2 ms·

Take a look into the source. I've only cast a vague eye so far but it looks like it reuses quite a lot of well regarded stuff including VNC, so I'll take issue

Take a look into the source. I've only cast a vague eye so far but it looks like it reuses quite a lot of well regarded stuff including VNC, so I'll take issue with "shady and sketchy". If you skim read that thread from HN where I also learned about Rust Desk then there is no consensus about "sketchy". Searching for the word "security" gets a discussion about SSL/TLS and some pontificating. I'm no real expert on IT security but I do have a Nessus license and a box to wield it from. I've run quite a few firewalls from Fortinet, pfSense, Juniper, hand crafted Linux, <various others>. I have 15 VLANs at home 8) In my office I have a pair of Dell S funky devops switches worth around £20,000 sat on the bench as I plough through the 2000 page manual. I've got over the lack of old school stacking (why do they still have a stack LED indicator?) They have a LACP mediated VLT domain link running at 200Gbs-1 (Gb/s) - two physical wires. Now, do I partition the 100Gb links into four lots of 25Gb because that will allow more flows. Ok let's look at how this thing is used: iSCSI for data and VMware. The iSCSI links are 10Gb to the M series SAN so more links seem indicated. I also learned Ansible on Thursday rather rapidly because I can deploy these beasts with it (they boot Debian and have Docker installed already, which is adorable!) and coincidentally, I need a non MS way of getting at Windows boxes from Linux. Ansible doesn't need a client app. It's getting busy in IT. I'm 52 FFS (and absolutely love it!)

metadat 4y ago
The Rust Desk security concern is due to it's not 100% self-hosted, it uses some kind of TURN or fw hole puncher which they host and didn't provide the sources for. If I'm mistaken please tell me, would love to use it if it's "safe".
- gerdesj 4y ago
  I've got a self hosted host in my office. When you deploy a client, you can rename the Windows exe to include the DNS name and public key of your host and it will then use them - clever idea. So I don't think you need their TURN/STUN. I suspect those are simply provided as a service and nothing more sinister. They also provide three or so really low spec jump boxes to get people up and running if they can't self host - again, I call that altruism not sinister. I will get Wireshark out anyway to check about this stuff next week. You can do your own real due-dil stuff yourself by browsing around this: https://github.com/rustdesk/rustdesk https://github.com/rustdesk/rustdesk - read the issues, browse the source (read the comments!) get a feel for the software. I'm asserting that it is no worse than anything else. I can also assert that the binaries that I get on Arch Linux are probably from the official sources (I checked a few strings etc). I can't sign off the Windows binaries but I can assert that I do trust them from their GitHub repo. I can assert things until I'm blue in the face but I trust rustdesk more than most remote access facilities for now but I am still kicking the tyres.

metadat 4y ago

The Rust Desk security concern is due to it's not 100% self-hosted, it uses some kind of TURN or fw hole puncher which they host and didn't provide the sources for. If I'm mistaken please tell me, would love to use it if it's "safe".

gerdesj 4y ago
I've got a self hosted host in my office. When you deploy a client, you can rename the Windows exe to include the DNS name and public key of your host and it will then use them - clever idea. So I don't think you need their TURN/STUN. I suspect those are simply provided as a service and nothing more sinister. They also provide three or so really low spec jump boxes to get people up and running if they can't self host - again, I call that altruism not sinister. I will get Wireshark out anyway to check about this stuff next week. You can do your own real due-dil stuff yourself by browsing around this: https://github.com/rustdesk/rustdesk https://github.com/rustdesk/rustdesk - read the issues, browse the source (read the comments!) get a feel for the software. I'm asserting that it is no worse than anything else. I can also assert that the binaries that I get on Arch Linux are probably from the official sources (I checked a few strings etc). I can't sign off the Windows binaries but I can assert that I do trust them from their GitHub repo. I can assert things until I'm blue in the face but I trust rustdesk more than most remote access facilities for now but I am still kicking the tyres.