Marix open source desktop SSH client for developers and sysadmins

Comments

• Fubukibox Member

  January 20

  @Levi said:

  @Fubukibox said:
  after testing Marix in a vm, i saw it used around 190-240MB of ram on idle. Seriously. I moved over to Termix and that uses less then 80MB of ram usage. the UI is cool n all but Marix with Electron + React + Tailwind CSS all eating near 200MB is not good imo. I'll just stick to Termix from now on since it works on desktop and mobile...

  Why on 64GB personal pc should matter 200MB or 80MB?

  my desktop has 32GB DDR5, laptop 64GB DDR5. still, i multitask a lot
• Levi Member

  January 20

  @Fubukibox said:

  @Levi said:

  @Fubukibox said:
  after testing Marix in a vm, i saw it used around 190-240MB of ram on idle. Seriously. I moved over to Termix and that uses less then 80MB of ram usage. the UI is cool n all but Marix with Electron + React + Tailwind CSS all eating near 200MB is not good imo. I'll just stick to Termix from now on since it works on desktop and mobile...

  Why on 64GB personal pc should matter 200MB or 80MB?

  my desktop has 32GB DDR5, laptop 64GB DDR5. still, i multitask a lot

  Show me your taskbar. To drain 32GB of sweet DDR5 there should be a LOT of tabs with hentai.
• forest Member

  January 20

  @Levi said:

  @Fubukibox said:

  @Levi said:

  @Fubukibox said:
  after testing Marix in a vm, i saw it used around 190-240MB of ram on idle. Seriously. I moved over to Termix and that uses less then 80MB of ram usage. the UI is cool n all but Marix with Electron + React + Tailwind CSS all eating near 200MB is not good imo. I'll just stick to Termix from now on since it works on desktop and mobile...

  Why on 64GB personal pc should matter 200MB or 80MB?

  my desktop has 32GB DDR5, laptop 64GB DDR5. still, i multitask a lot

  Show me your taskbar. To drain 32GB of sweet DDR5 there should be a LOT of tabs with hentai.

  Not that much. Only <200 tabs of Gelbooru and E-Hentai on Firefox is enough to put memory pressure on a 32 GiB laptop if you don't use a tab-unloading add-on.
• drielsma Member

  January 20 edited January 20

  Hello, @marix

  Can you add the function SFTP (SSH File Transfer Protocol) to your app/program? I'm currently using Filezilla for this.

  and would also be useful for ftp to be able to choose the folder if you create a host and it doesn't end up straight away in www or root
• buzzyLET Member

  January 20

  @forest can you help explain to me what this app is doing which is so dangerous, I can't understand it from the description and the posts. But thank you for your informative views as a security researcher it helps me learn. I've used a few SSH frontends like sshm or lazyssh - I assumed these were safe because they were basically just wrappers and not storing or transmitting any data, how is this so different, and are these other wrappers really safe to use?
• forest Member

  January 20

  @buzzyLET said:
  @forest can you help explain to me what this app is doing which is so dangerous, I can't understand it from the description and the posts. But thank you for your informative views as a security researcher it helps me learn. I've used a few SSH frontends like sshm or lazyssh - I assumed these were safe because they were basically just wrappers and not storing or transmitting any data, how is this so different, and are these other wrappers really safe to use?

  The problem is that, although it uses proper SSH for the protocol itself, it also parses data from the server and the code is poorly-written, since it has zero eyes on it (it's all AI-written, so not even the author understands the code).

  I don't know about those other wrappers, but whether or not they are safe depends on how much control the server has over the control flow within the wrapper. An example that used to be a serious issue (but is largely not a big deal anymore) is exploits through terminal control codes, where an SSH server could exploit an SSH client running under xterm.
• buzzyLET Member

  January 20

  @forest said:

  @buzzyLET said:
  @forest can you help explain to me what this app is doing which is so dangerous, I can't understand it from the description and the posts. But thank you for your informative views as a security researcher it helps me learn. I've used a few SSH frontends like sshm or lazyssh - I assumed these were safe because they were basically just wrappers and not storing or transmitting any data, how is this so different, and are these other wrappers really safe to use?

