free
/
freedombone
Watch 1
Star 0
Fork 0
Code Issues 0 Pull Requests 0 Releases 0 Wiki Activity
Browse Source

Mention forking

Bob Mottram 8 years ago
parent
8c0d5ed365
commit
36631ad4fb
2 changed files with 107 additions and 105 deletions
Split View Show Diff Stats
  1. 1
    0
      doc/EN/faq.org
  2. 106
    105
      website/EN/faq.html

+ 1
- 0
doc/EN/faq.org View File 

@@ -146,6 +146,7 @@ If you are currently using a proprietary chat app, something without any encrypt
146 146 
  * *It requires the installation of Google Play*. If you already have Google Play installed on a stock Android OS then this doesn't increase your security problems, but for other more secure Android variants it's a massive increase in attack surface.
147 147 
  * *It depends entirely upon the Google message pushing system*. That means that Google /at least knows who Signal messages are being sent to and may be able to infer the rest via your (insecure) Android phone contact list or via timing correlation of alternating deliveries/. Remember that for an adversary metadata in aggregate is much better than having the content of messages. At any time Google could decide that it doesn't want to support Signal, or in adverse circumstances they could be leaned upon by the usual agencies or government cronies.
148 148 
  * *Their privacy policy indicates that they will give whatever server data they have to third parties* under some conditions. Of course this is always claimed to be /for the very best of reasons/ - such as combating fraud - but once that sort of disclosure capability exists it may be abused without you ever knowing about it.
149 
+ * *Forking isn't really an option*. A fork was tried, but Moxie got annoyed when it still used his server. At the same time the level of interest in federating the server is not detectable with our best intrumentation, and is suspected to be negative. That's a catch 22 which effectively means that independent implementations of Signal will always leave some users unable to communicate with each other.
149 150
150 151 
 To give credit where it's due Signal is good, but it could be a lot better. The real solution for private chat is to run your own XMPP server, as you can with Freedombone, or to have someone within your community do that. /There is no substitute for a decentralised solution which is within the control of your community/.
151 152 
 * What is the most secure chat app to use on mobile?

+ 106
- 105
website/EN/faq.html View File 

@@ -3,11 +3,11 @@
3 3 
 "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
4 4 
 <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
5 5 
 <head>
6 
-<!-- 2016-10-28 Fri 23:39 -->
6 
+<!-- 2016-10-30 Sun 14:59 -->
7 7 
 <meta http-equiv="Content-Type" content="text/html;charset=utf-8" />
8 8 
 <meta name="viewport" content="width=device-width, initial-scale=1" />
9 9 
 <title></title>
10 
-<meta name="generator" content="Org-mode" />
10 
+<meta name="generator" content="Org mode" />
11 11 
 <meta name="author" content="Bob Mottram" />
12 12 
 <meta name="description" content="Frequently asked questions"
13 13 
  />
 
@@ -256,27 +256,27 @@ for the JavaScript code in this tag.
256 256 
 </colgroup>
257 257 
 <tbody>
258 258 
 <tr>
259 
-<td class="org-left"><a href="#orgdd3006d">What applications are supported?</a></td>
259 
+<td class="org-left"><a href="#org4428193">What applications are supported?</a></td>
260 260 
 </tr>
261 261
262 262 
 <tr>
263 
-<td class="org-left"><a href="#org241bc25">I don't have a static IP address. Can I still install this system?</a></td>
263 
+<td class="org-left"><a href="#org717062d">I don't have a static IP address. Can I still install this system?</a></td>
264 264 
 </tr>
265 265
266 266 
 <tr>
267 
-<td class="org-left"><a href="#org2e8c3e1">Why Freedombone and not FreedomBox?</a></td>
267 
+<td class="org-left"><a href="#org6ee3c98">Why Freedombone and not FreedomBox?</a></td>
268 268 
 </tr>
269 269
270 270 
 <tr>
271 
-<td class="org-left"><a href="#org48bd91e">Why not support building images for Raspberry Pi?</a></td>
271 
+<td class="org-left"><a href="#orgc38c10d">Why not support building images for Raspberry Pi?</a></td>
272 272 
 </tr>
273 273
274 274 
 <tr>
275 
-<td class="org-left"><a href="#org1164a78">Why use Github?</a></td>
275 
+<td class="org-left"><a href="#org6a11c24">Why use Github?</a></td>
276 276 
 </tr>
277 277
278 278 
 <tr>
279 
-<td class="org-left"><a href="#orgf5b1f20">Keys and emails should not be stored on servers. Why do you do that?</a></td>
279 
+<td class="org-left"><a href="#org6858bf9">Keys and emails should not be stored on servers. Why do you do that?</a></td>
280 280 
 </tr>
281 281
282 282 
 <tr>
 
