I spent a week using Tails as my only operating system

published: 2023-04-01

Please don't post links to my blog posts on social media or forums. I want to keep this website low-traffic and lowkey, and artificial publicity has historically attracted large swaths of men contacting me in bad faith. Ovarit is the only exception as long as y'all can tone down the ableism for five minutes. (Rest in peace, ThePinkPill.) Thank you for respecting my boundaries.

Introduction

I think the hard drive in my computer is starting to die. Programs take several minutes to load on first use where once they popped up almost instantly. It's a bit shameful when my decked-out Thinkpad T510 with the maximum RAM is slower than the netbook I "stole" from my grandmother several years ago with only a fraction of the RAM and a CPU with half the GHz. But apparently the average lifespan of a hard drive is about three to five years, and I salvaged this hard drive from a computer I got in 2017, so six years is a pretty good run for a consumer-grade hard drive that's seen lots of distrohopping and data hoarding.

So I went looking for a live Linux distro I could throw on a flash drive and camp out on until my first paycheck (or tax return, or holiday present) came. My first thought was Kodachi, since I knew it would come with Tor and I2P already installed. But then I saw a recent review on DistroWatch that scared me away:

I admit I was until recently a fan of this distro, but testing out what some other reviewers said, finding criticism well-founded, plus discovering some new information about how internet and vpn use is regulated in the developer's nation, I can no longer say this is at all a distro for casual web and app users' privacy or security.

Indeed, there is GUFW, but it is out of the box disabled, with no warnings from the developer; though one unchecks "Enable ipv6" in Dashboard, then and after restarts every time one's ipv6 address is always visible to the web despite ipv4 becoming obfuscated as promised; gnunet and i2p are outdated modules, and it's not easy for casual users to know or update them; on first boot, per a 2020 Youtube Russian OSINT video at his channel, the developer states the OS writes to json your IP so he can check it for blacklisting...if you're blacklisted, you won't be able to ever connect to Kodachi vpn.

At first boot, regardless of IP blacklisting or not, the OS further does an HWID hash of your device and sends it to the developer so he can ban you from Kodachi vpn (and perhaps further download of the OS); no contest with banning spammers, torrent abusers, and the like. But one has to realize that this OS and developer are in Oman and check laws there.

Since 2010, vpn use has been heavily restricted in Oman; literally one has to have a business to apply for vpn use, and even then such business will be required to get and keep information on user identities and usage, required to forward same to the Telecommunications Regulatory Service; it's not just spam/crime that's banned and actionable in Oman, but if you criticize faith or the Royal family, or view sexually explicit material of any kind, or are the whistleblower type, or are an activist, likely you at least need to be watched if outside Oman. In any case, minimally, at first boot your HWID, IP and location are very likely going to be sent to cyber at trs dot gov dot om as TRS requires of all business licensees. Given the solid relationship Oman has with the US and UK governments, decide for yourself if you'd be comfortable with Oman watching your online moves.

To me it seems intended or not, Kodachi OS is more in the nature of a honeypot, rather than oasis from, online surveillance; in the quest toward better privacy I'd suggest an OS such as Qubes or Whonix if your device can handle virtualization; if not, some like ParrotOS home edition have AnonSurf via Tor, a network manager with pre-configured openvpn you can easily enter your own free or paid vpn credentials into, plus it runs easily even on Pentium III dual cores.

rlxos caught my eye, thinking that maybe what I needed was not a live USB but instead an immutable distro to reduce disk writes. But the strange grammar errors throughout the homepage and documentation put me off. I had a long list of phrases I found particularly egregious, but in the two months since first drafting this post and publishing it, they seem to have all been fixed. Maybe rlxos will be suitable for usage one day. Just not today. Until then, enjoy this... walkthrough. Truly the fastest tutorial in my life.

Going back to my search for a live distro, I next focused on Parrot, particularly Home Edition as I didn't need all the pentesting tools found in Security Edition. Parrot, from the descriptions on the download page, looked like what Kodachi used to back in its heyday: a quick way to conceal all network traffic (albeit with Tor instead of Kodachi's built-in VPN), lots of "normal people" desktop applications like GIMP and LibreOffice built into the live image, support for whatever full-disk encryption I wanted to use... But then I attempted to follow both the official instructions and a post in the community forums for enabling encrypted persistence, because I figured, if it was an option, I'd like to not have to rebuild all my configuration files on reboot. Neither sets of instructions worked. Plus I don't like the concept of downloading random binary blobs from GitHub repos.

