VNC and RustDesk are both remote desktop solutions, however, Rustdesk is considerably more performant than the VNC family, because the latter primarily sends framebuffer updates, while the former can use modern video codecs and temporal compression to encode screen changes much more efficiently.
VNC is one way of doing remote GUI access (well, more a family of different protocols and products with different capabilities and tradeoffs). RustDesk is just another product that does the same thing but doesn't have a specific connection to VNC as a protocol so e.g. doesn't have to handle legacy authentication modes and stream formats. In my experience most remote access solutions beat VNC for performance, for example.
Well first there was TeamViewer which was VNC with more bells and whistles then it became enshittified. Then anydesk came along and ate up teamviewer then that became enshittified, Now we have rustdesk which seems to hopefully be a bit more immune to being enshittified.
If you already use VNC this is not something for you
I've noticed that RealVNC has hidden their formerly free VNC desktop client, now called RealVNC Classic Viewer, behind an enterprise subscription login, and replaced it with a different cloud first thing, RealVNC Connect Viewer, that requires a login to at least obtain, and is anemic in terms of features.
Not that RealVNC is VNC. However, enshittification has clearly taken another scalp.
I think you bring up a fine point. Most applications have encryption built in and transparent to the user. While technical IT people in charge of infrastructure will not make this assumption, it is not unreasonable, at the same time, for small business / individual users, to not understand or know of this limitation.
VNC does not, for example, and you need to set up port forwarding through ssh.
X2Go does....but I don't trust it terribly. So, RustDesk..what do you need to wrap it in? ssh?
I really want a better solution that VNC/X2Go..especially since I use hardware accelerated apps that need to use VGL to operate correctly (but underwhich operation is quite buggy).
Your statement is not entirely accurate. This only applies when using Direct IP Access on local networks, which is off by default. Their justification and invitation to PRs is the final comment [1] on the issue you linked. Why are you leaving this information out of your comment?
RustDesk works so much better and easier than vnc and other vendored solutions. No need to open ports, no need for vpn, it just works, no account BS, no vendor lock in BS.
I have used RustDesk for years, also run my own lookup/relay server so I do not need to rely on the public lookup server
While everything else gets enshitified RustDesk just keeps getting better
It's open-source, so just build it yourself with the tiny change. Something this trivial could be done with a 30 second prompt at this point, so there's not even an excuse of "too much effort".
I will note that the XKCD password scheme being proposed there is, in fact, completely insecure. A modern consumer GPU can crack "four random English words" in a day. You can argue that it's the user's choice to be allowed to use insecure passwords, but arguing that that scheme is actually secure is just wrong.
> A modern consumer GPU can crack "four random English words" in a day. [...] but arguing that that scheme is actually secure is just wrong.
Let me do just that!
This is a networked service. You send your password (or a hashed form) to it, and it validates it. You don't have the local hash to bruteforce it offline.
Even if we only consider the top 10k english words, it's 10000^4. It's going to take years to bruteforce this over a network because you'll go through so many rate-limits, cooldown periods, and outright bans that it's questionable whether it's even possible.
> This is a networked service. You send your password (or a hashed form) to it
Hopefully neither. But given everybody involved in VNC seems to be the same batch of clueless morons who built all those PHP web forums twenty years ago with MD5 as the password hash, who knows what they cobbled together. Maybe an expert can chime in about what actually happens here?
Virtually any password other than "password123" is fine if you're rate limited to a few guesses per day by a networked service. Passwords should be secure against the inevitable data breach when the service you're using loses their hashed password database, which happens on a routine basis.
The "joy of the XKCD technique" is that it prescribes a specific format millions of people will use, and it's so trivial to break that you can throw in similar variations of it into your cracking algorithm at virtually no cost.
If you were willing to use a bespoke, more secure variation of it, you could include a capital letter and a number rather than filing an issue on a repo insisting that you be allowed to use exactly the insecure variation.
I think you are both greatly overestimating the number of people who remember what xkcd is and their willingness to do what a webcomic prescribes uncritically. What you describe as "bespoke" is likely the normal way someone might use it: with their chosen format.