@@ -284,83 +284,83 @@ for the JavaScript code in this tag.
284 284 
 </tr>
285 285
286 286 
 <tr>
287 
-<td class="org-left"><a href="#org73eb004">Why can't I access my .onion site with a Tor browser?</a></td>
287 
+<td class="org-left"><a href="#org63a7bf2">Why can't I access my .onion site with a Tor browser?</a></td>
288 288 
 </tr>
289 289
290 290 
 <tr>
291 
-<td class="org-left"><a href="#org6f5f054">What is the best hardware to run this system on?</a></td>
291 
+<td class="org-left"><a href="#org79048ad">What is the best hardware to run this system on?</a></td>
292 292 
 </tr>
293 293
294 294 
 <tr>
295 
-<td class="org-left"><a href="#orgaa5acb9">Can I add more users to the system?</a></td>
295 
+<td class="org-left"><a href="#orgcefa42b">Can I add more users to the system?</a></td>
296 296 
 </tr>
297 297
298 298 
 <tr>
299 
-<td class="org-left"><a href="#org0ecbaa7">Why not use Signal for mobile chat?</a></td>
299 
+<td class="org-left"><a href="#org091c18c">Why not use Signal for mobile chat?</a></td>
300 300 
 </tr>
301 301
302 302 
 <tr>
303 
-<td class="org-left"><a href="#orgfeefd99">What is the most secure chat app to use on mobile?</a></td>
303 
+<td class="org-left"><a href="#orgc7011d3">What is the most secure chat app to use on mobile?</a></td>
304 304 
 </tr>
305 305
306 306 
 <tr>
307 
-<td class="org-left"><a href="#org9bdd6d8">How do I remove a user from the system?</a></td>
307 
+<td class="org-left"><a href="#org48f0ef5">How do I remove a user from the system?</a></td>
308 308 
 </tr>
309 309
310 310 
 <tr>
311 
-<td class="org-left"><a href="#org95a8236">How do I reset the tripwire?</a></td>
311 
+<td class="org-left"><a href="#orgc7c1988">How do I reset the tripwire?</a></td>
312 312 
 </tr>
313 313
314 314 
 <tr>
315 
-<td class="org-left"><a href="#org9980a49">Is metadata protected?</a></td>
315 
+<td class="org-left"><a href="#org82dbbfb">Is metadata protected?</a></td>
316 316 
 </tr>
317 317
318 318 
 <tr>
319 
-<td class="org-left"><a href="#orga27aa6b">How do I create email processing rules?</a></td>
319 
+<td class="org-left"><a href="#org235442e">How do I create email processing rules?</a></td>
320 320 
 </tr>
321 321
322 322 
 <tr>
323 
-<td class="org-left"><a href="#org325c7ef">Why isn't dynamic DNS working?</a></td>
323 
+<td class="org-left"><a href="#org887b30e">Why isn't dynamic DNS working?</a></td>
324 324 
 </tr>
325 325
326 326 
 <tr>
327 
-<td class="org-left"><a href="#orgb5d7db0">How do I change my encryption settings?</a></td>
327 
+<td class="org-left"><a href="#org52bd959">How do I change my encryption settings?</a></td>
328 328 
 </tr>
329 329
330 330 
 <tr>
331 
-<td class="org-left"><a href="#orgf06495e">How do I get a domain name?</a></td>
331 
+<td class="org-left"><a href="#org464aadb">How do I get a domain name?</a></td>
332 332 
 </tr>
333 333
334 334 
 <tr>
335 
-<td class="org-left"><a href="#orgae912fb">How do I get a "real" SSL/TLS/HTTPS certificate?</a></td>
335 
+<td class="org-left"><a href="#org4991a21">How do I get a "real" SSL/TLS/HTTPS certificate?</a></td>
336 336 
 </tr>
337 337
338 338 
 <tr>
339 
-<td class="org-left"><a href="#orgc54d4b4">How do I renew a Let's Encrypt certificate?</a></td>
339 
+<td class="org-left"><a href="#org026e292">How do I renew a Let's Encrypt certificate?</a></td>
340 340 
 </tr>
341 341
342 342 
 <tr>
343 
-<td class="org-left"><a href="#org7f40186">I tried to renew a Let's Encrypt certificate and it failed. What should I do?</a></td>
343 
+<td class="org-left"><a href="#orgc6afa55">I tried to renew a Let's Encrypt certificate and it failed. What should I do?</a></td>
344 344 
 </tr>
345 345
346 346 
 <tr>
347 
-<td class="org-left"><a href="#orgca29cce">Why use self-signed certificates?</a></td>
347 
+<td class="org-left"><a href="#orge1d6a21">Why use self-signed certificates?</a></td>
348 348 
 </tr>
349 349
350 350 
 <tr>
351 
-<td class="org-left"><a href="#org76a5af5">Why not use the services of $company instead? They took the Seppuku pledge</a></td>
351 
+<td class="org-left"><a href="#org4b00e60">Why not use the services of $company instead? They took the Seppuku pledge</a></td>
352 352 
 </tr>
353 353
354 354 
 <tr>
355 
-<td class="org-left"><a href="#org7dcc476">Why does my email keep getting rejected as spam by Gmail/etc?</a></td>
355 
+<td class="org-left"><a href="#org1208fbe">Why does my email keep getting rejected as spam by Gmail/etc?</a></td>
356 356 
 </tr>
357 357 
 </tbody>
358 358 
 </table>
359 359 
 </div>
360 360
361 
-<div id="outline-container-orgdd3006d" class="outline-2">
362 
-<h2 id="orgdd3006d">What applications are supported?</h2>
363 
-<div class="outline-text-2" id="text-orgdd3006d">
361 
+<div id="outline-container-org4428193" class="outline-2">
362 
+<h2 id="org4428193">What applications are supported?</h2>
363 
+<div class="outline-text-2" id="text-org4428193">
364 364 
 <ul class="org-ul">
365 365 
 <li><b>Email</b> - Server and Mutt client configured for use with GPG and Emacs or Vim</li>
366 366 
 <li><b>DLNA</b> - Play music on your local network devices</li>
 
