DNS to Tor DNSPort
sudo iptables -t nat -A OUTPUT -p udp --dport 53 -j REDIRECT --to-ports 9053

# Redirect TCP traffic to Tor TransPort (except Tor itself)
sudo iptables -t nat -A OUTPUT -p tcp --syn -m owner ! --uid-owner debian-tor -j REDIRECT --to-ports 9040

# Allow loopback
sudo iptables -t nat -A OUTPUT -o lo -j RETURN

# Don't redirect local/private networks (optional - adjust as needed)
sudo iptables -t nat -A OUTPUT -d 127.0.0.0/8 -j RETURN
sudo iptables -t nat -A OUTPUT -d 192.168.0.0/16 -j RETURN
sudo iptables -t nat -A OUTPUT -d 10.0.0.0/8 -j RETURN

echo "[*] Current iptables nat rules:"
sudo iptables -t nat -L -v

echo "[*] Tor transparent proxy is now active"
echo "[*] Test with: curl --socks5 127.0.0.1:9050 https://check.torproject.org";

echo "[*] Saving iptables rules..."
sudo mkdir -p /etc/iptables
sudo iptables-save > /etc/iptables/rules.v4

echo "[*] Creating systemd service for autostart..."

sudo tee /etc/systemd/system/tor-firewall.service > /dev/null << 'EOF'
[Unit]
Description=Tor Transparent Proxy Firewall
After=network.target tor.service
Wants=tor.service

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/sbin/iptables-restore /etc/iptables/rules.v4
ExecStop=/sbin/iptables -F; /sbin/iptables -t nat -F; /sbin/iptables -t mangle -F

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl daemon-reload
sudo systemctl enable tor-firewall.service

echo "[*] Done. Rules will persist after reboot."

если что-то пойдет не так, то на ...

2026-07-07T15:57:58Z

In reply to nevent1q…8fk3
_________________________

если что-то пойдет не так, то на телефонах пиксель проще всего вернуть обычный андроид и попробовать снова. просто заходишь на сайт android flash tools и подключаешь телефон к usb. главное - перед восстановлением нажать на редактирование и убрать галочку с "заблокировать загрузчик". но там вряд ли что-то не так пойдет при установке - она слишком простая.

создаем команды для запуска и ...

2026-07-05T09:41:38Z

In reply to nevent1q…yxrz
_________________________

создаем команды для запуска и деактивации overlayroot

для выхода из overlayroot создайте в /usr/local/bin/stop-overlay:
#!/bin/sh
sudo mount -o remount,rw /live/image
sudo touch /live/image/
sudo mount -o remount,ro /live/image
sudo reboot

и затем в терминале sudo stop-overlay

после перезагрузки всё пишется снова на диск. для запуска overlayroot создайте /usr/local/bin/start-overlay:
rm /.overlayroot-disable
sudo reboot

и потом в терминале введи sudo start-overlay

p.s. естеснна, все файлы в /usr/local/bin надо делать исполняемыми sudo chmod +x

затем устанавливаем свой вариант ...

2026-07-05T09:31:25Z

In reply to nevent1q…t02z
_________________________

затем устанавливаем свой вариант overlayroot в initramfs для работы в RAM и потере данных при перезагрузке из режима overlayroot:

sudo tee /etc/initramfs-tools/scripts/init-bottom/overlayroot >/dev/null <<EOF
#!/bin/sh
# Overlayroot initramfs hook для Debian/Mobian

case "$1" in
prereqs)
echo ""
exit 0
;;
esac

. /scripts/functions

PATH=/usr/sbin:/usr/bin:/sbin:/bin
MYTAG="overlayroot"

# === НАСТРОЙКИ ===
root_rw=/media/root-rw
root_ro=/media/root-ro
NEWROOT="${rootmnt:-/root}"
OVERLAYROOT_DEBUG=1

# === ЛОГИРОВАНИЕ ===
log() {
"log_${1}_msg" "$MYTAG: $2"
_debug "[$1]:" "$2"
}
log_fail() { log failure "$*"; }
log_success() { log success "$*"; }
log_warn() { log warning "$*"; }
fail() {
[ $# -eq 0 ] || log_fail "$@"
exit 0
}

_debug() {
if [ "${DEBUG_BUSTED:-0}" = "0" ]; then
{ echo "$@" >> "/dev/.initramfs/${MYTAG}.log"; } 2>/dev/null ||
{ DEBUG_BUSTED=1; logwarn "debug is busted"; }
fi
}

debug() {
_debug "$@"
[ "${OVERLAYROOT_DEBUG:-0}" = "0" ] && return
echo "$MYTAG:" "$@"
}

# === ПАРСИНГ КОМАНДНОЙ СТРОКИ ЯДРА ===
# Читаем /proc/cmdline и ищем параметры overlayroot*
parse_cmdline() {
local cmdline=""
read cmdline < /proc/cmdline || return 1

OVERLAY_MODE=""
OVERLAY_CHROOT=0

for tok in $cmdline; do
case "$tok" in
overlayroot=off)
OVERLAY_MODE="disabled"
;;
overlayroot=chroot)
OVERLAY_CHROOT=1
;;
overlayroot=tmpfs)
OVERLAY_MODE="tmpfs"
;;
overlayroot=*)
OVERLAY_MODE="${tok#overlayroot=}"
;;
esac
done
}

# === ПРОВЕРКА ФЛАГОВ В ОРИГИНАЛЬНОМ КОРНЕ ===
check_disable_flags() {
# Проверяем флаг-файл в оригинальном корне (до overlay)
if [ -f "$NEWROOT/.overlayroot-disable" ]; then
log_success "found .overlayroot-disable flag, disabling overlay"
rm -f "$NEWROOT/.overlayroot-disable"
return 0
fi

# Проверяем флаг-файл для одноразового chroot
if [ -f "$NEWROOT/.overlayroot-chroot" ]; then
log_success "found .overlayroot-chroot flag, enabling chroot mode"
OVERLAY_CHROOT=1
rm -f "$NEWROOT/.overlayroot-chroot"
return 1
fi

return 1
}

# === МОНТИРОВАНИЕ TMPFS ДЛЯ OVERLAY ===
mount_overlay_tmpfs() {
local size="${1:-50%}"

mkdir -p "$root_rw" || fail "failed to create $root_rw"
mount -t tmpfs -o mode=0755,size=80% tmpfs-root "$root_rw" ||
fail "failed to mount tmpfs on $root_rw"

mkdir -p "$root_rw/overlay" "$root_rw/work" ||
fail "failed to create overlay dirs on tmpfs"
}

# === МОНТИРОВАНИЕ ОРИГИНАЛЬНОГО КОРНЯ ===
mount_original_root() {
mkdir -p "$root_ro" || fail "failed to create $root_ro"

# Если корень уже примонтирован в NEWROOT — биндим его
if [ -d "$NEWROOT/bin" ]; then
mount --bind "$NEWROOT" "$root_ro" ||
fail "failed to bind $NEWROOT to $root_ro"
else
fail "$NEWROOT is not mounted"
fi
}

# === МОНТИРОВАНИЕ OVERLAY ===
mount_overlay() {
local lowerdir="$1"
local upperdir="$2"
local workdir="$3"
local target="$4"

mkdir -p "$target" || fail "failed to create $target"

# Проверяем версию ядра для workdir
local mount_opts="lowerdir=$lowerdir,upperdir=$upperdir"
case "$(uname -r)" in
2*|3.1[01234567]*|3.[0-9].*)
# Старые ядра не требуют workdir
;;
*)
mount_opts="$mount_opts,workdir=$workdir"
;;
esac

mount -t overlay -o "$mount_opts" overlayroot "$target" ||
fail "failed to mount overlay on $target"
}

# === ПЕРЕМЕЩЕНИЕ MOUNTPOINT'ОВ ===
move_mounts() {
local source="$1"
local dest="$2"

# Переносим все дочерние mountpoint'ы (кроме самого source)
local mounts=""
mounts=$(awk -v mnt="$source" '$2 ~ "^"mnt && $2 != mnt {print $2}' /proc/mounts | sort)

for mp in $mounts; do
local rel="${mp#$source}"
[ -z "$rel" ] && continue

mkdir -p "$dest$rel" || log_warn "failed to create $dest$rel"
mount --move "$mp" "$dest$rel" ||
log_warn "failed to move $mp to $dest$rel"
done
}

