Cloud and privacy

[Reboot]

Since a half year now, I'm a Synergy user. It's far from perfect (but nothing that can't be fixed), but it does the job. However, with version 2, I'm worried about the cloud integration.

As Synergy is a virtual KVM switch, it has access to your keyboard, mouse and clipboard all the time. This makes interesting things possible for malicious people (or even governments).

Synergy 1.X works local, but I see a change in version 2. It even needs the cloud to log you in the first place, so it's directly attached to your person.

And that's creepy. It also rises questions...

• Where is Symless located? Under what jurisdiction does it operate?
• How do we know secret "law enforcing agencies" secretly enforce you to put some kind of backdoor in the code?
• It connects to v1.api.cloud.symless.com, every time it starts. It even seems to keep this connection alive. For what?
• I have no problem with a 1 time license check, but please keep it 1 time. Heck, I can't even see what kind of data is transmitted, hence HTTPS...
• Where is the source code? Any audits from independent company's?
• How do we know if the binaries we download are in fact compiled from the source we see, if at all?

I might sound a bit thin-foiled here, but remember this isn't Photoshop we're talking about. It's software monitoring our input and clipboard 24/7...

What are your thoughts on this?

[Karmek]

I haven't done any research on this but if it's true then it puts the project in a bad spot.

It adds up to the list of points that keep me from using Synergy again after purchasing the pro version for the formerly advertised support which is now included in the company-suited volume licenses only. When I received the E-Mail notification about Synergy 2.0 my interest initially spiked again until I read it's a) "Early Access" and b) they charge money once again.

The latter one in general is no problem however, I struggle finding a detailed changelog or other documentation which states the progress since 1.8. I am not aware wether or not the issues I had during use are fixed or not (which are faulty button mappings of forward, backward and the malfunction of the side-scroll wheel of my Logitech MX Master).

To test that I need to charge $5,- and the odds are that this is just a UI makeover leaving the same issues open to complain about. I am having you know that I am willing to pay for actual features, not bugfixes as the product you purchase is supposed to work in the first place.

[eth0]

I'd also question the usefulness of having the configuration, that is necessarily local, stored in the cloud. I mean, the configuration I use at home is completely useless anywhere else, so I see no point in storing it somewhere different than in the computers themselves. What is the purpose of having the configuration —including machine names— stored in your servers?

[Nick Bolton]

Hey guys, sorry if you don't want us storing your screen names on our servers. This makes it easier to establish a config even if you're having local network issues. We're adding a feature for you to change your screen names. Would that solve your privacy concerns?

[eth0]

That helps a bit, but you still store the private IPs, which I absolutely understand because without them you wouldn't know where to connect. But that brings me back to my previous question: I'm still curious about what problem exactly is what the new configuration-in-the-cloud feature is solving that can't be solved by just storing the configuration locally. Really, I just can't think of one use case where it's useful, please help me out here:

• Is it for mobility? Well, considering that my laptop only connects to my desktop computer at exactly one location and one location only, the possibility of needing that configuration anywhere else is very low.
• Is it for backup purposes? If that's the case, why? Isn't one of the main features of v2 the ability to autoconfigure itself? If I lost the configuration file, the only thing I'd need to do to restore my previous configuration would be to open Synergy v2 again and repositioning the screens around. That's not a big inconvenience, is it?

Wouldn't it be much easier and much less costly for you —not having to maintain the cloud servers, for starters— to just store locally one config file per connected machine and simply using that configuration if that machine is advertising itself on the local network?

Another concern I have has to do with the autoconfiguration itself. Maybe it's too early in the beta phase to ask, but what are the plans to prevent unauthorized clients to connect? I can put my office as an example: there are lots of Synergy users there, and in my case I've received many an alert from my Synergy server that some coworker's laptop is trying to connect to it. If Synergy 2 just connects to whatever machine it encounters, I'm afraid of running it on one of my work machines and having lots and lots of screens pop up and connect to it.

[Nick Bolton]

Yes, it does store your private IPs. This is needed so that the machines can try to connect with each other (without user intervention). We do take security very seriously. We don't mind maintaining a cloud service, it's not expensive.

[DJ_DoubleU]

I think a hidden Super User option would be really nice. Maybe we can host a server on a (primary) computer and maybe use port forwarding to link PC over the internet? and possibly control these settings in detail if we choose? i personally would love a Super User type mode where we could control all of this and more... maybe??

[Nick Bolton]

There will be an advanced settings screen in the stable release (due in November).