@@ -385,9 +385,9 @@ for the JavaScript code in this tag.
385 385 
 </ul>
386 386 
 </div>
387 387 
 </div>
388 
-<div id="outline-container-org241bc25" class="outline-2">
389 
-<h2 id="org241bc25">I don't have a static IP address. Can I still install this system?</h2>
390 
-<div class="outline-text-2" id="text-org241bc25">
388 
+<div id="outline-container-org717062d" class="outline-2">
389 
+<h2 id="org717062d">I don't have a static IP address. Can I still install this system?</h2>
390 
+<div class="outline-text-2" id="text-org717062d">
391 391 
 <p>
392 392 
 Yes. The minimum requirements are to have some hardware that you can install Debian onto and also that you have administrator access to your internet router so that you can forward ports to the system which has Freedombone installed.
393 393 
 </p>
 
@@ -397,17 +397,17 @@ The lack of a static IP address can be worked around by using a dynamic DNS serv
397 397 
 </p>
398 398 
 </div>
399 399 
 </div>
400 
-<div id="outline-container-org2e8c3e1" class="outline-2">
401 
-<h2 id="org2e8c3e1">Why Freedombone and not FreedomBox?</h2>
402 
-<div class="outline-text-2" id="text-org2e8c3e1">
400 
+<div id="outline-container-org6ee3c98" class="outline-2">
401 
+<h2 id="org6ee3c98">Why Freedombone and not FreedomBox?</h2>
402 
+<div class="outline-text-2" id="text-org6ee3c98">
403 403 
 <p>
404 404 
 When the project began in late 2013 the FreedomBox project seemed to be going nowhere, and was only designed to work with the DreamPlug hardware. There was some new hardware out - the Beaglebone Black - which could run Debian and was also a free hardware design so seemed more appropriate. Hence the name "Freedombone", being like FreedomBox but on a Beaglebone. There are some similarities and differences between the two projects:
405 405 
 </p>
406 406 
 </div>
407 407
408 
-<div id="outline-container-orgd3e147e" class="outline-3">
409 
-<h3 id="orgd3e147e">Similarities</h3>
410 
-<div class="outline-text-3" id="text-orgd3e147e">
408 
+<div id="outline-container-org50dfec0" class="outline-3">
409 
+<h3 id="org50dfec0">Similarities</h3>
410 
+<div class="outline-text-3" id="text-org50dfec0">
411 411 
 <ul class="org-ul">
412 412 
 <li>Uses freedom-maker and vmdebootstrap to build debian images</li>
413 413 
 <li>Supports the use of Tor onion addresses to access websites</li>
 
