# Hacker week: What we've been up to this time around **URL:** \ **Category:** Blog\ **Created:** [16 September 2026 06:39 UTC](https://community.thinlinc.com/t/hacker-week-what-weve-been-up-to-this-time-around/2079 "2026-09-16T06:39:16Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![matre](https://dub1.discourse-cdn.com/flex005/user_avatar/community.thinlinc.com/matre/32/732_2.png) [@matre](https://community.thinlinc.com/u/matre)\ **Post date:** [16 September 2026 06:39 UTC](https://community.thinlinc.com/t/hacker-week-what-weve-been-up-to-this-time-around/2079/1 "2026-09-16T06:39:17Z")
A couple of times a year the ThinLinc development team at Cendio sets aside a week to step away from the regular road map. We call it _hacker week_. The result is usually a mix of bug fixes across the product, new features (some of which you have been asking for), and smaller improvements that nobody thinks to request but everyone appreciates once they’re there. > “You can’t schedule every good idea months in advance. Hacker week gives our team the freedom to spot a rough edge and just fix it on the spot, so our customers get a smoother experience.” > _Samuel Mannehed, CTO_ Here’s a couple things that came out of this latest round: ### Port forwarding restrictions ThinLinc tunnels its traffic through local SSH port forwarding, and until now there was no supported way to restrict which ports a user could forward. This is something customers have been asking for and it is yet another tool for the sysadmins to further secure the OpenSSH server. The agent can now update the OpenSSH server configuration so that only the ports needed by currently active sessions are permitted, and each port is tied to the user it belongs to. The path to the `sshd_config` file is configurable, so the agent can write to a separate included file instead of touching a base config potentially managed by Ansible or Puppet. Configuration file `/opt/thinlinc/etc/conf.d/ssh.hconf`: ```ini [/ssh] restrict_sshd_config=/etc/ssh/restrictions ``` Before a connection in the restriction file `/etc/ssh/restrictions`: ```bash # @thinlinc-begin@ # @thinlinc-end@ ``` During a connection in the restriction file `/etc/ssh/restrictions`: ```bash # @thinlinc-begin@ Match User "matre" PermitOpen 127.0.0.1:5910 # @thinlinc-end@ ``` Once set up, the agent takes care of everything. Ports are added as users connect and are removed when sessions end. This will of course ship with documentation carefully crafted by @wilsj and @Zeijlon. They both had some choice words regarding this customer driven feature they cooked up together: > “It felt great to pick this up after being away from core development for a while, especially as it’s been a long-standing feature request from one of our larger customers.” > _William Sjöblom, Technical Presales Manager_ @Zeijlon, who dug into the kernel side of things to make the restriction airtight, added: > “Solving a problem built on actual customer feedback is always motivating, particularly when the goal is securing their ThinLinc setup.” > _Alexander Zeijlon, Developer_ ### Configuration restructuring Previously, the `/vsmagent/xserver_args` was perceived as complicated and not as intuitive as we would like. So, to make an array of settings more approachable, @CendioOssman moved a bunch of server parameters out of `/vsmagent` and into more logical locations. The idea is to use `/vsmagent` only for stuff directly related to the service itself, not every session related setting that previously happened to end up there. ![session-hconf](https://europe1.discourse-cdn.com/flex005/uploads/thinlinc/original/2X/9/90cf60ac59ae9054f29e8e085e716c6951390acd.png) ### Command line tool improvements The installer and `tl-setup` now accept a `--textmode` flag so you can explicitly run them without a GUI. Before, you had to rely on undocumented behavior to get text mode when a graphical environment was available. This has been requested by users with a workflow mixing terminal usage with graphical applications, such as a terminal accompanied by a web