RustDesk – Remote desktop software, written in Rust
github.com
github.com
That happens to most ecosystems that go through a "hype cycle" just like Rust is right now. So many Go projects have something "Go" in them, same with JavaScript, Ruby and all the others who've walked the path.
https://hn.algolia.com/?dateRange=all&page=0&prefix=false&qu...
And in this specific case, a rusty desk is probably not what most people want, so if you want any non-programmers to use it... it's not the best name.
These bugs are obviously particularly bad because of the security implications, but even for applications where you don't care about security having the app randomly segfault is no fun. All else being equal, I would choose an application written in Rust over C/C++.
That said, obviously the name of this project is just because the author likes Rust a lot. It happens in other languages too ("go" in Go projects, "py" in Python projects, etc).
One impressive data point (for me) is this: https://youtu.be/GtRo-eF8-TE?t=671
That part?
If I see something built for massive concurrency and I see Erlang or Elixir, I'm immediately much more confident in the tooling.
If I see something written in Rust, I'm confident in it's memory safety at a minimum but it usually bodes well for quality code in general.
Built in Rust does not assess of good code quality at all, it just tells you that you will most likely not have a class of bugs or issues, but the code itself can be very ugly.
As a matter of fact given that Rust is "young" most people don't have a lot of knowledge and will most likely copy paterns from other languages, especially when fighting with the borrow checker.
Just open some random Rust code, open the lib.rs and see how things are organized in there, you will be very surprised.
I'm mostly basing that on what I've read about Rust both here and in various other communities about the guarantees provided by the compiler/runtime itself. I haven't even dabbled in it yet myself, but I plan to at some point.
Besides the first-order effects of choice of language on program behavior (e.g. presence of type errors, memory errors, etc.) it also has a second-order filtering effect on the type of people writing programs and their mindset. There are certain languages without a strong first-order effect that nonetheless have a very strong second-order effect.
Now there are other issues other than popularity (like you can expect anything written in JavaScript/Python/Java to have a higher probability of a bloated mess, not only because they're popular...).
"X but in Rust" IME almost always implies something with at best feature parity, but also debloated code
- Rust is a complicated language, so novice developers probably use something else.
- Its ownership/borrowing system makes sure that architecture is not an afterthought (unless you pollute your code with countless smart pointers).
- You get memory safety in safe Rust code and don't need a garbage collector.
- Non-optimal solutions usually are visible/more cumbersome to write.
In the end it's up to the individual developer, but Rust really helps to produce high-quality code.
How's that? The difference between a suboptimal and an optimal solution can be perfectly valid normal code for lots of procedures. It's not something that's knowable without semantic meaning of what the code's trying to do.
- Rust forces you to deal with errors and "null" values (Option). If you just unwrap them, it's visible.
- Rust requires systems with clear ownership. You can opt out with various smart pointers, it's visible.
- Rust requires you to use Box for heap allocations, it's visible.
Note: I'm not talking about optimal solutions in the sense of "best algorithm", more in the sense of "well thought out and without lazy shortcuts".
While I get that languages can eliminate a type of problem, they don't eliminate badly written software. Most of the time, the software development process itself, is more important, if you really want to examine what it means to build secure/safe software.
Having a team dedicated to developing software safely and using a language with stronger type safety guarantees vs. having a person just build something with the same language, does not magically imbue the end product with good qualities.
Take your example, if you don't have a good foundation in distributed systems, and try to build a distributed system in Erlang, you will only get so far, before you hit your head against the wall so hard, you start studying distributed systems instead.
If you ask people explicitly about whether Rust just makes better products, they might say that they have doubts, or give a vague answer. But asking like this is just a leading question, and therefore the process itself of asking the question, will probably cast doubt over some automatic assumptions about what the type safetly of Rust really does for the end product.
But the reality is, "Made with Rust" is starting to look like a certificate/claim of validity, and its definitely not, just like any other language isn't either.
Language adoption isn't just about technical merits (although those have to be there). The ecosystem, tooling, core team, learning resources, and overall community have to be there, too.
To your point - if I want to get started in another language that is 1) statically compiled, 2) non-garbage collected, and 3) memory-safe by design, as far as I can tell my only other mainstream options are Swift / Objective-C, Ada / SPARK, and Nim. I don't see nearly as much activity in those language's open source ecosystems, and "basic" libraries might not even exist due to the small communities.
Care should be taken to not be in so much of a bubble, to not realize that other languages have viable solutions too or are developing alternatives to what's presently available. If our choice for one or the other, is more a matter of personal preference, it would arguably be better to acknowledge such.
This is the second time I've seen someone say this in the last week or so, but I've never seen this claim in the wild, and certainly not by Rust's core team or organization. It's also not a secret that Rust's memory management is heavily influenced by Cyclone. Can you show an example of someone making this claim?
Are you missing a negation here? I might be missing the intended tone perhaps?
- written in go: 1331 results
- written in rust: 1043 results
- written in python: 763 results
- written in javascript: 525 results
Not intended to be scientific and there are false positives but you get my point. Personally I appreciate not having to visit the repository to find out. A tool being written in a language I know and enjoy is a benefit.
Sincere question: why? I 100% agree about libraries, but why does the implementation language of an application matter to you?
- dwm as window manager
- neomutt for email
- newsboat for feeds
- notifications with inotifywait/watch and notify-send
- vim keybindings EVERYWHERE
Because of this the I've become very reliant on the ability to tweak and customize the tools I use. I know I'm a minority but I'm so deep down the rabbit hole I can never go back.
I don't know a thing about Ruby and for awhile really felt out of it when stuff was being written in it a lot more.
