EdnunpandClaude Fable 5
e0dc2fec94
Root cause found while REPRODUCING the suspected wrong-owner bug in a gate test (the repro failed in a way the theory couldn't explain, and the empirical icacls run showed why): the 5.6 hardening's /T sweep applied (OI)(CI) grants to FILES, where such ACEs are inherit-only — they grant the file itself NOTHING. Every file existing at harden time was left with /inheritance:r + inherit-only ACEs = an effectively EMPTY ACL: unreadable/unwritable by the user, admins, even SYSTEM. That is the Jonathan report (2026-08-06) end to end: profile save "access denied" even elevated, logs unreadable in Notepad, his own icacls /T "fix" adding useless inherit-only ACEs (137 processed, nothing healed), new files fine (echo test), and the service failing to start (SYSTEM can't read a wedged profile). The fix, in layers: - BuildServiceDirAclArgs no longer sweeps /T: the lockdown applies to the FOLDER only. Existing children are rebuilt by a new /reset pass (BuildResetChildrenArgs) as purely- inherited from the hardened folder ACL — real file access again, stale/planted explicit ACEs removed, and it HEALS files wedged by 5.6. Regression-pinned in the gate (the folder args must never contain /T again). - Second bug fixed in the same area: the elevated helper recorded ITS OWN token as the "installing user" — under over-the-shoulder elevation that's the separate admin account whose password was typed, not the person at the keyboard. Elevated verbs now carry --as-user <SID> from the non-elevated app (validated: real user SIDs only — service identities and builtin groups rejected) and install/repair re-record it, so a stale wrong owner can't persist through reinstalls or self-update re-hardens. - Self-heal everywhere: new --repair-service-access verb (re-record owner + re-harden); "Repair service folder access" in the Service menu; a startup write-probe that offers the repair when the folder is broken (settled startup sequence, ForegroundDialog, skipped on --silent); the profile-save UnauthorizedAccessException catch offers it at the exact wall users hit; and the service self-update's existing re-harden now runs the FIXED sequence, so wedged fleet machines heal automatically when 5.8 rolls out — no user action needed. - Logs readable again: Users get read-only on service\logs (inheritable, no /T needed — propagation covers existing files) and on service-events.log. The profile stays locked (it holds the obfuscated password). GrantUsersWriteToBin deleted — the folder ACL's inherited user-Modify covers bin, and the reset wiped its explicit grants anyway. - DoStart/DoStop no longer swallow the reason: exception recorded to service events, and distinct exit codes (6 timeout, 7 SCM refused, 9 repair-didn't-stick) let the dialog say what happened instead of the bare "(code 1)" that cost this diagnosis a day. Gate: new "Service folder repair" step reproduces BOTH bugs for real in a scratch folder — wedges a file with the exact 5.6 spec (proves reads genuinely die), locks the folder to the wrong owner, asserts the app's probe reports broken, runs the exact shipped repair sequence (ApplyServiceDirAcl), and asserts folder writable + wedged file readable again. Plus a SID pass-through step (validation, parse, arg-building, logs-grant shape). 72/72 + relay 7. Docs: Service-menu repair item + troubleshooting entry in readme; About + RELEASE_NOTES rewritten for 5.8; MANUAL regenerated. Version 5.8. NOT released — awaiting Ed's test. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
RemSound
Free Windows app for sending live audio between two computers — across a house, across a city, or anywhere your internet reaches. Encrypted end to end, low delay, great quality, fully accessible to screen-reader users.
Download the latest version · Read the user manual
RemSound is for anyone who wants to get live audio from one Windows PC to another with as little delay as possible — listening to one machine while you work at another, playing music together over the internet, co-hosting a podcast, and plenty more besides.
You sit at one computer, RemSound captures whatever is playing — a track in your music software, a video call, system sound from anything else running — and sends it cleanly to another computer where it plays through speakers or headphones in real time. The person at the other end hears what you're hearing, with a delay measured in milliseconds rather than seconds.
It's also fully accessible. The interface was designed with screen readers (NVDA in particular) in mind from day one. Every button has a keyboard shortcut, every status line is read out clearly, and there are no menus or controls that need a mouse to reach.