browser. ![installer-textmode](https://europe1.discourse-cdn.com/flex005/uploads/thinlinc/original/2X/3/3040005140ad105ab0ff84ec2391fdbc3dfa4466.png) Our command-line management tool `tlctl` also got some love with a better tab completion, along with a clearer license status information. Other than that, the display number is displayed in `tl-session`’s process title now. This makes it much easier to tell sessions (specifically multi-sessions) apart in `ps` output. ![image](https://europe1.discourse-cdn.com/flex005/uploads/thinlinc/original/2X/4/4b2e995e94875fa43bf05b16f57cfa26855d64e3.png) ### Small UX improvements The native client now shows when Caps Lock is active. Web Access already had this, so it was about time the native client caught up. ![caps-lock](https://europe1.discourse-cdn.com/flex005/uploads/thinlinc/original/2X/d/db263e580b6d40384b87a582139597b552b28bb1.png) We also went through the client’s dialogs and made sure the default buttons always point to the non-destructive option, and destructive actions can no longer be triggered by a single keypress. In Web Access, the PAM prompt buttons now get focused when there’s no input field, so you can just press Enter instead of reaching for the mouse. ### Legacy code removal and developer pipeline cleanup We removed `homecreatefilter`, `tlclient.cgi`, and `make_homedir`, as we believe these once great functions had their heyday come and go. Me, @linn, @CendioOssman and @frifl performed most of this autumn cleanup. If you use any of these, feel free to surprise us by letting us know! In return, we’ll offer you mitigations better suited for the job. 🙂 Also, quite a few not so user-facing changes have happened, too. This essentially means that we slimmed down our internal build and test pipeline. Faster CI and fewer manual testing steps means faster development. ## What’s still cooking Not everything was wrapped up during the week, but I’ll offer you a sneak peek of _some_ of the other features being worked on: ### Fade to black Before this, you might have noticed that an idle session would just go… _poof_ when the timeout hit. A patch has been drafted for upstream TigerVNC that fades the screen to black first, giving you a chance to wiggle the mouse before it’s too late. @adaha may have blasted a specific Metallica song during the development. ![fade-to-black](https://europe1.discourse-cdn.com/flex005/uploads/thinlinc/original/2X/6/6e7d61394a8492fcf8828dad1b0b8548211ea27c.gif) ### Web Access multi-session support If you have multiple sessions on the server, the idea is that Web Access should be able to list them and let you pick which one to reconnect to. Until now this was only possible in the native client. Great work so far, @tobias, just the remaining 90% now to wrap it up. 🙂 ![web-access-multi-session](https://europe1.discourse-cdn.com/flex005/uploads/thinlinc/original/2X/9/9b035d940d5d6920e433af1e73179061d16a4c12.png) ### Dark mode in Web Access No, dark moders, you are not forgotten. We are well aware that the otherwise lovely web client may appear **bright**. Rest assured, this is something @madni took upon herself to tackle. She is working together with a designer to get the design _just right_. Here’s a peek of the login prompt, back in black: ![darkmode](https://europe1.discourse-cdn.com/flex005/uploads/thinlinc/original/2X/9/9271d815372942d47becc30946fa6c1f9ac222e0.png) ### One more thing… @hanli and our new development manager Mikael Holm have been cooking up something we’re thrilled about. We’re not ready to show it off just yet, but let’s just say it will give users a more fine grained control over what kind of environment they connect to. Check back soon for a dedicated post about this one! * * * That’s the harvest from this hacker week. Some of these will ship in the near future, others might need another round or two. Several of these new features originate from requests from _you_, so keep letting us know what you would like to see in the upcoming releases! We appreciate any feature requests in the following channels: ```auto https://community.thinlinc.com https://bugzilla.cendio.com contact@cendio.com ``` ---