  The problem is that, although it uses proper SSH for the protocol itself, it also parses data from the server and the code is poorly-written, since it has zero eyes on it (it's all AI-written, so not even the author understands the code).

  I don't know about those other wrappers, but whether or not they are safe depends on how much control the server has over the control flow within the wrapper. An example that used to be a serious issue (but is largely not a big deal anymore) is exploits through terminal control codes, where an SSH server could exploit an SSH client running under xterm.

  So the security concern and threat model here is in the case that you could connect to a malicious server?
• forest Member

  January 20

  @buzzyLET said:

  @forest said:

  @buzzyLET said:
  @forest can you help explain to me what this app is doing which is so dangerous, I can't understand it from the description and the posts. But thank you for your informative views as a security researcher it helps me learn. I've used a few SSH frontends like sshm or lazyssh - I assumed these were safe because they were basically just wrappers and not storing or transmitting any data, how is this so different, and are these other wrappers really safe to use?

  The problem is that, although it uses proper SSH for the protocol itself, it also parses data from the server and the code is poorly-written, since it has zero eyes on it (it's all AI-written, so not even the author understands the code).

  I don't know about those other wrappers, but whether or not they are safe depends on how much control the server has over the control flow within the wrapper. An example that used to be a serious issue (but is largely not a big deal anymore) is exploits through terminal control codes, where an SSH server could exploit an SSH client running under xterm.

  So the security concern and threat model here is in the case that you could connect to a malicious server?

  That's the main one I can think of, besides physical offline attacks against the poor KDF settings, but there could be other issues that I just haven't seen, like attacks from unauthenticated users on the network.

  Note that there may be pre-auth vulnerabilities as well, so exploitation may be possible even if you have verified your server's host key and the attacker is on the network but has no control over your server.
• ScreenReader Member

  January 21

  • slopcode app - check
  • author uses llm to responds & circle around instead of addressing the problem - check

  and then..

  

  • https://www.virustotal.com/gui/file/9082b5678028444ddb611da0085135af4540f31900920a6cdf79e53e0803c2b0/behavior
  • https://www.virustotal.com/gui/file/3122d326c97fdf0ac82262e00bf44a667e12078ab720807a11c1a63fc102867d/behavior

  dunno chief. hard to trust app that wants your ssh private key if they have these kind behavior as opposed to just using /usr/bin/ssh

  a ssh client that rely on node / python package system is a redflag for me. as the app itself can be not malicious but someone else can push credential stealer on the package dependency.
• tof Member

  January 21

  @marix said:
  update 1.0.5 see on https://github.com/marixdev/marix

  better to adding these to the post.
• marix Member

  January 21

  @drielsma said:
  Hello, @marix

  Can you add the function SFTP (SSH File Transfer Protocol) to your app/program? I'm currently using Filezilla for this.

  and would also be useful for ftp to be able to choose the folder if you create a host and it doesn't end up straight away in www or root

  pls read readme sftp are include on 1.0.0 version
• marix Member

  January 21

  @ScreenReader said:

  • slopcode app - check
  • author uses llm to responds & circle around instead of addressing the problem - check

  and then..

  

  • https://www.virustotal.com/gui/file/9082b5678028444ddb611da0085135af4540f31900920a6cdf79e53e0803c2b0/behavior
  • https://www.virustotal.com/gui/file/3122d326c97fdf0ac82262e00bf44a667e12078ab720807a11c1a63fc102867d/behavior

  dunno chief. hard to trust app that wants your ssh private key if they have these kind behavior as opposed to just using /usr/bin/ssh

  a ssh client that rely on node / python package system is a redflag for me. as the app itself can be not malicious but someone else can push credential stealer on the package dependency.

  I understand your concern, and this mostly comes down to threat models.

  Marix does not attempt to replace /usr/bin/ssh for users who require a minimal, fully-audited TCB. If someone’s security model is “only trust the system SSH client”, then Marix is not the right tool — and that’s explicitly acceptable.

  Regarding VirusTotal behavior: Electron/Node applications will naturally exhibit filesystem, process, and network activity. Those reports do not indicate credential exfiltration, nor does Marix transmit private keys or secrets off-device. All SSH operations ultimately rely on the system SSH binary.

