Security Status of Mesh Central post Ylian and team

[southeasterntech]

Hi All,

We have become quite dependent on Mesh for everything. It's truly an incredible tool. Some of our people have raised concerns lately that Mesh, being open source, might have code exposed and security issues.

When Ylian and team were daily involved, I had no doubts in my mind. I know Ylian said he would no longer be actively developing it, but rather making sure it stayed secure.

1. When was the last comprehensive Pen test\vuln scan or security audit of Mesh?
2. What is the status of current security development
3. Is there a 2024\2025 security hardening guide?

Thanks!
Setech

[marclaporte]

We now have monthly community meetings, so please join us:
https://github.com/Ylianst/MeshCentral/wiki/Community-Monthly-Meetings

[NewUserfromDE]

3. Is there a 2024\2025 security hardening guide?

IMHO this third point a) is and b) is worth a separate thread. And although Marc is right to attend the community meeting for general security discussion this is good for points 1 and 2, but less for point 3, the hardening guide.

So as a reminder at last for me:

• there should be a hardening guide
• I shall discuss this on one of the community meetings
• maybe (re)post this some time in the future as a separate thread

From a strategic point of view IMHO (everything regarding) security is one crucial point for the (further) success of MeshCentral. Being open source (yeah!) creates problems commercial applications don't have, because open sources makes a software easily available:

• more abuse for scam and so on (reasons: free and more modifiable)
• more unsafe setups / more unprepared or uninformed admins (reasons: free(!) - and foreseeable future: turn-key installations and the like. So overall a lower barrier for an own remote access/management server.)

So I'm always attentive, when it comes to security and MeshCentral. And I had the same question (hardening guide) and therefore found this thread ;-)

Conclusion / Reminder: discuss creating a hardening guide

[southeasterntech]

Very much agree!  Shane D. LewisTechnical ***@***.***: 6788076156 x 701   ----- Original message ----- From: "NewUserfromDE" ***@***.***> To: "Ylianst/MeshCentral" ***@***.***> Cc: "Southeastern Technical" ***@***.***>, "Author" ***@***.***> Subject: Re: [Ylianst/MeshCentral] Security Status of Mesh Central post Ylian and team (Discussion #6599)Date: Wed, Jan 29, 2025 7:49 PM CAUTION: This email originated from outside the Southeastern network. Do not click links or open attachments unless you recognize the sender and know the content is safe. This warning was created by Southeastern Technical Information Security Services. Is there a 2024\2025 security hardening guide?IMHO this a) is and b) is worth a separate thread. And although Marc is right to attend the community meeting for general security discussion this is good for points 1 and 2, but less for point 3, the hardening guide.So as a reminder at last for me:there should be a hardening guideI shall discuss this on one of the community meetingsmaybe (re)post this some time in the future as a separate threadFrom a strategic point of view IMHO (everything regarding) security is one crucial point for the (further) success of MeshCentral. Being open source (yeah!) creates problems commercial applications don't have, because open sources makes a software easily available:more abuse for scam and so on (reasons: free and more modifiable)more unprepared or uninformed admins (reasons: free(!) - and foreseeable future: turn-key installations and the like)So I'm always attentive, when it comes to security and MeshCentral. And I had the same question (hardening guide) and therefore found this thread ;-)Conclusion / Reminder: discuss creating a hardening guide—Reply to this email directly, view it on GitHub, or unsubscribe.You are receiving this because you authored the thread.Message ID: ***@***.***>