1 tails (0.22) unstable; urgency=medium
5 - Stop migrating persistence configuration and access rights. Instead,
6 disable all persistence configuration files if the mountpoint has wrong
7 access rights (Closes: #6413).
8 - Upgrade to NSS 3.15.3 that fixes a few serious security issues affecting
9 the browser, such as CVE-2013-1741, CVE-2013-5605 and CVE-2013-5606.
12 - Switch to Iceweasel 24 (Closes: #6370).
13 · Resync' (most) Iceweasel prefs with TBB 3.0-beta-1 and get rid
14 of many obsolete or default settings.
15 · Disable WebRTC (Closes: #6468).
16 · Import TorBrowser profile at commit
17 51bf06502c46ee6c1f587459e8370aef11a3422d from the tor-browser-24.2.0esr-1
18 branch at https://git.torproject.org/tor-browser.git.
19 - Switch to Torbutton 1.6 (Closes: #6371).
20 · Prevent Torbutton from asking users to "upgrade TBB".
21 · Use the same Tor SOCKS port as the TBB (9151) for our web browser.
22 This should be enough to avoid being affected by Tor#8511.
23 · Disable Torbutton 1.6's check for Tor.
24 Unfortunately, the new check.torproject.org breaks the remote Tor
25 check. We cannot use the local Tor check with the control port. So,
26 the shortest and sanest path to fixing the check issue, because the
27 remote Tor check is broken" seems to simply disable this check.
28 Patch submitted upstream as Tor#10216.
29 - Prepare incremental upgrades to be the next default way to upgrade Tails,
30 on point-releases at least.
33 - Deny X authentication only after Vidalia exits (Closes: #6389).
34 - Disable DPMS screen blanking (Closes: #5617).
35 - Fix checking of the persistent volume's ACL.
36 - Sanitize more IP and MAC addresses in bug reports (Closes: #6391).
37 - Do not fail USB upgrade when the "tmp" directory exists on the
39 - Tails Installer: list devices with isohybrid Tails installed
43 - Create a configuration file for additional software if needed
45 - Translations all over the place.
46 - Enable favicons in Iceweasel.
47 - Do not propose to make permanent NoScript exceptions.
48 In Tails, every such thing is temporary, so better only display the menu
49 entry that's about temporarily allowing something.
50 - Clearer warning when deleting persistent volume (thanks to Andres Gomez
51 Ramirez <andres.gomez@cern.ch> for the patch).
52 - Make wording in Tails Installer more consistent.
55 * Use IBus instead of SCIM (Closes: #6206).
56 It makes it possible to input passwords in pinentry for at least Japanese,
57 Chinese and Korean languages.
58 * Add an import-translation script.
59 This automates the importation process of completed translations
61 * Always list optimal keyboard layout in the greeter (Closes: #5741).
62 * Fix on-the-fly translation of the greeter in various languages
66 * Update I2P to 0.9.8.1 (Closes: #6080, #5889).
67 * Improve I2P configuration:
68 - Disable IPv6 support in a nicer way.
69 - Disable i2cp (allows java clients to communicate from outside the JVM). If
70 this is unset an exception for port 7654 would need to be added to ferm.
71 - Disable "in-network" updates (this is also done in the regular I2P
73 - Disable the outproxies. Access to the Internet is already routed through
74 Tor so these are unnecessary. If end-users have a good reason to go
75 through one of the I2P outproxies they can turn them back on.
76 * Add a couple of default I2P IRC channels to Pidgin.
77 * Allow access to the local 'eepsite' through FoxyProxy.
78 * Add firewall exceptions for the standard I2P ports.
80 -- Tails developers <tails@boum.org> Sat, 30 Nov 2013 16:47:18 +0100
82 tails (0.21) unstable; urgency=low
85 - Don't grant access to the Tor control port for the desktop user
86 (amnesia). Else, an attacker able to run arbitrary code as this user
87 could obtain the public IP with a get_info command.
88 · Vidalia is now run as a dedicated user.
89 · Remove the amnesia user from the debian-tor group.
90 · Remove the Vidalia launcher in the Applications menu.
91 The Vidalia instance it starts is useless, since it can't connect
92 to the Tor control port.
93 - Don't allow the desktop user to directly change persistence settings.
94 Else, an attacker able to run arbitrary code as this user could
95 leverage this feature to gain persistent root access, as long as
96 persistence is enabled.
97 · Fully rework the persistent filesystem and files ownership
99 · Run the Persistent Volume Assistant as a dedicated user, that is
100 granted the relevant udisks and filesystem -level credentials.
101 · At persistence activation time, don't trust existing persistence
102 configuration files, migrate to the new ownership and permissions,
103 migrate every known-safe existing settings and backup what's left.
104 Warn the user when not all persistence settings could be migrated.
105 · Persistent Volume Assistant uses the new ownership and permissions
106 scheme when initializing a new persistent volume, and refuses to
107 read persistence.conf if it, or the parent directory, hasn't the
108 expected permissions.
109 · Make boot medium 'system internal' for udisks with bilibop.
110 Once Tails is based on Wheezy, this will further complete the
111 protection (see #6172 for details).
112 - Update Iceweasel to 17.0.10esr-0+tails2~bpo60+1.
113 - Update Torbutton to 1.5.2-2, including a patch cherry-picked from
114 upstream to make window resizing closer to what the design says.
117 - Add a persistence preset for printing settings (Closes: #5686).
118 Reload CUPS configuration after persistence activation.
119 - Support SD card connected through a SDIO host adapter (Closes: #6324).
120 · Rebrand Tails USB installer to Tails installer.
121 · Display devices brand, model and size in the Installer
123 · Ask for confirmation before installing Tails onto a device
125 · Add support for SDIO and MMC block devices to the Tails Installer
126 (Closes: #5744) and the Persistent Volume Assistant (Closes: #6325).
127 · Arm the udev watchdog when booted from SD (plugged in SDIO) too
131 - Provide a consistent path to the persistent volume mountpoint
133 - Add a KeePassX launcher to the top GNOME panel (Closes: #6290).
134 - Rework bug reporting workflow: point the desktop launcher to
135 the troubleshooting page.
136 - Make /home world-readable at build time, regardless of the Git
137 working copy permissions. This makes the build process more robust
138 against strict umasks.
139 - Add signing capabilities to the tails-build script (Closes: #6267).
140 This is in turn used to sign ISO images built by our Jenkins setup
142 - Simplify the ikiwiki setup and make more pages translatable.
143 - Exclude the version string in GnuPG's ASCII armored output.
144 - Prefer stronger ciphers (AES256,AES192,AES,CAST5) when encrypting
146 - Use the same custom Startpage search URL than the TBB.
147 This apparently disables the new broken "family" filter.
148 - Update AdBlock Plus patterns.
149 - Install Linux from Debian testing.
150 (That is, the same version that was shipped in 0.20.1.)
153 - Look for "/tmp/.X11-unix/X${1#:}" too when detecting displays in use.
154 - Adapt tests to match the Control Port access security fix:
155 · Take into account that the amnesia user isn't part of the debian-tor
157 · Run as root the checks to see if a process is running: this
158 is required to see other users' processes.
160 -- Tails developers <tails@boum.org> Sat, 26 Oct 2013 23:42:46 +0200
162 tails (0.20.1) unstable; urgency=low
165 - Install Tor 0.2.4.17-rc-1~d60.squeeze+1 from the Tor project's repository.
166 - Install Iceweasel 17.0.9esr with Torbrowser patches.
167 - Install Linux kernel 3.10-3 (version 3.10.11-1) from sid.
170 - Remount persistence devices read-only at shutdown/reboot time
172 - Greeter: display a warning icon on admin password mismatch and on
173 persistence unlocking failure. Thanks to Andres Gomez Ramirez
174 <andres.gomez@cern.ch> for the fix!
175 - Don't torsocksify Pidgin.
176 Instead we disable Pidgin's GNOME integration to get the "Global proxy
177 configuration", which we set to use Tor. This fixes the I2P IRC account.
178 - Additional software: fix typo in notification.
179 - Allow installing "Priority: standard" packages that we do not install
180 by default: remove them late in the build process instead of assigning
181 them a -1 APT pinning level.
184 - Update AdBlock Plus patterns.
185 - Use more unique ISO file name when building from Jenkins.
186 - Additional software: point to the system log on upgrade failure.
187 - Set SOCKS5_USER and SOCKS5_PASSWORD in the connect-socks wrapper (used
188 by Git). Else, Tor 0.2.4's IsolateSOCKSAuth and connect-proxy
189 sometimes play together in some way that makes connect-proxy ask for
190 a password to connect to the SocksPort. SOCKS5_USER and
191 SOCKS5_PASSWORD are passed through unchanged if they were manually set
193 - Use our custom connect-socks wrapper for SSH. Else, Tor 0.2.4's
194 IsolateSOCKSAuth and connect-proxy sometimes play together in some way
195 that makes connect-proxy ask for a password to connect to the
196 SocksPort. Note that connect-socks uses the default SocksPort too, so
197 no change here wrt. our connection isolation design.
200 - Import new translations from Transifex.
203 - Fix old ISO checking for consistent error reporting.
204 - Remove custom persistence test from manual test suite.
205 It was removed for the GUI in t-p-s 0.33.
207 -- Tails developers <tails@boum.org> Sun, 15 Sep 2013 15:49:36 +0200
209 tails (0.20) unstable; urgency=low
212 - Install Linux kernel 3.10.3-1 from Debian unstable.
213 - Iceweasel 17.0.8esr + Torbrowser patches.
216 - Prevent Iceweasel from displaying a warning when leaving HTTPS web sites.
217 - Make Iceweasel use the correct, localized search engine.
218 - Fix Git access to https:// repositories.
221 - Install Dasher, a predictive text entry tool.
222 - Add a wrapper around TrueCrypt which displays a warning about it soon
223 being deprecated in Tails.
224 - Remove Pidgin libraries for all protocols but IRC and Jabber/XMPP.
225 Many of the other protocols Pidgin support are broken in Tails and
226 haven't got any security auditting.
227 - Disable the pre-defined Pidgin accounts so they do not auto-connect
229 - Include information about Alsa in WhisperBack reports.
230 - Explicitly restrict access to ptrace. While this setting was enabled
231 by default in Debian's Linux 3.9.6-1, it will later disabled in 3.9.7-1.
232 It's unclear what will happen next, so let's explicitly enable it ourselves.
233 - Do not display dialog when a message is sent in Claws Mail.
234 - Sync iceweasel preferences with the Torbrowser's.
237 - Many translation updates all over the place.
238 - Merge all Tails-related POT files into one, and make use of intltoolize
239 for better integration with Transifex.
241 -- Tails developers <tails@boum.org> Tue, 30 Jul 2013 14:19:57 +0200
243 tails (0.19) unstable; urgency=low
246 - Install Linux kernel 3.9.5-1 from Debian unstable.
247 Features of particular interest for Tails are the Yama LSM
248 (ptrace scope restrictions) and improved hardware support.
249 As a corollary, install initramfs-tools from there too.
250 - Iceweasel 17.0.7esr + Torbrowser patches.
251 - Unblock Bluetooth, Wi-Fi, WWAN and WiMAX; block every other type of
252 wireless device. Next steps are described on the
253 todo/protect_against_external_bus_memory_forensics ticket.
256 - Fix write access to boot medium at the block device level,
257 by installing bilibop-udev. Thanks to quidame for his support.
258 - tails-greeter l10n-related fixes, thanks to winterfairy:
259 · Fix so translations is applied on password mismatch messages.
260 · Separate forward and login buttons and make them translatable.
261 - Fix link to documentation when no sudo password is set.
262 - gpgApplet: partial fix for clipboard emptying after a wrong passphrase
264 - Workaround aufs bug in Unsafe Browser script.
267 - Drop GNOME proxy settings: we did not find any use of it we were keen
268 to support, other than two programs (Seahorse, Pidgin) that are now run
270 - Format newly created persistent volumes as ext4.
271 - GnuPG: don't connect to the keyserver specified by the key owner.
272 This feature opens the door to a variety of subtle attacks.
273 - GnuPG: locate keys only from local keyrings.
274 This is probably the default, but better safe than sorry.
275 - Install virt-what from Wheezy.
276 The version from Squeeze does not detect at least Parallels for Mac v.8.
277 - Upgrade live-boot and live-config to the 3.0.x final version from Wheezy.
278 · Remove /live and /lib/live/image compatibility symlinks.
279 · Add /live/overlay -> /lib/live/mount/overlay symlink.
280 The live-boot changes (commit d2b2a461) brought to fix Debian bug
281 #696495 revert some of our previous changes (commit 77dab1cb), and as
282 a result, at the time live-persist runs, no tmpfs is mounted on
283 /live/overlay, which breaks the aufs mount. So, let's just ensure
284 /live/overlay points to a tmpfs.
285 · Really disable policykit and sudo live-config hooks.
286 ... by making it believe they've already been run.
287 This workarounds new live-config's default behavior.
290 - Many translation updates all over the place.
293 - Re-enable previously disabled boot device permissions test.
295 -- Tails developers <tails@boum.org> Wed, 26 Jun 2013 12:36:20 +0200
297 tails (0.18) unstable; urgency=low
300 - Support obfs3 bridges.
301 - Automatically install a custom list of additional packages chosen by
302 the user at the beginning of every working session, and upgrade them
303 once a network connection is established (technology preview).
306 - Upgrade to Iceweasel 17.0.6esr-0+tails1~bpo60+1.
307 - Update Torbrowser patches to current maint-2.4 branch (567682b).