# === ОБНОВЛЕНИЕ FSTAB ===
update_fstab() {
local root_ro="$1"
local root_rw="$2"

[ -f "${NEWROOT}/etc/fstab" ] || return 0

# Сохраняем оригинальный fstab
cp "${NEWROOT}/etc/fstab" "${NEWROOT}/etc/fstab.orig" 2>/dev/null || true

cat <<EOF >"${NEWROOT}/etc/fstab"
# This fstab is in an overlayfs.
# The real one can be found at ${root_ro}/etc/fstab
# To permanently modify files, chroot into writable view:
# sudo mount -o remount,rw ${root_ro}
# sudo chroot ${root_ro}
#
EOF

# Копируем оригинальные записи с изменёнными путями
while read spec file vfstype opts pass freq; do
# Пропускаем комментарии и пустые строки
case "$spec" in
\#*|""|swap) continue ;;
esac

# Корневую ФС заменяем на overlay
if [ "$file" = "/" ]; then
echo "overlayroot / overlay defaults 0 0"
echo "${root_ro} ${root_ro} none bind,ro 0 0"
echo "${root_rw} ${root_rw} none bind,rw 0 0"
continue
fi

# Виртуальные ФС пропускаем
case "$vfstype" in
proc|sys|tmpfs|devtmpfs|devpts|overlay) continue ;;
esac

# Остальные монтируем в ro-слой
echo "$spec ${root_ro}${file} $vfstype ro,$opts $pass $freq"
done < "${NEWROOT}/etc/fstab.orig" >> "${NEWROOT}/etc/fstab"
}

# === СОЗДАНИЕ ТОЧЕК ДОСТУПА /live/* ===
create_live_access() {
local root_ro="$1"
local root_rw="$2"

# Создаём /live/image (доступ к оригинальному ro корню)
mkdir -p "${NEWROOT}/live/image" || log_warn "failed to create /live/image"
mount --bind "$root_ro" "${NEWROOT}/live/image" ||
log_warn "failed to bind $root_ro to /live/image"

# Создаём /live/cow (доступ к rw слою)
mkdir -p "${NEWROOT}/live/cow" || log_warn "failed to create /live/cow"
mount --bind "$root_rw" "${NEWROOT}/live/cow" ||
log_warn "failed to bind $root_rw to /live/cow"
}

# === ОСНОВНАЯ ЛОГИКА ===

# 1. Парсим командную строку ядра
parse_cmdline

# 2. Проверяем флаги отключения
check_disable_flags
if [ $? -eq 0 ]; then
OVERLAY_MODE="disabled"
fi

# 3. Если overlay отключён — выходим
case "${OVERLAY_MODE:-enabled}" in
disabled|off|no)
log_success "overlayroot disabled, booting normal root"
exit 0
;;
esac

# 4. Проверяем что корень смонтирован
if [ ! -d "$NEWROOT/bin" ]; then
log_fail "$NEWROOT is not mounted"
exit 0
fi

# 5. Создаём временные директории в RAM
mkdir -p /run/overlay
mount -t tmpfs -o mode=0755,size=100% tmpfs /run/overlay ||
fail "failed to mount tmpfs on /run/overlay"

# 6. Монтируем оригинальный корень в ro-слой
mount_original_root

# 7. Монтируем tmpfs для rw-слоя
mount_overlay_tmpfs

# 8. Если запрошен chroot-режим — монтируем overlay отдельно
if [ "$OVERLAY_CHROOT" = "1" ]; then
log_warn "chroot mode requested, overlay will be available at /overlay"

# Монтируем overlay в /overlay внутри нового корня
mkdir -p "${NEWROOT}/overlay"
mount_overlay "$root_ro" "$root_rw/overlay" "$root_rw/work" "${NEWROOT}/overlay"

# Создаём точки доступа
create_live_access "$root_ro" "$root_rw"

# Переносим дочерние mountpoint'ы
move_mounts "$NEWROOT" "${NEWROOT}/overlay"

# Обновляем fstab
update_fstab "$root_ro" "$root_rw"

log_success "chroot overlay configured at /overlay"
exit 0
fi

# 9. Обычный режим: перемещаем корень в ro-слой, монтируем overlay на его место
# Перемещаем оригинальный корень
mount --move "$NEWROOT" "$root_ro" ||
fail "failed to move $NEWROOT to $root_ro"

# Монтируем overlay на место оригинального корня
mount_overlay "$root_ro" "$root_rw/overlay" "$root_rw/work" "$NEWROOT"

# 10. Переносим mountpoint'ы внутрь overlay
move_mounts "$root_ro" "$NEWROOT"

# 11. Перемещаем ro и rw слои внутрь overlay (чтобы были доступны из системы)
mkdir -p "${NEWROOT}${root_ro}" "${NEWROOT}${root_rw}"
mount --move "$root_ro" "${NEWROOT}${root_ro}" ||
log_warn "failed to move $root_ro into overlay"
mount --move "$root_rw" "${NEWROOT}${root_rw}" ||
log_warn "failed to move $root_rw into overlay"

# 12. Создаём точки доступа /live/*
create_live_access "${NEWROOT}${root_ro}" "${NEWROOT}${root_rw}"

# 13. Обновляем fstab
update_fstab "$root_ro" "$root_rw"

# 14. Если ядро просило ro — перемонтируем
read cmdline < /proc/cmdline
case " $cmdline " in
*\ ro\ *)
mount -o remount,ro "$NEWROOT" ||
log_warn "failed to remount overlay read-only"
;;
esac

log_success "overlayroot configured with /live/image and /live/cow access"
exit 0
EOF

sudo chmod 755 /etc/initramfs-tools/scripts/init-bottom/overlayroot

echo "overlay" | sudo tee -a /etc/initramfs-tools/modules

sudo update-initramfs -u -k all

sudo dpkg-reconfigure linux-image-$(uname -r)

Если хотите иметь еще и VPN, например ...

2026-07-05T09:27:56Z

In reply to nevent1q…pzhc
_________________________

Если хотите иметь еще и VPN, например WG, то запустите его по классике и сделайте такой переключатель из тора в вг и обратно в /usr/local/bin (переключение будет через команды sudo toggle-net wg или sudo toggle-net tor):

#!/bin/bash

# Toggle between Tor transparent proxy and WireGuard VPN
# Usage: sudo ./toggle-tor-wireguard.sh [tor|wg|status]

set -e

MODE="${1:-status}"
NFT_CONF_TOR="/etc/nftables.conf"
NFT_CONF_WG="/etc/nftables.wg.conf"
WIREGUARD_CONF="/etc/wireguard/wg0.conf"

show_status() {
echo "=== Current Status ==="
echo ""
echo "--- nftables rules ---"
sudo nft list ruleset 2>/dev/null || echo "No nftables rules loaded"
echo ""
echo "--- Tor service ---"
systemctl is-active tor 2>/dev/null || echo "Tor: inactive"
echo ""
echo "--- WireGuard ---"
wg show 2>/dev/null || echo "WireGuard: no interfaces"
echo ""
echo "--- Default route ---"
ip route | grep default || true
echo ""
echo "--- Checking Tor connectivity ---"
curl -s https://check.torproject.org | grep -i "congratulations\|sorry"
}

disable_tor() {
echo "[*] Disabling Tor transparent proxy..."

# Stop Tor service
if systemctl is-active --quiet tor 2>/dev/null; then
sudo systemctl stop tor
echo " Tor service stopped"
fi

# Flush nftables (remove Tor rules)
sudo nft flush ruleset 2>/dev/null || true
echo " nftables flushed"

# Restore basic nftables or leave empty for WireGuard
sudo nft -f - <<'EOF' 2>/dev/null || true
#!/usr/sbin/nft -f

table ip filter {
chain input {
type filter hook input priority filter; policy accept;
}
chain forward {
type filter hook forward priority filter; policy accept;
}
chain output {
type filter hook output priority filter; policy accept;
}
}
EOF

echo "[*] Tor disabled. Basic firewall restored."
}

enable_wireguard() {
echo "[*] Enabling WireGuard..."

