bitbound / ControlR

Zero-trust remote control built with .NET 8, MAUI, and ASP.NET Core.
https://controlr.app
GNU General Public License v3.0
39 stars 2 forks source link

Cant join the beta program on google play store. #4

Closed DanielH00 closed 1 month ago

DanielH00 commented 1 month ago

Issue Checklist

Self-hosted?

Describe the bug

A clear and concise description of what the bug is. Ideally with a screenshot if applicable.

To Reproduce

Steps to reproduce the behavior:

/

ControlR Version (if self-hosting)

Server (Docker image tag): / Agent (can be found on the devices table): / Viewer (can be found on the About page): / Viewer OS (Windows/Android): /

Screenshots

If applicable, add screenshots to help explain your problem.

Additional Context/Info

Add any other context about the problem here.

Hi,

I came across your project and wanted to test it, but I’m unable to join your Google Play beta. :( image

(I'm also familiar with your other project, Remotely, which I use frequently. However, this new project caught my attention, particularly because it supports Android and has a dedicated PC app, removing the need for a web browser. If Remotely offered an Android and a PC app for remote control of other devices, I would highly recommend it to larger companies. You could even consider adding subscription plans for businesses that include support services—or further develop this project to make it truly robust, achieving the same result. It would also be cool if there was an android remote support module to help others on their android phones. I'm still learning myself, but as soon as I fully master Kodin I would be happy to help you with this project or to offer remotely android remote support....)

Could you please help me with access to the beta link or fix the issue? I’m really eager to test this project

bitbound commented 1 month ago

@DanielH00 Thanks for letting me know! :)

Sorry for the mishap. This is my first time working with the Play Store, and I'm still figuring it out.

It looks like I either needed to manually add each tester's email address, or create a Google Group. So I created a group and made it public, so anyone can join.

Can you try joining this group and see if that works? https://groups.google.com/g/controlr-testers/about I think the original invite link should work after that. If that works, I'll update the docs.

To be completely transparent, I should also add that it isn't my intention to build out a super robust feature set with this project. After I sold Remotely to Immense, I found I still wanted a remote control project of my own for my own computers.

My intent is to keep it relatively simple. With Remotely, I ended up over-committing myself to features and ideas that I simply didn't have time to complete, and it got really stressful. I want to keep the scope narrow with ControlR to ensure I can continue supporting it indefinitely.

I hope that makes sense. :)

bitbound commented 1 month ago

That said, there are some interesting design choices I made, and I'm curious to see what people think.

For example, the server doesn't have a database. All data is stored locally on your device. Combined with the zero-trust model, I thought this would be appealing for people using the public server.

However, do self-hosters care about that? Would they prefer to have the data centralized on the server, so it follows them across devices without having to export/import?

There are a lot of other topics, but this isn't the place. 😄 I'll open up a discussion about it soon.

DanielH00 commented 1 month ago

@bitbound Hi, thanks for your reply! Yes, the link works! If you need 10 testers, I can help organize that for you ;) I can totally understand you, and I’d love to help out with the project. Here are my ideas:

The encryption implementation is solid, but not very practical. I think it would be more user-friendly if users could log in with their credentials and verify via 2FA, such as by email. This would be much simpler than needing to save a key or file across multiple devices. It would also be more efficient if users could create an account where the key is securely stored in the database—encrypted, of course. I could implement this with PHP.

The app design is quite good; I like it to some extent, and for a starting point, it’s already solid :)

However, the website :( As a web developer/designer, the design didn’t really sit well with me. I’d be happy to create a more modern and updated site, and I can also provide a web server with a properly configured email server. This way, the website could be hosted more efficiently, and you’d have the advantage of easily managing everything. How about contacting me via Discord or another platform, and I’ll share all the details with you? My Discord username is "daniel_haurich".

For self-hosting, wouldn’t it make sense to host it under your own domain? You could have an admin management portal where you can customize everything—such as the server URL, user permissions, etc. Alternatively, I could build a complete web interface where you can control everything, in case you don’t want to host it yourself. You’d get your own subdomain where you can manage users and more.

I’d be really excited to support you with this project :) Feel free to reach out via Discord or another platform, and I can send you all the details that shouldn’t be public. (My Discord: daniel_haurich)

Best regards, Daniel

DanielH00 commented 1 month ago

Screenshot_20240815_123915_Google Play Store.jpg :( I live in Germany, could you change that somehow? or is Google Play very strict there?

bitbound commented 1 month ago

The encryption implementation is solid, but not very practical. I think it would be more user-friendly if users could log in with their credentials and verify via 2FA, such as by email.

This is what I meant about my design decisions. Moving authentication to the server, even with 2FA, means that compromising the server could lead to compromising the agents connected to it. Because they would then be trusting the server to do authentication for them.

With this model, every message/command is signed with keys that never leave your local device, and the agent is able to verify the signature. If the server is compromised, it has no way accessing the agents.

Sure, I could build something similar on top of a typical account system (e.g. the Identity framework I used in Remotely), but I wanted to do something different. And simple.

I'm curious to see if people appreciate this, or if they'd rather have a classic server-side authentication system. But even if everyone hates this, I'm not sure if I'd change it. I personally like it. And I don't want to build a Remotely copy.

if users could create an account where the key is securely stored in the database

This would be a security vulnerability. You never want to store secrets in the same place as the resources to which they grant access. And you never want to store keys/passwords with reversible encryption in a database.

I could implement this with PHP.

I appreciate the offer, but there won't be any PHP in the project. If I did ever switch to server-side authn/autho, I'd want to do it myself. I've been looking for an excuse to use passkeys. :)

However, the website :( As a web developer/designer, the design didn’t really sit well with me. I’d be happy to create a more modern and updated site, and I can also provide a web server with a properly configured email server.

Again, I appreciate the offer. But the website is a static React app. It doesn't have a backend. Its only purpose is to provide links and serve a privacy page, which was required by the Microsoft Store.

If you want to make some suggestions for it, though, feel free to send a PR. It's in this repo. https://github.com/bitbound/ControlR/tree/main/ControlR.Website

You could have an admin management portal where you can customize everything—such as the server URL, user permissions, etc.

I don't intend to build anything like this for ControlR. There won't ever be branding, permissions, groups, etc. It won't ever be viable for business use. My goal is to keep it as a minimalistic tool for personal use, for only a handful of computers.

For business use, I'll be continuing to work on remote control at ImmyBot. I don't want there to be any conflicts of interest with my personal projects, which is one reason for keeping ControlR focused on personal use. Another is to keep ControlR simple, so it doesn't become a huge stressor and time sink, which would end up affecting my performance at work.

Hope that all makes sense! :)

bitbound commented 1 month ago

I've updated the readme with the new instructions. Thanks for bringing this up.

In regard to your other photo, the app is only available in the US. I'm not going to be setting up internationalization for it, unfortunately.

I'm going to close this issue out as completed.

Take care!