For instance, I have multiple separator characters, multiple beginning and end characters, and numbers places at specific places, and arbitrary casing. That may be overkill but it's still essentially the xkcd format.
> I think you are both greatly overestimating the number of people who remember what xkcd is and their willingness to do what a webcomic prescribes uncritically
XKCD's youtube videos get millions of views each. It is a very popular comic, and that particular password advice has spread beyond it.
> What you describe as "bespoke" is likely the normal way someone might use it.
And yet the issue in question is about someone who refuses to adapt it.
The user in question might have their own personal format that doesn't meet the RustDesk constraints. E.g. they may not use capitals, but use `word1$word2&word3@word4`.
Tayloring your format to the requirements of each site is a step towards defeating the utility of the system; now the user needs to remember some arbitrary hard-to-remember details for each password.
Although having a standard format for your passphrases across sites removes some of the advantages over just using the exact xkdc format (when one of your passwords is compromised and attackers can guess your custom format elsewhere now)...
so this means I can be on a vacation, turn on my ubuntu desktop remotely, login and control it ? I have a strong need for this as my desktop is also a server
Menu css looks a bit dodgy with the notification at the top:
https://files.catbox.moe/d5ztxi.jpg
How does this work on a technical level?
Does it framebuffer grab the current session and inject input events?
Yea I need to know this before I even consider something like this. I'm guessing it's a daemon that runs as root in the background.
Funny that the video in the blog post still needs X. I will see myself out....
What is rustdesk and how is it distinct from vnc?
Edit: i appreciate the explanations; thank you.
VNC and RustDesk are both remote desktop solutions, however, Rustdesk is considerably more performant than the VNC family, because the latter primarily sends framebuffer updates, while the former can use modern video codecs and temporal compression to encode screen changes much more efficiently.
VNC is one way of doing remote GUI access (well, more a family of different protocols and products with different capabilities and tradeoffs). RustDesk is just another product that does the same thing but doesn't have a specific connection to VNC as a protocol so e.g. doesn't have to handle legacy authentication modes and stream formats. In my experience most remote access solutions beat VNC for performance, for example.
Well first there was TeamViewer which was VNC with more bells and whistles then it became enshittified. Then anydesk came along and ate up teamviewer then that became enshittified, Now we have rustdesk which seems to hopefully be a bit more immune to being enshittified.
If you already use VNC this is not something for you
I've noticed that RealVNC has hidden their formerly free VNC desktop client, now called RealVNC Classic Viewer, behind an enterprise subscription login, and replaced it with a different cloud first thing, RealVNC Connect Viewer, that requires a login to at least obtain, and is anemic in terms of features.
Not that RealVNC is VNC. However, enshittification has clearly taken another scalp.
RustDesk still does not support encrypted connections when self hosting: https://github.com/rustdesk/rustdesk/issues/3714
I think you bring up a fine point. Most applications have encryption built in and transparent to the user. While technical IT people in charge of infrastructure will not make this assumption, it is not unreasonable, at the same time, for small business / individual users, to not understand or know of this limitation.
VNC does not, for example, and you need to set up port forwarding through ssh. X2Go does....but I don't trust it terribly. So, RustDesk..what do you need to wrap it in? ssh?
I really want a better solution that VNC/X2Go..especially since I use hardware accelerated apps that need to use VGL to operate correctly (but underwhich operation is quite buggy).
Tailscale, or any encrypted mesh overlay is perfect for this. Infact I prefer it that way. Rustdesk can do what it does best at its core.
Your statement is not entirely accurate. This only applies when using Direct IP Access on local networks, which is off by default. Their justification and invitation to PRs is the final comment [1] on the issue you linked. Why are you leaving this information out of your comment?
1 - https://github.com/rustdesk/rustdesk/issues/3714#issuecommen...
It may only apply to Direct IP Access, but isn't that what many would expect (not trusting middleman to be secure?)
RustDesk works so much better and easier than vnc and other vendored solutions. No need to open ports, no need for vpn, it just works, no account BS, no vendor lock in BS.