# Check if WireGuard config exists
if [ ! -f "$WIREGUARD_CONF" ]; then
echo "[!] WireGuard config not found: $WIREGUARD_CONF"
echo " Please create your WireGuard configuration first."
exit 1
fi

# Make sure Tor is stopped
disable_tor

# Enable IP forwarding (required for WireGuard)
sudo sysctl -w net.ipv4.ip_forward=1 >/dev/null

# Start WireGuard
sudo wg-quick up wg0 2>/dev/null || true

# Ensure WireGuard starts on boot
sudo systemctl enable wg-quick@wg0 2>/dev/null || true
sudo systemctl start wg-quick@wg0 2>/dev/null || true

echo "[*] WireGuard enabled on wg0"
}

enable_tor() {
echo "[*] Enabling Tor transparent proxy..."

# Stop WireGuard if active
if wg show wg0 >/dev/null 2>&1; then
echo " Stopping WireGuard..."
sudo wg-quick down wg0 2>/dev/null || true
sudo systemctl stop wg-quick@wg0 2>/dev/null || true
sudo systemctl disable wg-quick@wg0 2>/dev/null || true
fi

# Restore Tor nftables rules
if [ -f "$NFT_CONF_TOR" ]; then
sudo nft -f "$NFT_CONF_TOR"
echo " Tor nftables rules restored"
else
echo "[!] Tor nftables config not found: $NFT_CONF_TOR"
exit 1
fi

# Start Tor
sudo systemctl start tor
sudo systemctl enable tor

echo "[*] Tor transparent proxy enabled"
}

case "$MODE" in
tor|t)
enable_tor
;;
wg|wireguard|w)
enable_wireguard
;;
status|s|"")
show_status
;;
*)
echo "Usage: $0 [tor|wg|status]"
echo ""
echo " tor - Enable Tor transparent proxy, disable WireGuard"
echo " wg - Enable WireGuard VPN, disable Tor"
echo " status - Show current network status (default)"
echo ""
exit 1
;;
esac

echo ""
show_status

После запуска системы запускаем ...

2026-07-05T09:23:37Z

In reply to nevent1q…t02z
_________________________

После запуска системы запускаем обновления. Затем отправляем весь трафик через Tor, запустив этот скрипт (оставляем только дырку для Waydroid, в который для торификации установите Invizible Pro и в настройках VPN включите блокировку трафика при отключении приложения):

#!/bin/bash

set -e

TOR_UID=108

# Step 1: Install Tor
echo "[*] Installing Tor..."
sudo apt update
sudo apt install -y tor

# Step 2: Configure Tor
echo "[*] Configuring Tor..."
sudo tee /etc/tor/torrc >/dev/null <<'EOF'
TransPort 127.0.0.1:9040
DNSPort 127.0.0.1:9053
AutomapHostsOnResolve 1
VirtualAddrNetworkIPv4 10.192.0.0/10
EOF

# Step 3: Restart and enable Tor
echo "[*] Restarting and enabling Tor service..."
sudo systemctl restart tor
sudo systemctl enable tor

# Step 4: Verify Tor is listening
echo "[*] Checking Tor listening ports..."
sudo ss -tulpn | grep tor

# Step 5: Configure nftables
echo "[*] Writing nftables configuration..."
sudo tee /etc/nftables.conf >/dev/null <<EOF
#!/usr/sbin/nft -f

flush ruleset

define uid = ${TOR_UID}

define waydroid_net = 192.168.240.0/24

define unrouteables = {
127.0.0.0/8,
10.0.0.0/8,
172.16.0.0/12,
192.168.0.0/16,
0.0.0.0/8,
100.64.0.0/10,
169.254.0.0/16,
192.0.0.0/24,
192.0.2.0/24,
192.88.99.0/24,
198.18.0.0/15,
198.51.100.0/24,
203.0.113.0/24,
224.0.0.0/4,
240.0.0.0/4
}

table ip nat {
set unrouteables {
type ipv4_addr
flags interval
elements = \$unrouteables
}

chain prerouting {
type nat hook prerouting priority dstnat; policy accept;
}

chain postrouting {
type nat hook postrouting priority srcnat; policy accept;

oifname != "waydroid0" ip saddr \$waydroid_net counter masquerade
}

chain output {
type nat hook output priority dstnat; policy accept;

ct state established,related accept

ip daddr \$waydroid_net return
ip saddr \$waydroid_net return

meta l4proto tcp ip daddr 10.192.0.0/10 redirect to :9040

ip daddr 127.0.0.1 udp dport 53 redirect to :9053

meta skuid \$uid return

oifname "lo" return

ip daddr @unrouteables return

meta l4proto tcp redirect to :9040
}
}

table ip filter {
set unrouteables {
type ipv4_addr
flags interval
elements = \$unrouteables
}

chain input {
type filter hook input priority filter; policy drop;

ct state established,related accept
iifname "lo" accept

iifname "waydroid0" udp dport { 53, 67 } accept
iifname "waydroid0" tcp dport { 53, 67 } accept

counter log prefix "TOR-INPUT-DROP: " drop
}

chain forward {
type filter hook forward priority filter; policy drop;

ct state established,related accept

iifname "waydroid0" oifname != "waydroid0" accept
iifname != "waydroid0" oifname "waydroid0" ct state established,related accept
}

chain output {
type filter hook output priority filter; policy drop;

ct state established,related accept

oifname "lo" accept

ip daddr \$waydroid_net accept
oifname "waydroid0" accept

meta skuid \$uid accept

ip daddr @unrouteables accept

meta l4proto tcp accept

udp dport 53 accept

counter log prefix "TOR-KILLSWITCH: " drop
}
}
EOF

# Step 6: Validate and apply nftables
echo "[*] Validating nftables configuration..."
sudo nft -c -f /etc/nftables.conf

echo "[*] Applying nftables rules..."
sudo nft -f /etc/nftables.conf

# Step 7: Enable and start nftables
echo "[*] Enabling nftables service..."
sudo systemctl enable nftables
sudo systemctl start nftables

# Step 8: Show active ruleset
echo "[*] Current nftables ruleset:"
sudo nft list ruleset

# Step 9: Verify Tor connectivity
echo "[*] Checking Tor connectivity..."
curl -s https://check.torproject.org | grep -i "congratulations\|sorry"

Tails на телефоне. Создаем ...

2026-07-05T09:19:51Z

Tails на телефоне. Создаем зашифрованную мобильную ОС, которая будет терять все данные после перезагрузки.

Сначала устанавливаем Mobian - дебиан для телефонов (проще всего на старый pixel 3a, который можно купить за 3 копейки). Для полнодискового шифрования нужно собрать ОС.
устанавливаем зависимости и клонируем репозиторий

sudo apt install debos bmap-tools xz-utils android-sdk-libsparse-utils yq mkbootimg cryptsetup

git clone https://salsa.debian.org/Mobian-team/mobian-recipes.git -b mobian-trixie
cd mobian-recipes

и запускаем сборку указав свой пароль от диска (sdm670 - это для pixel)

./build.sh -t sdm670 -c -R <password>

после сборки ставим образ в телефон
sudo apt install adb fastboot google-android-platform-tools-installer
включаем режим разработчика: Настройки → Система → Об устройстве → 7 раз нажми "Номер сборки"
включаем OEM-разблокировку: Настройки → Система → Параметры разработчика → "Разблокировка OEM"
перезагружаем в fastboot: power + volume down при выключенном устройстве.
затем вводим эти команды
fastboot flashing unlock
fastboot flash boot mobian-*-phosh-*.boot-sargo.img #название созданного boot-sargo.img
fastboot -S 100M flash userdata mobian-*-phosh-*.rootfs.img #название созданного rootfs.img
fastboot erase dtbo
fastboot oem uart enable
fastboot reboot
и вводим пароль шифрования при запуске системы. дефолтный пинкод будет 1234. система установлена, продолжение ниже.

upd: this bug android 17, not graphene os.

2026-06-28T04:08:33Z

In reply to nevent1q…qu46
_________________________

upd: this bug android 17, not graphene os.

upd: connecting phone to pc is working. only sim card problem.

2026-06-27T15:05:59Z

In reply to nevent1q…qu46
_________________________

upd: connecting phone to pc is working. only sim card problem.

@npub1hxx…g75y after update graphene os, physical sim card ...

2026-06-27T14:04:54Z

AmberFinal (npub1hxx…g75y) after update graphene os, physical sim card won't turn on - nothing happens after pressing "turn on sim". also phone is not visible on pc when connected via usb. problems only in android 17. check please.