"written|built in Rust" 832 (790|42)
"written|built in Go" 809 (792|17)
"written|built in Python": 390 (364|26)
"written|built in Javascript/JS" 269 (220|14) / (32|3)
"written|built in Java" 107 (101|6)
"written|built in TypeScript" 66 (61|5)
"written|built in C#" 41 (38|3)
"written|built in Stone" 10 (10|0)
edited to include both "written in" and "built in". "written|built in Go/Golang" 918 (792|17) / (102|7)
"written|built in Rust" 832 (790|42)
"written|built in Python": 390 (364|26)
"written|built in Javascript/JS" 269 (220|14) / (32|3)
"written|built in Java" 107 (101|6)
"written|built in TypeScript" 66 (61|5)
"written|built in C#" 41 (38|3)
"written|built in Stone" 10 (10|0)
One other item I noticed is on average "written in Rust" has about 3 times the number of comments as "written in Go/Golang" for the more popular posts. Clearly, Rust gets a major award too.A project being written in rust communicates to me that if I ever wanted to join the community and start submitting patches, I could. I have little interest in devoting the next 10-15 years "mastering" c++ but I'm happy to dig into rust.
Then there was "in Go". Mid 10s.
And now it's Rust. 20s.
People used Java, but mostly for GUI apps. Not command line tools.
Aside from that though - there's a lot of comments on rust threads in general about how Rust isn't ready for this or that or the next thing, so these types of projects showcase that maybe the "not ready" info is outdated or over-exaggerated.
It's also one of those things that seems to occur "naturally" as a language becomes more widely adopted. A few years ago there were tons of projects linked here about "x - a tool for y written in go". And before that ruby or python, etc.
Because it's an accomplishment to ship anything of complexity in Rust! /s
Maybe you can look at it as "wow, it's an entire application with no unsafe code and really good (perfect?) memory safety"?
On the other hand when I see built with Rust I have high confidence it’s going to be fast, bloat free, easy to install binary and not some slow website packaged in electron made to look/feel like an app or some NodeJs app with 1000s of random dependencies.
not to criticize your answer, i just have not found any viable alternative that is free to use for all use cases.
Sadly there is no other FOSS out there that combines remote support with good NAT traversal. Existing remote access tools such e.g. VNC all do not offer NAT traversal and are incredibly hard to setup. All FOSS web/phone conference tools offering screen sharing refuse to implement transferring Cursor/Keyboard control. Probably because it is not so easy, but mostly, I guess, out if fear for diffuse security problems.
Too bad people then will be compelled to use this absolute mess...
The tool itself is open core: https://github.com/gravitational/teleport
Most of the desktop access stuff is open source. (The only desktop related thing that's proprietary is our tool that allows for access to machines not connected to Active Directory). A sizeable chunk of the desktop access code is even Written In Rust™: https://github.com/gravitational/teleport/tree/master/lib/sr...!
Do you have any links to issues/interactions you find concerning? I've been evaluating different remote desktop tools recently and I'd certainly like to know about any other red flags.
Furthermore they seem to share servers with what seems like an unrelated ecommerce website: https://github.com/rustdesk/rustdesk/issues/2712
It doesn't seem like they take security all that seriously.
Makes changes to system
https://github.com/rustdesk/rustdesk/blob/1.1.9/src/platform...
I prefer meshcentral myself
Plenty of reddit threads to on issues with relay servers (china) etc. Boils down to i just dont trust it anymore
But even more interestingly so, the modification is performed with elevated privileges, via `pkexec` command.
Yikes.
I currently use RealVNC and Steam's own VNC thing to connect to a desktop computer in the same city as where I'm connecting from. RealVNC is much laggier than Steam, which seems optimized for latency. The ping latency is something around 10-15ms (at peak hours, otherwise less), but somehow RealVNC manage to still be kind of laggy, at least compared to whatever Steam is doing.
The use case is doing game development (in Unreal Engine) via a shitty laptop, connected to a proper desktop computer.
So how would RustDesk compare to RealVNC/Steam here?
Big thanks to you!
TeamViewer is (both technically and commercially) awful, and getting rid of it is always priority #1 when taking on a new environment. You always run into fun stuff like 'oh, yeah, this 4-years obsolete version is running on our main accounting server all the time, as that's the only thing the vendor supports, and they need to be able to get in at all times'... 'yes, indeed, using only a 4-digit PIN, why do you ask?'...
Being able to supply your own RustDesk rendezvous/relay server is especially interesting to me, as features like proper SSO-linked 2FA, a log of who accessed what from where (hopefully including file transfers), and alerts on large data flows becom a lot easier to implement that way.
I can't wait though for the day the place I work for decides to drop support for them and stops paying for that... thing as it's not only extremely expensive and awful from a security perspective but also from a general quality one: some days their server just decides to not log you in, they have a nasty crashing bug that often happens when you resize your meeting window that has been there literally for years, among other things.
No idea if I did something worng, but it's unusable for me in the current state.
Anyhow, I'm still very intrested in a working version of this.
Did you guys had better luck than me?
Its been flawless on Linux, Mac and Windows for us, so I'm not sure why all the complaints of lag?
I'm using dwservice now, but still on a lookout for a self hosted solution.
But the back door is written in Rust, so it's a secure, well-built backdoor, a backdoor you can trust.
What were your dislikes with it? Thanks.
this is the most active and impressive collaborative community of developers who are VERY VERY responsive to all questions and are helpful in improving the software.
how many of those posters have created issues on github regarding these things?
phoning home?
security issues?
poor code quality?
edit: would you be comfortable with google analytics in exchange of "phoning home to china"?