@@ -421,9 +421,9 @@ When the project began in late 2013 the FreedomBox project seemed to be going no
421 421 
 </ul>
422 422 
 </div>
423 423 
 </div>
424 
-<div id="outline-container-orgc698feb" class="outline-3">
425 
-<h3 id="orgc698feb">Differences</h3>
426 
-<div class="outline-text-3" id="text-orgc698feb">
424 
+<div id="outline-container-org02f2110" class="outline-3">
425 
+<h3 id="org02f2110">Differences</h3>
426 
+<div class="outline-text-3" id="text-org02f2110">
427 427 
 <ul class="org-ul">
428 428 
 <li>FreedomBox is a Debian pure blend. Freedombone is not</li>
429 429 
 <li>Freedombone only supports Free Software. FreedomBox includes some closed binary boot blobs for certain ARM boards</li>
 
@@ -438,9 +438,9 @@ When the project began in late 2013 the FreedomBox project seemed to be going no
438 438 
 </div>
439 439 
 </div>
440 440 
 </div>
441 
-<div id="outline-container-org48bd91e" class="outline-2">
442 
-<h2 id="org48bd91e">Why not support building images for Raspberry Pi?</h2>
443 
-<div class="outline-text-2" id="text-org48bd91e">
441 
+<div id="outline-container-orgc38c10d" class="outline-2">
442 
+<h2 id="orgc38c10d">Why not support building images for Raspberry Pi?</h2>
443 
+<div class="outline-text-2" id="text-orgc38c10d">
444 444 
 <p>
445 445 
 The FreedomBox project supports Raspberry Pi builds, and the image build system for Freedombone is based on the same system. However, although the Raspberry Pi can run a version of Debian it requires a closed proprietary blob in order to boot the hardware. Who knows what that blob might contain or what exploits it could facilitate. From an adversarial point of view if you were trying to deliver "bulk equipment interference" then it doesn't get any better than piggybacking on something which has control of the boot process, and hence all subsequently run processes.
446 446 
 </p>
 
@@ -450,9 +450,9 @@ So although the Raspberry Pi is cheap and hugely popular it's not supported by t
450 450 
 </p>
451 451 
 </div>
452 452 
 </div>
453 
-<div id="outline-container-org1164a78" class="outline-2">
454 
-<h2 id="org1164a78">Why use Github?</h2>
455 
-<div class="outline-text-2" id="text-org1164a78">
453 
+<div id="outline-container-org6a11c24" class="outline-2">
454 
+<h2 id="org6a11c24">Why use Github?</h2>
455 
+<div class="outline-text-2" id="text-org6a11c24">
456 456 
 <p>
457 457 
 Github is paradoxically a centralized, closed and proprietary system which happens to mostly host free and open source projects. Up until now it has been relatively benign, but at some point in the name of "growth" it will likely start becoming more evil, or just become like SourceForge - which was also once much loved by FOSS developers, but turned into a den of malvertizing.
458 458 
 </p>
 
@@ -470,9 +470,9 @@ Currently many of the repositories used for applications which are not yet packa
470 470 
 </p>
471 471 
 </div>
472 472 
 </div>
473 
-<div id="outline-container-orgf5b1f20" class="outline-2">
474 
-<h2 id="orgf5b1f20">Keys and emails should not be stored on servers. Why do you do that?</h2>
475 
-<div class="outline-text-2" id="text-orgf5b1f20">
473 
+<div id="outline-container-org6858bf9" class="outline-2">
474 
+<h2 id="org6858bf9">Keys and emails should not be stored on servers. Why do you do that?</h2>
475 
+<div class="outline-text-2" id="text-org6858bf9">
476 476 
 <p>
477 477 
 Ordinarily this is good advice. However, the threat model for a device in your home is different from the one for a generic server in a massive warehouse. Compare and contrast:
478 478 
 </p>
 