@npub142g…xrj0 @npub1gcx…nj5z @npub1utx…50e8 ...

2026-06-24T05:15:24Z

amethyst (npub142g…xrj0) VitorPamplona (npub1gcx…nj5z) utxo the webmaster 🧑‍💻🍁 (npub1utx…50e8) Wisp (npub1wsp…7rqf) Please add a pincode in Amethyst and Dark Wisp to encrypt an account database

chainflip.io добавил поддержку сети tron и ...

2026-06-21T13:16:19Z

chainflip.io добавил поддержку сети tron и теперь это точно лучший кроссчейн-обменник для децентрализованной покупки чистого нативного биткоина на стейблкоины из сетей ethereum, solana, tron без kyc. chainflip имеет встроенный aml и хакерские битки там не пройдут. chainflip прошел кучу аудитов и имеет лучшие оценки безопасности для кроссчейнов с нативным битком на hindenrank. и там нет mev-атак при свопах ethereum.

RuStore это не магазин, а пегасус с ...

2026-06-12T08:36:32Z

RuStore это не магазин, а пегасус с арсеналом шпионажа за телефоном похлеще гуглов.

https://habr.com/ru/articles/1046710/

А это РуСтор "здорового человека" (хотя, сейчас все рус приложения - пегасусы: от яндексов до авито и сбера).

https://codeberg.org/mi6e4ka/openstore

самый удобный открытокодный ...

2026-06-09T11:26:01Z

самый удобный открытокодный антидетект браузер из всех, что пока попадались. если говорить об удобстве и простоте.

https://github.com/ProxyShard/ShardBrowser

новый ресурс, претендующий на ...

2026-06-03T17:27:50Z

новый ресурс, претендующий на звание лучшего хаба вселенной #Nostr

https://nostrhub.io/

about telegram "privacy" ...

2026-05-27T08:15:51Z

In reply to nevent1q…zlsu
_________________________

about telegram "privacy" https://www.whonix.org/wiki/Telegram

только в репозиториях самих ...

2026-05-25T19:04:23Z

In reply to nevent1q…wd5y
_________________________

только в репозиториях самих клиентов если. нет такого сайта, где вот прям все все клиенты собраны, т.к. клиентов всё больше, постоянно новые появляются. звонки пока добавлены в amethyst, 0xchat, nospeak. в общем, в отличие от джабьера, тут всё сложнее, т.к. клиентов намного больше и это мы говорим только о соцсети - еще вспомогательных ностр-тулзов десятки.

I can't see notes from private contacts, notes from ...

2026-05-21T05:16:16Z

In reply to nevent1q…fls4
_________________________

I can't see notes from private contacts, notes from relay-bridges (ditto.pub mostr.pub and nostr.data.haus). these problems didn't exist in the old versions 1.06 >

App has improved a lot functionally, but now it is impossible to use it to read and search for notes - many notes have disappeared

Zapstore - мой любимый магазин ...

2026-05-20T16:21:44Z

Zapstore - мой любимый магазин приложений. Заслужил грант.

quoting
note15a3…cjrl
New wave of nostr grants: 44Billion, NosCall, Routstr, Wisp, and Zapstore.
https://opensats.org/blog/seventeenth-wave-of-nostr-grants

Скиньте дырову, когда он снова ...

2026-05-18T10:27:42Z

Скиньте дырову, когда он снова будет постить всякую хуйню про ультра-приватность в телеге. Аудит подъехал.

Telegram's MTProto: Assessing Deanonymization Potential for a Network Attacker.
Dr. Nadim Kobeissi
Symbolic Software

https://static.istories.media/uploaded/documents/d92f02fe94f64906887d290489e26d14.pdf

@npub142g…xrj0 also I don't see notes from relay.data.haus ...

2026-05-17T05:24:01Z

In reply to nevent1q…q30n
_________________________

amethyst (npub142g…xrj0) also I don't see notes from relay.data.haus (rss). it works well in 0xchat and worked in the last version of Amethyst

@npub142g…xrj0 @npub1gcx…nj5z I don't see notes from my ...

2026-05-17T04:50:31Z

In reply to nevent1q…9cv7
_________________________

amethyst (npub142g…xrj0) VitorPamplona (npub1gcx…nj5z) I don't see notes from my private contacts in my feed, don't see notes from mastodon accounts with ditto-mostr relay, don't see some of my notes and some of my subscribers after the latest updates. check it please.

я думаю, сейчас постепенно все ...

2026-05-16T05:07:48Z

я думаю, сейчас постепенно все клиенты ностр будут переходить к золотому стандарту: поддержка звонков, мармот е2ее чатов с прямой секретностью, тор/прокси, приватных подписок, шифрования локальной базы данных + всякие штуки из телеги: анимированные стикеры и тд.
этот год будет поворотным в крутых обновлениях, будут закрыты последние баги, и ностр станет фантастической мега удобной соцсетью с высоченным уровнем приватности, децентрализации и свободы.

бомба! аметист становится ...

2026-05-15T20:50:30Z

бомба! аметист становится действительно топовым клиентом nostr. приватность, анонимность и куча крутых функций.

quoting
note1kxu…8cy8
#Amethyst v1.09.0: We are going crazy

- Go live on audio spaces (Nests)
- Marmot Group chats (WhiteNoise)
- Voice and Video calls (Noscall)
- PDF reader
- Favorite algo feeds
- HLS Video Uploads
- Schedule posts for later
- Cast videos to your TV (Chromecast)
- Mute a whole conversation thread
- Pull Notification (internal Pokey)
- Local LLMs (Pixel 9+, Samsung 25+, Xiaomi 15+)
- `amy`, a command-line Nostr client