  Supply-chain risk in package ecosystems is real, which is why Marix is open source, dependency-pinned, and does not load remote code at runtime. This is the same trust trade-off made by widely-used tools like VS Code and GitHub Desktop.

  If your threat model requires zero third-party dependencies, then sticking with /usr/bin/ssh is absolutely the correct choice.
• forest Member

  January 21

  It's almost like he didn't even read:

  @ScreenReader said:
  author uses llm to responds & circle around instead of addressing the problem - check
• forest Member

  January 21 edited January 21

  @ScreenReader On another note, I just saw your signature about Anna's Archive. I had no idea they allowed volunteering through torrent seeding. That will fit perfectly in the niche of low-RAM, high-bandwidth VPSes I have. The ones with plenty of RAM are already running Hyphanet (a distributed data store which, having been written in the early 2000s, is written entirely in Java), but there are some with 10-100 GB of wasted storage and not enough RAM (or vCPUs) to run Hyphanet.

  I'll set up rtorrent on a dozen or so of my servers and start seeding! Thanks for making me aware of that!

  And if you have any idlers with spare bandwidth, might I suggest you run some Tor middle relays?
• ScreenReader Member

  January 21

  @marix said:

  @ScreenReader said:

  • slopcode app - check
  • author uses llm to responds & circle around instead of addressing the problem - check

  and then..

  

  • https://www.virustotal.com/gui/file/9082b5678028444ddb611da0085135af4540f31900920a6cdf79e53e0803c2b0/behavior
  • https://www.virustotal.com/gui/file/3122d326c97fdf0ac82262e00bf44a667e12078ab720807a11c1a63fc102867d/behavior

  dunno chief. hard to trust app that wants your ssh private key if they have these kind behavior as opposed to just using /usr/bin/ssh

  a ssh client that rely on node / python package system is a redflag for me. as the app itself can be not malicious but someone else can push credential stealer on the package dependency.

  (...snip...)
  Supply-chain risk in package ecosystems is real, which is why Marix is open source, dependency-pinned, and does not load remote code at runtime. This is the same trust trade-off made by widely-used tools like VS Code and GitHub Desktop.

  IMO open source alone is not enough for a tool like these, what about you add the build system inside the github action itself to be more transparent, so whatever the build artifact is, people can see it's build history? can't have someone stuffing funny stuff inside like the https://tukaani.org/xz-backdoor/

  @forest said:
  @ScreenReader On another note, I just saw your signature about Anna's Archive. I had no idea they allowed volunteering through torrent seeding. That will fit perfectly in the niche of low-RAM, high-bandwidth VPSes I have. The ones with plenty of RAM are already running Hyphanet (a distributed data store which, having been written in the early 2000s, is written entirely in Java), but there are some with 10-100 GB of wasted storage and not enough RAM (or vCPUs) to run Hyphanet.

  I'll set up rtorrent on a dozen or so of my servers and start seeding! Thanks for making me aware of that!

  And if you have any idlers with spare bandwidth, might I suggest you run some Tor middle relays?

  hey thank you for the interest, i've been seeding anna's library for quite some time now but only book collections I'm interested in (like old fiction/magazine). more bandwidth are always welcome.

  as for tor middle relays i'll try to host some. my VPS are mostly in APAC region and the bandwidth are usually spent in syncthing relays. as long as they can be bandwidth-limit i'm sure it's manageable

  Thanked by 1forest
• forest Member

  January 21 edited January 21

  @ScreenReader said:
  hey thank you for the interest, i've been seeding anna's library for quite some time now but only book collections I'm interested in (like old fiction/magazine). more bandwidth are always welcome.

  I'm using https://annas-archive.li/torrents which automatically picks out some mirror links for me to seed, rather than choosing individual torrents to archive. It looks like it automatically chooses the torrents that need seeding the most.

  @ScreenReader said:
  as for tor middle relays i'll try to host some. my VPS are mostly in APAC region and the bandwidth are usually spent in syncthing relays. as long as they can be bandwidth-limit i'm sure it's manageable

  APAC regions are actually really valuable since they're rare! They don't get heavy usage since most of the network is concentrated in Europe, but they do get some. My Nigerian relay is currently pushing about 2 Mbps in each direction (despite being capable of handling 100 Mbps) whereas my Netherlands relays get over 150 Mbps in each direction, for example.

