browser plugin?

[Alex Smirnoff]

Is there a browser plugin that adds "open URL in disposable VM" function? like private tab on steroids :)

[Sven Semmler]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

On 11/12/20 11:41 AM, Alex Smirnoff wrote:
> Is there a browser plugin that adds "open URL in disposable VM"
> function? like private tab on steroids :)

https://github.com/raffaeleflorio/qubes-url-redirector

- --
public key: https://www.svensemmler.org/0x8F541FB6.asc
fingerprint: D7CA F2DB 658D 89BC 08D6 A7AA DA6E 167B 8F54 1FB6
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE18ry22WNibwI1qeq2m4We49UH7YFAl+uAMAACgkQ2m4We49U
H7a+SQ/9FTUH0IJx1+bkYuH+f2LiL2/TNZAvM6oWvavB8/pUDs5zGgNLqWqOWqtQ
EQdsHhbH5rPxP3gA1EddfsJoNcyArUOpbPyiVoE4rsuBEKaOnuCek+SgYcRFVZqC
r16vjH69JVlC5bEPDcpVOJW9LWL9AdHLgefG0hEz5Ux5lgw7Fq2YtAvELjTlgc7o
7VbDKmsIR9n6T4Ol2Wod1Bs+7vId+SxxuPjopcKxvhVsXJq26f1N9zeq9guMH0e5
6Ux8q/DqR4o48ovr0AY1UjLallOFdhK3amKVdXpp4Yt0VVEFA4ZVhRvlpfUNSI/E
xIK1LL9MrOusYphiQ5waOPrA6N8bKQFvR7o/PbPtt7k/68zDXIce0AKqQbW9a9Oi
eIbKRdvwJiLaIR4NC5GAAeTTxVyF1Q/adg4eCo2/Vlx8wAGIvbDV+BuNFQVmeERF
x1kB+xwsjgtJxoJxFSMTSaPwM7cU3FV6vw3IikgXXd0v1YYJp0l3ED27BBHkMa2S
WfOrhJSQ0BfGEo2g2hBM+wzAviVne92F6Rc3kjizi7S/k0AuBy5++UZqY2AWQSZt
Eiz+YKuMp5SX/8xCsy2SDK3yHBPiB06mArEpkGaLU9E+H1/urVwNud4bj+ft4fjH
ffG4j40awYoFXkchpmebI23lWlQhUDZ+wdufVWULzH1/cE0isSU=
=Bp9c
-----END PGP SIGNATURE-----

[Ulrich Windl]

On 11/13/20 4:42 AM, Sven Semmler wrote:
> On 11/12/20 11:41 AM, Alex Smirnoff wrote:
>> Is there a browser plugin that adds "open URL in disposable VM"
>> function? like private tab on steroids :)

I think this is important when following an URL in Thunderbird from a
non-disposable / not-anonymous VM. Copying the link and pasting it to
another VM is not really very user-efficient.
Well I would not need a new VM for each link, but a _different_ VM...

>
> https://github.com/raffaeleflorio/qubes-url-redirector
>
>

[Andrew David Wong]

On 11/21/20 4:00 PM, Ulrich Windl wrote:
> On 11/13/20 4:42 AM, Sven Semmler wrote:
>> On 11/12/20 11:41 AM, Alex Smirnoff wrote:
>>> Is there a browser plugin that adds "open URL in disposable VM"
>>> function? like private tab on steroids :)
>
> I think this is important when following an URL in Thunderbird from a
> non-disposable / not-anonymous VM. Copying the link and pasting it to
> another VM is not really very user-efficient.
> Well I would not need a new VM for each link, but a _different_ VM...
>

You can already do this with built-in Qubes tools without any extra
plug-ins or third-party programs:

https://www.qubes-os.org/doc/tips-and-tricks/#opening-links-in-your-preferred-appvm

--
Andrew David Wong (Axon)
Community Manager, Qubes OS
https://www.qubes-os.org

[Ulrich Windl]

On 11/28/20 8:20 PM, Andrew David Wong wrote:
> On 11/28/20 8:43 AM, Ulrich Windl wrote:

>> On 11/22/20 2:19 PM, Andrew David Wong wrote:
>>> On 11/21/20 4:00 PM, Ulrich Windl wrote:
>>>> On 11/13/20 4:42 AM, Sven Semmler wrote:
>>>>> On 11/12/20 11:41 AM, Alex Smirnoff wrote:
>>>>>> Is there a browser plugin that adds "open URL in disposable VM"
>>>>>> function? like private tab on steroids :)
>>>>
>>>> I think this is important when following an URL in Thunderbird from
>>>> a non-disposable / not-anonymous VM. Copying the link and pasting it
>>>> to another VM is not really very user-efficient.
>>>> Well I would not need a new VM for each link, but a _different_ VM...
>>>>
>>>
>>> You can already do this with built-in Qubes tools without any extra
>>> plug-ins or third-party programs:
>>>
>>> https://www.qubes-os.org/doc/tips-and-tricks/#opening-links-in-your-preferred-appvm
>>>
>>

>> OK, the page says: "This is unofficial, third-party documentation. The
>> Qubes OS Project cannot guarantee the accuracy of this page. Please
>> exercise caution."
>>
>> Despite of that in debian.10 there is no ~/.local/share/applications;
>> you must create the directory fist (it seems).
>>
>> The other question is when I want to open all links in a DVM (starting
>> a new DVM/browser for every link looks like overkill to me), how can I
>> set APPVMNAME correctly (it will have a name like "disp9474", changing
>> whenever on is started). And can such DVM be started automatically if
>> there is none yet?
>>
>> Regards,
>> Ulrich
>>
>
> Hi,
>
> I'm not sure how to do that, but I seem to recall someone posting a
> guide for doing that recently on the forum or qubes-users. Try searching
> in both places.
>
> By the way, I strongly encourage you to include the appropriate mailing
> list on these messages, so that you can potentially receive helpful
> replies from other people besides me. More on this:
>
> https://www.qubes-os.org/support/#discussion-guidelines

Mea culpa: I'm using many lists with different conventions and different
MUAs also. Occasionally I reply the wrong way without intention. Sorry!
I realized that I had not replied to the list most of the time that day...

>

[Sven Semmler]

I am not sure who wrote:
> The other question is when I want to open all links in a DVM
> (starting a new DVM/browser for every link looks like overkill to
> me), how can I set APPVMNAME correctly (it will have a name like
> "disp9474", changing whenever on is started). And can such DVM be
> started automatically if there is none yet?

You might want to create a named disposable qube...

qvm-create --class DispVM --template dvm-template --label red named-dvm

... then in the qubes.OpenURL policy file you can append default_target
to the ask like so:

$anyvm $dispvm ask,default_target=named-dvm

What that does:

* named-dvm is just like any other dispvm but you gave it a specific
name as opposed to disp123

* when you click a link you still get the policy dialog, but the named
dispvm is preselected

... I used to do that, but then decided that I want the extra security
of having a new disp vm for each link. I am sometimes tired or
distracted and want to have as many automatic safety in place as I can
to prevent information leakage.

Also: even though it is slightly inconvenient I strongly recommend to
have Javascript disabled by default (NoScript, Torbrowser on 'safest',
etc). This way you can still enable it if you decide you need it, but
nothing happens by default.

/Sven