Skip to content

Beamer 1.4.1

Choose a tag to compare

View all tags
@TK9443 TK9443 released this 29 Sep 09:20
v1.4.1
df10204

A security fix. Update both machines: 1.4.1 cannot talk to 1.4.0 or earlier, and the one still on the older version says "update both apps" until it is updated too. Your pairing and settings stay as they are.

Downloads

  • macOS 13 or later, Apple silicon: Beamer-1.4.1.dmg, signed with a Developer ID and notarised by Apple. Intel Macs are not supported.
  • Windows 10 and 11, 64-bit: Beamer-Setup-1.4.1.exe, or winget install KalkmanCode.Beamer once the winget listing is approved.

The Windows installer is not code-signed, so Windows shows "Windows protected your PC" the first time. Choose More info, then Run anyway. Everything in it is built from this repository.

Fixed

  • A recorded connection could be played back. Up to 1.4.0, every connection between your two machines was encrypted under the same key for as long as they stayed paired. Frames could not be replayed within a connection, but someone on your network who recorded one session could open a new connection, send the recording again, and the machine receiving it would accept it: the keystrokes, clicks and clipboard in it would happen again. They could not read the recording or send anything new without your token, only repeat what was sent.

    From 1.4.1, each connection's keys include a fresh random value from both machines, so a recording from one connection fails to decrypt in any other. SECURITY.md says what the link protects and what it does not.

Thanks to the side-by-side project, whose security notes pointed this out.

SHA-256

feb2722aa2d72102452b52361b9aee1363eacff0038fe16ac6c57c4bdff27bfd  Beamer-1.4.1.dmg
b0264e50e245d77ba2a45c879047e11ac64a1c9c2d2e79e3c942804c34e6dfed  Beamer-Setup-1.4.1.exe
Assets 5
Loading