## Features

- Voice and Video Calls (NIP-AC) — one-on-one and group WebRTC calls.
- Full-screen incoming-call UI over the lock screen.
- PiP, ringtone and vibration.
- Proximity sensor support.
- Bluetooth headset routing.
- Camera switch.
- Network resilience and default TURN servers.
- Mid-call peer invites with a 30s timeout and per-peer status.
- Settings toggle to disable calls.
- Audio Rooms / Nests (NIP-53) — a full revamp.
- Live chat panel.
- Reactions overlay and picker.
- Listener counter.
- Presence with publishing/onstage tags.
- Hand-raise queue.
- Host actions: kick, promote, demote, edit, close room.
- Per-participant context sheet.
- Scheduled rooms with a TimePicker and SCHEDULED badge.
- "Listen to recording" CTA for closed rooms.
- Share a room as `naddr1`.
- Custom room themes and fonts (kind 30312).
- Home live-bubble row showing follows broadcasting.
- Host-leave confirmation and default-server prompt.
- In-app lobby with a chat composer, gating room re-entry.
- PiP that focuses active speakers.
- Feed bucketed into Live / Scheduled / Recently ended, with live status verified by current presence.
- Live audio-level speaker ring.
- Keeps the screen on while connected.
- Audio plays through the media volume stream.
- Marmot Encrypted Group Chats (MLS over Nostr / NIP-EE)
- Create, join and leave groups.
- Inline group rendering in Messages.
- Member management with user search.
- Admin grant/revoke.
- Group info screen with picture, member list and per-relay freshness.
- Auto-publish KeyPackage.
- Reset Marmot State safety valve in Settings.
- Full RFC 9420 compliance pass (P0/P1/P2).
- External Commit flow.
- Retained-epoch decryption for offline catch-up.
- Required-capabilities advertised on groups; interop fixes for other Marmot clients.
- Popup notifications for group messages (kind:445).
- Multi-account on Desktop
- Account switcher dropdown in the sidebar and single-pane layout.
- Add Account dialog and per-account logout.
- View-only (npub-only) accounts.
- Account removal switches to another account or logs out cleanly.
- Encrypted local account storage (AES-256-GCM).
- Display names and middle-truncated npubs.
- Schedule posts for later
- Date/time picker and toolbar toggle in the post composer.
- Dedicated screen and drawer entry to view, push or delete scheduled posts.
- Background worker that publishes at the scheduled time.
- Warning when scheduling without always-on notifications.
- Cast videos to your TV
- Chromecast casting (Google Play build only).
- Stop-from-phone button; the local player pauses while casting.
- Cast button backfilled for accounts that already had video settings.
- Mute a whole thread
- Mute thread entry in the long-press dropdown and quick-action sheet.
- Muted threads listed in Security Filters with an unmute action.
- Muted threads dropped from feeds, notifications and push delivery.
- Configurable home tabs
- Choose between New Threads, Conversations and Everything.
- Visibility toggles persist across restarts.
- Configurable bottom navigation bar
- Pick which screens appear in the bottom bar.
- Restore-default button in settings.
- Reply and Mention notifications (NIP-10 / NIP-22)
- Dedicated Mentions channel.
- Per-thread grouping.
- Inline reply.
- All content-event citations routed to Mentions.
- Opt-in Following / Everyone tab split.
- Filter the home feed in place by hashtag, community, geohash and relay (no navigation away)
- Hashtag and geohash top-nav filters on Pictures, Shorts, Articles, Polls and Products
- NIP-22 comments on external content (hashtags, geohashes, URLs) render a typed reply-context chip and land in the conversations feed
- Interest Sets (NIP-51, kind 30015)
- List, create, rename, delete and clone interest sets.
- Public/private hashtag toggle.
- TopNav filter chips.
- NIP-9A Community Rules
- Structured rules editor in the new-community flow.
- Post validation against community rules in the composer.
- Opt-in moderation feed filter.
- PDF reader
- Inline PDF previews in feeds.
- Double-tap to toggle zoom.
- Zoom-aware hi-res re-render for crisp pinch-zoom.
- Download and save PDFs to Downloads/Amethyst.
- Multi-wallet NWC
- Multiple wallets with a balance view.
- Default picker, rename and reorder.
- Dedicated Add Wallet screen with Connect Wallet / paste / QR scan.
- Favorite Algo Feeds filter in the Top Nav Bar
- Custom Post creation on Polls / Pictures / Shorts / Longs
- Custom Emoji Packs (NIP-30)
- Browse Emoji Sets screen for discovering kind 30030 packs.
- My Emoji List screen for managing your kind 10030 selection.
- Modernized pack metadata screen with hero image and inline emoji/cover upload.
- Public/private toggle when adding emoji.
- Decrypted private emojis surfaced end-to-end.
- Dedicated drawer screens for more content types.
- Standalone Articles, Products, Public Chats, Communities (NIP-72), Live Streams and Follow Packs screens.
- Products screen defaults to "Around Me".
- Richer live stream chat.
- Inline clips (kind 1313) and raids (kind 1312).
- Inline zap receipts.
- NIP-75 zap goal pinned at the top.
- Top zappers leaderboard.
- Stream clips surfaced in the profile gallery tab.
- Content warnings on media.
- Grid-level content warnings with distinct reasons.
- Warning overlaid on the blurhash at media size.
- YouTube-style video quality picker.
- Feed and PiP default to the lowest HLS resolution.
- Fullscreen defaults to auto.
- HLS Video uploads (NIP-71)
- Pick which renditions to upload.
- See which file is currently uploading.
- Optional cross-post as a kind-1 note.
- Generated poster JPEG.
- Blurhash and thumbhash on every video imeta.
- ThumbHash support alongside BlurHash
- Used across events, uploads and the UI.
- Forwarded when adding media to the gallery.
- Upload failures to generate a blurhash/thumbhash are now surfaced.
- NIP-A3 Payment Targets (kind 10133)
- Pay action on the note reactions row.
- Payment-targets button on the profile.
- Lightning address moved to the wallet setup screen.
- Alt-text on payment-target events.
- Search power tools
- Scope, source, follows and sort toggles.
- Paste an `npub1…`, `nprofile1…`, `nevent1…`, `naddr1…` or `note1…` to jump straight to it.
- Markdown renderer — improved typography, blockquote gutter, table styling
- Polls
- Single-screen creation with a poll-type selector.
- Open/Closed tabs.
- "View results" option (prevents voting after viewing).
- Dismiss button on active-poll cards.
- Badge support Redesigned — You can now create, grant, manage and add/remove badges from your profile.
- Settings revamp
- Modernized Settings screen.
- Dedicated Profile UI settings page.
- Compose Settings screen (auto-draft toggle).
- Security Filters split into a hub with per-category screens.
- Tap a timestamp to toggle between relative ("2h ago") and absolute date/time, driven by a single shared ticker
- Copy raw JSON of a note from the dropdown menu
- Stale-relay hint on replaceable events, using the NIP-66 relay cache
- Two-stage zap progress on the zap action
- Bulk-remove for blocked users and hidden words
- Jump-to-parent icon on replies in Full UI mode
- Configurable report-warning threshold
- `.f4a` audio playback

## In AI-Ready phones (Pixel 9+, Samsung 25+, Xiaomi 15+):
- AI Writing Help — assistant in the new-post screen.
- Tone suggestions, precomputed in parallel.
- Auto language detection.
- On-device option in Application Preferences.
- AI Alt-Text for images — on-device image description / labeling.
- Suggestions appear in the upload sheet (Google Play build).

## Desktop

- Tor Support — full Tor support on the desktop app.
- kmp-tor daemon and settings UI.
- Per-relay routing.
- `.onion` badge.
- Restart-on-toggle.
- Image loading via Tor.
- Multi-account
- Sidebar account switcher.
- Add Account dialog and per-account logout.
- Encrypted account storage.
- Embedded local relay — an in-process relay with SQLite event persistence
- Custom feeds system
- Create, pin and inline-switch between custom feeds.
- Author search in the feed builder (relay NIP-50 + avatars).
- App Drawer with a categorized screen launcher
- Workspace management
- Save, switch and restore workspaces.
- Tabs, an editor and unified search.
- Pin/unpin syncs to the active workspace.
- Namecoin name resolution
- Namecoin lookups now resolve and surface in search.
- Follows the `import` field of name objects (ifa-0001).
- Added `relay.testls.bit` ElectrumX endpoints (clearnet TLS, Tor, bare IP).
- Native theming for macOS, GNOME, KDE and Windows (matches platform look and accent colors)
- Relay power tools
- Dashboard and config editors.
- Per-screen relay picker.
- Persistent configuration.
- Correct counts.
- Messages
- Draggable divider.
- Alignment polish and centered empty states.
- Typography hierarchy and refined dividers.
- macOS polish
- Dock / Cmd+Tab icon via the Taskbar API.
- Apple-HIG squircle margins.
- Transparent window icon.
- Light-mode primary contrast.
- Content extends correctly under the title bar.
- Reading layout — width-capped reading column with comfortable side margins for wide windows
- Compact UI
- Search/Chat/Profile inputs.
- Settings hierarchy normalized.
- Tabs-first headers across Home / Reads / Notifications.
- Whole-card hover on notes.
- Per-OS theming preview flag for testing macOS/GNOME/KDE/Windows looks locally
- Selectable error messages.
- Scrollable single-pane navigation rail.
- Fixes feed loading, repost rendering and Profile back-navigation visibility.

## Amy (CLI)

- New `amy`, a non-interactive CLI Nostr client.
- Drives the same Quartz + Commons engine as the apps.
- Available on macOS and Linux from the GitHub Release.
- Subcommands:
- `account` / `use`, `profile`, `post`, `feed`, `notes`.
- `dm send | list | await | send-file` (NIP-17, kind:14 + kind:15).
- `marmot …`.
- `store stat | sweep-expired | scrub | compact`.
- Cache-first reads from a local file-backed event store.
- `relays.json` is gone — `kind:10002 / 10050 / 10051` events in the store *are* the config.
- Secure key storage.
- Private keys move out of `identity.json` into the OS keychain or a NIP-49 encrypted file.
- On-disk data restricted to owner-only.
- Color, human-readable output by default; `--json` opts in.

