Re: VNC, No Matching Security Types

VNC is a bit hard to secure. Some, like TightVNC, only allow a very short password ... 8 characters, in Linux anyhow. The ports are Well Known and there's nothing inherent to discourage automated attacks.

(TightVNC *is* good because it very easily lets you create independent "screens/environments" rather than just being an echo of what the main user sees)

The Solution is to use VNC-Over-SSH ... well-documented for Linux (though a bit of a pain via Winders). A secure "tunnel" is created. Also NEVER expose the standard ports to The World ... use odd ports and NAT redirects on yer router.

Alas NO remote-access tech seems super-duper "secure", no matter how much you pay for it. Remember the SolarWinds debacle of just a couple years ago. If you don't HAVE to have remote access then DON'T.

As for BookWorm ... all in all THAT seems to work like always. However I'd suggest dropping the VNC used by the PI and add something else ... just so no secret "helpful shortcuts" remain. Tight works well, be aware that Tiger can alter some kinda unexpected files in /etc which prevent OTHER VNCs from working properly. I found repair docs, but it wasn't so easy/obvious. For now I only use Tight, but there are several alternatives to Tiger.

BookWorm has proven to be the "Vista" of the LiniVerse. I don't like it. Too many STUPID changes to no good rational purpose.

I configured the Real VNC server that is bundled into RasPiOS and can access it from Real VNC client on Windows (7 and 10) and on Android 13. I didn't need to configure anything non-standard - it "just worked".

The information at the Android client for the connection to my Pi says "128-bit AES encryption", "JRLE encoding" and an estimated speed of 5.2 Mb/sec for a direct IP-to-IP (ie non-cloud) connection - because the server on the Pi allows direct connections in addition to cloud connections via RealVNCs servers.

Sorry for appearing daft, but if you only have TigerVNC viewer have you tried installing Tigervnc server on the Pi?

Just to throw a wrinkle into everything, the latest version of RealVNC viewer, 7.8.0, will connect to a Pi4 running wayvnc. I expect it will work with a Pi5 too.

I think Tiger or something IS pre-installed on PIs - but you have to use raspi-config or the GUI one to ENABLE it.

Alas Tiger has a rep for altering some low-level, poorly documented, config files that PREVENTS some other kinds of VNC from working ... so I'd suggest immediately installing Tight or something else. If you install then you don't have to use raspi-config, it's just THERE. 'vncpasswd' to set the pass and you're basically done. Just put like "vncserver :3 -geometry 1200x760" or nearabouts into an autostart file, .profile SOMETIMES works.

I did this three times just last week.

Not sure why the poster is complaining about "having" to use VNC. It's a fair remote-desktop system ... the weak bit being that some have only 8-character passwords. The BEST way to use it is to also enable SSH on the PI and then use an "SSH tunnel" for VNC. This IS secure. Docs abound. It's a weird, but not TOO long, command line ... I just put 'em in bash scripts.

"Tight" is nice because you can have it reflected on the dest screen OR create one or more screens the PI user never even sees (and are maybe outside what script-kiddie hacks will bother probing).

VNC has always worked for me with SSH forwarding, without using TLS:

$ vncpasswd

- set a password for the VNC session

$ vncserver -geometry 1920x1080 :1

- starts a VNC server on display :1, ie localhost port 5901

Then on your PC: $ ssh -L 5901:localhost:5901 pi@192.168.1.99

to login to your Pi, and tunnel port 5901 on the Pi to port 5901 on the local machine.

Then start your VNC client and connect to the VNC server on localhost:1

If you get a blank screen with no apps, you may need to start the desktop. In the SSH session:

$ export DISPLAY=:1 $ startx &

You can also run X apps 'by hand', eg a terminal and window manager:

$ sudo apt install fvwm $ export DISPLAY=:1 $ xterm & $ fvwm &

(~/.vncsession is the place to put commands to run each time you open a new vnc session)

They are different. VNC is a pixel-based sharing protocol, ie it renders things on the Pi and pushes blocks of pixels to the PC. With X, everything is rendered on the PC - lines, fonts, etc. VNC speed depends on network bandwidth and compression speed, but X is constrained by latency (lots of messages flying back and forth).

X is slow if your latency is bad (eg over the internet). Protocols like X2go and NX can speed it up because they reduce the number of roundtrips and hence their impact on latency.

ssh -C can compress any data stream that passes through it, including VNC traffic on a forwarded port, but the VNC traffic is already compressed by VNC so there's not much point.

Theo

Look, "it depends".

If you work in a small, known, local, environment - esp if you are the only tech-savvy person there - then you CAN almost forget "security". I've done the same more than once ... but neither VNC or SSH are run on 'standard' ports, just in case. Oh, there are a few easy SSH settings that sabotage brute-force hacks.

As for VNC "tunnels" through SSH - no it's NOT faster, but it's not terribly slower either. I'd rec doing it, Just Because. Evil actors are *everywhere* these days, oft govt-funded.

Yep - it's wonderful (given previous years/decades).

I generally prefer "Tight" though because you can set up so many virtual screens so easily. The downside, unless they've recently changed, is kinda crappy stream/creds encryption in Linux/Unix. If using Tight, I still suggest SSH tunnels.

n estimated speed of 5.2

AES-128 is still considered "pretty good". There ARE cracks, but they're still computing-intensive so unless you're the CIA or Bank Of America, not worth the effort. I use AES-128 for stuff stored on "the cloud" because it's faster, and feel quite secure. The cloud owners ain't gonna get S*IT to sell.