  Bandwidth-limiting Tor relays is as simple as adding this to the torrc configuration file (an example for 4.5 TB):

  AccountingMax 4500GB
  AccountingRule sum
  Accounting start month 1 0:00
  

  Thanked by 1ScreenReader
• forest Member

  January 21 edited January 21

  In case it is helpful to anyone who wants to seed these as well, this is my current setup for rtorrent, optimized for security (MAC sandboxing, seccomp syscall filtering, systemd sandboxing, and privilege separation). It seems to work well so far.

  Initial setup:

  mkdir -m 700 -p /var/lib/rtorrent/{data,session} /var/log/rtorrent
  adduser --system --group --home /var/lib/rtorrent --no-create-home rtorrent
  chown -R rtorrent:rtorrent /var/{lib,log}/rtorrent
  

  Systemd unit file (/etc/systemd/system/rtorrent.service):

  [Unit]
  Description=rTorrent system daemon
  After=network.target
  
  [Service]
  Type=simple
  User=rtorrent
  Group=rtorrent
  ExecStartPre=-/usr/bin/find /var/log/rtorrent -maxdepth 1 -type f -name 'rtorrent-*.log' -mtime +7 -delete
  ExecStart=/usr/bin/rtorrent -n -o system.daemon.set=true -o import=/etc/rtorrent.conf -O log.open_file=rtorrent.log,(cat,/var/log/rtorrent/rtorrent-,(system.time),.log) -O log.add_output=info,rtorrent.log
  ExecStopPost=/bin/rm -f /var/lib/rtorrent/session/rtorrent.lock
  Restart=on-failure
  AppArmorProfile=rtorrent
  RestartSec=3
  CPUSchedulingPolicy=idle
  IOSchedulingClass=idle
  LogsDirectory=rtorrent
  ProtectKernelLogs=yes
  ProtectKernelModules=yes
  ProtectKernelTunables=yes
  ProtectControlGroups=yes
  ProtectSystem=strict
  ProtectHome=yes
  ProtectHostname=yes
  PrivateDevices=yes
  ReadWritePaths=/var/lib/rtorrent /var/log/rtorrent
  RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
  MemoryDenyWriteExecute=yes
  SystemCallArchitectures=native
  SystemCallFilter=@basic-io @file-system @io-event @network-io @signal @sync @process uname umask ioctl madvise # if there are any crashes, it's probably due to a missing syscall here
  
  [Install]
  WantedBy=multi-user.target
  

  AppArmor profile (/etc/apparmor.d/usr.bin.rtorrent):

  # vim:syntax=apparmor
  #include <tunables/global>
  
  profile rtorrent /usr/bin/rtorrent {
    #include <abstractions/base>
    #include <abstractions/nameservice>
    #include <abstractions/openssl>
    #include <abstractions/ssl_certs>
  
    owner /var/lib/rtorrent/** rw,
    owner /var/log/rtorrent/** w,
    /etc/rtorrent.conf r,
  }
  

  rTorrent configuration file (/etc/rtorrent.conf):

  protocol.pex.set = yes
  protocol.encryption.set = allow_incoming,try_outgoing,enable_retry
  dht.mode.set = auto
  dht.port.set = 50001 # remember to whitelist UDP/50001 in your firewall!
  network.port_range.set = 50000-50000 # remember to whitelist UDP/50000 and TCP/50000 too!
  network.port_random.set = no
  directory.default.set = /var/lib/rtorrent/data
  session.path.set = /var/lib/rtorrent/session
  system.cwd.set = /var/lib/rtorrent
  system.umask.set = 0077
  system.file.allocate = 2
  schedule_remove2 = low_diskspace
  

  Finishing up:

  sudo -u rtorrent rtorrent -n -o import=/etc/rtorrent.conf # add torrents manually from https://annas-archive.li/torrents
  systemctl reload apparmor
  systemctl daemon-reload
  systemctl enable --now rtorrent.service
  

  And now you have a secure, hands-free way to support Anna's Archive on your idlers!

