Engineering deep dives, product updates, and perspectives on SSH security from the Mezite team.
A technical look at the architecture behind rejecting bespoke database and Kubernetes protocol parsing, and why that boundary — not "SSH only" — is what keeps Mezite secure and simple.
Read moreA deep dive into why string-matching your Content-Security-Policy header in tests is dangerous, and how we parse the actual SPA entry document to prevent self-inflicted outages.
Read moreA technical look at our deliberate decision to reject database and Kubernetes proxying, and where we draw the line on what Mezite proxies at all.
Read moreWhat a live cross-tenant probe taught us about the difference between per-pod compute isolation and enforceable network boundaries on Amazon EKS.
Read moreA technical exploration of why Mezite agents use reverse tunnels to connect to the control plane, eliminating inbound firewall rules and simplifying cluster deployments.
Read moreA technical look at our decision to drop CGO and use a pure Go SQLite driver, and the specific query context cancellation patterns required to keep the system robust.
Read moreWhy we mandate ReadHeaderTimeout on all http.Server instantiations in Mezite, and how a one-line oversight can expose your infrastructure to catastrophic resource exhaustion.
Read moreA deep dive into Mezite's audit logging architecture. Discover how we decouple database writes from the fast path to guarantee low latency and high throughput.
Read moreA technical deep dive into how we use TLS ALPN to serve HTTPS, gRPC, reverse tunnels, and SSH all over a single port, simplifying deployment and firewall rules.
Read moreA technical look at our decision to standardize on ECDSA P-256 for CA keypairs, focusing on Go's crypto implementation, entropy handling, and ubiquitous compatibility.
Read moreA technical look at why proxy-based session recording is a flawed architecture for modern infrastructure, and how we implemented node-mode recording at the PTY level in Go.
Read moreToday we are launching Mezite, a self-hosted platform that replaces static SSH keys with certificate-based authentication. Single signed binary, closed source, source-available under enterprise license.
Read moreYour SSH access platform holds the keys to every server in your infrastructure. Here is why it should run on your hardware, in your network, under your control.
Read moreSSH keys have been the default for decades. They are also one of the biggest unmanaged attack surfaces in most organizations. Here is how certificates fix this.
Read more