308 - Isolate DOM storage to first party URI, and enable DOM storage:
309 don't set dom.storage.enabled anymore, and set Torbutton's
310 disable_domstorage to false.
311 - Isolate the image cache per url bar domain.
312 - Torbutton 1.5.2, and various prefs hacks to fix breakage:
313 · Add .saved version of the Torbutton preferences the TBB also sets.
314 · Set TOR_SOCKS_HOST and TOR_SOCKS_PORT.
315 · Move some prefs (network.proxy.*, extensions.autoDisableScopes,
316 extensions.foxyproxy.last-version) to user.js.
317 Else, with Torbutton 1.5.x, these ones are not taken into account.
318 · Set network.proxy.socks_version.
319 Else we get the meaningless user_pref("network.proxy.socks_version", 9063);
320 in prefs.js after the initial startup.
321 · Set extensions.foxyproxy.socks_remote_dns to true.
322 Else, it overrides the various ways we set network.proxy.socks_remote_dns,
323 which in turn makes Torbutton think it should start in non-Tor mode.
324 · Also pass the TOR_SOCKS_* environment variables to iceweasel when
325 generating the profile: Torbutton behaves differently depending on
326 these variables, so we don't want the initial profile generation to be
327 done without them. In practice, this has no implication that we could
328 see right now, but better safe than sorry.
329 · Import all version overrides from the TBB prefs.
330 Else, the User-Agent sent in the HTTP headers is fine, but real
331 values leak with JavaScript, as demonstrated by ip-check's "Browser
333 · Move a bunch of settings to user_pref(), that are not applied otherwise.
334 For some, this fixes a regression in 0.18~rc1.
335 For other, the bug was already present in Tails 0.17.2.
336 - HTTPS Everywhere 3.2.
337 - Update prefs to match the TBB's, fix bugs, and take advantage of the latest
339 · Increase pipeline randomization.
340 · Fix @font-face handling of local() fonts.
341 Also disable fallback font rendering.
342 · Explicitly disable SPDY v2 and v3.
343 · Update http pipelining prefs.
344 - Make prefs organization closer to the TBB's:
345 · Remove Torbutton prefs that we set at their default value.
346 · Import Torbutton preferences from the TBB.
347 · Organize iceweasel config files in sections the same way as the TBB.
349 · Don't set extensions.torbutton.clear_cookies nor
350 extensions.torbutton.saved.share_proxy_settings:
351 we don't care about toggling anymore.
352 · Don't set extensions.torbutton.saved.download_retention nor
353 extensions.torbutton.saved.search_suggest:
354 these settings are not used in Torbutton anymore.
355 - Update unsafe browser prefs mangling accordingly.
356 - Move network.protocol-handler.warn-external.* to user_pref().
357 Else they're not applied.
358 These prefs are actually ignored by Firefox these days -- the TBB
359 design doc reads "They are set still anyway out of respect for the
360 dead". Let's go on doing the same.
361 - Update extensions.adblockplus.currentVersion.
362 - Fetch xul-ext-https-everywhere (3.2-2) and xul-ext-noscript (2.6.6.1-1)
363 from Debian unstable. They were uploaded there, and accordingly removed
367 - Linux 3.2.41-2+deb7u2.
368 - Fixed swapped filenames of tails-{reboot,shutdown}.desktop.
369 Thanks to Mikko Harhanen for the patch.
370 - Only add ClientTransportPlugin to torrc when bridge mode is enabled.
371 This should bring back support for proxies of type other than obfsproxy.
374 - Set kernel.dmesg_restrict=1, and make /proc/<pid>/ invisible
375 and restricted for other users. It makes it slightly harder for an attacker
376 to gather information that may allow them to escalate privileges.
377 - Install gnome-screenshot.
378 - Don't disable IPv6 on all network interfaces anymore.
379 It turns out the IPv6 leaks we wanted to fix actually don't exist.
380 - Add a "About Tails" launcher in the System menu.
381 - Install GNOME accessibility themes.
382 - Use 'Getting started...' as the homepage for Tails documentation button.
383 - Stop relying on the obsolete /live/image compatibility symlink.
384 - Disable audio preview in Nautilus.
385 - Wheezy was released => Squeeze is now oldstable.
386 - Pick Tor from deb.torproject.org regardless of the release name they
387 advertise. At some point we needed it, their APT repository still thought
388 that stable == Squeeze.
389 - Add Wheezy APT sources.
390 - Install Linux and related packages from Wheezy.
391 Debian sid just got Linux 3.8, and we don't want to switch to a new kernel
393 - Fetch laptop-mode-tools from Wheezy.
394 Wheezy has the version we've been installing in 0.18~rc1,
395 while a newer one was uploaded to sid in the meantime.
396 - Fetch a few packages from Wheezy instead of unstable.
397 Namely: spice-vdagent, libregexp-common-perl, macchanger, service-wrapper,
398 libservice-wrapper-java and libservice-wrapper-jni.
399 Wheezy has the versions we've been installing for a while, so let's
400 avoid having unstable push a newer one to us uselessly at some point.
401 Note that at the time of this writing, the versions in sid and in Wheezy
402 are the same, so this commit is effectively a no-op as of today: it is
403 merely a safeguard for the future.
406 - Many translation updates all over the place.
409 - Make Vagrant's build-tails script support Jenkins too.
412 - Fix Unsafe Browser test broken by hidepid.
414 -- Tails developers <tails@boum.org> Mon, 13 May 2013 22:17:38 +0200
416 tails (0.17.2) unstable; urgency=low
419 - Upgrade to Iceweasel 17.0.5esr-0+tails2~bpo60+1.
420 - Stop displaying obsolete context menu entries ("Open Tor URL" and friends).
423 - Update Linux to 3.2.41-2
426 - Use more reliable OpenPGP keyservers:
427 · use the hkps pool in GnuPG (and import their SSL CA)
428 · use hkp://pool.sks-keyservers.net in Seahorse (as it does not support
430 - Keep udisks users (GNOME Disk Utility, tails-persistence-setup, etc.)
431 from resetting the system partition's attributes when manipulating the
432 partition table. To this end, backport the relevant bugfix from Wheezy
433 into parted 2.3-5+tails1. This allowed to remove the sgdisk-based
434 workaround in tais-persistence-setup, and to stop installing
435 python-parted. All this is a first needed step to fix
436 todo/make_system_disk_read-only in a future release.
439 - Disable NoScript's HTML5 media click-to-play for better user experience.
442 - Tails USB installer: update translations for French, German, Spanish,
443 Finnish, Greek, Italian, Latvian, Dutch, Polish and Chinese.
444 - Tails Greeter: update translations for Farsi, Chinese, French;
445 new translations: Finnish, Norwegian Bokmål, Galician.
446 - tails-persistence-setup: update Farsi and Chinese translations;
447 import new translations for Finnish and Swedish.
448 - WhisperBack: update translations for Arabic, French, German, Greek,
449 Spanish, Korean, Polish, Russian. New translations: Finnish, Chinese.
452 - Add automated testing framework (Sikuli, Cucumber, libvirt -based)
453 with a bunch of tests.
455 -- Tails developers <amnesia@boum.org> Sun, 07 Apr 2013 12:17:26 +0200
457 tails (0.17.1) unstable; urgency=low
460 - Upgrade to Iceweasel 17.0.4esr-0+tails1~bpo60+1.
463 - Update Linux to 3.2.39-2.
464 It includes the drm and agp subsystems from Linux 3.4.29.
465 - Don't install xserver-xorg-video-rendition backport.
466 xserver-xorg-video-rendition has been removed from squeeze-backports
467 due to an upstream tarball mismatch discover when merging backports
468 into the main Debian archive, and xserver-xorg-video-all still depends
469 on it, so we explicitly install all drivers from -all but -rendition
470 as a (hopefully temporary) workaround.
473 - Remove Indymedia IRC account, until we ship a version of Pidgin
474 with SASL support, that is when Tails is based on Wheezy.
477 - Don't ship the wiki's todo and bugs on ISO images.
479 -- Tails developers <amnesia@boum.org> Thu, 21 Mar 2013 18:54:11 +0100
481 tails (0.17) unstable; urgency=low
484 - Install the KeePassX password manager, with a configuration and
485 documentation that makes it easy to persist the password database.
488 - Upgrade to Iceweasel 17.0.3esr-1+tails1~bpo60+1.
489 - Install xul-ext-adblock-plus from squeeze-backports.
490 - Do not allow listing all available fonts.
491 Set browser.display.max_font_attempts and browser.display.max_font_count
492 to enable the Torbrowser Limit-the-number-of-fonts-per-document patch.
493 - Set default spellchecker dictionary to English (USA),
494 and localize it according to locale with our custom branding extension.
495 - Disable the add-ons automatic update feature.
496 - Make the generated profile world-readable.
497 - Remove NoScript click-to-play confirmation.
498 - Sync some prefs set by Torbutton, to be ready when it stops setting these.
499 - Disable navigation timing.
500 - Disable SPDY. It stores state and may have keepalive issues.
501 - More aggressive iceweasel HTTP pipelining settings.
502 - Enable WebGL (as click-to-play only).
503 - Disable network.http.connection-retry-timeout.
504 - Disable full path information for plugins.
505 - Remove NoScript blocks of WebFonts.
506 - Disable DOM storage in Torbutton.
507 Since we don't apply the 0026-Isolate-DOM-storage-to-first-party-URI.patch
508 Torbrowser patch yet, and still disable DOM storage, we need to tell
509 Torbutton not to use it.
510 - Synchronize iceweasel's general.useragent.override with TBB based on FF17.
511 The User-Agent settings are not kept up-to-date anymore in Torbutton, so
512 we have to keep in sync manually with TBB's settings.
513 - Remove obsolete APT pining for Torbutton.
514 It's not maintained in Debian anymore, so we now fetch it from our own
516 - Fetch FoxyProxy from Debian experimental and libnspr4-0d from
517 squeeze-backports, for compatibility with Iceweasel 17.
518 - Rebase bookmarks file on top of the default iceweasel 17 one.
519 - Explicitly disable AdBlock Plus "correct typos" feature.
520 This feature connects to http://urlfixer.org/.
521 It is disabled by default in 2.2-1, but let's be careful.
524 - Upgrade to live-boot 3.0~b11-1 and live-config 3.0.12-1.
525 Accordingly update the 9980-permissions hook, live-persist,
526 unsafe-browser and boot-profile.
527 Add compatibility symlinks from /live to /lib/live, and from /live/image
528 to /lib/live/mount/medium, to ease the transition.
529 - Check for errors when sourcing live-boot files, e.g. to detect when
530 they have been renamed upstream.
531 - Don't add "quiet" to the kernel command-line ourselves.
532 Else, it appears twice as live-build's lb_binary_syslinux adds it too.
533 Historically, we've been adding it ourselves on top of that because
534 lb_binary_yaboot does not add it, but since we gave up the PowerPC support
535 attempt, we're now only interested in syslinux, so let's make it easier
536 for the general case, e.g. when one wants to remove the "quiet" parameter
537 as suggested by our "Tails does not start" debugging documentation.
538 - Upgrade I2P to 0.9.4.
541 - Many bugfixes brought by the Debian Squeeze 6.0.7 point-release.
542 - Use the regular GnuPG agent + pinentry-gtk2 instead of Seahorse
543 as a GnuPG agent. This fixes usage of OpenPGP in Claws Mail,
544 and brings support for OpenPGP smartcards.
545 - Enable I2P hidden mode.
546 Else, killing I2P ungracefully is bad for the I2P network.
547 - live-persist: move error() function before the first potential usecase.
548 - Add missing executable bit on restart-tor and restart-vidalia.
549 - Add shutdown and reboot launchers to the menu.
550 This workarounds the lack of a shutdown helper applet in camouflage mode.
551 - Remove Pidgin's MXit and Sametime support.
552 ... at least until CVE-2013-0273, CVE-2013-0272 and CVE-2013-0271 are
553 fixed in Debian stable. While we're at it, don't force file removal in
554 these "set -e" build scripts: fail hard, instead of silently ignoring
555 the fact that files may have moved or disappeared.
558 - Install recent Intel and AMD microcode from squeeze-backports,
559 explicitly excluding the iucode-tool package that's not a good idea
561 - Install firmware loader for Qualcomm Gobi USB chipsets.
562 This is needed to have various mobile broadband chipsets work.
563 - Upgrade barry to 0.18.3-5~bpo60+1.
564 This much improved new version supports more hardware & ISP,
565 and does not display dozens of spurious error messages at boot time.
568 - Remove APT local cache (/Var/cache/apt/{,src}pkgcache.bin).
570 -- Tails developers <amnesia@boum.org> Sat, 23 Feb 2013 10:37:57 +0100
572 tails (0.16) unstable; urgency=low
575 - Replace the too-easy-to-misclick shutdown button with a better
576 "Shutdown Helper" Gnome applet.
577 - Display ~/Persistent in GNOME Places and GtkFileChooser if it is mounted.
578 - Set Unsafe Browser's window title to "Unsafe Browser".
579 - Install ekeyd to support the EntropyKey.
580 - Install font for Sinhala.
581 - Update Poedit to 1.5.4.
582 - Kill Vidalia when restarting Tor.
583 Doing this as early as possible exposes Vidalia's "broken onion" icon
585 - Hide the persistence setup launchers in kiosk mode.
586 - Add a shell library for Tor functions.
587 These are shared among multiple of our scripts.
588 - Install dictionaries for supported languages.
589 Install hunspell dictionaries when possible,
590 fall back on myspell ones else.
593 - Disable IPv6 on all network interfaces.
