why doesn't codex remote-control use similar noise protocol from codex remote exec-server?
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 125k
- Forks
- 19.4k
- PR merge metrics
- PR metrics pending
Description
The local and remote sides of exec-server connect with a web socket relay server and use noise to achieve end to end encryption, this is necessary because a compromised relay can execute any commands on the remote exec-server.
The local and remote sides of remote-control also connect with a web socket relay server, but it doesn't use noise, instead the relay server transports clear-text json-rpc messages in WSS connection, this means a compromised relay can record all json-rpc traffic and even fool codex app-server to execute any commands and approve permissions.
These two features are similar, remote exec-server is used to connect to remote server from local host, remote-control is used to connect a PC from another mobile device, the latter is probably more sensitive to security, why doesn't it use similar noise protocol design?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Compare the remote exec-server and remote-control websocket relay paths, focusing first on how Noise protects the former and how the latter transports JSON-RPC. Define the required security behavior for remote-control, including protection against relay inspection or command manipulation, and document how it will be verified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- networking, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Active
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100