I updated post #20 with a massively overhauled version of my script, which features:

1. Organization (go functions!)
2. Extensive, optional sanity checks--mostly to help "future me" get things working on my (helper) end
3. @fungus - Default/initial variable values less prone to optical illusions

BTW, I tried the script with firewall active on my machine and only port 22 open. Script worked. Script also worked with router forwarding nothing but port 22. I think this proves that the remote desktop session is traveling within the SSH tunnel.

Ralph, please forgive me for asking a newbie question (I don't have much experience with SSH).

Can you confirm that using this setup the VNC connection would be encrypted?

@ralph.ronnquist - Haha, I think I found enough magic to go around! Read on...

There was one reason to keep pursuing the old-fashioned way: With gitso the connection is unencrypted. So I kept pushing and finally figured it out. It's a bit complicated--involves leaving two terminals open on each end--but it works, requires no configuration on helpee's end, is through an encrypted tunnel, and uses only free software. Totally worth my splitting headache

Setup:
- Packages on gnuser/helper's computer: ssh and vinagre
- Configuration on gnuser/helper's router: Forward ports 22 and 5500 to gnuser/helper's machine

- Necessary packages on motherinlaw/helpee's computer: ssh and x11vnc
- Configuration steps on motherinlaw/helpee's computer/router: none

Steps:
1. Helpee opens up a terminal:

motherinlaw$ x11vnc

2. Helpee opens up a second terminal:

motherinlaw$ ssh -R 7000:localhost:22 gnuser@<gnuser's public ip address>
[motherinlaw types gnuser's password]

Helpee leaves her two terminals open and waits.

3. Helper opens up a terminal:

gnuser$ ssh motherinlaw@localhost -p 7000
[gnuser enters motherinlaw's password]

4. Helper opens up a second terminal:

gnuser$ ssh -L 5901:localhost:5900 motherinlaw@localhost -p 7000
[gnuser enters motherinlaw's password again]

Helper leaves his two terminals open.

5. Now helper goes to application menu, internet submenu, and selects "Remote Desktop Viewer" (that's how vinagre shows up in the menus).
Click "Connect"
Choose "VNC" protocol
in Host window, type: localhost:5901
click Connect

Bingo!

I played around for many hours today. I was able to establish a reverse SSH connection, but couldn't get VNC to work over it.

However, I managed to get gitso to work and it is perfect for what I need: Nothing for my MIL to do other than type in my public IP address (which I'd tell her over the phone)

The problem was that despite forwarding of port 5500 being setup in my router and, on my laptop, "nmap <mylocalip>" showing 5500 open while gitso is running, a remote desktop connection could not be established. Also, canyouseeme.org kept saying that port 5500 was closed. I was on the verge of calling my ISP to see if they were blocking traffic on this port for some reason.

After hours going round and round, typing this into a terminal on my laptop fixed everything:

sudo iptables -I INPUT -p tcp -m tcp --dport 5500 -j ACCEPT

It's odd that nmap lies about the port being open. It's also odd that the kernel was blocking traffic on that port even though I'm not running a firewall on the laptop. (EDIT: It turned out that there was a firewall running on my laptop after all. "sudo ufw disable" turned it off, and now I no longer need the above iptables command.)

To summarize, gitso turned out to be exactly what I was looking for, and this is how to make it work:
1. Get a static local ip for your machine (many ways to do this--either through router or, probably easier, through your network manager)
2. Configure your router to forward port 5500 to your machine's static local ip (how to do this varies depending on your router firmware)
3. Make sure you don't have a firewall running on your machine (e.g., if "sudo ufw status" says firewall is active, do this: "sudo ufw disable")
4. Install gitso from Devuan's official repository, start it (in MATE, it shows up in the Internet submenu), chose "Give support"
5. Ask your friend who needs help to install gitso, start it, choose "Get help", and enter your public ip address (output of "wget http://ipinfo.io/ip -q -O -" on your machine)

@ralph.ronnquist @fsmithred - I'd love to learn that approach, catch is that I need to figure out how to set it up with reverse tunneling, the way gitso does it. I can't expect MIL to be of any help on her end. I'm going to have to chew on this.

I really appreciate all your input. Until this thread, I didn't even know that doing a reverse connection with all the configuration on the "helper" end was possible. That's exactly what I'm looking for!

Many thanks!