Now I'm retiring. The New Guy seems to TRUST M$ and others who offer cloud services/storage. It's a mistake, but management has drifted towards Dilbert-ism. He's far better than me at "modern services" fer sure, but he's not a programmer, never deals with "system level" stuff, can't cope with Linux/Unix stuff. It's a much more "shallow" level of expertise. If MY info gets compromised I *will* be suing. Good post-retirement income source dontchaknow :-)

I'm very old school, PDP-11/punchcard/VIC-20 era ... something odd needed, WRITE IT YOURSELF. Modern = BUY SOMEONE ELSE'S expen$ive "solution" and PRETEND as hard as you can ............

Don't be so quick to cuss X11.

Yep, it DOES have some serious inefficiencies, but its ultra-compatible and very "complete".

Leave Wayland for the "gamers".

Compression is only JUST so useful. Confine it to "from the net" applications. On a local network it can be slower.

VNC/RDP/etc ... they're usually intended for "convenience", not "top performance".

Not in my home they are not :-)

Wait until you have plumbing problems !

Frankly, Plumbers are unobtanium and I installed and service my own plumbing.

Did have a sweep in a few weeks ago, and a boiler service man, but he didn't fix the aga either.

No one wants to do repair work anymore. They want to make shitloads installing wanky new boilers and the like.

Aw, they CAN be had OK ... mine is from an old family-biz. Fair prices, prompt service, access to commercial-quality wholesale-only thingies. But yea, that IS unusual these days ......

MOST are a gigantic rip-off machine.

Alas I've reached an age and condition where there are things I just *can't* do myself anymore. Finding good proxies is always a challenge.

Have one relative in the fix-it biz. He's been useful now and again - esp in finding parts for old equipment.

Most all new equipment is "wanky" these days. Cheap-ass s*it that won't last very long - and the warrantee never QUITE covers what your problems may be.

Appliances made in the 50s/60s are still your best bet. Not too long ago I popped into a roadside store/fuel station out in the USA country - they had an antique refrigerator, the kind with the big circular coil on top - AND IT WAS STILL WORKING. Probably made 1925 or so. Likely not the best in "energy-efficiency", but the money saved in DURABILITY more than made up for that.

Something like :

Good 2 know.

VNC still has a very useful place. It's NOT so great for external access, but for administering LOCAL stuff it's the quick cheap EZ solution.

For external, "SSH tunnel".

I still like "Tight" because it's so EZ to set up multiple virtual consoles.

On 26/11/2023 03:39, 56g.1173 wrote: In the USA there are "antique appliance" companies that will restore/sell OLD stuff, like : []

Repair and reusability is encouraged across Europe.

Um ... so SURE of that ? :-)

The EU/UK is far more receptive to the "Greta View".

Thing is, you really have to Do The Numbers. The energy costs of refining steel/aluminum and pressing it into the needed shapes for appliances - it that really offset by slightly better "energy efficiency" ?

In truth a LARGE amount of energy, and CO2, has to be dedicated to making something even as basic as a stove or laundry washer.

Those 50s/60s construction standards - which leaned heavily towards "durability" - may not be so archaic as they seem.

But then none of this has anything to do with rPIs ...

Though they ARE "durable" - still getting good use out of a few 1st-gen PIs .....

No it isn't.

Generally far from it - which simply means that when you have to replace something then you do so with the most durable and efficient you can find and afford.

Replacing something that works or can easily be repaired is daft (except as a functional upgrade) but past a certain point replacement makes more sense than repair. It is a shame when that point is reached just because parts have become unobtainable because the last production run has been used.

The good engineering trend seems to be towards reliability in favour of maintenance - using sealed for life bearings instead of making repacking them easier for example. It's a pity about the "how many corners can we cut before it won't sell" crowd - some of whom get knighthoods (is it sir uncle or uncle sir ?).

It is pure economics. When a robot assembly line can e.g. spit out PICO PI boards at less than 6 minutes labour cost, for a skilled repairer...who the **** is going to fix one?

To call out an engineer to fix a $300 washing machine will likely be $300 parts and labour.

You might as well buy a new one .

If you want one that wont break and has a 7 year guarantee expect to pay $1000 instead.

It's all down to robotisation. Its far cheaper to buy a new part off an automatic production line than employ an actual human to fix that part. IT and CAD/CAM and robotisation have destroyed the skilled labour market, and the high street retail model. Just as the machine loom destroyed craft weaving.

We (the West) are now a society of consumption that does no production at all. That's all done in China or some other part of Asia, or South America.

The world is changing, and we can't really turn the clock back.

Amazon is my high street and China is my repairman.

I've been fighting a recalcitrant Aga range stove for months - no one even returns my calls to fix it.

Finally I managed to dismantle the very last part and fixed that, only to find that it had coked up *again* due to utterly s*it fuel mandated by the EU for 'low sulphur'...

Luckily I now have that down to less than an hour as I bought all the right tools. Long drill for the feed pipe and wood working burrs to smash out all the carbon.

These days when you want something doing, do it yourself or buy it off Ali Express. Ore Amazon.

No one is making a living doing it for you anymore.

PS my 4 zone PI ZERO W central heating controller with wifi thermostats went live yesterday. What it replaced already looks worth more on ebay than what I paid in the end, and many many thanks to all who helped make it as rock solid as it now seems to be. There are still logical bugs in the (heater) programming which I will attend in due course, but in terms of doing the switching at the right times and temperatures it is simply awesome. So its onto project server, which is the Pi 4B, which is having its 3D case designed...and then project oil level sensor, but that can wait...