594 This is a workaround for the IPv6 link-local multicast leak that was recently
595 discovered. Tails has no local service that listens on IPv6, so there should be
596 no regression, hopefully, unless one wants to play with OnionCat and VoIP,
597 but those of us should know how to workaround this anyway.
598 - live-persist: Fix variable mismatch, fixing probe white-list.
599 Tails may previously have been able to list GPT partitions labelled
600 "TailsData" on hard drives (!) as valid persistence volumes...
601 - live-persist: Fix --media option when no devices are attached.
602 Earlier, if it was set to e.g. 'removable-usb' and no USB storage was
603 connected, $whitelistdev would be empty, which is interpreted like
604 all devices are ok by the rest of the code.
605 - Fix SCIM in the autostarted web browser: save IM environment variables
606 to a file during Desktop session startup, and export them into the
607 autostarted browser's environment.
608 - Talk of DVD, not of CD, in the shutdown messages.
609 - Make tordate work in bridge mode with an incorrect clock.
610 When using a bridge Tor reports TLS cert lifetime errors (e.g. when
611 the system clock is way off) with severity "info", but when no bridge
612 is used the severity is "warn". tordate/20-time.sh depends on grepping
613 these error messages, so we termporarily increase Tor's logging
614 severity when using bridge mode. If we don't do this tordate will
615 sleep forever, leaving Tor in a non-working state.
616 · White-list root to use Tor's ControlPort.
617 · Add logging for is_clock_way_off().
618 · Remove Tor's log before time syncing.
619 We depend on grepping stuff from the Tor log (especially for
620 tordate/20-time.sh), so deleting it seems like a Good Thing(TM).
621 · Stop Tor before messing with its log or data dir.
622 - live-persist: limit searched devices the same way as live-boot.
623 If no --media argument is specified, use live-boot's
624 "(live-media|bootfrom)=removable(|-usb)" argument to limit devices
625 searched for a persistent volume.
626 - tails-greeter: do not pass media=removable to live-persist.
627 Now that we have autodetection with kernel command-line,
628 it should not be needed anymore.
629 - Start memlockd after configuring it,
630 instead of starting it before and restarting it after.
631 This avoids running memlockd twice, and prevents other possibly
632 surprising race-conditions.
633 As a consequence, also have tails-sdmem-on-media-removal start after the
634 memlockd service *and* tails-reconfigure-memlockd: to start the watchdog,
635 we need memlockd to be properly configured *and* running.
638 - Set iceweasel homepage to the news section on the Tails website.
639 ... using the localized one when possible.
640 - Hide the iceweasel add-on bar by default.
641 Now that we don't want to ship the Monkeysphere addon anymore,
642 that was the only one displayed in there, we can as well hide the whole bar.
643 - Don't hide the AdBlock-Plus button in the add-on bar anymore. Now that
644 we hide the whole addon bar, we can get rid of this old
646 - Do not install a placeholder (fake) FireGPG iceweasel extension anymore.
647 It was shipped from 0.10 (early 2012) to 0.15 (late November),
648 so the migration period should be over now.
649 - Don't install xul-ext-monkeysphere anymore.
650 The implication of the current keyserver policy are not well
651 understood, Monkeysphere is little used in Tails, and we're not sure
652 anymore it would be our first bet for the web browser profile with no
653 CA. Let's keep the various configuration bits (e.g. FoxyProxy,
654 patching MSVA), though, so that advanced users who are used to have
655 Monkeysphere in Tails just have to install the package.
658 - Install the "standard" task with tasksel for better consistency in the
659 Tails ISO images built in various environments.
660 - Install p7zip-full. It's a dep by file-roller, but we explicily use it
661 elsewhere, and it's better to be safe than sorry.
662 - Remove pinning of libvpx0 to sid.
663 This package is part of Squeeze, and not from testing/sid.
664 We have been shipping the version from Squeeze for a while.
665 - Remove config/chroot_local-packages/ from .gitignore.
666 The documented way for "external" contributors to add custom packages
667 is to put them in chroot_local-packages, and once we pull we import
668 any such package into our APT repo and rewrite the
669 history appropriately.
670 Also, the ability to add packages in there and not see them in "git
671 status" makes it very easy to build tainted ISO images with
672 non-standard packages, which makes some of us fear can lead to hard to
674 - Make it clearer what can and cannot be done in terms of local packages.
676 -- Tails developers <amnesia@boum.org> Thu, 10 Jan 2013 12:47:42 +0100
678 tails (0.15) unstable; urgency=low
681 - Persistence for browser bookmarks.
682 - Support for obfsproxy bridges.
685 - Add the Hangul (Korean) Input Method Engine for SCIM.
686 - Add vendor-specific dpkg origin information. This makes dpkg-vendor
687 return correct information.
688 - Install pcscd and libccid from squeeze-backports. This is needed to
689 support, to some extent, some OpenPGP SmartCard readers.
690 - Install HPIJS PPD files and the IJS driver (hpijs).
691 This adds support for some printers, such as Xerox DocumentCenter400.
692 - Optimize fonts display for LCD.
693 - Update TrueCrypt to version 7.1a.
696 - Do not use pdnsd anymore. It has been orphaned in Debian, has quite
697 some bugs in there, and apparently Tor's DNSPort's own caching is
699 - Remove useless iceweasel cookies exceptions. They are useless as
700 per-session cookies are allowed.
701 - Do not run setupcon on X. This call is only needed on the Linux
702 console, no need to annoy the user with a weird "Press enter to
703 activate this console" when the open a root shell in a GNOME
705 - Allow the tails-iuk-get-target-file user to connect to the SOCKSPort
706 dedicated for Tails-specific software.
707 - Fix gpgApplet menu display in Windows camouflage mode.
708 - Fix Tor reaching an inactive state if it's restarted in "bridge mode",
709 e.g. during the time sync' process.
712 - Update iceweasel to 10.0.11esr-1+tails1.
713 - User profile is now generated at build time in order to support persistent
715 - Update HTTPS Everywhere to version 3.0.4.
716 - Update NoScript to version 2.6.
717 - Fix bookmark to I2P router console.
718 - Re-enable Monkeysphere extension to connect to the validation agent.
721 - The Tails USB installer, tails-persistence-setup and tails-greeter
722 are now translated into Bulgarian.
723 - Update Chinese translation for tails-greeter.
724 - Update Euskadi translation for WhisperBack.
727 - Custom packages are now retrieved from Tails APT repository instead
728 of bloating the Git repository.
729 - Allow '~' in wiki filenames. This makes it possible to ship
730 update-description files for release candidates.
731 - Document how to create incremental update kit.
732 - Handle release candidates when generating custom APT sources.
733 - Remove pinning for xul-ext-adblock-plus.
734 It is obsolete since we've added this package to our APT repository.
736 -- Tails developers <amnesia@boum.org> Sun, 25 Nov 2012 12:59:17 +0100
738 tails (0.14) unstable; urgency=low
741 - Enable Tor stream isolation; several new SocksPorts with
742 appropriate Isolate* options have been added for different use
743 cases (i.e. applications). All application's have been
744 reconfigured to use these new SocksPorts, which should increase
745 anonymity by making it more difficulte to correlate traffic from
746 different applications or "online identities".
747 - The web browser now has the anonymity enhancing patches from the
749 - gpgApplet can now handle public-key cryptography.
750 - Install an additional, PAE-enabled kernel with NX-bit
751 support. This kernel is auto-selected when the hardware supports
753 * provide executable space protection, preventing certain types of
754 buffer overflows from being exploitable.
755 * enable more than 4 GiB of system memory.
756 * make all processors/cores available, including their
757 power-saving functionality.
758 - Add a persistence preset for NetworkManager connections.
761 - On kexec reboot, make the boot quiet only if debug=wipemem was not
763 - Update torproject.org's APT repo key.
764 - Update the embedded Tails signing key.
765 - Use symlinks instead of duplicating localized searchplugins.
766 - Rewrite Tails firewall using ferm. Tails firewall was written in
767 very unsophisticated iptables-save/restore format. As more feature
768 creeped in, it started to be quite unreadable.
769 - Optimize VirtualBox modules build at runtime to avoid installing the
770 userspace utils N times.
771 - Drop most of Vidalia's configuration. Our custom lines just caused
772 trouble (with multiple SocksPorts) and the default works well.
773 - Blacklist PC speaker module. On some computers, having the pcspkr
774 module loaded means loud beeps at bootup, shutdown and when using
775 the console. As it draws useless attention to Tails users, it is
776 better to prevent Linux from loading it by default.
777 - Remove all addons from the Unsafe Browser. No addons are essential
778 for the Unsafe Browser's intent. If anything they will modify the
779 network fingerprint compared to a normal Iceweasel install, which
781 - Prevent some unwanted packages to be installed at all, rather than
782 uninstalling them later. This should speed up the build a bit.
783 - Add a symlink from /etc/live/config to /etc/live/config.d. This
784 makes the system compatible with live-config 3.0.4-1, without
785 breaking backward compatibility with various parts of the system
786 that use the old path.
787 - Do not run unecessary scripts during shutdown sequence, to make
789 - Make live-persist deal with persistent ~/.gconf subdirs so that
790 any options saved therein actually get persistent.
791 - Prevent memlockd unload on shutdown, to make sure that all
792 necessary tools for memory wiping are available when the new
794 - Patch initscripts headers instead of fiddling with update-rc.d. We
795 now let insserv figure out the correct ordering for the services
796 during startup and shutdown, i.e. use dependency-based boot
798 - Remove the last absolute path in our isolinux config, which makes
799 it easier to migrate from isolinux to syslinux (just rename the
800 directory), and hence might make it easier for 3rd party USB
801 installers (like the Universal USB Installer) to support Tails.
804 - Include `seq` in the ramdisk environment: it is used to wipe more
805 memory. This fixes the long-standing bug about Tails not cleaning
806 all memory on shutdown.
807 - Fix Yelp crashing on internal links
808 - Allow amnesia user to use Tor's TransPort. This firewall exception
809 is necessary for applications that doesn't have in-built SOCKS
810 support and cannot use torsocks. One such example is Claws Mail,
811 which uses tsocks since torsocks makes it leak the hostname. This
812 exception, together with Tor's automatic .onion mapping makes
813 Claws Mail able to use hidden service mail providers again.
814 - Force threads locking support in Python DBus binding. Without this
815 liveusb-creator doesn't work with a PAE-enabled kernel.
816 - Fix localized search plugins for 'es' and 'pt'
817 - Fix live-boot's readahead, which caused an unnecessary pause
819 - Factorize GCC wanted / available version numbers in VirtualBox
820 modules building hook. This, incidentally, fixes a bug caused by
821 duplication and not updating all instances.
822 - Fix tordate vs. Tor 0.2.3.x. Since 0.2.3.x Tor doesn't download a
823 consensus for clocks that are more than 30 days in the past or 2
824 days in the future (see commits f4c1fa2 and 87622e4 in Tor's git
825 repo). For such clock skews we set the time to the Tor authority's
826 cert's valid-after date to ensure that a consensus can be
830 - Update to version 0.2.3.24-rc-1~~squeeze+1, a new major
831 version. It's not a stable release, but we have been assured by
832 the Tor developers that this is the right move.
833 - Stop setting custom value for the Tor LongLivedPorts
834 setting. Gobby's port was upstreamed in Tor 0.2.3.x.
837 - Update to 10.0.10esr-1+tails1, which has all the anonymity enhancing
838 patches from the TorBrowser applied.
839 - Install iceweasel from our own repo, http://deb.tails.boum.org.
840 - Fix Iceweasel's file associations. No more should you be suggested
841 to open a PDF in the GIMP.
844 - Use curl instead of wget, and add a --proxy option passed through
846 - Remove the --fullrequest option, we don't need it anymore.
847 - Remove --dns-timeout option, we don't need it anymore.
848 - Change --proxy handling to support Debian Squeeze's curl.
849 - Clarify what happens if --proxy is not used.
850 - Compute the median of the diffs more correctly.
853 - Update Linux to 3.2.32-1.
856 - Update vidalia to 0.2.20-1+tails1.
857 - Update bundled WhisperBack package to 1.6.2:
858 * Raise the socket library timeout to 120 seconds
859 * Use smtplib's timeout parameter
860 * Fix error output when calling send a 2nd time
861 - Update liveusb-creator to 3.11.6-3.
862 - Update i2p to 0.9.2.
863 - Update tails-persistence-setup to 0.20-1, which should make it
864 possible to install Tails on large (>= 32 GiB) USB drives.
865 - Install console-setup and keyboard-configuration from unstable
866 (required by new initramfs-tools).
867 - Update tails-greeter to 0.7.3:
868 * Import pt_BR translation.
869 * Let langpanel usable during option selection stage
870 * Print less debugging messages by default
871 (below are changes in tails-greeter 0.7.2:)
872 * Use correct test operators.
873 * Generate language codes of available locales at package build
875 * Read list of language codes from where we have saved it at
877 * Drop tails-lang-helper, not used anymore.
878 * Do not compile locales at login time anymore. Tails now ships
880 - Import live-config{,-sysvinit} 3.0.8-1. live-config >= 3.0.9-1
881 has basically nothing useful for us, and it migrates to new paths
882 brought by live-boot 3.0~b7, which we're not ready for yet (see:
883 todo/newer_live-boot).
886 - Fix Tails specific Iceweasel localization for pt-BR
887 - Add Japanese input system: scim-anthy.
888 - whisperback is now also translated into German, Hebrew, Hungarian,
890 - tails-persistence-setup is now also translated into Arabic.
891 - tails-greeter is now also translated into Arabic, Hebrew, Basque,
892 Hungarian, Italian and Chinese.
895 - Catch more errors in during build time:
896 - Ensure that all local hooks start with 'set -e'.
