I think you bring up a fine point. Most applications have encryption built in and transparent to the user. While technical IT people in charge of infrastructure will not make this assumption, it is not unreasonable, at the same time, for small business / individual users, to not understand or know of this limitation.
replyVNC does not, for example, and you need to set up port forwarding through ssh. X2Go does....but I don't trust it terribly. So, RustDesk..what do you need to wrap it in? ssh?
I really want a better solution that VNC/X2Go..especially since I use hardware accelerated apps that need to use VGL to operate correctly (but underwhich operation is quite buggy).
Tailscale, or any encrypted mesh overlay is perfect for this. Infact I prefer it that way. Rustdesk can do what it does best at its core.
replyI disagree, modern software should make encrypted connections over something like HTTP3 or QUIC directly so true secure end to end connectivity works. This would make VPN software such as tailscale obsolete.
replyI'm also in favor of adding encrypted connections to RustDesk, not to replace tailscale, but as a part of this complete breakfast. Tailscale provides mutually authenticated, authorized L3 access. TLS can be configured to provide mutually authenticated L4 access. With a little OIDC/webauthn setup, both L3/L4 support device attestation, meaning there's no way to connect without e.g. a yubikey (or perhaps an enrolled TPM.)
replyagreed, zero-trust solution with proper endpoint security and PKI is superior to transport encryption and insecure protocols
replyYour statement is not entirely accurate. This only applies when using Direct IP Access on local networks, which is off by default. Their justification and invitation to PRs is the final comment [1] on the issue you linked. Why are you leaving this information out of your comment?
reply1 - https://github.com/rustdesk/rustdesk/issues/3714#issuecommen...
It may only apply to Direct IP Access, but isn't that what many would expect (not trusting middleman to be secure?)
replyI still think its an essential feature for self-hosting, but they seem to be open to PRs so what is the problem?
reply