## Quartz

- Adds NIP-AC — WebRTC call signaling events (offer / answer / ICE / hangup / reject / renegotiate) over EphemeralGiftWrap, multi-device, group calls
- Adds EphemeralGiftWrapEvent (kind 21059) — replaces 20s expiration GiftWraps for call signaling
- Adds NIP-A3 Payment Targets (kind 10133)
- Adds NIP-82 Software Applications (experimental)
- Adds the AdminCommandEvent for audio-room kick (kind 4312)
- Adds the NIP-9A community rules parser + validator (kind:34551)
- Expands NIP-34 git collaboration coverage.
- Repository State (kind 30618).
- Pull Requests and PR updates (kinds 1618 / 1619).
- Git Status events (open / closed / draft / applied).
- Adds the rest of NIP-51 list event kinds and full NIP-53 live-activity rendering
- Adds MLS / Marmot event types and a pure-Kotlin MLS engine with IETF RFC 9420 interop test vectors (no native deps)
- Adds an async SQLite event persistence layer.
- NIP-09 / NIP-50 / NIP-62 compliance.
- Room-style connection pool.
- Adds a file-backed event store.
- flock + transactions.
- scrub/compact.
- NIP-50 full-text search.
- NIP-62 Right-to-Vanish.
- NIP-01 tiebreaker.
- NIP-09 created_at window.
- Deletion-author check.
- Adds a reactive `ObservableEventStore` layer.
- A façade that wraps any event store — SQLite-backed, file-backed, or in-memory.
- Publishes a `StoreChange` on every accepted insert, delete and expiration sweep.
- Projections stay in sync without re-querying the store.
- Ephemeral events (kinds 20000-29999) emit without being persisted.
- `EventStoreProjection` turns the change stream into a cold `Flow` of sealed `ProjectionState`.
- Per-filter limits and per-projection NIP-62 vanish scoping.
- Promotes the relay toolkit into the new `geode` module — a real Nostr relay.
- Implements NIP-01 and NIP-45.
- NIP-77 negentropy reconciliation (strfry parity).
- NIP-86 management API.
- TOML config and graceful drain.
- Adaptive connection pooling for 10k+ connections.
- Adds an EventInterner so deserialized events share canonical instances, with an interning event store that interns on insert
- Adds Ktor KMP HTTP implementations alongside OkHttp
- Adds macOS (Apple Silicon), iOS and Linux native targets.
- Pure-Kotlin Ed25519 and X25519 for the MLS crypto on those platforms.
- `commonMain` now compiles for Kotlin/Native.

## Crypto and Performance

- Custom secp256k1 implementation, starting to replace `fr.acinq.secp256k1`
- Pure-Kotlin core for KMP native targets (macOS / iOS / Linux).
- C + inline-ASM accelerated path on Android via a JNI bridge.
- Hardware SHA-256 (SHA-NI on x86_64, ARMv8 CE on ARM64).
- Comb method for G multiplication → 3× faster sign/keygen.
- Same-pubkey batch Schnorr verify (5–6× throughput).
- `verifySchnorrFast` for Nostr (skips y-parity inversion).
- 4×64-bit limb representation with lazy field ops and ARM64 assembly.
- Standalone `libsecp256k1-nostr` / `libschnorr256k1` C project, with Android benchmarks.
- Concurrent caching DNS resolver (SurgeDns)
- Lock-free DNS cache.
- 24h positive TTL.
- Stale-while-revalidate.
- Persisted across process restarts.
- Smoother video playback
- Warm ExoPlayer pool and retained warm players.
- Tuned LoadControl.
- VideoCache warmup 10s → 1.5s.
- Stable controller-overlay tree.
- Faster icons — shared FontFamily and TextMeasurer across all Material Symbols
- Faster chat lists — stable list keys and reduced recomposition
- Faster note rendering — cached event-derived values, fewer per-item allocations during feed scroll
- Faster Quartz queries
- Direct-slot driver for replaceable + addressable lookups.
- Streaming k-way merge.
- Smallest-first FTS intersect.
- Parallel Schnorr verify in the ingest queue.
- Index-driven fan-out for cache observers.
- Faster rich-text translation
- Thumbnail disk cache for profile pictures; Coil disk-cache eviction moved off the write path to prevent scroll stalls
- Paginated GiftWrap loading for the DM chat list
- Bookmark events preloaded for faster access
- Lifecycle-aware screen subscriptions
- Feed/screen relay subscriptions pause on background and resume on foreground.
- 30s grace delay so brief app switches don't churn subscriptions.
- Adaptive video disk cache — sized to 20% of free disk (256 MB–4 GB) instead of a fixed 1 GB, with on-demand HLS videos cached in SimpleCache
- Tuned image/video OkHttp dispatcher and connection pool (16 in-flight per host) to de-serialize feed loading
- Streaming image hashing — computes image hashes without loading the whole file into memory; SHA-256 hasher moved off the thread pool
- GeoHash library rewritten from scratch for performance, dropping an external dependency

## QUIC + nestsClient (foundation)

- New pure-Kotlin QUIC v1 + HTTP/3 + WebTransport client (no JNI, no native deps).
- Powers the NIP-53 audio-rooms over MoQ-transport path.
- Full RFC coverage and stabilization:
- RFC 9002 loss recovery and retransmission.
- 0-RTT early data.
- 1-RTT key update.
- TLS 1.3 session resumption (PSK).
- ECN.
- Connection migration with path validation.
- Retry and Version Negotiation packet handling.
- Stateless-reset detection.
- Broad DoS-hardening / RFC-compliance stabilization sweep.
- Passes the quic-interop-runner test matrix against picoquic and quic-go.
- Covers handshake, transfer, multiplexing, retry, 0-RTT, key-update, ECN, http3.
- Includes qlog diagnostics.
- Multiple security and correctness audits.
- RFC 9001 test vectors.
- Live interop against aioquic and picoquic.
- `nestsClient` module
- MoQ-transport (IETF) reference implementation.
- Production moq-lite Lite-03/04 codec with version-aware ALPN negotiation.
- `catalog.json` publishing aligned with kixelated/hang.
- Opus + AudioRecord/AudioTrack.
- Reconnection policy with proactive JWT refresh.
- Cross-stack (Amethyst ↔ Rust ↔ browser) interop harness in CI.

## Improvements and Fixes
- WakeUp Push Notification events — Starting to migrate to a better Push/Loading system
- Pinned notes moved to their own screen
- Left drawer reorganized into collapsible You / Feeds / Create / System sections, with clearer names
- Article writing redesign — banner, tags, slug
- Redesigned long-form article cards
- GIF support
- Playback controls and autoplay.
- GIF→MP4 upload conversion option in the upload screen.
- GIF / image keyboard support in the short post screen and in Marmot, DM and public-channel chat fields.
- Configurable video player buttons in Account Settings
- Autoplay Videos setting (Always / Never), separate from the video-loading toggle
- Drag-and-drop reordering for some relay list settings
- 3-dot options menu on video / picture / file feed cards
- Zoomable media grows from its source bounds, and loads the full-resolution source in the image dialog
- Favorite relays can now be added to the Global Feed
- Configurable max-hashtag spam filter
- Account setting to forward kind 0 events to a local relay
- Relay Sync UI replaced with visual indicators
- Account Settings
- Split broadcast tracker visibility from Complete UI mode.
- Hide payment-targets icon by default and place it after Zap.
- Float the broadcast banner as a rounded card.
- Danger Zone section in settings
- NIP-89 client tag
- Per-account toggle to disable it, synced via NIP-78 security settings.
- On by default and moved into Compose settings.
- Local Blossom cache — image and profile-picture fetches route through a local Blossom cache
- Mention preservation in compose:
- Survives keyboard auto-correction.
- Partial-overlap edits delete the whole mention.
- Cursor snaps to mention boundaries.
- Chat cursor jumping fixed
- Avatar zoom-in keeps aspect ratio during the animation
- Profile pictures center-cropped to prevent squashing
- HLS video fixes:
- Playback routed to the right MediaSource.
- Multi-rendition videos collapse to a single gallery tile.
- Render with artwork and a graceful fallback.
- Broken "Pause" action removed from the always-on background notification
- Hand-raise button in audio rooms now has a visible toggled state
- GiftWrap unwrapping for all writable accounts when always-on is enabled
- Search bar bech32 paste navigates instead of running a search
- Top and bottom bars stay visible on non-scrollable lists
- Rich-text translation:
- Bug, performance and jitter overhaul.
- `{N}` placeholders so URLs survive CJK translation.
- Swipe-to-dismiss containers fixed on newer Compose
- Right-to-Vanish settings observe toggles reactively, preserve prior behavior on upgrade
- Relay reconnection:
- Auto-reconnect after a server-initiated disconnect.
- Periodic keep-alive to revive relays stuck in long backoff.
- Account settings (profile, follow list, mutes, relay lists, KeyPackages) are republished to newly-selected relays so accounts aren't lost on fresh relays
- Broadcasting relays:
- Kept out of personal & channel sends.
- Always included in non-private sends.
- Fixed an infinite loop in the broadcast-relay computation.
- Tor now falls back to clearnet when bootstrap is stuck
- Android Arti reliability: stale Arti cache cleared on init with retry, SOCKS proxy default port moved with busy-port retry, relay-over-Tor connectivity fixes
- Chess game challenges filtered out of the home feed (ended games only); chess cards show user picture and name instead of hex pubkeys
- Expired polls re-evaluated and removed from notification cards
- NIP-39 external identity claims without a platform separator are rejected
- Dismissible cleanup banner across Pinned Notes, Bookmarks and Bookmark Sets, flagging author-deleted items with a "Remove from list" action
- Bogus Content-Type rejected when saving downloaded media, with URL-extension fallback validation
- NIP-46 bunker decrypt/encrypt response parsing fixed, with a longer timeout
- Hidden DMs no longer counted toward the unread message badge
- Profile header hides the `_@` prefix on NIP-05 names
- Foreground-service-not-allowed exception from the background handled gracefully
- Fixes Samsung crash on outgoing call
- Foreground service starts earlier to prevent call death on Android 14+
- Stop ringtone and call notification when rejecting consecutive calls

