OpenThinRDP 0.3.5

OpenThinRDP 0.3.5: the sign-in screen right after power on, and an honest message while the network comes up.

• Devices already in use get it with the update. A new stick or install: the 0.3.1 ISO updates itself at the first start.

• No new manager: 1.1.7 stays the latest.

• The sign-in screen right after power on (#199). On a
  device without a management folder it came up to a minute late: the kiosk first waited for a network (20 s) and for
  the answer of the update source (45 s, Checking for updates). It now shows at once and the check runs in the
  background (on the test bench: 20 s from power on instead of 42-67 s). A new version found meanwhile is asked as
  soon as the sign-in screen is idle, or at the next one.

• Waiting for the network, not "check the cable" (#197).
  When the cable is in (or Wi-Fi is on) and the address has not come yet, the sign-in waits on one screen,
  Waiting for the network, with the seconds and Cancel. It waits up to 2 minutes without spending the attempts,
  and goes on as soon as the address comes. This covers a slow DHCP, or a switch port that passes traffic only some
  30 s after the link. Check the network cable now shows only when no cable is in and Wi-Fi is off.

• With the cable pulled, the sign-in says so: a route kept on a link that is down no longer counts as a network.

• The sign-in screen is no longer redrawn under somebody typing: for a new version, new settings or new pictures, only
  after 10 s without input.

• The sign-in screen ready time in the anonymous data only within 10 minutes of power on.

OpenThinRDP 0.3.4

OpenThinRDP 0.3.4: back on time after a power cut.

• Devices already in use get it with the update. A new stick or install: the 0.3.1 ISO updates itself at the first start.

• No new manager: 1.1.7 stays the latest.

• Back after a power cut (#194). A device with
  POWER_ON_TIME and POWER_OFF_TIME that starts outside its hours (the power came back at night, or someone
  pressed the button) shows the 60 s warning with Cancel of the scheduled power off, then switches off with the
  alarm set again, so it wakes at POWER_ON_TIME. Cancel or an open session keeps it on.

• What a Dell does when the power comes back: the report says it (FW_AC_RECOVERY), read through
  dell-wmi-sysman without the BIOS password. With AC Recovery = Off a device stays off, and the alarm of
  POWER_ON_TIME goes with the power: set it to On for devices with hours (hardware.md).

• The questions at the top of the screen (this warning, the scheduled jobs, the remote screen) are as high as their
  text: before, a white space was left under the buttons.

OpenThinRDP 0.3.3

OpenThinRDP 0.3.3: you choose what anonymous data the project gets.

• Devices already in use get it with the update and keep sending the anonymous data (now Full). A new stick or install: the 0.3.1 ISO updates itself at the first start, then asks.

• The manager 1.1.7 has the same three levels and sets them for the devices. Everything that is sent, item by item: privacy.

• Anonymous data: Full, Errors only or Off (#190). A
  new device asks at its first start, with every level explained on the screen and Full ready, and sends nothing
  before the answer. Devices that sent the anonymous counts before send Full.

  • Full, once a week:
    • what the device is;
    • how it is set up: domain or workgroup, broker or one PC, VPN, screens, kinds of USB devices;
    • how it is used: sessions, days, hours, UDP or TCP;
    • how fast it runs: start to sign-in screen, sign-in by step, latency;
    • what went wrong.
  • Errors only: only in a week when something went wrong.
  • Off: nothing.
  • Never names, addresses, users, servers, settings or anything typed.
  • Where it goes: to PostHog in the EU, with a random id per send, no person profile, no place, no IP address
    kept. privacy.md lists every item.
  • Stays on the device: the event log now notes whether a session ran over UDP or TCP, and how long the device
    took from power on to the sign-in screen.

• Hardware test in the anonymous data: which check failed, a missing graphics driver or sound card, and the
  firmware files the computer asked for and the system lacks. They tell us what to add to the image.

OpenThinRDP 0.3.2

OpenThinRDP 0.3.2: a computer on another port, and screens for 4K monitors.

• Devices already in use get it with the update. A new stick or install: the 0.3.1 ISO updates itself to 0.3.2 at the first start.

• The manager 1.1.6 sets both, for the whole site, a group or one device.

• A computer on another port (#182): the remote
  computer (or broker) takes name:port, as its help text said, for a PC or VM reached through port forwarding.
  Before, Save refused it with "Invalid broker", also in Workgroup mode where there is no broker. The fallback
  brokers and the other computers of the sign-in screen take the same form. Diagnostics and the hardware test try
  each computer on its own port, and after a drop the VM is asked on the port of the session.

• 4K and other large screens (#183): a Screen
  section in the settings.

  • Resolution: native, or one of the modes the monitor offers (DISPLAY_RESOLUTION).
  • Scale: automatic (200% on a 4K monitor, 100% otherwise) or 100-200% (DISPLAY_SCALE), for the screens of
    the device, the web page and the remote desktop, which Windows gets as its own display scale.
  • Monitors (MULTIMON), until now only in the manager.
  • Applied when saved, no restart. 125-175% are drawn sharp, not blown up.