@@ -530,17 +530,17 @@ In the home environment a box with a good firewall and no GUI components install
530 530 
 </div>
531 531 
 </div>
532 532
533 
-<div id="outline-container-org73eb004" class="outline-2">
534 
-<h2 id="org73eb004">Why can't I access my .onion site with a Tor browser?</h2>
535 
-<div class="outline-text-2" id="text-org73eb004">
533 
+<div id="outline-container-org63a7bf2" class="outline-2">
534 
+<h2 id="org63a7bf2">Why can't I access my .onion site with a Tor browser?</h2>
535 
+<div class="outline-text-2" id="text-org63a7bf2">
536 536 
 <p>
537 537 
 Probably you need to add the site to the NoScript whitelist. Typically click/press on the noscript icon (or select from the menu on mobile) then select <i>whitelist</i> and add the site URL. You may also need to disable HTTPS Everywhere when using onion addresses, which don't use https.
538 538 
 </p>
539 539 
 </div>
540 540 
 </div>
541 
-<div id="outline-container-org6f5f054" class="outline-2">
542 
-<h2 id="org6f5f054">What is the best hardware to run this system on?</h2>
543 
-<div class="outline-text-2" id="text-org6f5f054">
541 
+<div id="outline-container-org79048ad" class="outline-2">
542 
+<h2 id="org79048ad">What is the best hardware to run this system on?</h2>
543 
+<div class="outline-text-2" id="text-org79048ad">
544 544 
 <p>
545 545 
 It was originally designed to run on the Beaglebone Black, but that should be regarded as the most minimal system, because it's single core and has by today's standards a small amount of memory. Obviously the more powerful the hardware is the faster things like web pages (blog, social networking, etc) will be served but the more electricity such a system will require if you're running it 24/7. A good compromise between performance and energy consumption is something like an old netbook. The battery of an old netbook or laptop even gives you <a href="https://en.wikipedia.org/wiki/Uninterruptible_power_supply">UPS capability</a> to keep the system going during brief power outages or cable re-arrangements, and that means using full disk encryption on the server also becomes more practical.
546 546 
 </p>
 
@@ -550,9 +550,9 @@ It was originally designed to run on the Beaglebone Black, but that should be re
550 550 
 </p>
551 551 
 </div>
552 552 
 </div>
553 
-<div id="outline-container-orgaa5acb9" class="outline-2">
554 
-<h2 id="orgaa5acb9">Can I add more users to the system?</h2>
555 
-<div class="outline-text-2" id="text-orgaa5acb9">
553 
+<div id="outline-container-orgcefa42b" class="outline-2">
554 
+<h2 id="orgcefa42b">Can I add more users to the system?</h2>
555 
+<div class="outline-text-2" id="text-orgcefa42b">
556 556 
 <p>
557 557 
 Yes. Freedombone can support a small number of users, for a "<i>friends and family</i>" type of home installation. This gives them access to an email account, XMPP, SIP phone and the blog (depending on whether the variant which you installed includes those).
558 558 
 </p>
 
@@ -575,9 +575,9 @@ Another point is that Freedombone installations are not intended to support many
575 575 
 </p>
576 576 
 </div>
577 577 
 </div>
578 
-<div id="outline-container-org0ecbaa7" class="outline-2">
579 
-<h2 id="org0ecbaa7">Why not use Signal for mobile chat?</h2>
580 
-<div class="outline-text-2" id="text-org0ecbaa7">
578 
+<div id="outline-container-org091c18c" class="outline-2">
579 
+<h2 id="org091c18c">Why not use Signal for mobile chat?</h2>
580 
+<div class="outline-text-2" id="text-org091c18c">
581 581 
 <p>
582 582 
 Celebrities recommend Signal. It's Free Software so it must be good, right?
583 583 
 </p>
 
@@ -591,6 +591,7 @@ If you are currently using a proprietary chat app, something without any encrypt
591 591 
 <li><b>It requires the installation of Google Play</b>. If you already have Google Play installed on a stock Android OS then this doesn't increase your security problems, but for other more secure Android variants it's a massive increase in attack surface.</li>
592 592 
 <li><b>It depends entirely upon the Google message pushing system</b>. That means that Google <i>at least knows who Signal messages are being sent to and may be able to infer the rest via your (insecure) Android phone contact list or via timing correlation of alternating deliveries</i>. Remember that for an adversary metadata in aggregate is much better than having the content of messages. At any time Google could decide that it doesn't want to support Signal, or in adverse circumstances they could be leaned upon by the usual agencies or government cronies.</li>
593 593 
 <li><b>Their privacy policy indicates that they will give whatever server data they have to third parties</b> under some conditions. Of course this is always claimed to be <i>for the very best of reasons</i> - such as combating fraud - but once that sort of disclosure capability exists it may be abused without you ever knowing about it.</li>
594 
+<li><b>Forking isn't really an option</b>. A fork was tried, but Moxie got annoyed when it still used his server. At the same time the level of interest in federating the server is not detectable with our best intrumentation, and is suspected to be negative. That's a catch 22 which effectively means that independent implementations of Signal will always leave some users unable to communicate with each other.</li>
594 595 
 </ul>
595 596
596 597 
 <p>
 
