mirror of
https://github.com/UNITRONIX/BetterDesk.git
synced 2026-09-10 01:27:11 +00:00
UNITRONIX
26038176eb
Introduce the independent Rust + Flutter desktop client with CDAP/RustDesk session support, packaging via build.py, and tag-triggered Windows/Linux release artifacts. Align server CDAP desktop interop (view_only, desktop_end, capabilities), protocol docs, pre-release checklist, version bump rules, and WAN allowlist for /api/health and /api/server/pubkey. Thanks: INSOLVE (Honorary); Marco Jakobs (@jacotec); MyNameisStitch (@MyNameisStitch); Redspin (@playerumpknow)
2.1 KiB
2.1 KiB
BetterDesk Desktop security model
Trust assumptions
- The configured server URL and public key are untrusted until validated.
- A remote peer is untrusted until its identity and server-signed key chain are verified.
- The web UI is not a security boundary.
- A connection may be interrupted or replayed at any point.
Required controls
- Release builds require TLS certificate validation.
- Transport selection is automatic: HTTPS is preferred for addresses without a scheme, while explicitly configured HTTP is reported as plaintext and is never reached through a silent HTTPS downgrade.
- Server public keys are validated before they are stored or used.
- Protocol frames have hard size limits and reject malformed lengths.
- Credentials are never written to logs or included in error messages.
- Secrets use the operating-system credential store where available.
- Remote file paths are treated as peer data, constrained to an operator-approved root, and never passed to a local shell.
- Privileged settings use an operation allowlist and platform elevation.
- Tray notifications contain no passwords, tokens or full remote paths.
- Reconnect uses bounded exponential backoff and does not retry failed authentication indefinitely.
Settings classification
| Class | Examples | Elevation |
|---|---|---|
| User | language, theme, window layout, peer history | No |
| Session | quality, monitor, view-only, clipboard, audio | No; peer policy still applies |
| Machine/security | server key, unattended mode, service, autostart, system proxy, update | Yes |
The application does not run its complete process as administrator. On Windows, the helper uses UAC. On Linux, the helper uses polkit where available. If elevation is unavailable, the operation fails closed.
Clean-room provenance
Protocol interoperability is implemented from the BetterDesk repository's protocol definitions and tests. RustDesk is treated as an external behavioral reference only. No RustDesk source, generated binary, UI asset, trademark or brand resource is included in this directory.