srsly-0001

> Also this looks like an applet that runs a js vnc client locally and connects you directly various open VNC servers. Its your IP address in those logs and depending on your jurisdiction or policies, may get you in trouble just for visiting the site. Took me a second to realize this. May want a warning here for those at work.

Not quite. The VNC client is noVNC, with a websocket proxy on the same machine http://srsly.de runs on. The connections you make with the web interface will go to our server, be translated from websockets to regular sockets, and then forwarded to the real VNC server. The address they see in their logs is ours.

We don't log access to the VNC client, by the way.

The latter. We didn't know about that bug until now, but we'll probably keep it this way so connections work with any VNC client people might have lying around.

We actually tried a StartSSL certificate, but got OCSP errors with (at least) Firefox. We'll retry the certificate in the (very) near future, maybe it just takes a while for the OCSP information to trickle through after creating a cert.

You are probably right, at least in some jurisdictions. If in doubt, just use the web VNC client (click on the screenshot).

The web client uses our machine to proxy the websocket connection the client uses to the VNC server and we don't collect user data, especially not who used the VNC client to connect to which server.

If that's the case, please retry. We're actively working on the backend of the site and restarting the application sometimes takes a second.

We're using zmap to basically scan 0.0.0.0/0 on ports ranging from 5900 to 5910.

Adresses that have at least one of these open then get passed to a Python script that attempts to connect to those machines and take a screenshot.

The web frontend is built using Go httpd by the way.

Edit: We are able to do this because we're at the 31c3 with an enormeously fast internet connection. The machine this is running on has a 1Gbps connection to the internet.