@@ -598,9 +599,9 @@ To give credit where it's due Signal is good, but it could be a lot better. The
598 599 
 </p>
599 600 
 </div>
600 601 
 </div>
601 
-<div id="outline-container-orgfeefd99" class="outline-2">
602 
-<h2 id="orgfeefd99">What is the most secure chat app to use on mobile?</h2>
603 
-<div class="outline-text-2" id="text-orgfeefd99">
602 
+<div id="outline-container-orgc7011d3" class="outline-2">
603 
+<h2 id="orgc7011d3">What is the most secure chat app to use on mobile?</h2>
604 
+<div class="outline-text-2" id="text-orgc7011d3">
604 605 
 <p>
605 606 
 On mobile there are various options. The apps which are likely to be most secure are ones which have end-to-end encryption enabled by default and which can also be onion routed via Orbot. End-to-end encryption secures the content of the message and onion routing obscures the metadata, making it hard for a passive adversary to know who is communicating with who.
606 607 
 </p>
 
@@ -610,13 +611,13 @@ The current safest way to chat is to use <a href="https://conversations.im">Conv
610 611 
 </p>
611 612
612 613 
 <p>
613 
-There are many <a href="#org0ecbaa7">other fashionable chat apps</a> with end-to-end security, but often they are closed source, have a single central server or can't be onion routed. It's also important to remember that closed source chat apps should be assumed to be untrustworthy, since their security cannot be independently verified.
614 
+There are many <a href="#org091c18c">other fashionable chat apps</a> with end-to-end security, but often they are closed source, have a single central server or can't be onion routed. It's also important to remember that closed source chat apps should be assumed to be untrustworthy, since their security cannot be independently verified.
614 615 
 </p>
615 616 
 </div>
616 617 
 </div>
617 
-<div id="outline-container-org9bdd6d8" class="outline-2">
618 
-<h2 id="org9bdd6d8">How do I remove a user from the system?</h2>
619 
-<div class="outline-text-2" id="text-org9bdd6d8">
618 
+<div id="outline-container-org48f0ef5" class="outline-2">
619 
+<h2 id="org48f0ef5">How do I remove a user from the system?</h2>
620 
+<div class="outline-text-2" id="text-org48f0ef5">
620 621 
 <p>
621 622 
 To remove a user:
622 623 
 </p>
 
@@ -631,9 +632,9 @@ Select <i>Administrator controls</i> then <i>Manage Users</i> and then <i>Delete
631 632 
 </p>
632 633 
 </div>
633 634 
 </div>
634 
-<div id="outline-container-org95a8236" class="outline-2">
635 
-<h2 id="org95a8236">How do I reset the tripwire?</h2>
636 
-<div class="outline-text-2" id="text-org95a8236">
635 
+<div id="outline-container-orgc7c1988" class="outline-2">
636 
+<h2 id="orgc7c1988">How do I reset the tripwire?</h2>
637 
+<div class="outline-text-2" id="text-orgc7c1988">
637 638 
 <p>
638 639 
 The tripwire will be automatically reset once per week. If you want to reset it earlier then do the following:
639 640 
 </p>
 
@@ -648,9 +649,9 @@ Select <i>Administrator controls</i> then "reset tripwire" using cursors and spa
648 649 
 </p>
649 650 
 </div>
650 651 
 </div>
651 
-<div id="outline-container-org9980a49" class="outline-2">
652 
-<h2 id="org9980a49">Is metadata protected?</h2>
653 
-<div class="outline-text-2" id="text-org9980a49">
652 
+<div id="outline-container-org82dbbfb" class="outline-2">
653 
+<h2 id="org82dbbfb">Is metadata protected?</h2>
654 
+<div class="outline-text-2" id="text-org82dbbfb">
654 655 
 <blockquote>
655 656 
 <p>
656 657 
 "<i>We kill people based on metadata</i>"
 
@@ -666,9 +667,9 @@ Even when using Freedombone metadata analysis by third parties is still possible
666 667 
 </p>
667 668 
 </div>
668 669 
 </div>
669 
-<div id="outline-container-orga27aa6b" class="outline-2">
670 
-<h2 id="orga27aa6b">How do I create email processing rules?</h2>
671 
-<div class="outline-text-2" id="text-orga27aa6b">
670 
+<div id="outline-container-org235442e" class="outline-2">
671 
+<h2 id="org235442e">How do I create email processing rules?</h2>
672 
+<div class="outline-text-2" id="text-org235442e">
672 673 
 <div class="org-src-container">
673 674 
 <pre class="src src-bash">ssh username@domainname -p 2222
674 675 
 </pre>
 