## UI Refresh

- Migrates the icon set from Material Icons to Material Symbols (thin weight) for a more consistent, modern look across the app
- Drops unused legacy drawables
- Bottom-bar icon size bumped to compensate for Material Symbols padding

## Build & Documentation

- CI restructure:
- Splits Android into its own CI job.
- Adds Android Lint as the first step.
- Merges test+build to eliminate duplicate compilation.
- Drops `assembleDebug` APK uploads.
- Adds a `:nestsClient:test` step to the desktop CI leg
- Adds a quic-interop-runner CI workflow and a browser-side cross-stack interop workflow
- Broadens `libicu` Depends so the `.deb` installs across Debian and Ubuntu
- Adds `SECURITY.md` with private vulnerability reporting policy
- Moves desktop packaging / AppImage tooling into the `desktopApp` module
- AGP and dependencies bumped

## Contributors

- VitorPamplona (nprofile…vhl6)
- ⚡ Dee Kay ⚡ (nprofile…m3sx)
- beefenergy (nprofile…wpzp)
- greenart7c3 (nprofile…xcpk)
- KotlinGeek (nprofile…n65v)
- v (nprofile…mjk6)

## Translations

- Czech, German, Swedish, and Portuguese by ⚡ Dee Kay ⚡ (nprofile…m3sx)
- Hungarian by summoner (nprofile…ns2l)
- French by DuPainEtDesJeux (nprofile…d26f)
- Polish by Polak (nprofile…ajyt)
- Hindi by राज (nprofile…3hlx)
- Slovenian by StellarStoic (nprofile…406e)
- Bengali by Cats (nprofile…3aw2)
- Spanish by ⚡₿it₿y₿it⚡ (nprofile…yhdq)
- Chinese by hypnotichemionus4 and CXPLAY (nprofile…r68m)
- Russian by Anton Zhao

Интересные исследования ...

2026-05-15T15:09:14Z

Интересные исследования шифрования whatsapp через реверс-инженеринг + аудит trail of bits. По сути, сквозное шифрование сообщений и прямую секретность доказать удалось, чтоб там павел дыров не кричал. Конечно, статьи нашли достаточно уязвимых мест, в основном, для метаданных, и отклонений от протокола signal (цукерберг тоже врун), но это всё равно лучше, чем облачные переписки в телеге, особенно, в групповых чатах.

1. https://eprint.iacr.org/2025/794.pdf

2. https://arxiv.org/html/2511.11385v2

3. https://blog.trailofbits.com/2026/04/07/what-we-learned-about-tee-security-from-auditing-whatsapps-private-inference/

@npub1utx…50e8 hello! add a private following - private contact ...

2026-05-14T04:47:57Z

utxo the webmaster 🧑‍💻🍁 (npub1utx…50e8) hello! add a private following - private contact list with hidden subs, like in Amethyst and 0xchat. many users will not see all the following list on Wisp after Amethyst and 0xchat. and please add a PIN code that encrypts the database.

"шифрование" винды - это цирк с ...

2026-05-13T15:23:09Z

"шифрование" винды - это цирк с блэкджеком и бэкдорами

https://cybernews.com/security/researcher-releases-bitlocker-bypass-and-privilege-escalation-exploit/

Крутой инструмент обхода белых ...

2026-05-08T11:52:37Z

Крутой инструмент обхода белых списков на базе белых звонков/стримингов
https://github.com/openlibrecommunity/olcrtc

И подробные инструкции как это запустить самому
https://habr.com/ru/articles/1020114/
https://www.youtube.com/watch?v=kxv7ET2cV1U

юзерам из рф особый поклон #note1wvu…8952

2026-05-07T08:53:26Z

юзерам из рф особый поклон

quoting
note1wvu…8952
Completely refactored the real-time Geohash Explorer on #Nymchat to be way more performant as a 2D flat world map and show country borders and names as well as have an optional heat map, shown below:

https://nymchat.app

Amethyst, Wisp and 0xchat

2026-05-06T21:16:29Z

In reply to nevent1q…w4as
_________________________

Amethyst, Wisp and 0xchat

Nospeak added support for audio and video calls! very cool secure ...

2026-05-03T05:03:45Z

Nospeak added support for audio and video calls! very cool secure nostr messenger.
psic4t (npub174t…mqm6) thanks! what's next? notes? marmot chats?

Nospeak теперь один из лучших и стабильно работающих мессенджеров #nostr
https://github.com/psic4t/nospeak

Simplex Chat добавил функцию каналов. ...

2026-05-01T14:44:18Z

Simplex Chat добавил функцию каналов. Каналы реализованы по похожей на Nostr модели - передача контента пойдет через реле с сохранением состояния, при этом, реле не имеют никакой инфы о владельцах или пользователях канала, а контент зашифрован криптографией. Админы каналов полностью владеют клачами и контентом - никаких банов, как в телеге у Дырова нет + полная анонимность участников. Вот что значит - делать с заботов о людях и их приватности. Учись Пашка и не рассказывай сказки о приватности в своей дырявой помойке.
https://github.com/simplex-chat/simplex-chat/blob/master/docs/protocol/channels-overview.md

Выявление слежки в 30 популярных ...

2026-05-01T08:12:09Z

Выявление слежки в 30 популярных российских приложениях
https://rks.global/files/research/russian_apps_search_for_vpn_ru.pdf

Cloudflare пометил макс, как шпионское ...

2026-04-30T11:47:26Z

Cloudflare пометил макс, как шпионское ПО. В идеале, как минимум, так надо пометить еще и яндекс с вк/ок, но до этих у Cloudflare, наверно, руки не дойдут

Cool! Warp is now open-source! ...

2026-04-29T06:14:13Z

Cool! Warp is now open-source!
https://www.warp.dev/blog/warp-is-now-open-source

Delta Chat может работать в белых ...

2026-04-27T06:41:52Z

Delta Chat может работать в белых списках. Вот что для этого нужно:

Подготовка «транспорта»: Не используйте свой личный ящик, иначе Delta Chat смешает ваши почтовые письма с чатами. Зарегистрируйте новый чистый аккаунт, например, на яндекс почте или на вк почте.

Разрешение доступа (Критический шаг): Современные почтовые сервисы запрещают подключение по IMAP с основным паролем от аккаунта в целях безопасности. Вам нужно создать Пароль приложения.

В Яндексе: Зайдите в аккаунт -> Безопасность -> Пароли приложений. Создайте новый пароль (выберите тип “Почта”). Скопируйте сгенерированный 16-значный код. Убедитесь, что в настройках почтового ящика (Почтовые программы) включен доступ по IMAP.

В VK Почте: Перейдите в настройки безопасности аккаунта VK ID -> Безопасность и вход -> Пароли для внешних приложений. Сгенерируйте пароль.

Установка и первый запуск: Скачайте клиент Delta Chat. Приложения доступны для Android, iOS, Windows, macOS и Linux. При запуске выберите «Войти в свой аккаунт». Запустите приложение и выберите "Использовать электронную почту как релей". Введите ваш созданный e-mail и вставьте пароль приложения. Приложение автоматически подтянет настройки серверов Яндекса или VK.

