For devices that have a remotely accessible GUI listen address with authentication, it would be nice to advertise that to other nodes for remote administration. Those could then display a link in their GUI's respective device box.

I think this would make remote administration much less painful, but of course requires a protocol extension and some logic to find the right address. Basically:

• If the GUI listen address is set to localhost, do not advertise it.
• If set to a specific address, advertise that and bind() to it.
  • TBD: Should an address be allowed where bind() fails? It would be useful for Dynamic DNS, tunnels, or NAT routing, but risks linking to totally unrelated hosts.
• Send a flag to indicate whether the connection requires HTTPS.

On the receiving end:

• Display the advertised address as a link. If 0.0.0.0 was advertised, use the last IP address where a successful direct connection was made.
• If HTTPS is required, the receiving end could try connecting to the port and see if the certificate matches the device.

Does that sound like a reasonable proposal? I'm not familiar with Syncthing's code or Go at all, so I cannot immediately offer taking a stab at implementing any of this.