897 - Fail hard if adduser fails in local hooks.
898 - Fail hard if 'rm' fails in local hooks.
899 - vagrant: Ensure we have the set of Perl packages needed by our
901 - vagrant: Configure live-build to ship with ftp.us.debian.org.
902 Using cdn.debian.net leads to bad interactions with Tor.
903 - vagrant: Don't use gzip compression when building from a tag, i.e.
905 - vagrant: Optionally use bootstrap stage cache for faster builds
906 via the 'cache' build option.
907 - vagrant: Make sure release builds are clean, i.e. they don't use
908 any potentially dangerous build options.
909 - vagrant: Disable live-build package caching. This build system is
910 meant to use an external caching proxy, so live-build's cache just
911 wastes RAM (for in-memory builds) or disk space.
912 - vagrant: use aufs magic instead of copying source into tmpfs.
913 This reduces the amount of RAM required for building Tails in.
914 - vagrant: Allow in-memory builds when a VM with enough memory is
917 -- Tails developers <amnesia@boum.org> Sat, 10 Nov 2012 12:34:56 +0000
919 tails (0.13) unstable; urgency=low
922 - Use white-list/principle of least privelege approach for local services.
923 Only users that need a certain local (i.e. hosted on loopback) service
924 (according to our use cases) are granted access to it by our firewall;
925 all other users are denied access.
926 - Ship a first version of the incremental update system. Updates are not
927 currently triggered automatically, but this will allow tests to be done
931 - Enable four workspaces in the Windows XP camouflage. This allows
932 users to quickly switch to a more innocent looking workspace in case
933 they are working on sensitive data and attract unwanted attention.
934 The workspace switcher applet isn't there, though, since there's no
935 such thing in Windows XP, so switching is only possible via keyboard
937 - Ship with precompiled locales instead of generating them upon login.
938 - Add support for wireless regulation.
939 - Use color for Git output, not intended for machine consumption,
940 written to the terminal.
941 - Have ttdnsd use OpenDNS. Using Google's DNS servers was very
942 glitchy, and rarely succeeded when it should. It can probably be
943 attributed to Google's DNS, which is known to take issue with Tor
945 - Upgrade WhisperBack to 1.6, with many UI improvements and new translations.
946 - Include GDM logs and dmidecode informations in the reports.
947 - Allow to modify language and layout in the "Advanced options" screen
949 - GnuPG: bump cert-digest-algo to SHA512.
950 - Update torproject.org's APT repo key.
953 - Make Claws Mail save local/POP emails in its dot-directory. The
954 default is to save them at ~/Mail, which isn't included in our
955 current Claws Mail persistence preset.
956 - Fix the System Monitor applet.
957 - Remove broken ttdnsd from the default DNS resolution loop.
958 - Hide the 'TailsData' partition in desktop applications.
959 - Ship unrar-free again, so that the GNOME archive manager knows about
961 - Ship with an empty whitelist for Noscript.
962 - Disable FoxyProxy's advertisement on proxy error page.
963 - Fix slow browsing experience for offline documentation.
964 - Raise the socket timeout to 120 seconds in WhisperBack.
965 - Enable the ikiwiki trail plugin for the locally built wiki too.
968 - Upgrade iceweasel to 10.0.6esr-1 (Extended Support Release) and install it
969 and its dependencies from squeeze-backports.
972 - Upgrade Linux to 3.2.23-1.
975 - Update tor to version 0.2.2.39.
976 - Update Iceweasel to version 10.0.7esr-2.
977 - Update i2p to version 0.9.1.
980 - vagrant: Install Ikiwiki from Debian unstable. The 'mirrorlist'
981 patches have finally been merged in upstream Ikiwiki. So instead of
982 building Ikiwiki by hand, we can now install the package directly
983 from Debian unstable.
984 - Do not build the ikiwiki forum on the bundled static website copy.
986 -- Tails developers <amnesia@boum.org> Mon, 17 Sep 2012 15:19:25 +0200
988 tails (0.12.1) unstable; urgency=low
990 This is a brown paper bag release to fix two major problems introduced in
994 - Upgrade Torbutton to 1.4.6.
995 - Upgrade AdBlock Plus to 2.1.
996 - Update AdBlock Plus patterns.
999 - Upgrade Linux to 3.2.21-3 (linux-image-3.2.0-3-486).
1002 - Install MAT from Debian backports, drop custom package.
1003 - Install python-pdfrw to re-add PDF support to the MAT.
1004 - Upgrade tails-greeter to 0.7.1, which fixes the race condition that
1005 broke administration password and locale settings on some systems.
1008 - Remove the Tails specific plymouth theme. The theme interfers heavily with
1009 the boot process on some hardware.
1011 -- Tails developers <amnesia@boum.org> Mon, 17 Sep 2012 13:06:03 +0200
1013 tails (0.12) unstable; urgency=low
1015 * Major new features
1016 - Add the Unsafe Web Browser, which has direct access to the Internet and
1017 can be used to login to captive portals.
1018 - The (previously experimental, now deemed stable) Windows camouflage can now
1019 be enabled via a check box in Tails greeter.
1022 - Upgrade to 0.2.2.37-1~~squeeze+1.
1025 - Upgrade iceweasel to 10.0.5esr-1 (Extended Support Release) and install it
1026 and its dependencies from squeeze-backports.
1027 - Add a bookmark for the offline Tails documentation.
1028 - Update AdBlock patterns.
1031 - Allow using larger USB drives by increasing the mkfs timeout to 10 minutes.
1032 - Tell the user what's going on when the Tails boot device cannot be found.
1035 - Upgrade Linux to 3.2.20-1 (linux-image-3.2.0-2-amd64).
1039 - Install torsocks. Note that this makes `torify' use `torsocks' instead of
1040 `tsocks'. The `tsocks' binary is dropped to avoid problems, but remaining
1041 files (the library) are kept since ttdnsd depends on them.
1042 - Fetch live-config-sysvinit from sid so that it matches live-config version.
1043 - Update virtualbox backports to 4.1.10-dfsg-1~bpo60+1.
1044 - Install pciutils (needed by virtualbox-guest-utils).
1045 - Install mousetweaks. This is needed to use the mouse accessibility settings
1046 in System -> Preferences -> Mouse -> Accessibility.
1047 - Install the "hardlink" files deduplicator.
1048 - Do not install cryptkeeper anymore. See todo/remove_cryptkeeper for reason.
1049 Users of cryptkeeper are encouraged to install cryptkeeper via `apt-get
1050 update; apt-get install --yes cryptkeeper`, open their volume and move
1051 their to Tails' built-in persistence instead, as a one-time migration.
1052 - Upgrade I2P to version 0.9.
1053 - Don't install GParted. GNOME Disk Utility has been on par with GParted
1054 since Squeeze was released.
1055 - Upgrade live-boot to 3.0~a27-1+tails2~1.gbp319fe6.
1056 - Upgrade live-config to 3.0~a39-1 and install it from Debian experimental.
1057 - Upgrade tails-greeter to 0.7.
1058 - Upgrade tails-persistence-setup to 0.17-1.
1059 - Install libyaml-libyaml-perl.
1060 - Upgrade MAT, the metadata anonymisation toolkit, 0.3.2-1~bpo60+1.
1061 - Fetch python-pdfrw from backports, drop custom package.
1063 * Internationalization
1064 - The Tails website and documentation now has a (partial) Portuguese
1068 - Tails can now be built without using a HTTP proxy.
1069 - Tails can now easily be built by using Vagrant. See the updated
1070 contribute/build page for instructions.
1073 - Remove obsolete noswap boot parameter. live-boot now handles swap on an
1075 - The squashfs.sort files generated with boot-profile should now be ok which
1076 makes the generate images boot noticeably faster on optical media. See
1077 bugs/weird_squashfs.sort_entries for more information.
1078 - Set Tails specific syslinux and plymouth themes.
1079 - Add NVidia KMS video drivers to the initrd in order to show our shiny new
1080 plymouth theme on more systems.
1082 -- Tails developers <amnesia@boum.org> Mon, 11 Jun 2012 13:37:00 +0200
1084 tails (0.11) unstable; urgency=low
1086 * Major new features
1087 - Do not grant the desktop user root credentials by default.
1088 - A graphical boot menu (tails-greeter 0.6.3) allows choosing among
1089 many languages, and setting an optional sudoer password.
1090 - Support opt-in targeted persistence
1091 · tails-persistence-setup 0.14-1
1092 · live-boot 3.0~a25-1+tails1~5.gbp48d06c
1093 · live-config 3.0~a35-1
1094 - USB installer: liveusb-creator 3.11.6-1
1097 - Install iceweasel 10.0.4esr-1 (Extended Support Release).
1098 Let's stop tracking a too fast moving target.
1099 Debian Wheezy will ship ESR versions.
1100 - Install needed dependencies from squeeze-backports.
1103 bing appeared due to our upgrading iceweasel.
1104 Removing it makes things consistent with the way they have been
1105 until now, that is: let's keep only the general search engines
1106 we've been asked to add, plus Google, and a few specialized ones.
1107 · Replace Debian-provided DuckDuckGo search plugin with the "HTML SSL"
1108 one, version 20110219. This is the non-JavaScript, SSL, POST flavour.
1110 · Install localized search engines in the correct place.
1111 No need to copy them around at boot time anymore.
1112 · Remove Scroogle. RIP.
1113 - Enable TLS false start, like the TBB does since December.
1114 - Adblock Plus: don't count and save filter hits, supress first run dialog.
1115 - Install neither the GreaseMonkey add-on, nor any GreaseMonkey script.
1116 YouTube's HTML5 opt-in program is over.
1117 HTML5 video support is now autodetected and used.
1120 - Upgrade to 0.2.17-1+tails1: drop Do-not-warn-about-Tor-version.patch,
1122 - Set SkipVersionCheck=true.
1123 Thanks to chiiph for implementing this upstream (needs Vidalia 0.2.16+).
1125 * Internationalization
1126 - Install all available iceweasel l10n packages.
1127 - Remove syslinux language choosing menu.
1128 tails-greeter allows choosing a non-English language.
1129 - Add fonts for Hebrew, Thai, Khmer, Lao and Korean languages.
1131 - Setup text console at profile time.
1132 Context: Tails runs with text console autologin on.
1133 These consoles now wait, using a "Press enter to activate this console"
1134 message, for the user. When they press enter in there, they should have chosen
1135 their preferred keyboard layout in tails-greeter by now. Then, we run setupcon.
1136 As a result, the resulting shell is properly localized, and setupcon
1137 sets the correct keyboard layout, both according to the preferences expressed by
1138 the user in tails-greeter.
1139 - Don't use localepurge, don't remove any Scribus translations anymore,
1140 don't localize environment at live-config time:
1141 tails-greeter allows us to support many, many more languages.
1144 - Linux 3.2.15-1 (linux-image-3.2.0-2-amd64).
1145 - Fix low sound level on MacBook5,2.
1146 - Disable laptop-mode-tools automatic modules. This modules set often
1147 needs some amount of hardware-specific tweaking to work properly.
1148 This makes them rather not well suited for a Live system.
1151 - Install GNOME keyring.
1152 This is needed so that NetworkManager remembers the WEP/WPA secrets
1153 for the time of a Tails session. Initialize GNOME keyring at user
1155 - Install usbutils to have the lsusb command.
1156 - Install the Traverso multitrack audio recorder and editor.
1159 - GNOME Terminal: keep 8192 scrollback lines instead of the smallish
1161 - Replaced tails-wifi initscript with laptop-mode-tools matching feature.
1162 - Disable gdomap service.
1163 - Fetch klibc-utils and libklibc from sid.
1164 The last initramfs-tools depends on these.
1165 - Set root password to "root" if debug=root is passed on the
1166 kernel cmdline. Allow setting root password on kernel cmdline via
1167 rootpw=. Looks like we implemented this feature twice.
1168 - Append a space on the kernel command line. This eases manually adding
1170 - Rename sudoers.d snippets to match naming scheme.
1171 Sudo credentials that shall be unconditionally granted to the Tails
1172 default user are named zzz_*, to make sure they are applied.
1173 - WhisperBack: also include /var/log/live-persist and
1174 /var/lib/gdm3/tails.persistence.
1175 - Add a wrapper to torify whois.
1176 - Rework the VirtualBox guest modules building hook to support
1178 - Consistently wait for nm-applet when waiting for user session to come up.
1179 Waiting for gnome-panel or notification-daemon worked worse.
1180 - Don't start the NetworkManager system service via init.
1181 Some Tails NM hooks need the user to be logged in to run properly.
1182 That's why tails-greeter starts NetworkManager at PostLogin time.
1183 - Also lock /bin/echo into memory. For some reason, kexec-load needs it.
1184 - Pidgin: don't use the OFTC hidden service anymore.
1185 It proved to be quite unreliable, being sometimes down for days.
1186 - Do not display storage volumes on Desktop, by disabling
1187 /apps/nautilus/desktop/volumes_visible GConf entry. Enabling that
1188 GConf setting avoids displaying the bind-mounted persistent
1189 directories on the Desktop, and reduces user confusion. It also is
1190 a first step towards a bigger UI change: GNOME3 does not manage the
1191 Desktop anymore, so volume icons and other Desktop icons are meant to
1192 disappear anyway. It implies we'll have to move all Desktop icons
1193 elsewhere. Let's start this move now: this will smooth the UI change
1194 Wheezy will carry for our users, by applying some of it progressively.
1197 - Don't build hybrid ISO images anymore. They boot less reliably on
1198 a variety of hardware, and are made less useful by us shipping
1199 a USB installer from now on.