Private by default — your audio is encrypted
Everything RemSound sends is encrypted end to end: scrambled the moment it leaves your computer and only unscrambled at the other end, so nobody in between — your internet provider, a shared Wi-Fi, anyone watching the line — can listen in. You no longer need a VPN just to keep a private connection private.
It works with a simple shared password. You and the person you're connecting to use the same password, and only the two of you can hear the audio — get the password wrong and nothing comes through. RemSound stores a password on each profile and walks you through setting one. And it all adds no delay you'd ever notice.
What you can do with it
- Listen to one of your computers from another room. Sit at your laptop and hear what's playing on your desktop. Walk around the house — the sound follows you.
- Play music together over the internet. Two musicians at different houses can play along together with very low delay. Much faster than a video call, fast enough that timing-sensitive playing works.
- Mix everyone as you go. With several people connected, set each person's volume, lean them left or right, and shape their tone with a built-in equaliser (simple 3-band, 12-band graphic, or a full 16-band parametric) — all live, and it's captured in your recordings.
- Send a finished mix to a producer or client in real time, without uploading a file and waiting.
- Record what comes through the connection to WAV, MP3, OGG-Opus, or FLAC — the whole mix, or each person on their own separate track to mix afterwards.
- Give the people you connect to names that stick, and see who's connected and what they're sending at a glance.
- Drive it from the command line. As well as its normal window, RemSound takes command-line options — list your audio devices, run a self-test of the whole capture-to-playback path, write a diagnostics report to send for help, or start straight into a profile from a shortcut or script. See Command-line options in the manual.
Three quality settings, simple choice
Inside RemSound there's just one main decision: which quality and delay you want.
- PCM 48K 24 bit — uncompressed. The best possible sound. Uses about 2.3 megabits a second. Use it when both computers are on the same local network.
- Opus, broadcast quality — loss tolerant. Compressed, very good sound, only 200 kilobits a second. Robust against patchy connections. Use it across the internet.
- Opus, live latency — for jamming and monitoring. Compressed, ultra-low-latency mode. About 5 milliseconds of delay added by the codec itself, very close to PCM. Best when you and the person on the other end are playing along together over a clean network.
How to install it
- Go to the latest release.
- Download the file called
RemSound-v3.3.zip(the version number changes over time — pick whichever is newest). - Extract the zip into a folder of your choice.
- Double-click
RemSound.exeand away you go.
The first time you launch, RemSound will offer to install Microsoft's .NET 10 Desktop Runtime if you don't already have it. Free, just say yes.
After that, RemSound updates itself. Help → Check for updates pulls the next version, or you can tick a box in Preferences and let it install updates quietly in the background.
What you'll need
- Windows 10 or 11. Some users run it successfully on Windows 7, but it's not officially supported there.
- Another person running RemSound on their own Windows machine.
- A way for the two machines to reach each other on the network. Both on the same Wi-Fi works. Both on the same Tailscale network works (free and easy to set up). Or both pointed at the public RemSound relay (also free, no setup).
RemSound on Android
There's a companion Android receiver, so a phone or tablet can pick up RemSound audio — handy for listening on the move while a Windows machine does the sending. It's a separate community project, built and maintained by Aryan Choudhary, who is a screen-reader user himself and has tuned the app for TalkBack. It isn't part of RemSound and isn't maintained by us, but it speaks the same protocol and we're glad to point you to it.
Get it: RemSound Android — Releases — download the latest app-release.apk.
RemSound on iOS
There's also a companion app for iPhone and iPad, currently in beta on Apple's TestFlight. Like the Android app it's a separate community project — built and maintained by Jonathan Schuster — and isn't part of RemSound or maintained by us, but it speaks the same protocol.
Join the beta: RemSound for iOS on TestFlight
Learn how to use it
The full user manual is right here on GitHub: Read the user manual. It covers getting connected for the first time, every setting and what it does, troubleshooting tips, and a glossary at the end. It's the same manual you can press F1 to read from inside RemSound, so you can read it before installing if you want to see what you're getting.
Questions or problems?
File an issue. Bugs and questions are welcome and someone will get back to you.
Who made this
RemSound was built to solve a specific problem: hearing the audio from a powerful computer while sitting at a lighter one, with that powerful machine running remotely. There are other programs that can move audio between PCs, but none of them did it quite the way I wanted, so I built my own. It's free, open-source, and yours to use however you like.
Licence
MIT. See LICENSE.