OpenThinRDP 0.3.1

OpenThinRDP 0.3.1: a lighter image. What only some devices use is no longer in the image: a device installs it the first time it needs it, and only that. The ISO is about 220 MB smaller, an installed device up to about 430 MB.

• New stick or new install: download openthinrdp-0.3.1.iso below. A device already in use gets it with the update.

• The 0.3.0 features (workgroup setup, remembered password, Wake-on-LAN, Tailscale, Bluetooth, browser of your choice, a live stick that keeps its settings, install alongside Windows) are all here: see the 0.3.0 release.

• A lighter image: what only some devices use is installed where it is used, the first time (Internet needed
  then; on a live stick with its settings partition it stays on the stick). About 430 MB less on every device that
  does not use it:

  • No browser in the image. A device gets one only when its settings have a web page (web button or kiosk
    page), and only the one chosen: Chromium, or Firefox ESR, Brave, Chrome, Edge (Chromium is then removed). No web
    page: no browser at all, also on the devices that had one.
  • Tailscale: installed when turned on, kept up to date with the security updates, removed with its repository
    when turned off (signing in again is then needed). In 0.3.0 a device updated from an older version had none.
  • Bluetooth: the first time the Bluetooth page is opened. Smart cards (pcscd and its drivers): when a reader
    is first plugged in; sessions open as before without them. WireGuard, OpenVPN: when that VPN is chosen.
  • Devices already installed keep what they have (but the browsers, as above).
  • INCLUDE_BROWSER=yes in build.conf keeps Chromium in an image of your own, for devices that never reach the
    Internet.

OpenThinRDP 0.3.0

OpenThinRDP 0.3.0: also for one computer at home. Choose Workgroup at the first start and reach your PC or virtual machine from an old laptop, a mini PC or a Raspberry Pi, from home or from outside with Tailscale. The live USB stick now keeps its settings, and OpenThinRDP installs alongside Windows.

• New stick or new install: download openthinrdp-0.3.0.iso below. A device already in use gets everything with the update, a stick written with an older ISO included (its settings partition is made by the update, no need to write the stick again).

• Devices already set up keep working as they do: the environment (domain or workgroup) is inferred from their settings. Manager 1.1.0 knows the new settings.

• Domain or workgroup (#174): the first start asks for
  the environment of the device, Active Directory domain (brokers, collections, central management) or Workgroup
  (one computer or virtual machine, a local or Microsoft account), and the settings show only what applies
  (SETUP). Devices already set up keep what they have: the environment is inferred from their settings.

• Password remembered (REMEMBER_PASSWORD): the password of the default user stays on the device, sealed in the
  TPM when there is one; at power on the desktop opens by itself. Removed as soon as Windows rejects it.

• Wake-on-LAN of the remote computer: its MAC address is learnt after the first connection (or set in
  WAKE_MAC); a computer that does not answer is woken up, with a wait screen (WAKE_WAIT).

• Computers found on the network: in a workgroup, the computer field offers the computers of the network with
  Remote Desktop on. Several computers (CONNECTIONS): the sign-in screen offers the choice.

• Tailscale (VPN=tailscale): the computer at home reached from outside, no server to set up; the device shows a
  sign-in link to open on a phone.

• Bluetooth: headsets, keyboards and mice paired from the settings of the device; audio through PipeWire.

• The browser of your choice (BROWSER, #133):
  Chromium, Firefox ESR, Brave, Google Chrome or Microsoft Edge, installed only on the devices that choose it, from its
  maker's signed repository, kept up to date with the security updates, with the same rules for all of them.

• The live system keeps its settings (LIVE_PERSISTENCE): started from a USB stick with free space, it makes a
  partition there at the first start; from the next start settings, updates and Wi-Fi stay, as on other live
  distributions. A stick written with an older image gets there with this update, without writing it again: the
  update changes its partition table (nothing of the image moves, BIOS and UEFI start as before), the settings
  partition is made at the next start and used from the one after. The image is now laid out as Debian's own (an
  MBR, the image mountable from partition 1, the EFI partition after it): the old layout let live-boot mount only
  the whole stick, and then no partition of it could be used.

• Install alongside Windows: a new entry of the installer uses the free space of the disk (shrink Windows first)
  and leaves Windows and its partitions as they are; the boot menu offers both (OpenThinRDP first, 5 seconds).
  The installer asks which way to partition with "the largest continuous free space" already chosen, then shows
  the partitions it is going to make and asks before writing, as before.

• Help for Microsoft accounts: in a workgroup a refused password says that the account's email address and password
  are needed, the Windows Hello PIN is not accepted by Remote Desktop.

• The hardware test of the live system shows once per stick that keeps its settings, not at every start.

• The ISO of this release is needed only for a new stick or an install: a stick in use gets everything with the
  update, the settings partition included.