1200 - Append .conf to live-config configuration filenames:
1201 live-config >3.0~a36-1 only takes into account files named *.conf
1202 in there. Accordingly update scripts that source these files.
1203 - Remove long-obsolete home-refresh script and its configuration.
1205 * Virtualization support
1206 - Support Spice and QXL: install the Spice agent from Debian sid,
1207 install xserver-xorg-video-qxl from squeeze-backports.
1209 -- Tails developers <amnesia@boum.org> Tue, 17 Apr 2012 14:54:00 +0200
1211 tails (0.10.2) unstable; urgency=low
1214 - Update to 10.0.2-1.
1215 - Disable HTTPS-Everywhere's SSL Observatory (plus first-run pop-up).
1216 - Revert "FoxyProxy: don't enclose regexps between ^ and $."
1217 Currently "http://www.i2p2.de" (and everything similar) is captured by
1218 the I2P filter, which is incorrect. It seems isMultiLine="false" does
1219 *not* make RE into ^RE$ any longer.
1220 - Remove file:// from NoScript's exception lists.
1221 This will fix the JavaScript toggles in the local copy of the documentation.
1222 - Update AdBlock patterns.
1225 - Upgrade I2P to 0.8.13.
1226 - Install libvpx0 from sid.
1227 - Fetch klibc-utils and libklibc from sid.
1228 The last initramfs-tools depends on these.
1231 - Upgrade Linux kernel to 3.2.7-1.
1232 - Install firmware-libertas.
1233 This adds support for wireless network cards with Marvell Libertas
1234 8xxx chips supported by the libertas_cs, libertas_sdio, libertas_spi,
1235 libertas_tf_usb, mwl8k and usb8xxx drivers.
1238 - Revert "Set time to middle of [valid-after, fresh-until] from consensus."
1239 This reverts commit 18d23a500b9412b4b0fbe4e38a9398eb1a3eadef.
1240 With this vmid clocks that are E minutes back in time may cause issues
1241 (temporary Tor outages) after consensus updates that happen at the
1242 (60-E):th minute or later during any hour. Full analysis:
1243 https://mailman.boum.org/pipermail/tails-dev/2012-January/000873.html
1244 - Add the default user to the vboxsf group.
1245 This will allow the user to get full access to automounted VirtualBox
1246 shared folders as they are mounted with guid vboxsf and rwx group
1249 -- Tails developers <amnesia@boum.org> Thu, 01 Mar 2012 20:26:21 +0100
1251 tails (0.10.1) unstable; urgency=low
1254 - Make Startpage the default web search engine. Scroogle does not look
1255 reliable enough these days.
1258 - Upgrade WhisperBack to 1.5.1 (update link to bug reporting documentation).
1259 - Update MAT to 0.2.2-2~bpo60+1 (fixes a critical bug in the GUI).
1262 - Upgrade Linux kernel to 3.2.1-2
1264 * Time synchronization
1265 Serious rework that should fix most, if not all, of the infamous
1266 time-sync' related bugs some Tails users have experienced recently.
1267 - Make htpdate more resilient by using three server pools, and
1268 allowing some failure ratio.
1269 - Set time from Tor's unverified-consensus if needed.
1270 - Set time to middle of [valid-after, fresh-until] from consensus.
1271 - Many robustness, performance and fingerprinting-resistance improvements.
1272 - Display time-sync' notification much earlier.
1275 - Fix access to "dumb" git:// protocol by using a connect-socks wrapper
1276 as GIT_PROXY_COMMAND.
1277 - SSH client: fix access to SSH servers on the Internet by correcting
1278 Host / ProxyCommand usage.
1279 - Pidgin: use OFTC hidden service to workaround Tor blocking.
1280 - Claws Mail: disable draft autosaving.
1281 When composing PGP encrypted email, drafts are saved back to
1282 the server in plaintext. This includes both autosaved and manually
1284 - tails-security-check-wrapper: avoid eating all memory when offline.
1286 -- Tails developers <amnesia@boum.org> Sat, 28 Jan 2012 10:00:31 +0100
1288 tails (0.10) unstable; urgency=low
1290 * Tor: upgrade to 0.2.2.35-1.
1293 - Install Iceweasel 9.0 from the Debian Mozilla team's APT repository.
1294 - Update Torbutton to 1.4.5.1-1.
1295 - Support viewing any YouTube video that is available in HTML5 format:
1296 install xul-ext-greasemonkey and the "Permanently Enable HTML5 on
1297 YouTube" GreaseMonkey script.
1298 - Stop using Polipo in Iceweasel. Its SOCKS support was fixed.
1299 - Install from Debian sid the iceweasel extensions we ship,
1300 for compatibility with FF9.
1301 - Use Scroogle (any languages) instead of Scroogle (English only) when
1302 booted in English. Many users choose English because their own
1303 language is not supported yet; let's not hide them search results in
1305 - Install Iceweasel language packs from Debian unstable:
1306 unfortunately they are not shipped on the mozilla.debian.net repository.
1307 - Install the NoScript Firefox extension; configure it the same way as
1309 - Disable third-party cookies.
1310 They can be used to track users, which is bad. Besides, this is what
1311 TBB has been doing for years.
1312 - FoxyProxy: allow direct connections to RFC1918 IPs.
1314 * Do not transparent proxy outgoing Internet connections through Tor.
1315 - Torify the SSH client using connect-proxy to all IPs but RFC1918 ones.
1316 - Torify APT using Polipo HTTP.
1317 - Torify wget in wgetrc.
1318 - Torify gobby clients using torsocks. It does not support proxies yet.
1319 - Torify tails-security-check using LWP::UserAgent's SOCKS proxy support.
1320 - Fix enabling of GNOME's HTTP proxy.
1323 - Upgrade Vidalia to 0.2.15-1+tails1.
1324 · New upstream release.
1325 · Do not warn about Tor version.
1326 - Upgrade MAT to 0.2.2-1~bpo60+1.
1327 - Upgrade VirtualBox guest software to 4.1.6-dfsg-2~bpo60+1,
1328 built against the ABI of X.Org backports.
1329 - Upgrade I2P to 0.8.11 using KillYourTV's Squeeze packages;
1330 additionally, fix its start script that was broken by the tordate merge.
1331 - Install unar (The Unarchiver) instead of the non-free unrar.
1332 - Install Nautilus Wipe instead of custom Nautilus scripts.
1335 - Upgrade Linux kernel to 3.1.6-1.
1336 - Upgrade to X.Org from squeeze-backports.
1337 - Install more, and more recent b43 firmwares.
1338 - Upgrade barry to 0.15-1.2~bpo60+1.
1340 * Internationalization
1341 - Add basic language support for Russian, Farsi and Vietnamese.
1342 - Install some Indic fonts.
1343 - Install some Russian fonts.
1344 - Add Alt+Shift shortcut to switch keyboard layout.
1347 - Support booting in "Windows XP -like camouflage mode":
1348 · Install homebrewn local .debs for a Windows XP look-alike Gnome theme.
1349 · Add the "Windows XP Bliss" desktop wallpaper.
1350 · Added a script that's sets up Gnome to look like Microsoft Windows XP.
1351 · Add Windows XP "camouflage" icons for some programs.
1352 · Make Iceweasel use the IE icon when Windows XP camouflage is enabled.
1353 · Add special launcher icons for the Windows XP theme so that they're
1355 - Decrease Florence focus zoom to 1.2.
1356 - Do not fetch APT translation files. Running apt-get update is heavy enough.
1357 - Add MSN support thanks to msn-pecan.
1358 - Add custom SSH client configuration:
1359 · Prefer strong ciphers and MACs.
1360 · Enable maximum compression level.
1361 · Explicitly disable X11 forwarding.
1362 · Connect as root by default, to prevent fingerprinting when username
1364 - Replace flawed FireGPG with a home-made GnuPG encryption applet;
1365 install a feature-stripped FireGPG that redirects users to
1366 the documentation, and don't run Seahorse applet anymore.
1367 - Enable Seahorse's GnuPG agent.
1368 - Blank screen when lid is closed, rather than shutting down the system.
1369 The shutdown "feature" has caused data losses for too many people, it seems.
1370 There are many other ways a Tails system can be shut down in a hurry
1372 - Import Tails signing key into the keyring.
1373 - Fix bug in the Pidgin nick generation that resulted in the nick
1374 "XXX_NICK_XXX" once out of twenty.
1375 - Pre-configure the #tor IRC discussion channel in Pidgin.
1376 - Fix "technology preview" of bridge support: it was broken by tordate merge.
1377 - Install dependencies of our USB installer to ease its development.
1378 - Make vidalia NM hook sleep only if Vidalia is already running.
1379 - Reintroduce the htpdate notification, telling users when it's safe
1380 to use Tor Hidden Services.
1381 - htpdate: omit -f argument to not download full pages.
1382 - htpdate: write success file even when not within {min,max}adjust.
1383 Otherwise htpdate will not "succeed" when the time diff is 0 (i.e.
1384 the clock was already correct) so the success file cannot be used
1385 as an indicator that the system time now is correct, which arguably
1386 is its most important purpose.
1389 - Name built images according to git tag.
1391 -- Tails developers <tails@boum.org> Wed, 04 Jan 2012 09:56:38 +0100
1393 tails (0.9) unstable; urgency=low
1396 - Upgrade to 0.2.2.34 (fixes CVE-2011-2768, CVE-2011-2769).
1399 - Upgrade to 3.5.16-11 (fixes CVE-2011-3647, CVE-2011-3648, CVE-2011-3650).
1400 - Upgrade FireGPG to 0.8-1+tails2: notify users that the FireGPG Text
1401 Editor is the only safe place for performing cryptographic operations,
1402 and make it impossible to do otherwise. Other ways open up several
1403 severe attacks through JavaScript (e.g. leaking plaintext when
1404 decrypting, signing messages written by the attacker).
1405 - Install Cookie Monster extension instead of CS Lite.
1406 - Always ask where to save files.
1407 - Upgrade Torbutton to 1.4.4.1-1, which includes support for the in-browser
1408 "New identity" feature.
1411 - Install MAT, the metadata anonymisation toolkit.
1412 - Upgrade TrueCrypt to 7.1.
1413 - Upgrade WhisperBack to 1.5~rc1 (leads the user by the hand if an error
1414 occurs while sending the bugreport, proposes to save it after 2 faild
1415 attempts, numerous bugfixes).
1416 - Linux: upgrade to linux-image-3.0.0-2-486 (version 3.0.0-6); fixes
1417 a great number of bugs and security issues.
1420 - Fully rework date and time setting system.
1421 - Remove the htp user firewall exception.
1422 - Saner keyboard layouts for Arabic and Russian.
1423 - Use Plymouth text-only splash screen at boot time.
1424 - Color the init scripts output.
1425 - Suppress Tor's warning about applications doing their own DNS lookups.
1426 This is totally safe due to our Tor enforcement.
1427 - Disable hdparm boot-time service.
1428 We only want hdparm so that laptop-mode-tools can use it.
1429 - Run Claws Mail using torify.
1430 It's not as good as if Claws Mail supported SOCKS proxies itself,
1431 but still better than relying on the transparent netfilter torification.
1432 - Install HPLIP and hpcups for better printing support.
1434 * Erase memory at shutdown
1435 - Run many sdmem instances at once.
1436 In hope of erasing more memory until we come up with a proper fix for
1437 [[bugs/sdmem_does_not_clear_all_memory]].
1438 - Kill gdm3 instead of using its initscript on brutal shutdown.
1439 - Use absolute path to eject for more robust memory wipe on boot medium removal.
1442 - Exclude kernel and initramfs from being put into the SquashFS.
1443 Those files are already shipped where they are needed, that is in the ISO
1444 filesystem. Adapt kexec and memlockd bits.
1445 - Do not ship the GNOME icon theme cache.
1446 - Do not ship .pyc files.
1447 - Do not ship NEWS.Debian.gz files.
1450 - Re-implement hook that modifies syslinux config to make future
1453 -- Tails developers <amnesia@boum.org> Tue, 01 Nov 2011 13:26:38 +0100
1455 tails (0.8.1) unstable; urgency=low
1458 - Update to 3.5.16-10 (fixes DSA-2313-1).
1459 - FireGPG: force crypto action results to appear in a new window, otherwise
1460 JavaScript can steal decrypted plaintext. Advice: always use FireGPG's
1461 text editor when writing text you want to encrypt. If you write it in a
1462 textbox the plaintext can be stolen through JavaScript before it is
1463 encrypted in the same way.
1464 - Update HTTPS Everywhere extension to 1.0.3-1.
1465 - Stop using the small version of the Tor check page. The small version
1466 incorrectly tells Tails users to upgrade their Torbrowser, which has
1467 confused some users.
1470 - Update Linux to 3.0.0-2 (fixes DSA-2310-1, CVE-2011-2905, CVE-2011-2909,
1471 CVE-2011-2723, CVE-2011-2699, CVE-2011-1162, CVE-2011-1161).
1472 - Update usb-modeswitch to 1.1.9-2~bpo60+1 and usb-modeswitch-data to
1473 20110805-1~bpo60+1 from Debian backports. This adds support for a few
1474 devices such as Pantech UMW190 CDMA modem.
1475 - Install libregexp-common-perl 2011041701-3 from Debian unstable. This
1476 fixes the bug: [[bugs/msva_does_not_use_configured_keyserver]].
1477 - Install hdparm so the hard drives can be spinned down in order to save
1479 - Install barry-util for better BlackBerry integration.