I eventually dusted off my old Tails drive, knowing that it had a working persistence feature... and discovered that Tails version 5.8 had major issues with persistence, meaning that I had to backup, wipe, and then recreate my entire Tails drive. Yeah, no problem, computer, just let me re-copy my entire Wii ISO collection... I totally have five hours to burn...

(Side rant: for the love of fuck, stop stylizing the name of the distro as "TAILS". I can smell a wannabe hackerman LARPer from a mile away when he (the LARPers on privacy subreddits are always men from what I've observed) goes into r/onions or r/tor and tells someone to "install" "TAILS" so that they can go buy drugs. Yes, I know, it was historically an acronym for "The Amnesic Incognito Live System". But you know what? You go onto the distro's official website, and the name of the distro is stylized in normal case as "Tails". You look at the documentation, and it's referred to as "Tails". You go to the Git repo and scroll down to the README, and it's "Tails". You BOOT UP THE DAMN THING and get to the desktop and open "About", and it calls itself "Tails". For a website that cares so much about "deadnaming", you'd think Redditors would be more careful about making sure they were using the right name for their tools. Maybe I expect too much from social media users...)

After I got all my files back on my Tails drive where I wanted them, I then made it my mission to spend at least a week using Tails as my only operating system. Everything I did, from darknet exploration to website publishing to even just watching weird men review shitty NFT play-to-earn games, had to be done in Tails. However, there's no rule saying I couldn't tweak some of Tails' system settings...

Results

Tails has built-in support for unlocking and mounting VeraCrypt drives, which is fortunate because I wasn't able to make an AppImage of VeraCrypt work properly in time for this experiment. Unison doesn't play nicely with Tails' Dotfiles feature, though, repeatedly complaining that its archive files (needed to make future runs of Unison faster) were out-of-date or offering to delete large swaths of the files on either my sneakernet drive or my Tails drive. If I pass the -ignorearchives option to Unison when running it, this problem goes away, but then I need to wait for Unison to calculate hashes for every file I want to sync. Since my sneakernet drive is about thirty-two gigabytes and almost full, this means almost an hour of waiting on each sync run. I've got better things to do with my time, so I opted to only sync the two once a week instead of before turning off my computer each day.

Most programs can be jerryrigged to run on Tails with persistence by prepending the HOME variable to the command used to run them, forcing them to believe that the home directory lives somewhere else. For example, to force RetroArch to save my configurations, I open a terminal and run:

HOME=/home/amnesia/Persistent/sneakernet/fakehome/retroarch/ retroarch

If a program has a configuration file that you don't see yourself editing often, if ever, you can also enable Dotfiles in the Persistent Storage settings and then copy that config file to /live/persistence/TailsData_unlocked/dotfiles/. The config file will then be symlinked into your home directory on next boot and every boot after that. This is how I got Zim to remember the paths to my three dream journals.

I didn't expect piracy to go well anyway, since Tor isn't designed for torrenting and it wouldn't make sense to try to configure a VPN. The deemix AppImage, needed for ripping music from the streaming service Deezer's servers, hung and didn't load. Originally, I thought this was because Tails wasn't letting it bind to localhost port 6595, so I punched a hole in iptables. It loaded then, but I couldn't find an option in the settings to set a proxy, so I closed it and started it again with torsocks ./deemix-new.appimage. At least, that was my intention; a window never popped up, and the program didn't output any debugging info to stderr or stdout, so I can only assume it hung again.

Unlike deemix, the personal booru (image collection) software Hydrus has the option to set a SOCKS5 proxy (socks5://127.0.0.1:9050) to be able to talk to the Internet, so I didn't have to fiddle with torsocks to get a usable connection. Note that you'll get an IP of a known Tor exit node, so some websites will rate-limit or even block your connection. Even then, drag-and-drop from Tor Browser didn't work, so I had to manually copy the link for whatever page I was trying to rip images from and then paste it into the URL box on Hydrus' download screen. Very frustrating.