  Thanked by 1uhu
• uhu Member

  January 21

  @marix said:

  @drielsma said:
  Hello, @marix

  Can you add the function SFTP (SSH File Transfer Protocol) to your app/program? I'm currently using Filezilla for this.

  and would also be useful for ftp to be able to choose the folder if you create a host and it doesn't end up straight away in www or root

  pls read readme sftp are include on 1.0.0 version

  Uh-oh, I think marix has been hacked by a human. This is clearly not an LLM generated reply....
• forest Member

  January 21

  @uhu said:

  @marix said:

  @drielsma said:
  Hello, @marix

  Can you add the function SFTP (SSH File Transfer Protocol) to your app/program? I'm currently using Filezilla for this.

  and would also be useful for ftp to be able to choose the folder if you create a host and it doesn't end up straight away in www or root

  pls read readme sftp are include on 1.0.0 version

  Uh-oh, I think marix has been hacked by a human. This is clearly not an LLM generated reply....

  I saw that and was filled with hope, but then I scrolled down one more post and saw "I understand your concern, and this mostly comes down to threat models." and rolled my eyes.
• buzzyLET Member

  January 21

  @forest said:
  In case it is helpful to anyone who wants to seed these as well, this is my current setup for rtorrent, optimized for security (MAC sandboxing, seccomp syscall filtering, systemd sandboxing, and privilege separation). It seems to work well so far.

  Initial setup:

  mkdir -m 700 -p /var/lib/rtorrent/{data,session} /var/log/rtorrent
  adduser --system --group --home /var/lib/rtorrent --no-create-home rtorrent
  chown -R rtorrent:rtorrent /var/{lib,log}/rtorrent
  

  Systemd unit file (/etc/systemd/system/rtorrent.service):

  [Unit]
  Description=rTorrent system daemon
  After=network.target
  
  [Service]
  Type=simple
  User=rtorrent
  Group=rtorrent
  ExecStartPre=-/usr/bin/find /var/log/rtorrent -maxdepth 1 -type f -name 'rtorrent-*.log' -mtime +7 -delete
  ExecStart=/usr/bin/rtorrent -n -o system.daemon.set=true -o import=/etc/rtorrent.conf -O log.open_file=rtorrent.log,(cat,/var/log/rtorrent/rtorrent-,(system.time),.log) -O log.add_output=info,rtorrent.log
  ExecStopPost=/bin/rm -f /var/lib/rtorrent/session/rtorrent.lock
  Restart=on-failure
  AppArmorProfile=rtorrent
  RestartSec=3
  CPUSchedulingPolicy=idle
  IOSchedulingClass=idle
  LogsDirectory=rtorrent
  ProtectKernelLogs=yes
  ProtectKernelModules=yes
  ProtectKernelTunables=yes
  ProtectControlGroups=yes
  ProtectSystem=strict
  ProtectHome=yes
  ProtectHostname=yes
  PrivateDevices=yes
  ReadWritePaths=/var/lib/rtorrent /var/log/rtorrent
  RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
  MemoryDenyWriteExecute=yes
  SystemCallArchitectures=native
  SystemCallFilter=@basic-io @file-system @io-event @network-io @signal @sync @process uname umask ioctl madvise # if there are any crashes, it's probably due to a missing syscall here
  
  [Install]
  WantedBy=multi-user.target
  

  AppArmor profile (/etc/apparmor.d/usr.bin.rtorrent):

  # vim:syntax=apparmor
  #include <tunables/global>
  
  profile rtorrent /usr/bin/rtorrent {
    #include <abstractions/base>
    #include <abstractions/nameservice>
    #include <abstractions/openssl>
    #include <abstractions/ssl_certs>
  
    owner /var/lib/rtorrent/** rw,
    owner /var/log/rtorrent/** w,
    /etc/rtorrent.conf r,
  }
  

  rTorrent configuration file (/etc/rtorrent.conf):

  protocol.pex.set = yes
  protocol.encryption.set = allow_incoming,try_outgoing,enable_retry
  dht.mode.set = auto
  dht.port.set = 50001 # remember to whitelist UDP/50001 in your firewall!
  network.port_range.set = 50000-50000 # remember to whitelist UDP/50000 and TCP/50000 too!
  network.port_random.set = no
  directory.default.set = /var/lib/rtorrent/data
  session.path.set = /var/lib/rtorrent/session
  system.cwd.set = /var/lib/rtorrent
  system.umask.set = 0077
  system.file.allocate = 2
  schedule_remove2 = low_diskspace
  