1480 - Debian security upgrades: OpenOffice.org (DSA-2315-1), openjdk-6
1481 (DSA-2311-1), policykit-1 (DSA-2319-1)
1483 * Protecting against memory recovery
1484 - Set more appropriate Linux VM config before wiping memory. These
1485 parameters should make the wipe process more robust and efficient.
1487 -- Tails developers <amnesia@boum.org> Sun, 16 Oct 2011 11:31:18 +0200
1489 tails (0.8) unstable; urgency=low
1491 * Rebase on the Debian Squeeze 6.0.2.1 point-release.
1494 - Update to 0.2.2.33-1.
1495 - Disabled ControlPort in favour of ControlSocket.
1496 - Add port 6523 (Gobby) to Tor's LongLivedPorts list.
1500 - Start script now depends on HTP since I2P breaks if the clock jumps or is
1501 too skewed during bootstrap.
1504 - Update to 3.5.16-9 (fixes CVE-2011-2374, CVE-2011-2376, CVE-2011-2365,
1505 CVE-2011-2373, CVE-2011-2371, CVE-2011-0083, CVE-2011-2363, CVE-2011-0085,
1506 CVE-2011-2362, CVE-2011-2982, CVE-2011-2981, CVE-2011-2378, CVE-2011-2984,
1508 - Enable HTTP pipelining (like TBB).
1509 - Update HTTPS Everywhere extension to 1.0.1-1 from Debian unstable.
1510 - Suppress FoxyProxy update prompts.
1511 - Prevent FoxyProxy from "phoning home" after a detected upgrade.
1512 - Fixed a bunch of buggy regular expressions in FoxyProxy's configuration.
1513 See [[bugs/exploitable_typo_in_url_regex?]] for details. Note that none of
1514 these issues are critical due to the transparent proxy.
1515 - Add DuckDuckGo SSL search engine.
1518 - Update to torbutton 1.4.3-1 from Debian unstable.
1519 - Don't show Torbutton status in the status bar as it's now displayed in the
1523 - More random looking nicks in pidgin.
1524 - Add IRC account on chat.wikileaks.de:9999.
1527 - Upgrade htpdate script (taken from Git 7797fe9) that allows setting wget's
1528 --dns-timeout option.
1531 - Update Linux to 3.0.0-1. -686 is now deprecated in favour of -486 and
1532 -686-pae; the world is not ready for -pae yet, so we now ship -486.
1533 - Update OpenSSL to 0.9.8o-4squeeze2 (fixes CVE-2011-1945 (revoke
1534 compromised DigiNotar certificates), CVE-2011-1945).
1535 - Update Vidalia to 0.2.14-1+tails1 custom package.
1536 - Install accessibility tools:
1537 - gnome-mag: screen magnifier
1538 - gnome-orca: text-to-speech
1539 - Replace the onBoard virtual keyboard with Florence.
1540 - Install the PiTIVi non-linear audio/video editor.
1545 * Arbitrary DNS queries
1546 - Tor can not handle all types of DNS queries, so if the Tor resolver fails
1547 we fallback to ttdnsd. This is now possible with Tor 0.2.2.x, since we
1548 fixed Tor bug #3369.
1551 - Install ipheth-utils for iPhone tethering.
1552 - Install xserver-xorg-input-vmmouse (for mouse integration with the host OS
1554 - Install virtualbox-ose 4.x guest packages from Debian backports.
1557 - Switch gpg to use keys.indymedia.org's hidden service, without SSL.
1558 The keys.indymedia.org SSL certificate is now self-signed. The hidden
1559 service gives a good enough way to authenticate the server and encrypts
1560 the connection, and just removes the certificates management issue.
1561 - The squashfs is now compressed using XZ which reduces the image size quite
1563 - Remove Windows autorun.bat and autorun.inf. These files did open a static
1564 copy of our website, which is not accessible any longer.
1567 - Use the Git branch instead of the Debian version into the built image's
1569 - Allow replacing efficient XZ compression with quicker gzip.
1570 - Build and install documentation into the chroot (-> filesystem.squashfs).
1571 Rationale: our static website cannot be copied to a FAT32 filesystem due
1572 to filenames being too long. This means the documentation cannot be
1573 browsed offline from outside Tails. However, our installer creates GPT
1574 hidden partitions, so the doc would not be browseable from outside Tails
1575 anyway. The only usecase we really break by doing so is browsing the
1576 documentation while running a non-Tails system, from a Tails CD.
1578 -- Tails developers <amnesia@boum.org> Thu, 09 Sep 2011 11:31:18 +0200
1580 tails (0.7.2) unstable; urgency=high
1583 - Disable Torbutton's external application launch warning.
1584 ... which advises using Tails. Tails *is* running Tails.
1585 - FoxyProxy: install from Debian instead of the older one we previously
1589 - haveged: install an official Debian backport instead of a custom backport.
1590 - unrar: install the version from Debian's non-free repository.
1591 Users report unrar-free does not work well enough.
1593 -- Tails developers <amnesia@boum.org> Sun, 12 Jun 2011 15:34:56 +0200
1595 tails (0.7.1) unstable; urgency=high
1597 * Vidalia: new 0.2.12-2+tails1 custom package.
1600 - Don't show Foxyproxy's status / icon in FF statusbar to prevent users
1601 from accidentaly / unconsciously put their anonymity at risk.
1602 - "amnesia branding" extension: bump Iceweasel compatibility to 4.0 to ease
1603 development of future releases.
1606 - Upgrade Linux kernel to Debian's 2.6.32-33: fixes tons of bugs,
1607 including the infamous missing mouse cursor one. Oh, and it closes
1608 a few security holes at well.
1609 - Install unrar-free.
1610 - Do not install pppoeconf (superseeded by NetworkManager).
1611 - Upgrade macchanger to Debian testing package to ease development of
1612 future Tails releases.
1613 - Debian security upgrades: x11-xserver-utils (DSA-2213-1), isc-dhcp
1614 (DSA-2216-1), libmodplug (DSA-2226-1), openjdk-6 (DSA-2224-1).
1616 * Protecting against memory recovery
1617 - Add Italian translation for tails-kexec. Thanks to Marco A. Calamari.
1618 - Make it clear what it may mean if the system does not power off
1620 - Use kexec's --reset-vga option that might fix display corruption issues
1623 * WhisperBack (encrypted bug reporting software)
1624 - Upgrade WhisperBack to 1.4.1:
1625 localizes the documentation wiki's URL,
1626 uses WebKit to display the bug reporting help page,
1627 now is usable on really small screens.
1628 - Extract wiki's supported languages at build time, save this
1629 information to /etc/amnesia/environment, source this file into the
1630 Live user's environment so that WhisperBack 1.4+ can make good use
1634 - Fix boot in Chinese.
1635 - Install mobile-broadband-provider-info for better 3G support.
1636 - Add back GNOME system icons to menus.
1637 - tails-security-check: avoid generating double-slashes in the Atom
1639 - Remove "vga=788" boot parameter which breaks the boot on some hardware.
1640 - Remove now useless "splash" boot parameter.
1641 - Fix a bunch of i386-isms.
1642 - Pass the noswap option to the kernel. This does not change actual Tails
1643 behaviour but prevents users from unnecessarily worrying because of
1644 the "Activating swap" boot message.
1645 - Make use of check.torproject.org's Arabic version.
1648 - Enable squeeze-backports. It is now ready and will be used soon.
1649 - Install eatmydata in the chroot.
1650 - Convert ikiwiki setup files to YAML.
1652 -- Tails developers <amnesia@boum.org> Fri, 29 Apr 2011 17:14:53 +0200
1654 tails (0.7) unstable; urgency=low
1657 - Install foomatic-filters-ppds to support more printers.
1658 - Give the default user the right to manage printers.
1661 - Deinstall unwanted packages newly pulled by recent live-build.
1663 -- Tails developers <amnesia@boum.org> Wed, 06 Apr 2011 22:58:51 +0200
1665 tails (0.7~rc2) unstable; urgency=low
1667 ** SNAPSHOT build @824f39248a08f9e190146980fb1eb0e55d483d71 **
1669 * Rebase on Debian Squeeze 6.0.1 point-release.
1671 * Vidalia: new 0.2.10-3+tails5 custom package..
1674 - Install usb-modeswitch and modemmanager to support mobile broadband
1675 devices such as 3G USB dongles. Thanks to Marco A. Calamari for the
1679 - Website relocated to https://tails.boum.org/ => adapt various places.
1680 - Configure keyboard layout accordingly to the chosen language for
1681 Italian and Portuguese.
1683 -- Tails developers <amnesia@boum.org> Fri, 25 Mar 2011 15:44:25 +0100
1685 tails (0.7~rc1) UNRELEASED; urgency=low
1687 ** SNAPSHOT build @98987f111fc097a699b526eeaef46bc75be5290a **
1689 * Rebase on Debian Squeeze.
1691 * T(A)ILS has been renamed to Tails.
1693 * Protecting against memory recovery
1694 New, safer way to wipe memory on shutdown which is now also used when
1695 the boot media is physically removed.
1698 - Update to 0.2.1.30-1.
1701 - Add HTTPS Everywhere 0.9.4 extension.
1702 - Better preserve Anonymity Set: spoof US English Browser and timezone
1703 the same way as the Tor Browser Bundle, disable favicons and picture
1705 - Install AdBlock Plus extension from Debian.
1706 - Add Tor-related bookmarks.
1707 - Support FTP, thanks to FoxyProxy.
1708 - Update AdBlock patterns.
1709 - Disable geolocation and the offline cache.
1712 - Update Vidalia to 0.2.10-3+tails4.
1713 - Install gnome-disk-utility (Palimpsest) and Seahorse plugins.
1714 - Add opt-in i2p support with Iceweasel integration through FoxyProxy.
1715 - onBoard: fix "really quits when clicking the close window icon" bug.
1716 - Optionally install TrueCrypt at boot time.
1717 - Install laptop-mode-tools for better use of battery-powered hardware.
1718 - Replace xsane with simple-scan which is part of GNOME and way easier
1720 - Upgrade WhisperBack to 1.3.1 (bugfixes, French translation).
1721 - Install scribus-ng instead of scribus. It is far less buggy in Squeeze.
1724 - Drop incoming packets by default.
1725 - Forbid queries to DNS resolvers on the LAN.
1726 - Set output policy to drop (defense-in-depth).
1729 - Install Atheros and Broadcom wireless firmwares.
1730 - Install libsane-hpaio and sane-utils, respectively needed for
1731 multi-function peripherals and some SCSI scanners.
1733 * live-boot 2.0.15-1+tails1.35f1a14
1734 - Cherry-pick our fromiso= bugfixes from upstream 3.x branch.
1737 - Many tiny user interface improvements.
1738 - More robust HTP time synchronization wrt. network failures.
1739 Also, display the logs when the clock synchronization fails.
1740 - Disable GNOME automatic media mounting and opening to protect against
1741 a class of attacks that was recently put under the spotlights.
1742 Also, this feature was breaking the "no trace is left on local
1743 storage devices unless explicitly asked" part of Tails specification.
1744 - Make configuration more similar to the Tor Browser Bundle's one.
1745 - GnuPG: default to stronger digest algorithms.
1746 - Many more or less proper hacks to get the built image size under 700MB.
1747 - Compress the initramfs using LZMA for faster boot.
1750 - Run lb build inside eatmydata fsync-less environment to greatly improve
1753 -- Tails developers <amnesia@boum.org> Fri, 11 Mar 2011 15:52:19 +0100
1755 tails (0.6.2) unstable; urgency=high
1757 * Tor: upgrade to 0.2.1.29 (fixes CVE-2011-0427).
1759 - Upgrade Linux kernel, dpkg, libc6, NSS, OpenSSL, libxml2 (fixes various
1761 - Upgrade Claws Mail to 3.7.6 (new backport).
1762 - Install Liferea, tcpdump and tcpflow.
1763 * Seahorse: use hkp:// transport as it does not support hkps://.
1764 * FireGPG: use hkps:// to connect to the configured keyserver.
1765 * Build system: take note of the Debian Live tools versions being used
1766 to make next point-release process faster.
1767 * APT: don't ship package indices.
1769 -- T(A)ILS developers <amnesia@boum.org> Wed, 19 Jan 2011 16:59:43 +0100
1771 tails (0.6.1) unstable; urgency=low
1773 * Tor: upgrade to 0.1.28 (fixes CVE-2010-1676)
1774 * Software: upgrade NSS, Xulrunner, glibc (fixes various security issues)
1775 * FireGPG: use the same keyserver as the one configured in gpg.conf.
1776 * Seahorse: use same keyserver as in gpg.conf.
1777 * HTP: display the logs when the clock synchronization fails.
1778 * Update HTP configuration: www.google.com now redirects to
1779 encrypted.google.com.
1780 * Use the light version of the "Are you using Tor?" webpage.
1781 * Update AdBlock patterns.
1783 -- T(A)ILS developers <amnesia@boum.org> Fri, 24 Dec 2010 13:28:29 +0100
1785 tails (0.6) unstable; urgency=low
1789 * New OpenPGP signing-only key. Details are on the website:
1790 https://amnesia.boum.org/GnuPG_key/
1793 - Fixed torbutton has migrated to testing, remove custom package.
1796 - Query ssl.scroogle.org instead of lists.debian.org.
1797 - Don't run when the interface that has gone up is the loopback one.
1800 - Add shortcut to securely erase free space in a partition.
1801 - The nautilus-wipe shortcut user interface is now translatable.
1804 - Really fix virtualization warning display.
1805 - More accurate APT pinning.
1806 - Disable Debian sid APT source again since a fixed live-config has
1807 migrated to Squeeze since then.
1809 * live-boot: upgrade to 2.0.8-1+tails1.13926a
1810 - Sometimes fixes the smem at shutdown bug.