Крутая настройка для усиления приватности перед почтовым провайдером: Зайдите в Настройки Delta Chat -> Продвинутые настройки. Опционально можно включить скрытие заголовков Message-ID и Chat-Version, чтобы ваши письма даже для почтовых алгоритмов Яндекса выглядели максимально стандартно, без следов автоматизации мессенджером.

В Delta Chat через ботов можно читать крупные публичные телеграм каналы и rss-ленты. В итоге, получится телеграм на минималках, но зато с шифрованием. Список публичных ботов Delta Chat:
https://deltachat-bot.github.io/public-bots/#/home

@npub16zx…4ynp please add a PIN code and local database ...

2026-04-25T11:26:09Z

Delta Chat (npub16zx…4ynp) please add a PIN code and local database encryption to the mobile and desktop clients

@npub1hru…f3yh chats nip-17 and marmot are very good👍 add a ...

2026-04-24T17:34:51Z

VectorPrivacy (npub1hru…f3yh) chats nip-17 and marmot are very good👍
add a multi-account and maybe nostr web apps for viewing news and notes. also need a function to hide messages in notifications.

@npub180c…h6w6 Hello. Are Nostr messages using NIP-17, NIP-EE, ...

2026-04-24T09:43:40Z

fiatjaf (npub180c…h6w6) Hello. Are Nostr messages using NIP-17, NIP-EE, or Marmot protected against extraction from the device or forensic analysis (including deleted messages)? Can intelligence agencies and police recover data after the application has been uninstalled?

Hello! You have a wonderful app! The browser works really great. ...

2026-04-24T09:06:21Z

In reply to nevent1q…as7e
_________________________

Hello! You have a wonderful app! The browser works really great. But I noticed some issues with chats: it's impossible to have one Signal chat synced between phone and desktop. Also, messages disappear in the NIP-17 chat when using the account on both phone and desktop simultaneously. I tested this on Debian 13 and Android 16. Also, why is there a separate chat for my NIP-17 messages and notifications from there? (Maybe allow muting notifications for individual chats?). It would be cool if the app had a single unified chat on both phone and desktop, syncing all messages for both NIP-17 and Signal.

@npub1wht…r3ec @npub1h0u…rwx8 White Noise and Keychat not ...

2026-04-20T06:15:05Z

White Noise (npub1wht…r3ec) Keychat (npub1h0u…rwx8) White Noise and Keychat not compatible now? (different encryption protocols?)
#nostr #signal #mls

https://github.com/ExTV/Podroid Запуск ...

2026-04-19T05:17:30Z

https://github.com/ExTV/Podroid

Запуск Linux-контейнеров на Android без root-прав. Podroid позволяет пользователю запускать на устройстве под управлением Android (Android 9+ arm64) облегчённую виртуальную машину Alpine Linux с использованием QEMU.

Tor начал разрабатывать собственные ...

2026-04-18T07:22:36Z

Tor начал разрабатывать собственные ram-серверы, уничтожающие все данные при изъятии. Мощная защита от криминалистики.

https://www.techradar.com/vpn/vpn-privacy-security/beyond-no-log-tor-looks-into-seizure-proof-servers-that-forget-your-data

Sorry, I found how to delete cookies. Cool!

2026-04-17T05:22:45Z

In reply to nevent1q…m24w
_________________________

Sorry, I found how to delete cookies. Cool!

@npub1h0u…rwx8 hello! you are amazing! please add deleting ...

2026-04-17T04:46:43Z

Keychat (npub1h0u…rwx8) hello! you are amazing! please add deleting cookies in your browser. and I don't receive messages in nip-17 - I get a new message notification, but there is no message. check it please.
mls chats work great! and Keychat works great on Linux!

@npub17n4…fyh9 thanks for dm! please add support of private ...

2026-04-16T06:34:29Z

Jumble (npub17n4…fyh9) thanks for dm! please add support of private following / private contacts (secret subscriptions that no one sees, like contacts in 0xchat and dm-contacts in Amethyst).

Jumble added DM with signal mls encryption. The first Nostr web ...

2026-04-16T06:21:36Z

Jumble added DM with signal mls encryption. The first Nostr web client with the most powerful encryption. Now you can use mls encryption in 0xchat in Jumble (napps).

Джамбл добавил личку с супер-шифрованием сигнала - теперь у нас есть и вэб-клиент ностр с мощнейшим шифрованием. В 0хchat можно совмещать шифрование с nip-17 (в лс 0х) + млс-шифрование в джамбл (в napps).

https://jumble.social/

wow okay 😂

2026-04-15T11:33:22Z

In reply to nevent1q…k559
_________________________

wow okay 😂

@npub1gcx…nj5z add ntfy support for notifications. amethyst has ...

2026-04-15T04:06:20Z

VitorPamplona (npub1gcx…nj5z) add ntfy support for notifications. amethyst has no notification in graphene os

FBI Extracts Suspect’s Deleted Signal Messages Saved in iPhone ...

2026-04-10T07:32:29Z

FBI Extracts Suspect’s Deleted Signal Messages Saved in iPhone Notification Database.
Вот почему криминалистическая экспертиза - вещь серьезная, и от нее надо мощно защищаться (лучше всего, с Graphene OS)

https://lifehacker.com/tech/fbi-extracted-deleted-signal-messages-from-a-defendants-iphone

Cloudflare признал Telega шпионским ПО ...

2026-04-09T11:34:18Z

Cloudflare признал Telega шпионским ПО

https://kod.ru/cloudflare-vs-telega

ну и третий спасительный вариант - ...

2026-04-08T17:47:07Z

ну и третий спасительный вариант - использовать graphene os и расскидать вк-яндексы и ютубы-инстаграмы в разные профили.

quoting
note1seg…3wn2
На гитхабе появились приложения для андроид с проверкой обнаружения впн на устройстве. Реализовано всё это по методичке РКН.

RKNHardering
https://github.com/xtclovver/RKNHardering

yourvpndead
https://github.com/loop-uh/yourvpndead

Можно затестить спалят ли вашу амнезию впн приложухи макс, вк, яндекс (скорее всего спалят и очень легко).
Чтобы избежать этого есть 2 пути: телефон без рус гос приложений и впн на роутере с openwrt

На гитхабе появились приложения ...

2026-04-08T17:40:14Z

На гитхабе появились приложения для андроид с проверкой обнаружения впн на устройстве. Реализовано всё это по методичке РКН.

RKNHardering
https://github.com/xtclovver/RKNHardering

yourvpndead
https://github.com/loop-uh/yourvpndead

Можно затестить спалят ли вашу амнезию впн приложухи макс, вк, яндекс (скорее всего спалят и очень легко).
Чтобы избежать этого есть 2 пути: телефон без рус гос приложений и впн на роутере с openwrt

Nostr Mail должен позволить болтать с ...

2026-04-08T07:11:50Z

Nostr Mail должен позволить болтать с юзерами из Delta Chat.

quoting
note1dya…hvkc
New wave of nostr grants: Amethyst Desktop, Nostr Mail, Nostrord, and Nurunuru. Onward 🫡 https://opensats.org/blog/sixteenth-wave-of-nostr-grants

Nostr event nevent1qqs2q7y4ga44an0jnf3s6ac9ghu7a4tfjup97eqg4u8u35wwn9u7l6qzyrpslrukdypvwekwxe7we7sglwf082ued46r225m2jgmpl2w630323356qf

2026-04-08T06:57:05Z

#nostr

Use 0xchat nostr client. You can use telegram web in 0xchat. Web ...

2026-04-07T06:20:50Z

In reply to nevent1q…nqc5
_________________________

Use 0xchat nostr client. You can use telegram web in 0xchat. Web version of telegram is the safest. 0xchat has mini-browser.

Telegram can be even worse than WhatsApp. The app sends ...

2026-04-06T11:09:38Z

In reply to nevent1q…z37t
_________________________

Telegram can be even worse than WhatsApp. The app sends unencrypted traffic - this traffic can leak your metadata and even geolocation to local police. WhatsApp doesn't have such traffic.
https://rys.io/en/179.html

https://www.whonix.org/wiki/Telegram

dont use telegram. chats not encrypted, secret chats have ...

2026-04-06T10:33:24Z

In reply to nevent1q…8vrf
_________________________

dont use telegram. chats not encrypted, secret chats have backdoors, metadata not encrypted. telegram shares user data with police

0xchat.com #nostr #meme #memes ...

2026-04-06T09:17:38Z

0xchat.com #nostr #meme #memes