I have used RustDesk for years, also run my own lookup/relay server so I do not need to rely on the public lookup server
While everything else gets enshitified RustDesk just keeps getting better
Without self-hosting, how can I be sure that the middleman server layer won't affect my security?
Definitely a lifesaver for tech support!
And the fact it's self-hosted is priceless.
Does my screen have to be on?
RustDesk should fix their password requirements: https://github.com/rustdesk/rustdesk/discussions/2888
It's open-source, so just build it yourself with the tiny change. Something this trivial could be done with a 30 second prompt at this point, so there's not even an excuse of "too much effort".
I will note that the XKCD password scheme being proposed there is, in fact, completely insecure. A modern consumer GPU can crack "four random English words" in a day. You can argue that it's the user's choice to be allowed to use insecure passwords, but arguing that that scheme is actually secure is just wrong.
> A modern consumer GPU can crack "four random English words" in a day. [...] but arguing that that scheme is actually secure is just wrong.
Let me do just that!
This is a networked service. You send your password (or a hashed form) to it, and it validates it. You don't have the local hash to bruteforce it offline.
Even if we only consider the top 10k english words, it's 10000^4. It's going to take years to bruteforce this over a network because you'll go through so many rate-limits, cooldown periods, and outright bans that it's questionable whether it's even possible.
> This is a networked service. You send your password (or a hashed form) to it
Hopefully neither. But given everybody involved in VNC seems to be the same batch of clueless morons who built all those PHP web forums twenty years ago with MD5 as the password hash, who knows what they cobbled together. Maybe an expert can chime in about what actually happens here?
Yes, for a sensible scheme this can't work.
Virtually any password other than "password123" is fine if you're rate limited to a few guesses per day by a networked service. Passwords should be secure against the inevitable data breach when the service you're using loses their hashed password database, which happens on a routine basis.
Seems like the only real issue here is that rustdesk uses SHA256 instead of argon2.
> A modern consumer GPU can crack "four random English words" in a day.
Sure, if you can rely on users using a specific format. The joy of the xkcd technique is you don't need to tell other people what yours is.
But, people just aren't going to remember strings of gibberish. Expecting users to do this is just silly.
The "joy of the XKCD technique" is that it prescribes a specific format millions of people will use, and it's so trivial to break that you can throw in similar variations of it into your cracking algorithm at virtually no cost.
If you were willing to use a bespoke, more secure variation of it, you could include a capital letter and a number rather than filing an issue on a repo insisting that you be allowed to use exactly the insecure variation.
I think you are both greatly overestimating the number of people who remember what xkcd is and their willingness to do what a webcomic prescribes uncritically. What you describe as "bespoke" is likely the normal way someone might use it: with their chosen format.
For instance, I have multiple separator characters, multiple beginning and end characters, and numbers places at specific places, and arbitrary casing. That may be overkill but it's still essentially the xkcd format.
> I think you are both greatly overestimating the number of people who remember what xkcd is and their willingness to do what a webcomic prescribes uncritically
XKCD's youtube videos get millions of views each. It is a very popular comic, and that particular password advice has spread beyond it.
> What you describe as "bespoke" is likely the normal way someone might use it.
And yet the issue in question is about someone who refuses to adapt it.
The user in question might have their own personal format that doesn't meet the RustDesk constraints. E.g. they may not use capitals, but use `word1$word2&word3@word4`.
Tayloring your format to the requirements of each site is a step towards defeating the utility of the system; now the user needs to remember some arbitrary hard-to-remember details for each password.
Although having a standard format for your passphrases across sites removes some of the advantages over just using the exact xkdc format (when one of your passwords is compromised and attackers can guess your custom format elsewhere now)...
This is a non-issue with a password manager
> And yet the issue in question is about someone who refuses to adapt it.
Does this person exist?
Okay. The feature I'm waiting for is the self-hosted web client.
so this means I can be on a vacation, turn on my ubuntu desktop remotely, login and control it ? I have a strong need for this as my desktop is also a server
For a remote Linux system you can also do a lot over plain SSH as well.
You can already do this with VNC or Xpra (the latter is a screen/tmux for graphical applications).