  Finishing up:

  sudo -u rtorrent rtorrent -n -o import=/etc/rtorrent.conf # add torrents manually from https://annas-archive.li/torrents
  systemctl reload apparmor
  systemctl daemon-reload
  systemctl enable --now rtorrent.service
  

  And now you have a secure, hands-free way to support Anna's Archive on your idlers!

  Couldn't you still get abuse reports for doing this? or are your idlers chosen from the ones that support tor relays and aren't like that
• forest Member

  January 21 edited January 21

  @buzzyLET said:

  @forest said:
  In case it is helpful to anyone who wants to seed these as well, this is my current setup for rtorrent, optimized for security (MAC sandboxing, seccomp syscall filtering, systemd sandboxing, and privilege separation). It seems to work well so far.

  Initial setup:

  mkdir -m 700 -p /var/lib/rtorrent/{data,session} /var/log/rtorrent
  adduser --system --group --home /var/lib/rtorrent --no-create-home rtorrent
  chown -R rtorrent:rtorrent /var/{lib,log}/rtorrent
  

  Systemd unit file (/etc/systemd/system/rtorrent.service):

  [Unit]
  Description=rTorrent system daemon
  After=network.target
  
  [Service]
  Type=simple
  User=rtorrent
  Group=rtorrent
  ExecStartPre=-/usr/bin/find /var/log/rtorrent -maxdepth 1 -type f -name 'rtorrent-*.log' -mtime +7 -delete
  ExecStart=/usr/bin/rtorrent -n -o system.daemon.set=true -o import=/etc/rtorrent.conf -O log.open_file=rtorrent.log,(cat,/var/log/rtorrent/rtorrent-,(system.time),.log) -O log.add_output=info,rtorrent.log
  ExecStopPost=/bin/rm -f /var/lib/rtorrent/session/rtorrent.lock
  Restart=on-failure
  AppArmorProfile=rtorrent
  RestartSec=3
  CPUSchedulingPolicy=idle
  IOSchedulingClass=idle
  LogsDirectory=rtorrent
  ProtectKernelLogs=yes
  ProtectKernelModules=yes
  ProtectKernelTunables=yes
  ProtectControlGroups=yes
  ProtectSystem=strict
  ProtectHome=yes
  ProtectHostname=yes
  PrivateDevices=yes
  ReadWritePaths=/var/lib/rtorrent /var/log/rtorrent
  RestrictAddressFamilies=AF_INET AF_INET6 AF_UNIX
  MemoryDenyWriteExecute=yes
  SystemCallArchitectures=native
  SystemCallFilter=@basic-io @file-system @io-event @network-io @signal @sync @process uname umask ioctl madvise # if there are any crashes, it's probably due to a missing syscall here
  
  [Install]
  WantedBy=multi-user.target
  

  AppArmor profile (/etc/apparmor.d/usr.bin.rtorrent):

  # vim:syntax=apparmor
  #include <tunables/global>
  
  profile rtorrent /usr/bin/rtorrent {
    #include <abstractions/base>
    #include <abstractions/nameservice>
    #include <abstractions/openssl>
    #include <abstractions/ssl_certs>
  
    owner /var/lib/rtorrent/** rw,
    owner /var/log/rtorrent/** w,
    /etc/rtorrent.conf r,
  }
  

  rTorrent configuration file (/etc/rtorrent.conf):

  protocol.pex.set = yes
  protocol.encryption.set = allow_incoming,try_outgoing,enable_retry
  dht.mode.set = auto
  dht.port.set = 50001 # remember to whitelist UDP/50001 in your firewall!
  network.port_range.set = 50000-50000 # remember to whitelist UDP/50000 and TCP/50000 too!
  network.port_random.set = no
  directory.default.set = /var/lib/rtorrent/data
  session.path.set = /var/lib/rtorrent/session
  system.cwd.set = /var/lib/rtorrent
  system.umask.set = 0077
  system.file.allocate = 2
  schedule_remove2 = low_diskspace
  