@@ -724,9 +725,9 @@ Spamassassin is also available and within Mutt you can use the S (shift+s) key t
724 725 
 </p>
725 726 
 </div>
726 727 
 </div>
727 
-<div id="outline-container-org325c7ef" class="outline-2">
728 
-<h2 id="org325c7ef">Why isn't dynamic DNS working?</h2>
729 
-<div class="outline-text-2" id="text-org325c7ef">
728 
+<div id="outline-container-org887b30e" class="outline-2">
729 
+<h2 id="org887b30e">Why isn't dynamic DNS working?</h2>
730 
+<div class="outline-text-2" id="text-org887b30e">
730 731 
 <p>
731 732 
 If you run the command:
732 733 
 </p>
 
@@ -749,9 +750,9 @@ https://www.privateinternetaccess.com/pages/whats-my-ip/
749 750 
 </div>
750 751 
 </div>
751 752
752 
-<div id="outline-container-orgb5d7db0" class="outline-2">
753 
-<h2 id="orgb5d7db0">How do I change my encryption settings?</h2>
754 
-<div class="outline-text-2" id="text-orgb5d7db0">
753 
+<div id="outline-container-org52bd959" class="outline-2">
754 
+<h2 id="org52bd959">How do I change my encryption settings?</h2>
755 
+<div class="outline-text-2" id="text-org52bd959">
755 756 
 <p>
756 757 
 Suppose that some new encryption vulnerability has been announced and that you need to change your encryption settings. Maybe an algorithm thought to be secure is now no longer so and you need to remove it. You can change your settings by doing the following:
757 758 
 </p>
 
@@ -766,9 +767,9 @@ Select <i>Administrator controls</i> then select <i>Security Settings</i>. You w
766 767 
 </p>
767 768 
 </div>
768 769 
 </div>
769 
-<div id="outline-container-orgf06495e" class="outline-2">
770 
-<h2 id="orgf06495e">How do I get a domain name?</h2>
771 
-<div class="outline-text-2" id="text-orgf06495e">
770 
+<div id="outline-container-org464aadb" class="outline-2">
771 
+<h2 id="org464aadb">How do I get a domain name?</h2>
772 
+<div class="outline-text-2" id="text-org464aadb">
772 773 
 <p>
773 774 
 Suppose that you have bought a domain name (rather than using a free subdomain on freedns) and you want to use that instead.
774 775 
 </p>
 
@@ -832,9 +833,9 @@ You should now be able to send an email from <i>postmaster@mynewdomainname</i> a
832 833 
 </div>
833 834 
 </div>
834 835
835 
-<div id="outline-container-orgae912fb" class="outline-2">
836 
-<h2 id="orgae912fb">How do I get a "real" SSL/TLS/HTTPS certificate?</h2>
837 
-<div class="outline-text-2" id="text-orgae912fb">
836 
+<div id="outline-container-org4991a21" class="outline-2">
837 
+<h2 id="org4991a21">How do I get a "real" SSL/TLS/HTTPS certificate?</h2>
838 
+<div class="outline-text-2" id="text-org4991a21">
838 839 
 <p>
839 840 
 If you did the full install or selected the social variant then the system will have tried to obtain a Let's Encrypt certificate automatically during the install process. If this failed for any reason, or if you have created a new site which you need a certificate for then do the following:
840 841 
 </p>
 
@@ -853,9 +854,9 @@ One thing to be aware of is that Let's Encrypt doesn't support many dynamic DNS
853 854 
 </p>
854 855 
 </div>
855 856 
 </div>
856 
-<div id="outline-container-orgc54d4b4" class="outline-2">
857 
-<h2 id="orgc54d4b4">How do I renew a Let's Encrypt certificate?</h2>
858 
-<div class="outline-text-2" id="text-orgc54d4b4">
857 
+<div id="outline-container-org026e292" class="outline-2">
858 
+<h2 id="org026e292">How do I renew a Let's Encrypt certificate?</h2>
859 
+<div class="outline-text-2" id="text-org026e292">
859 860 
 <p>
860 861 
 Normally certificates will be automatically renewed once per month, so you don't need to be concerned about it. If anything goes wrong with the automatic renewal then you should receive a warning email.
861 862 
 </p>
 