OpenThinRDP 0.2.28

• The manager has releases of its own, from 1.0.0: numbered apart from the devices, on
  its repository, signed with the same project key. This
  release carries one last manager (0.2.28): it updates itself to the releases of the manager, and from there to
  1.0.0, by itself. From the next release of the devices on, their release no longer carries the manager.
• What manager 1.0.0 brings: the Health Center no longer stays empty when a number goes down very slowly (the days
  until it ran out were too many for the reading, and nothing was shown, not even the last reading); the last reading
  at once when it opens, then the new one part by part, with its progress in Home too; no long .NET error when the
  window closes after Update the manager; an error nobody caught is written to
  %LOCALAPPDATA%\OpenThinRDP\manager-errors.log and said in a few words. The servers, the iDRACs and the rest are
  read at the same time, the iDRACs with one session each (a reading of a whole site went from 3 minutes to under one),
  and the progress moves part by part.
• Anonymous counts, one per device: the counter tells visitors apart by internet address and program, so the
  devices of a site, all behind one address, counted as one (7 devices sent, 1 counted). Each send now carries a
  random number made for that send only, kept nowhere and taken from nothing of the device
  (privacy). The manager sends once a day instead of once a week.

OpenThinRDP 0.2.27

• The anonymous counts get out (#167): a device started
  them in the background of its report, which runs as a oneshot service, and systemd stopped them when the report
  ended, before anything was sent, on every device. They now run in a unit of their own (systemd-run): seen on an
  OptiPlex 3000 Thin Client, they reach the counter within a minute. What is sent does not change
  (privacy), and ANON_STATS=off still turns them off.
• Manager: no more -EncodedCommand: the launcher started Windows PowerShell with the manager as a Base64 command
  line, which EDRs such as SentinelOne report as suspicious. It now starts OpenThinRDP-Manager.start.ps1, a fixed
  script of a few lines signed with the release, and hands it the manager on its standard input: nothing of the
  manager goes on a command line or to the disk. After the update the manager starts once more through the launcher
  of before; from the next start on, through the new one.
• Manager: the site key reaches every device by itself: a device that was off when the site key was sent, or was
  installed again, took no update from the folder any more (UPDATE_KEY=site: "invalid signature"). The manager, open
  with the vault, now sends the key to such a device as soon as it is on (SSH), and notes it in changes.log.
• Manager: it opens again after updating itself: after an update of 0.2.24-0.2.26 it could close instead of
  starting again (the new start found the one still closing and gave way to it). It now waits for it.

OpenThinRDP 0.2.26

• Webcams that keep up (#165): a webcam that compresses
  to H.264 by itself sent that H.264 to Windows as it was, and those frames cannot be dropped: a late one held the
  next and the picture fell behind. The webcam is now read in MJPEG and encoded by the device, which drops a late
  frame and keeps up, on the video engine of the processor (Intel Quick Sync, VA-API) so the processor stays
  free: 30 fps at 1080p on an OptiPlex 3000 Thin Client, the processor 89% idle. And Windows is offered at most
  1080p (720p on a device without such a video engine), where it picked the largest a 2K webcam had. Three
  settings change it: CAMERA_H264, CAMERA_HWACCEL, CAMERA_MAX, in the manager too.
• FreeRDP fb0198dbe: the options of the
  camera channel (h264, hwaccel, maxres), built with VA-API.
• Tip: in a dark room many webcams lengthen their exposure and give half the frames (10 fps instead of 20-30). More
  light, or a webcam with a fixed frame rate, helps more than any setting.

OpenThinRDP 0.2.25

• The manager is signed with Authenticode: OpenThinRDP-Manager.exe carries the signature of the project
  (CN=OpenThinRDP Project, with a timestamp). An EDR or antivirus that held the manager back (SentinelOne,
  #133) is told once to allow it by signer, and every next
  release passes: how. Your own
  code signing certificate still works too (Settings > Security > Code signing).
• The right time after the change of the clock: Windows takes the time zone of the device only when a session
  opens, so a session open across the change to or from daylight saving time showed the time one hour off until it
  was opened again. The device now opens it again by itself when the clock changes: a few seconds, the programs stay
  open.
• A new release is said where you look: Home lists New version for the devices (or of the manager) with
  what the folder publishes now, and the menu counts it on Updates. In 0.2.24 the window checked GitHub but showed
  it nowhere.
• Readings that end: the iDRACs are read in parallel, firmware, memory modules and processors only every 6
  hours, and the next reading starts 3 minutes after the end of the last one (a reading longer than 3 minutes ran
  back to back). Each step and each part of a controller keeps how long it took.
• Rings in proportion: memory, disks and the other rings of the manager were drawn full or empty, never in between.
• A narrow window puts the cards of a row two by two, then one under the other, instead of a scroll to the side.
• Charts keep their words straight (they were stretched with the drawing), the days of the scheduled jobs come in
  the language of the manager, and the hints that still named the settings of 0.2.23 lead to the line of the server.