**Author:** ![jeanz](https://dub1.discourse-cdn.com/flex005/user_avatar/community.thinlinc.com/jeanz/32/25_2.png) [@jeanz](https://community.thinlinc.com/u/jeanz)\ **Post date:** [16 September 2026 06:46 UTC](https://community.thinlinc.com/t/hacker-week-what-weve-been-up-to-this-time-around/2079/2 "2026-09-16T06:46:39Z")
Great job, Cendio team! Proud to see what you’ve accomplished! Beautiful text @matre ! ---
**Author:** ![pira](https://dub1.discourse-cdn.com/flex005/user_avatar/community.thinlinc.com/pira/32/35_2.png) [@pira](https://community.thinlinc.com/u/pira)\ **Post date:** [16 September 2026 12:35 UTC](https://community.thinlinc.com/t/hacker-week-what-weve-been-up-to-this-time-around/2079/3 "2026-09-16T12:35:49Z")
Is there still a way to supply custom Xvnc args with the new scheme? We have historically when needed enabled more logging and the ability for Xvnc to generate coredumps. ---
**Author:** ![wilsj](https://dub1.discourse-cdn.com/flex005/user_avatar/community.thinlinc.com/wilsj/32/554_2.png) [@wilsj](https://community.thinlinc.com/u/wilsj)\ **Post date:** [17 September 2026 10:03 UTC](https://community.thinlinc.com/t/hacker-week-what-weve-been-up-to-this-time-around/2079/4 "2026-09-17T10:03:01Z")
After these changes, we have dedicated configuration for the following `Xvnc` parameters: `-noclipboard`, `-AcceptCutText`, `-SendCutText`, `-IdleTimeout`, `-MaxIdleTime`, `-MaxConnectionTime`, `-MaxDisconnectionTime`, and `-listen tcp`. There will still be ways to accomplish what you want after this change, but we are careful about documenting them, as editing the raw `Xvnc` arguments has historically been a source of hard-to-troubleshoot errors and should not be needed in 99% of use cases (given the new parameters). Besides that, it’s far from optimal UX. > enabled more logging Based on my support experiences, a higher `Xvnc` verbosity rarely provides more useful context. That’s the reason it was not moved to a separate parameter. Has the added verbosity been of use when troubleshooting your installation? > the ability for Xvnc to generate coredumps Would you mind providing some more context here? What extra arguments were needed for this? To reiterate, there will still be ways to accomplish what you are after. Moreover, we are very much open to adding further parameters down the line when new use cases are discovered. ---
**Author:** ![pira](https://dub1.discourse-cdn.com/flex005/user_avatar/community.thinlinc.com/pira/32/35_2.png) [@pira](https://community.thinlinc.com/u/pira)\ **Post date:** [17 September 2026 10:55 UTC](https://community.thinlinc.com/t/hacker-week-what-weve-been-up-to-this-time-around/2079/5 "2026-09-17T10:55:10Z")
I believe that one must specify `-core` for Xvnc to generate core-dumps on crash. ---
**Author:** ![wilsj](https://dub1.discourse-cdn.com/flex005/user_avatar/community.thinlinc.com/wilsj/32/554_2.png) [@wilsj](https://community.thinlinc.com/u/wilsj)\ **Post date:** [18 September 2026 08:13 UTC](https://community.thinlinc.com/t/hacker-week-what-weve-been-up-to-this-time-around/2079/6 "2026-09-18T08:13:46Z")
> I believe that one must specify -core for Xvnc to generate core-dumps on crash. Right. Is this something that is part of your regular troubleshooting workflow, or have you mainly needed these when in contact with our support in the past? In case of the latter, us staff will have an easier time judging if/when a configuration parameter for `-core` is needed (since we’ll be in the loop). Since ThinLinc’s `Xvnc` is GPL licensed, you can build it with debug symbols and analyze the core dumps yourself. But this is not something I really see people doing on the regular. I’d happily be proven wrong here though 🙂 ---
**Author:** ![pira](https://dub1.discourse-cdn.com/flex005/user_avatar/community.thinlinc.com/pira/32/35_2.png) [@pira](https://community.thinlinc.com/u/pira)\ **Post date:** [18 September 2026 08:20 UTC](https://community.thinlinc.com/t/hacker-week-what-weve-been-up-to-this-time-around/2079/7 "2026-09-18T08:20:00Z")
We have mainly used it for sending core-dumps to cendio support.