Thanks, nixer, but I'm looking for free as in free speech (libre), not free as in free beer (gratis). The combination of libre + easy to use is what's making the search challenging.

If all I needed were gratis + easy to use, I'd go with Teamviewer. The problem is that Teamviewer is not libre (i.e., it's proprietary/closed source) so I don't trust it enough to install it on someone else's computer.

Money is not the issue. The issue is trust.

Okay, so the xhci_hcd kernel module (previously known as simply xhci) has long been known to cause GNU/Linux to have insomnia. Create /etc/pm/config.d/00sleep_well_baby_gnu with only this in it...

SUSPEND_MODULES="xhci_hcd"

...and problem vanishes! The above unloads the troublesome kernel module just before system tries to suspend. The module is automatically reloaded when the system resumes, so I had no problem using my ExpressCard after resuming.

@ralph.ronnquist - Thanks for pointing me in the right direction!

Update: I booted into my Debian Jessie partition on this same machine and tried suspending several times. No problems on either AC or battery power.

Thanks, garyz, but I don't use wicd. I use network-manager.

I figured out a workaround. It doesn't actually run my script before every wifi connection, but does run the script before connecting to wifi at two critical times: after boot and after resuming from suspend. That's good enough for what I need.

Two scripts are required:

#!/bin/bash

# Save this one as /etc/init.d/jobs-preconnect

### BEGIN INIT INFO
# Provides:          jobs-preconnect
# Required-Start:    $remote_fs dbus udev
# Required-Stop:     $remote_fs dbus udev
# Should-Start:	     $syslog
# Should-Stop:       $syslog
# X-Start-Before:    network-manager
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: bruno's jobs-preconnect
# Description:       jobs to run before network-manager starts
### END INIT INFO

[ "$1" = "start" ] && /path/to/preconnect/script

#!/bin/bash

# Save this one as /etc/pm/sleep.d/33jobs-preconnect

if [[ "$1" = "resume" ]]; then
	service network-manager stop 
	bash /path/to/preconnect/script
	service network-manager start
fi

Then run these commands in a terminal as root:

chown root /etc/init.d/jobs-preconnect
chmod 755 /etc/init.d/jobs-preconnect
update-rc.d jobs-preconnect defaults
chown root /etc/pm/sleep.d/33jobs-preconnect
chmod 755 /etc/pm/sleep.d/33jobs-preconnect

Thanks for the tip, golinux. I was able to read the post.

Fungus, your post is clearly political and tangential. I don't see what neoliberalism, veganism, and political correctness have to do with this thread. If this forum's rules prohibit political/tangential posts, then the post is inappropriate and golinux is just doing his job. Nevertheless, I agree with you that the rules need to apply to all forum/list users and that certain users should not be singled out.

BTW, I hope you realize that you are convicting yourself of selfishness and saying that you don't deserve to use Devuan when you write: "individuals who do use open/free software, do they deserve it?  In my perception no, because they are doing it just for their own selfish interests." You do realize that Debian and Devuan's core is all free software? The main repository consists of nothing but free software It all goes back to Debian's founding: "The Debian Project is an association of individuals who have made common cause to create a free operating system."

As for "self restricting", we all do it: We don't associate with certain people or use certain things in the interest of avoiding harm or potential for harm. The potential for harm in using proprietary software is well documented and I'm not going to rehash that here. If your point is that free software in userspace is of little use when things are proprietary closer to metal (BIOS and firmware), then I completely agree and that's why I'm not going to waste time and effort to hop from compromised phone to compromised phone.

---

Anyway, back to the main topic of the thread: I hope the Librem 5 proves to be the holy grail phone that's fully functional and uses only free software from the bootloader on up, but I guess we'll have to wait and see.

If Purism makes compromises when they hit road blocks, theirs will be just another "security and privacy focused" "mostly free" phone. I think such devices are doomed from the start because most potential users (folks who care about privacy) already have a "mostly free" device that they've configured to be "security and privacy focused".

Thanks, fungus. I'll look into udoo, but my guess is that it isn't 100% libre given that I couldn't find it anywhere on FSF's lists.

The only fully free phone OS I am aware of is Replicant. I've tried Replicant 6 on a few phones but I couldn't get any of them to recognize my SIM card, making the phones useless.

I'm going to hold on to my current "compromised" phone until I have something that runs only free software and, unlike Replicant, actually works for me.