1811 - Now possible to create a second partition on the USB stick T(A)ILS is
1815 - Support RT2860 wireless chipsets by installing firmware-ralink from
1817 - Install firmware-linux-nonfree from backports.
1818 - Fix b43 wireless chipsets by having b43-fwcutter extract firmwares at
1822 - Install live-build and live-helper from Squeeze.
1823 - Update SquashFS sort file.
1825 -- T(A)ILS developers <amnesia@boum.org> Wed, 20 Oct 2010 19:53:17 +0200
1827 tails (0.6~rc3) UNRELEASED; urgency=low
1829 ** SNAPSHOT build @a3ebb6c775d83d1a1448bc917a9f0995df93e44d **
1832 - Autostart Iceweasel with the GNOME session. This workarounds the
1833 "Iceweasel first page is not loaded" bug.
1836 - Upgrade htpdate script (taken from Git 7797fe9).
1839 - Disable ssh-agent auto-starting with X session: gnome-keyring is
1841 - Fix virtualization warning display.
1842 - Boot profile hook: write desktop file to /etc/skel.
1845 - Convert build system to live-build 2.0.1.
1846 - APT: fetch live-build and live-helper from Debian Live snapshots.
1847 - Remove dependency on live-build functions in chroot_local-hooks.
1848 This makes the build environment more robust and less dependent on
1849 live-build internals.
1850 - Remove hand-made rcS.d/S41tails-wifi: a hook now does this.
1851 - Measure time used by the lh build command.
1852 - Fix boot profile hook.
1853 - Boot profiling: wait a bit more: the current list does not include
1856 -- T(A)ILS developers <amnesia@boum.org> Sat, 02 Oct 2010 23:06:46 +0200
1858 tails (0.6~rc2) UNRELEASED; urgency=low
1860 ** SNAPSHOT build @c0ca0760ff577a1e797cdddf0e95c5d62a986ec8 **
1863 - Refreshed AdBlock patterns (20100926).
1864 - Set network.dns.disableIPv6 to true (untested yet)
1865 - Torbutton: install patched 1.2.5-1+tails1 to fix the User-Agent bug,
1866 disable extensions.torbutton.spoof_english again.
1869 - WhisperBack: upgrade to 1.3~beta3 (main change: let the user provide
1870 optional email address and OpenPGP key).
1872 - Update haveged backport to 0.9-3~amnesia+lenny1.
1873 - Update live-boot custom packages (2.0.6-1+tails1.6797e8): fixes bugs
1874 in persistency and smem-on-shutdown.
1875 - Update custom htpdate script. Taken from commit d778a6094cb3 in our
1876 custom Git repository: fixes setting of date/time.
1879 - Bugfix: failed builds are now (hopefully) detected.
1880 - Fix permissions on files in /etc/apt/ that are preserved in the image.
1881 - Install version 2.0~a21-1 of live-build and live-helper in the image.
1882 We are too late in the release process to upgrade to current Squeeze
1883 version (2.0~a29-1).
1886 - Pidgin/OTR: disable the automatic OTR initiation and OTR requirement.
1888 -- T(A)ILS developers <amnesia@boum.org> Wed, 29 Sep 2010 19:23:17 +0200
1890 tails (0.6~1.gbpef2878) UNRELEASED; urgency=low
1892 ** SNAPSHOT build @ef28782a0bf58004397b5fd303f938cc7d11ddaa **
1895 - Use a 2.6.32 kernel: linux-image-2.6.32-bpo.5-686 (2.6.32-23~bpo50+1)
1896 from backports.org. This should support far more hardware and
1897 especially a lot of wireless adapters.
1898 - Add firmware for RTL8192 wireless adapters.
1899 - Enable power management on all wireless interfaces on boot.
1904 - Install gfshare and ssss: two complementary implementations
1905 of Shamir's Secret Sharing.
1906 - Install tor-geoipdb.
1907 - Remove dialog, mc and xterm.
1910 - Set extensions.torbutton.spoof_english to its default true value
1911 in order to workaround a security issue:
1912 https://amnesia.boum.org/security/Iceweasel_exposes_a_rare_User-Agent/
1915 - Install the Iceweasel extension.
1916 - Use a hkps:// keyserver.
1919 - Install gnupg from backports.org so that hkps:// is supported.
1920 - Use a hkps:// keyserver.
1921 - Proxy traffic via polipo.
1922 - Prefer up-to-date digests and ciphers.
1924 * Vidalia: rebased our custom package against 0.2.10.
1927 - Built images are now named like this:
1928 tails-i386-lenny-0.5-20100925.iso
1929 - Use live-helper support for isohybrid options instead of doing the
1930 conversion ourselves. The default binary image type we build is now
1932 - Remove .deb built by m-a after they have been installed.
1933 - Setup custom GConf settings at build time rather than at boot time.
1934 - Move $HOME files to /etc/skel and let adduser deal with permissions.
1935 - Convert to live-boot / live-config / live-build 2.x branches.
1936 - Replaced our custom live-initramfs with a custom live-boot package;
1937 included version is 2.0.5-1+tails2.6797e8 from our Git repository:
1938 git clone git://git.immerda.ch/tails_live-boot.git
1939 - Install live-config* from the live-snapshots Lenny repository.
1940 Rationale: live-config binary packages differ depending on the target
1941 distribution, so that using Squeeze's live-config does not produce
1942 fully-working Lenny images.
1943 - Rename custom scripts, packages lists and syslinux menu entries from
1944 the amnesia-* namespace to the tails-* one.
1947 - Use (authenticated) HTP instead of NTP.
1948 - The htpdate script that is used comes from commit 43f5f83c0 in our
1949 custom repository: git://git.immerda.ch/tails_htp.git
1950 - Start Tor and Vidalia only once HTP is done.
1953 - Fix IPv6 firewall restore file. It was previously not used at all.
1954 - Use ftp.us.debian.org instead of the buggy GeoIP-powered
1956 - Gedit: don't autocreate backup copies.
1957 - Build images with syslinux>=4.01 that has better isohybrid support.
1958 - amnesia-security-check: got rid of the dependency on File::Slurp.
1959 - Take into account the migration of backports.org to backports.debian.org.
1960 - Make GnuPG key import errors fatal on boot.
1961 - Warn the user when T(A)ILS is running inside a virtual machine.
1962 - DNS cache: forget automapped .onion:s on Tor restart.
1964 * Documentation: imported Incognito's walkthrough, converted to
1965 Markdown, started the needed adaptation work.
1967 -- T(A)ILS developers <amnesia@boum.org> Sun, 26 Sep 2010 11:06:50 +0200
1969 tails (0.5) unstable; urgency=low
1971 * The project has merged efforts with Incognito.
1972 It is now to be called "The (Amnesic) Incognito Live System".
1976 - Created the amnesia-news mailing-list.
1977 - Added a forum to the website.
1978 - Created a chatroom on IRC: #tails on irc.oftc.net
1981 - Workaround nasty NetworkManager vs. Tor bug that often
1982 prevented the system to connect to the Tor network: restart Tor and Vidalia
1983 when a network interface goes up.
1984 - onBoard now autodetects the keyboard layout... at least once some
1985 keys have been pressed.
1986 - New windows don't open in background anymore, thanks to
1988 - Memory wiping at shutdown is now lightning fast, and does not prevent
1989 the computer to halt anymore.
1990 - GNOME panel icons are right-aligned again.
1991 - Fixed permissions on APT config files.
1992 - Repaired mouse integration when running inside VirtualBox.
1995 - Torbutton: redirect to Scroogle when presented a Google captcha.
1996 - Revamped bookmarks
1997 . moved T(A)ILS own website to the personal toolbar
1998 . moved webmail links (that are expected to be more than 3 soon)
1999 to a dedicated folder.
2000 - Don't show AdBlock Plus icon in the toolbar.
2001 - Adblock Plus: updated patterns, configured to only update subscriptions
2002 once a year. Which means never, hopefully, as users do update their
2003 Live system on a regular basis, don't they?
2005 * Vidalia: rebased our custom package against 0.2.8.
2008 - Install Claws Mail from backports.org to use the X.509 CA
2009 certificates provided by Debian.
2010 - Enable PGP modules with basic configuration:
2011 . Automatically check signatures.
2012 . Use gpg-agent to manage passwords.
2013 . Display warning on start-up if GnuPG doesn't work.
2014 - Set the IO timeout to 120s (i.e. the double of the default 60s).
2017 - Automatically connect to irc.oftc.net with a randomized nickname,
2018 so as not to advertize the use of T(A)ILS; this nickname is made of:
2019 . a random firstname picked from the 2000 most registered by the U.S.
2020 social security administration in the 70s;
2021 . two random digits.
2022 Good old irc.indymedia.org is still configured - with same nickname -
2023 but is not enabled by default anymore.
2024 - Disabled MSN support, that is far too often affected by security flaws.
2026 * Build $HOME programmatically
2027 - Migrated all GConf settings, including the GNOME panel configuration,
2028 to XML files that are loaded at boot time.
2029 - Configure iceweasel profile skeleton in /etc/iceweasel.
2030 A brand new profile is setup from this skeleton once iceweasel is
2032 . build sqlite files at build time from plain SQL.
2033 . FireGPG: hard-code current firegpg version at build time to prevent
2034 the extension to think it was just updated.
2035 . stop shipping binary NSS files. These were here only to
2036 install CaCert's certificate, that is actually shipped by Debian's
2040 - Updated Debian Live snapshots APT repository URL.
2041 - Purge all devel packages at the end of the chroot configuration.
2042 - Make sure the hook that fixes permissions runs last.
2043 - Remove unwanted Iceweasel search plugins at build time.
2046 - Added a progress bar for boot time file readahead.
2047 - Readahead more (~37MB) stuff in foreground at boot time.
2048 - Make the APT pinning persist in the Live image.
2049 - localepurge: keep locales for all supported languages,
2050 don't bother when installing new packages.
2051 - Removed syslinux help menu: these help pages are either buggy or
2052 not understandable by non-geeks.
2053 - Fixed Windows autorun.
2054 - Disable a few live-initramfs scripts to improve boot time.
2055 - Firewall: forbid any IPv6 communication with the outside.
2056 - Virtualization support: install open-vm-tools.
2057 - WhisperBack: updated to 1.2.1, add a random bug ID to the sent
2059 - Prompt for CD removal on shutdown, not for USB device.
2061 * live-initramfs: new package built from our Git (e2890a04ff) repository.
2062 - Merged upstream changes up to 1.177.2-1.
2063 - New noprompt=usb feature.
2064 - Fix buggy memory wiping and shutdown.
2065 - Really reboot when asked, rather than shutting down the system.
2068 - Upgraded to a new custom, patched package (0.93.0-0ubuntu4~amnesia1).
2069 - Added an entry in the Applications menu.
2072 - Install vim-nox with basic configuration
2074 - Install monkeysphere and msva-perl
2075 - Replaced randomsound with haveged as an additional source of entropy.
2078 - Build ralink rt2570 wifi modules.
2079 - Build rt2860 wifi modules from Squeeze. This supports the RT2860
2080 wireless adapter, found particularly in the ASUS EeePC model 901
2082 - Build broadcom-sta-source wifi modules.
2083 - Bugfix: cpufreq modules were not properly added to /etc/modules.
2084 - Use 800x600 mode on boot rather than 1024x768 for compatibility
2085 with smaller displays.
2087 -- amnesia <amnesia@boum.org> Fri, 30 Apr 2010 16:14:13 +0200
2089 amnesia (0.4.2) unstable; urgency=low
2091 New release, mainly aimed at fixing live-initramfs security issue
2092 (Debian bug #568750), with an additional set of small enhancements as
2095 * live-initramfs: new custom package built from our own live-initramfs
2096 Git repository (commit 8b96e5a6cf8abc)
2097 - based on new 1.173.1-1 upstream release
2098 - fixed live-media=removable behaviour so that filesystem images found
2099 on non-removable storage are really never used (Debian bug #568750)
2101 * Vidalia: bring back our UI customizations (0.2.7-1~lenny+amnesia1)
2103 * APT: consistently use the GeoIP-powered cdn.debian.net
2105 * Software: make room so that {alpha, future} Squeeze images fit on
2107 - only install OpenOffice.org's calc, draw, impress, math and writer
2109 - removed OpenOffice.org's English hyphenation and thesaurus
2110 - removed hunspell, wonder why it was ever added
2113 - explicitly disable persistence, better safe than sorry
2114 - removed compulsory 15s timeout, live-initramfs knows how to wait for
2115 the Live media to be ready
2117 * Build system: don't cache rootfs anymore
2119 -- amnesia <amnesia@boum.org> Sun, 07 Feb 2010 18:28:16 +0100
2121 amnesia (0.4.1) unstable; urgency=low
2123 * Brown paper bag bugfix release: have amnesia-security-check use
2124 entries publication time, rather than update time... else tagging
2125 a security issue as fixed, after releasing a new version, make this
2126 issue be announced to every user of this new, fixed version.
2128 -- amnesia <amnesia@boum.org> Sat, 06 Feb 2010 03:58:41 +0100
2130 amnesia (0.4) unstable; urgency=low
2132 * We now only build and ship "Hybrid" ISO images, which can be either
2133 burnt on CD-ROM or dd'd to a USB stick or hard disk.
