All the rest seem to copy the terrible design of on demand code signing and that doesn’t work. If you get an EV certificate for instant SmartScreen reputation the key is on a HSM. If you get an OV certificate that is easier to automate with you need to build SmartScreen reputation which is brutal.
The RuskDesk project mentioned below was the most interesting to me. It’s a small executable and works pretty good. That’s enough to tell me that someone should be able to build a great product if they have instant support executables signed with an EV certificate.
What it comes down to though is that everyone needs their own code signing certificate or someone needs to run a matchmaking service. I’m sure you could build something that works well with Cloudflare Workers/KV by sending hashed (+salted) IDs to a matchmaking Worker. When a customer reads me the ID I know the secret and can tell the matchmaker “here’s the secret, please redirect the client to my self hosted server, relay, etc. at support.example.com.”
Also, Screego is another interesting project to check out.
A possible solution would be to distribute the client through something like the Windows Store on Windows, and a URL connection handler. The support-receiving website (or intranet support page) could work by opening a URL like remote-support://internal.domain.eu/listen from a web page and if that fails, link to the Windows Store and install directions instead. An unsigned, backup download of unsigned executables can be added to that download page if you so desire.
Theoretically, you could also set up some kind of DHT or TOR-like network where nodes can just find each other. You wouldn't want to send standard Bittorrent or TOR traffic without warning in corporate networks, of course, but the technology exists.
For businesses, the unsigned executable with config could just be distributed by the IT department with their own certificate or the necessary exemptions, and launch an autoconnect daemon, if necessary.
The _real_ challenge, I think, for building such a tool is that if it works well, scammers will use it and slander your product. Some might even patch out any warnings or alerts that you add to protect innocent people from scams. Scammers aren't intelligent enough to make their own RAT, but just one tech-savvy criminal could make loads of money with some slight modifications.
There's more nuance here which OP is alluding to. If you form a corporation and get an EV cert, you will not get a SmartScreen block, not even on your very first download. Immediate SmartScreen reputation is the point of getting an EV cert for this; Microsoft says this explicitly. If you get an OV cert (the only kind that an individual developer can get!), you will get blocked and will have to build reputation.
As an individual open source developer, I have an OV signing cert :( At least it shows my name on the SmartScreen prompt.
I’ve never done it myself but there was a posting here about 8 years ago about how Dropbox distributed their installer and I took a quick look at it: https://news.ycombinator.com/item?id=8204454
That's because it's not only a matter of software but also a matter of service (STUN is not enough, TURN is required in many situations. And someone has to pay for the servers and bandwidth...). If IPv6 had succeded instead of IPv4+NAT, maybe the situation would be different.
In terms of software, the open-source x2go (based on nomachine NX libraries and protocol, see https://wiki.x2go.org/doku.php) has been very efficient in my cases when bandwidth was limited and when I had no big NAT issues.
I agree that STUN/TURN servers are a necessity, but they're not _that_ expensive to self-host. You could stuff the STUN/TURN feature behind rate limits for the hosted version or put them behind a pay wall entirely so companies don't have to mess around with that stuff themselves.
It pairs well with Tactical RMM https://github.com/wh1te909/tacticalrmm
I'd really like to replicate this, even in a really simple CLI way but I haven't found all the right blocks to fit together. Naturally I don't have TeamViewer's account servers to rely on, and ideally I'd not use any centralised/third-party service at all (e.g. Zerotier or Tailscale).
My current idea is to make a GNUnet VPN and then use avahi to discover SSH or VNC servers, then I can use Remmina as a fancy GUI. This will probably be slow and difficult.
There are plenty of FOSS tools that do almost what I want, but none I've found quite gets there yet.
https://github.com/rustdesk/rustdesk-server/blob/master/id-r...
;) that's what an MVP is used for - prove key business assumptions.
as I see it, space is hardly the issue, nor build/engineering - as a species we are pretty apt at abstracting around them.
I've not had need to use VNC, remote desktop etc for years.
The rates for decent remote support software are terrible. For €150 per month, you can use three simultaneous connections across your entire organization, limited to a certain number of users who might possibly use the system. Teamviewer once offered lifetime licenses, but then they inserted ads for their subscription model into the lifetime customers to get even more money out of them.
The core idea is simple: a video stream from one computer to another, with mouse and keyboard controls sent the other way. Connection negotiation can be done Magic Wormhole style, via basic STUN, encryption can be done in a number of ways. Add some clipboard and P2P file transfer features and you've got most of Teamviewer/Anydesk/whatever implemented. There's VNC, but that's horribly outdated and the UX is absolutely terrible.
I think there's a business to be built here; open source remote support with a Gitlab-style self-hosted option companies can put down in their own networks, or have them pay you for management and servers.
This project is a good starting place, as any. With some tweaks you could probably build this into a end-user friendly system with your usual numeric code and random password. There's a business to be built in this space, I'm sure of it. I wish I had the expertise to take advantage of that.