In the past, I've been able to get Syncthing working on Tails. While I no longer have the tutorial in my files to reference, it involved passing a command-line flag to tell Syncthing where to put its configuration files, also passing it an environment variable to tell it to use the Tor SOCKS5 proxy, punching a hole in iptables to allow the Syncthing web UI to bind to localhost port 8384, and then telling Tor Browser to not attempt to proxy connections to localhost. However, I am no longer able to find that specific option in Tor Browser, neither in the proxy settings nor in about:config, so unless you like manually editing XML files or finagling with syncthing-gtk, you're out of luck.

As a replacement for Syncthing, I used bsync instead to manually sync file changes to my server:

python3 ~/bsync.py -v -i -p 4445 -o "-i ~/.ssh/contabo" /home/amnesia/Persistent/Notebox lethe@letsdecentralize.org:/home/lethe/Sync/Notebox

jSite works if you have Freenet running on a remote server, but you need to do some wrestling with iptables first in a root terminal:

apt install default-jre -y
iptables -I INPUT -p tcp -m tcp --dport 9481 -j ACCEPT
iptables -I OUTPUT -p tcp -m tcp --dport 9481 -j ACCEPT

Then SSH to your remote server (in a normal terminal, not a root one) and port forward 9481 to localhost:

ssh username@your.server -L 9481:127.0.0.1:9481

Then you can run jSite:

java -jar ~/Persistent/sneakernet/Apps/jSite.jar

Similarly, if you need to upload a single file or just browse Freenet itself and don't feel like using a TUI browser on the remote server:

sudo iptables -I INPUT -p tcp -m tcp --dport 8888 -j ACCEPT
sudo iptables -I OUTPUT -p tcp -m tcp --dport 8888 -j ACCEPT
ssh username@your.server -L 8888:127.0.0.1:8888

Because I can't find the option in Tor Browser to allow connections to localhost anymore, I instead had to use an AppImage of Firefox I had lying around in order to open the Freenet web UI:

~/Persistent/sneakernet/Apps/Firefox_Developer_Edition-110.0b4.glibc2.17-x86_64.AppImage --profile /home/amnesia/Persistent/sneakernet/fakehome/firefox/

(In retrospect, I could have used this browser to configure Syncthing too... oh well.)

As far as programming goes, I can't build anything written in Golang that requires modules, because Google's Golang proxy servers don't like Tor users:

go: github.com/a-h/gemini@v0.0.44: Get "https://proxy.golang.org/github.com/a-h/gemini/@v/v0.0.44.mod": dial tcp 142.250.186.177:443: connect: connection refused

Running the build command as GOPROXY=direct torsocks go build didn't help:

go: golang.org/x/text@v0.3.3: unrecognized import path "golang.org/x/text": https fetch: Get "https://golang.org/x/text?go-get=1": dial tcp 142.250.186.113:443: connect: connection refused

As demonstrated by bsync above, Python works just fine, but good luck installing anything from pip. If you install build-essential, you can also build C/C++ projects as long as their dependencies are in the default Debian repositories and you have Additional Software enabled in Tails' Persistent Storage settings.

Conclusion

My biggest problem during this week was the lack of I2P support. In order to check I2P eepsite uptimes for Let's Decentralize, I had to SSH into my personal server and run a text-based browser to go to every eepsite. This wouldn't have been much of a problem except that someone's spent the last few months DDoSing my server, making all network connections in and out glacially slow. One of these days I'll move my sorry ass back to Vultr. I've been spending three dollars a month there to reserve my old IPv4 address, anyway. Home sweet home, 8.9.30.45. Just wait until that damn paycheck comes, okay?

Other than I2P and the slow Unison syncs, everything in Tails worked surprisingly fine. I found myself mounting my computer's internal hard drive to retrieve some file far less than expected, and when I did, files loaded much faster because the rest of the operating system wasn't also writing every log file to the disk at the same time. Things would have gone a lot worse if I hadn't had the server to piggyback everything off of, though. I can't imagine trying to run Freenet or IPFS directly on Tails, or creating virtual machines, or wrangling a large music server with all the uploading and downloading that entails. Tails certainly excels at helping me in my goal of reducing screen time, because there simply isn't as much that I can do.