Security · MiniControl

How your Macs connect

Everything MiniControl does on a server goes through your system ssh: over Tailscale when it’s up, and over your home network when it isn’t. Nothing is relayed through us, and no port is opened on your router.

Keys, not passwords. Server Setup can turn off password logins for ssh, so guessing passwords gets nowhere.
Your own key. Pairing gives each Mac its own key (~/.ssh/minicontrol_ed25519) and pins the server’s host key, so a Mac pretending to be your server is refused.
Tailscale runs on the server from startup, before anyone logs in, and is yours: MiniControl never limits your network.

Pairing

Pairing adds a server with a six-digit code that both screens show. The code comes from both sides’ keys and random values, so someone in between would show a different code on each screen. The Mac asking to pair commits to its value before it sees the server’s, so nobody can keep trying until the codes match. Nothing pairs until you click Allow on the server.

The server lists every paired device in Settings → This Mac. Remove takes a device’s key out again and closes its open sessions. Pairing listens on TCP port 47474, found over Bonjour.

What MiniControl changes on your server

Server Setup shows each change before it makes it, and runs one script in Terminal that asks for the password once. The settings that cost something, the firewall and logging in automatically, are off by default and say what they cost.
Catalog apps install with Homebrew and run as LaunchAgents in your own account, not as root. The app shows the exact install script before it runs, and so does each app’s page.
Restart needs a one-time rule that allows exactly /sbin/shutdown -r now without a password, and nothing else.
Dev Hosts uses a small root-owned helper that only accepts localhost.* names and two addresses, so it can’t redirect real domains.

Updates

Every release is signed with our own Ed25519 key. The app checks that signature, the bundle and the build number before it installs an update, and never installs an older build. A stolen GitHub login alone can’t push code to your Macs. Updates download from GitHub.

What reaches our servers

With Free, nothing. Free never talks to us except to check for updates, and those checks go to GitHub. It needs no account and sends no usage data or crash reports.

With Pro, once billing starts:

Your account: your email address and your plan. You sign in with a link, so there’s no password to leak.
A licence your Macs refresh once a day. If they can’t reach us, Pro keeps working for 14 days.
For offline alerts (coming), a check-in from your server every minute, with a random token, its display name and the time. No IP address is kept, and no service names or stats are sent.

Payments go through Paddle, which handles your card; we never see it. Our servers never send commands to a Mac and never see your data. The privacy policy has the details.

Report a problem