@@ -874,9 +875,9 @@ Select <i>Administrator controls</i> then <b>Security settings</b> then <b>Renew
874 875 
 </p>
875 876 
 </div>
876 877 
 </div>
877 
-<div id="outline-container-org7f40186" class="outline-2">
878 
-<h2 id="org7f40186">I tried to renew a Let's Encrypt certificate and it failed. What should I do?</h2>
879 
-<div class="outline-text-2" id="text-org7f40186">
878 
+<div id="outline-container-orgc6afa55" class="outline-2">
879 
+<h2 id="orgc6afa55">I tried to renew a Let's Encrypt certificate and it failed. What should I do?</h2>
880 
+<div class="outline-text-2" id="text-orgc6afa55">
880 881 
 <p>
881 882 
 Most likely it's because Let's Encrypt doesn't support your particular domain or subdomain. Currently free subdomains tend not to work. You'll need to buy a domain name, link it to your dynamic DNS account and then do:
882 883 
 </p>
 
@@ -891,9 +892,9 @@ Select <i>Administrator controls</i> then <b>Security settings</b> then <b>Creat
891 892 
 </p>
892 893 
 </div>
893 894 
 </div>
894 
-<div id="outline-container-orgca29cce" class="outline-2">
895 
-<h2 id="orgca29cce">Why use self-signed certificates?</h2>
896 
-<div class="outline-text-2" id="text-orgca29cce">
895 
+<div id="outline-container-orge1d6a21" class="outline-2">
896 
+<h2 id="orge1d6a21">Why use self-signed certificates?</h2>
897 
+<div class="outline-text-2" id="text-orge1d6a21">
897 898 
 <p>
898 899 
 Almost everywhere on the web you will read that self-signed certificates are worthless. They bring up <i>scary-scary looking</i> browser warnings and gurus will advise you not to use them. Self-signed certificates are quite useful though. What the scary warnings mean - and it would be good if they explained this more clearly - is that you have an encrypted connection established but there is <i>no certainty about who that connection is with</i>. They probably will protect the content of your communications from passive bulk interception - such as the tapping of under-sea cables.
899 900 
 </p>
 
@@ -908,17 +909,17 @@ You might say, <i>"but surely LetsEncrypt is a single point of failure!"</i>, an
908 909 
 </div>
909 910 
 </div>
910 911
911 
-<div id="outline-container-org76a5af5" class="outline-2">
912 
-<h2 id="org76a5af5">Why not use the services of $company instead? They took the Seppuku pledge</h2>
913 
-<div class="outline-text-2" id="text-org76a5af5">
912 
+<div id="outline-container-org4b00e60" class="outline-2">
913 
+<h2 id="org4b00e60">Why not use the services of $company instead? They took the Seppuku pledge</h2>
914 
+<div class="outline-text-2" id="text-org4b00e60">
914 915 
 <p>
915 916 
 <a href="https://cryptostorm.org/viewtopic.php?f=63&amp;t=2954&amp;sid=7de2d1e699cfde2f574e6a7f6ea5a173">That pledge</a> is utterly worthless. Years ago people trusted Google in the same sort of way, because they promised not be be evil and because a lot of the engineers working for them seemed like honest types who were "<i>on our side</i>". Post-<a href="https://en.wikipedia.org/wiki/Nymwars">nymwars</a> and post-<a href="https://en.wikipedia.org/wiki/PRISM_(surveillance_program)">PRISM</a> we know exactly how much Google cared about the privacy and security of its users. But Google is only one particular example. In general don't trust pledges made by companies, even if the people running them seem really sincere.
916 917 
 </p>
917 918 
 </div>
918 919 
 </div>
919 
-<div id="outline-container-org7dcc476" class="outline-2">
920 
-<h2 id="org7dcc476">Why does my email keep getting rejected as spam by Gmail/etc?</h2>
921 
-<div class="outline-text-2" id="text-org7dcc476">
920 
+<div id="outline-container-org1208fbe" class="outline-2">
921 
+<h2 id="org1208fbe">Why does my email keep getting rejected as spam by Gmail/etc?</h2>
922 
+<div class="outline-text-2" id="text-org1208fbe">
922 923 
 <p>
923 924 
 Welcome to the world of email. Email is really the archetypal decentralized service, developed during the early days of the internet. In principle anyone can run an email server, and that's exactly what you're doing with Freedombone. Email is very useful, but it has a big problem, and that's that the protocols are totally insecure. That made it easy for spammers to do their thing, and in response highly elaborate spam filtering and blocking systems were developed. Chances are that your emails are being blocked in this way. Sometimes the blocking is so indisciminate that entire countries are excluded. What can you do about it? Unless you control the block list at the receiving end you may not be able to do much unless you can find an email proxy server which is trusted by the receiving server.
924 925 
 </p>