2135 * l10n: we now build and ship multilingual images; initially supported
2136 (or rather wanna-be-supported) languages are: ar, zh, de, en, fr, it,
2138 - install Iceweasel's and OpenOffice.org's l10n packages for every
2140 - stop installing localized help for OpenOffice.org, we can't afford it
2141 for enough languages
2142 - when possible, Iceweasel's homepage and default search engine are localized
2143 - added Iceweasel's "any language" Scroogle SSL search engine
2144 - when the documentation icon is clicked, display the local wiki in
2145 currently used language, if available
2146 - the Nautilus wipe script is now translatable
2147 - added gnome-keyboard-applet to the Gnome panel
2150 - replaced Icedove with claws mail, in a bit rough way; see
2151 https://amnesia.boum.org/todo/replace_icedove_with_claws/ for best
2152 practices and configuration advices
2153 - virtual keyboard: install onBoard instead of kvkbd
2154 - Tor controller: install Vidalia instead of TorK
2155 - install only chosen parts of Gnome, rather than gnome-desktop-environment
2156 - do not install xdialog, which is unused and not in Squeeze
2157 - stop installing grub as it breaks Squeeze builds (see Debian bug #467620)
2158 - install live-helper from snapshots repository into the Live image
2161 - do not install the NoScript extension anymore: it is not strictly
2162 necessary but bloodily annoying
2164 * Provide WhisperBack 1.2 for anonymous, GnuPG-encrypted bug reporting.
2165 - added dependency on python-gnutls
2166 - install the SMTP hidden relay's certificate
2168 * amnesia-security-check: new program that tells users that the amnesia
2169 version they are running is affected by security flaws, and which ones
2170 they are; this program is run at Gnome session startup, after sleeping
2171 2 minutes to let Tor a chance to initialize.
2174 - uses the Desktop Notifications framework
2175 - fetches the security atom feed from the wiki
2176 - verifies the server certificate against its known CA
2177 - tries fetching the localized feed; if it fails, fetch the default
2180 * live-initramfs: new custom package built from our own live-initramfs
2181 Git repository (commit 40e957c4b89099e06421)
2182 - at shutdown time, ask the user to unplug the CD / USB stick, then run
2183 smem, wait for it to finish, then attempt to immediately halt
2186 - bumped dependency on live-helper to >= 2.0a6 and adapted our config
2187 - generate hybrid ISO images by default, when installed syslinux is
2189 - stop trying to support building several images in a row, it is still
2190 broken and less needed now that we ship hybrid ISO images
2191 - scripts/config: specify distribution when initializing defaults
2192 - updated Debian Live APT repository's signing key
2195 - disable virtualbox packages installing and module building on !i386
2196 && !amd64, as PowerPC is not a supported guest architecture
2197 - built and imported tor_0.2.1.20-1~~lenny+1_powerpc.deb
2200 - rough beginnings of a scratch Squeeze branch, currently unsupported
2201 - install gobby-infinote
2204 - updated GnuPG key with up-to-date signatures
2205 - more improvements on boot time from CD
2206 - enhanced the wipe in Nautilus UI (now asks for confirmation and
2207 reports success or failure)
2208 - removed the "restart Tor" launcher from the Gnome panel
2210 -- amnesia <amnesia@boum.org> Fri, 05 Feb 2010 22:28:04 +0100
2212 amnesia (0.3) unstable; urgency=low
2214 * software: removed openvpn, added
2220 - lvm2 (with disabled initscript as it slows-down too much the boot in certain
2222 - NetworkManager 0.7 (from backports.org) to support non-DHCP networking
2224 - randomsound to enhance the kernel's random pool
2226 - install the latest stable release from deb.torproject.org
2227 - ifupdown script now uses SIGHUP signal rather than a whole tor
2228 restart, so that in the middle of it vidalia won't start it's own
2230 - configure Gnome proxy to use Tor
2232 - adblockplus: upgraded to 1.0.2
2233 - adblockplus: subscribe to US and DE EasyList extensions, updated patterns
2234 - firegpg is now installed from Debian Squeeze rather than manually; current
2235 version is then 0.7.10
2236 - firegpg: use better keyserver ... namely pool.sks-keyservers.net
2237 - added bookmark to Amnesia's own website
2238 - use a custom "amnesiabranding" extension to localize the default search
2239 engine and homepage depending on the current locale
2240 - updated noscript whitelist
2241 - disable overriden homepage redirect on iceweasel upgrade
2243 - nicer default configuration with verified irc.indymedia.org's SSL cert
2244 - do not parse incoming messages for formatting
2245 - hide formatting toolbar
2246 * hardware compatibility
2248 - beginning of support for the ppc architecture
2249 - load acpi-cpufreq, cpufreq_ondemand and cpufreq_powersave kernel
2251 * live-initramfs: custom, updated package based on upstream's 1.157.4-1, built
2252 from commit b0a4265f9f30bad945da of amnesia's custom live-initramfs Git
2254 - securely erases RAM on shutdown using smem
2255 - fixes the noprompt bug when running from USB
2256 - disables local swap partitions usage, wrongly enabled by upstream
2257 * fully support for running as a guest system in VirtualBox
2258 - install guest utils and X11 drivers
2259 - build virtualbox-ose kernel modules at image build time
2261 - new (translatable) wiki, using ikiwiki, with integrated bugs and todo
2262 tracking system a static version of the wiki is included in generated
2263 images and linked from the Desktop
2265 - adapt for live-helper 2.0, and depend on it
2266 - get amnesia version from debian/changelog
2267 - include the full version in ISO volume name
2268 - save .list, .packages and .buildlog
2269 - scripts/clean: cleanup any created dir in binary_local-includes
2270 - updated Debian Live snapshot packages repository URL and signing key
2271 - remove duplicated apt/preferences file, the live-helper bug has been
2273 * l10n: beginning of support for --language=en
2275 - improved boot time on CD by ordering files in the squashfs in the order they
2276 are used during boot
2277 - added a amnesia-version script to built images, that outputs the current
2279 - added a amnesia-debug script that prepares a tarball with information that
2280 could be useful for developpers
2281 - updated Amnesia GnuPG key to a new 4096R one
2282 - set time with NTP when a network interface is brought up
2283 - import amnesia's GnuPG pubkey into the live session user's keyring
2284 - do not ask DHCP for a specific hostname
2285 - install localepurge, only keep en, fr, de and es locales, which reduces the
2286 generated images' size by 100MB
2287 - added a hook to replace /sbin/swapon with a script that only runs
2289 - moved networking hooks responsibility from ifupdown to NetworkManager
2291 -- amnesia <amnesia@boum.org> Thu, 26 Nov 2009 11:17:08 +0100
2293 amnesia (0.2) unstable; urgency=low
2295 * imported /home/amnesia, then:
2296 - more user-friendly shell, umask 077
2297 - updated panel, added launcher to restart Tor
2298 - mv $HOME/bin/* /usr/local/bin/
2299 - removed metacity sessions
2300 - removed gstreamer's registry, better keep this dynamically updated
2301 - rm .qt/qt_plugins_3.3rc, better keep this dynamically updated
2302 - removed .gnome/gnome-vfs/.trash_entry_cache
2303 - removed kconf_update log
2304 - removed and excluded Epiphany configuration (not installed)
2307 - enable caching in RAM
2308 - explicitly disable ssl v2, and enable ssl v3 + tls
2309 - removed prefs for the non-installed webdeveloper
2310 - removed the SSL Blacklist extension (not so useful, licensing issues)
2311 - deep profile directory cleanup
2312 - extensions cleanup: prefer Debian-packaged ones, cleanly reinstalled
2313 AddBlock Plus and CS Lite to allow upgrading them
2314 - updated pluginreg.dat and localstore.rdf
2315 - moved some settings to user.js
2316 - made cookie/JavaScript whitelists more consistent
2317 - force httpS on whitelisted sites
2318 - NoScript: marked google and gmail as untrusted
2319 - some user interface tweaks, mainly for NoScript
2320 - FireGPG: disable the buggy auto-detection feature, the link to firegpg's
2321 homepage in generated pgp messages and the GMail interface (which won't
2322 work without JavaScript anyway)
2323 - updated blocklist.xml
2324 - removed and excluded a bunch of files in the profile directory
2325 * icedove: clean the profile directory up just like we did for iceweasel
2326 * software: install msmtp and mutt
2328 - use rsync rather than tar
2331 - reviewed pidgin-otr security (see TODO)
2333 - stop calling home-refresh in lh_build
2334 - include home-refresh in generated images
2336 - fix permissions on local includes at build time
2337 - updated scripts/{build,clean} wrt. new $HOME handling
2338 - scripts/{build,config}: stop guessing BASEDIR, we must be run from
2339 the root of the source directory anyway
2340 - stop storing /etc/amnesia/version in Git, delete it at clean time
2342 - converted Changelog to the Debian format and location, updated
2343 build scripts accordingly
2344 - added a README symlink at the root of the source directory
2345 - basic debian/ directory (not working for building packages yet,
2346 but at least we can now use git-dch)
2347 - added debian/gbp.conf with our custom options for git-dch
2348 - config/amnesia: introduce new $AMNESIA_DEV_* variables to be used
2349 by developpers' scripts
2350 - added ./release script: a wrapper around git-dch, git-commit and git-tag
2352 -- amnesia <amnesia@boum.org> Tue, 23 Jun 2009 14:42:03 +0200
2354 amnesia (0.1) UNRELEASED; urgency=low
2356 * Forked Privatix 9.03.15, by Markus Mandalka:
2357 http://mandalka.name/privatix/index.html.en
2358 Everything has since been rewritten or so heavily changed that nothing
2359 remains from the original code... apart of a bunch of Gnome settings.
2361 - install a bunch of non-free wifi firmwares
2362 - install xsane and add the live user to the scanner group
2363 - install aircrack-ng
2364 - install xserver-xorg-video-geode on i386 (eCafe support)
2365 - install xserver-xorg-video-all
2366 - install firmware-linux from backports.org
2367 - install system-config-printer
2368 - added instructions in README.eCAFE to support the Hercules eCAFE EC-800
2371 - configure pinning to support installing chosen packages from
2372 squeeze; the APT source for testing is hardcoded in chroot_sources/,
2373 since there is no way to use $LH_CHROOT_MIRROR in chroot_local-hooks
2374 - give backports.org priority 200, so that we track upgrades of packages
2375 installed from there
2376 * release: include the Changelog and TODO in the generated images,
2377 in the /usr/share/doc/amnesia/ directory
2378 * software: install gnomebaker when building Gnome-based live OS, to
2379 easily clone myself when running from CD
2381 - build i386 images when the build host is amd64
2382 - added a version file: /etc/amnesia/version
2383 - use snapshot live-* packages inside the images
2384 - setup timezone depending on the chosen build locale
2385 - rely on standard live-initramfs adduser to do our user setup
2386 (including sudo vs. Gnome/KDE, etc.)
2387 - stop "supporting" KDE
2388 - allow building several images at once
2389 - migrated most of lh_config invocations to scripts/config
2390 - append "noprompt" so that halting/rebooting work with splashy
2391 - moved our own variables to config/amnesia, using the namespace
2394 - default search engine is now Scroogle SSL, configured to search pages
2395 in French language; the English one is also installed
2396 - never ask to save passwords or forms content
2397 - configured the torbutton extension to use polipo
2398 - installed the CACert root certificate
2399 - installed the SSL Blacklist extension and the blacklist data
2400 - installed the FireGPG extension
2401 - installed the CS Lite extension
2402 - installed the NoScript extension
2403 - NoScript, CS Lite: replaced the default whitelists with a list of
2404 trusted, non-commercial Internet Service Providers
2405 - configure extensions (add to prefs.js):
2406 user_pref("extensions.torbutton.startup", true);
2407 user_pref("extensions.torbutton.startup_state", 1);
2408 user_pref("extensions.torbutton.tor_enabled", true);
2409 user_pref("noscript.notify.hide", true);
2410 user_pref("capability.policy.maonoscript.sites", "about:
2411 about:blank about:certerror about:config about:credits
2412 about:neterror about:plugins about:privatebrowsing
2413 about:sessionrestore chrome: resource:");
2414 user_pref("extensions.firegpg.no_updates", true);
2415 - install the NoScript plugin from Debian squeeze
2416 - delete urlclassifier3.sqlite on $HOME refresh: as we disabled
2417 "safebrowsing", this huge file is of no use
2418 - torbutton: install newer version from Squeeze
2419 * linux: removed non-686 kernel flavours when building i386 images
2420 * compatibility: append "live-media=removable live-media-timeout=15", to
2421 prevent blindly booting another debian-live installed on the hard disk
2425 - cryptkeeper: Gnome system tray applet to encrypt files with EncFS
2426 - kvkbd: virtual keyboard (installed from backports.org)
2427 - sshfs (and added live user to the fuse group)
2428 - less, secure-delete, wipe, seahorse, sshfs, ntfs-3g
2431 - enable the transparent proxy, the DNS resolver, and the control port
2432 - save authentication cookie to /tmp/control_auth_cookie, so that the
2433 live user can use Tork and co.
2434 - autostart Tork with Gnome
2435 - Tork: installed, disabled most notifications and startup tips
2436 - added a restart tor hook to if-up.d (used by Network Manager as well),
2437 so that Tor does work immediately even if the network cable was
2438 plugged late in/after the boot process
2440 - added a nautilus-script to wipe files and directories
2441 - bash with working completion for the live user
2442 * polipo: install and configure this HTTP proxy to forward requests
2444 * DNS: install and configure pdnsd to forward any DNS request through
2446 * firewall: force every outgoing TCP connection through the Tor
2447 transparent proxy, discard any outgoing UDP connection
2449 - set syslinux timeout to 4 seconds
2450 - use splashy for more user-friendly boot/halt sequences
2452 -- amnesia <amnesia@boum.org> Sat, 20 Jun 2009 21:09:15 +0200