  Finishing up:

  sudo -u rtorrent rtorrent -n -o import=/etc/rtorrent.conf # add torrents manually from https://annas-archive.li/torrents
  systemctl reload apparmor
  systemctl daemon-reload
  systemctl enable --now rtorrent.service
  

  And now you have a secure, hands-free way to support Anna's Archive on your idlers!

  Couldn't you still get abuse reports for doing this? or are your idlers chosen from the ones that support tor relays and aren't like that

  I'm sure you could get an abuse report in theory, but this is archival rather than straight-up distribution of ready-to-use data, so the chances would be extremely low. The only realistic way you'd get in trouble is if your host hates torrents in general and monitors their network for torrent activity (or looks on places like ipinfo.io to see if their IPs are found on DHT).

  I'd say, if the host literally says "no P2P or torrent applications" then abide by that. Otherwise, don't really worry about DMCA, since the chances that you'll get a DMCA complaint are very low for something like an archival torrent.
• marix Member

  January 21

  @ScreenReader said:

  @marix said:

  @ScreenReader said:

  • slopcode app - check
  • author uses llm to responds & circle around instead of addressing the problem - check

  and then..

  

  • https://www.virustotal.com/gui/file/9082b5678028444ddb611da0085135af4540f31900920a6cdf79e53e0803c2b0/behavior
  • https://www.virustotal.com/gui/file/3122d326c97fdf0ac82262e00bf44a667e12078ab720807a11c1a63fc102867d/behavior

  dunno chief. hard to trust app that wants your ssh private key if they have these kind behavior as opposed to just using /usr/bin/ssh

  a ssh client that rely on node / python package system is a redflag for me. as the app itself can be not malicious but someone else can push credential stealer on the package dependency.

  (...snip...)
  Supply-chain risk in package ecosystems is real, which is why Marix is open source, dependency-pinned, and does not load remote code at runtime. This is the same trust trade-off made by widely-used tools like VS Code and GitHub Desktop.

  IMO open source alone is not enough for a tool like these, what about you add the build system inside the github action itself to be more transparent, so whatever the build artifact is, people can see it's build history? can't have someone stuffing funny stuff inside like the https://tukaani.org/xz-backdoor/

  @forest said:
  @ScreenReader On another note, I just saw your signature about Anna's Archive. I had no idea they allowed volunteering through torrent seeding. That will fit perfectly in the niche of low-RAM, high-bandwidth VPSes I have. The ones with plenty of RAM are already running Hyphanet (a distributed data store which, having been written in the early 2000s, is written entirely in Java), but there are some with 10-100 GB of wasted storage and not enough RAM (or vCPUs) to run Hyphanet.

  I'll set up rtorrent on a dozen or so of my servers and start seeding! Thanks for making me aware of that!

  And if you have any idlers with spare bandwidth, might I suggest you run some Tor middle relays?

  hey thank you for the interest, i've been seeding anna's library for quite some time now but only book collections I'm interested in (like old fiction/magazine). more bandwidth are always welcome.

  as for tor middle relays i'll try to host some. my VPS are mostly in APAC region and the bandwidth are usually spent in syncthing relays. as long as they can be bandwidth-limit i'm sure it's manageable

  Good point — I agree this matters.

  At the moment, releases are already built via CI and tied to specific commits, and the artifacts are not built locally. What’s still missing is making the build workflow more visible and explicitly documented, which I’m updating now so anyone can trace how each binary is produced.

  Thanks for raising the supply-chain angle — it’s a fair concern, especially after incidents like XZ.
• marix Member

  January 21

  
• forest Member

  January 21

  A list of tags has no relevancy to supply chain issues and does not alleviate the previous concerns in any way.
• TimboJones Member

  January 22

  @forest said:

  @zed said:

  @marix said: I also understand that for some users, only long-established, heavily audited tools are acceptable. That’s a valid position, and Marix is not trying to replace those tools.

  It doesn't even matter what you claim (or don't), you're announcing an ssh client and some poor dummy is going to assume "ssh client" is equal to "safe" or "secure" because duh. You're a danger to society, get out.

  It's crazy how LLMs boost people's confidence so much that they become so dangerous to themselves and others. I miss the days when only pathological narcissism and Dunning-Kruger led to this kind of crap.

  I wouldn't be surprised if the CIA was able to get AI companies to use weakened security on purpose.
• marix Member

  January 23

  [1.0.13] - 2026-01-23

  Added

  • Lazy Theme Loading: Terminal themes are now loaded on-demand from JSON files

    • Reduces initial bundle size by ~300KB
    • 7 popular themes inlined for instant access (Dracula, Nord, Monokai, etc.)
    • Other 300+ themes loaded via IPC when selected
    • Improves app startup time
    • Files: themeService.ts, index.ts

  • SFTP Drive Selector: Added drive/disk selection dropdown in local file browser

    • Shows all available drives, partitions, and removable devices
    • Windows: Lists all drive letters with type (Local, USB, Network, CD-ROM)
    • macOS: Shows Macintosh HD, Home, and /Volumes
    • Linux: Detects partitions via lsblk including NTFS, ext4, exFAT, USB drives
    • Unmounted drives shown with "Not mounted" badge
    • Click to mount with automatic polkit/pkexec authentication prompt
    • Refresh button to detect newly plugged USB drives
    • Files: index.ts, DualPaneSFTP.tsx

  • LAN File Transfer Encryption: AES-256-GCM encryption for file transfers

    • All files are now encrypted during LAN transfer
    • Encryption key derived from pairing code via PBKDF2 (100,000 iterations)
    • Removed security warning banner (no longer needed)
    • Files: LANFileTransferService.ts, LANFileTransferPage.tsx

  • LAN File Transfer i18n: Full internationalization support

    • Translated to all 14 supported languages
    • Languages: EN, VI, JA, KO, ZH, ID, FR, DE, ES, TH, MS, RU, FIL, PT
    • Files: All locale JSON files

  Fixed

  • RDP Connection Detection: Fixed "endless waiting" issue when connecting to Windows servers

    • Proper connection detection by parsing xfreerdp stdout for gdi_init_ex
    • 5-second error detection window, then assumes connected
    • 20-second maximum timeout for unresponsive servers
    • File: RDPManager.ts

  • RDP Error Handling: Improved error messages for common RDP failures

    • Authentication failed → "Check username/password"
    • Connection refused → "Check if server is reachable and RDP is enabled"
    • Network unreachable → "Check server address and network connection"
    • Connection timeout → "Server may be behind firewall"
    • Account locked/disabled detection
    • File: RDPManager.ts

  • RDP Session Cleanup: Fixed session not removing when xfreerdp window closes

    • Properly resets activeSessionId when all sessions closed
    • Auto-opens sidebar when last session ends
    • Switches to last active session when current one closes
    • File: App.tsx

  Thanked by 1ricardo777
• marix Member

  January 23

  @forest said:
  A list of tags has no relevancy to supply chain issues and does not alleviate the previous concerns in any way.

  You're correct that version tags alone do not address supply-chain security concerns.

  The tags are provided to improve traceability and transparency for users, not as a claim of full supply-chain verification.

  Given the scope of this project (desktop client, no auto-update, no privileged execution), we currently consider this an acceptable baseline. More advanced measures like reproducible builds and signed artifacts may be explored in the future.
• forest Member

  January 23

  @marix said: Encryption key derived from pairing code via PBKDF2 (100,000 iterations)

  I haven't even looked at it, but if you're doing some kind of kex (which you should be), then there's no need to use PBKDF2. Also, PBKDF2 sucks and has been supplanted by Argon2.
• minitor Member

  January 24

  I think I'm in love , but still has some bugs that need to be fixed
• marix Member

  January 24

  @minitor said:
  I think I'm in love , but still has some bugs that need to be fixed

  Haha, thank you! ❤️
  Definitely still some bugs to squash, but I’m working on improvements every release.
  Your feedback is always welcome!