4 ms·
I hate people who are demanding of open source projects but... doing performance improvements and adding comic book support before making the product secure eno
by altano 24d ago
I hate people who are demanding of open source projects but... doing performance improvements and adding comic book support before making the product secure enough to expose to the internet is wild prioritization and I don't know what else to say.
Or release native clients that can use OIDC.
Doing neither sucks =[.
- nearlyepic 24d agoWhat about it is insecure with regards to exposing it to the internet?
- amiga386 24d agoThere's nothing wrong with exposing it to the internet. There have been exploits: https://github.com/jellyfin/jellyfin/security https://github.com/jellyfin/jellyfin/security The project is a fork of another project (Emby) and there has always been potential for user-supplied data ending up in command-line arguments, or exploitation of the (admin) user getting to upload various files. Nonetheless, all reported security bugs have been fixed promptly, and they're proactively sweeping through the full set of APIs they inherited, looking for possible exploit paths. Most exploits required an authenticated user. If you're concerned about this, you should run Jellyfin's docker image, with read-only mounts of your media library, and only give accounts to people you trust, which is how you should treat your personal media library anyway.
- jaimex2 24d agoI think they are confusing Jellyfin with the crazy exploits in Plex recently.
- altano 24d agohttps://github.com/jellyfin/jellyfin/issues/5415 https://github.com/jellyfin/jellyfin/issues/5415 A lot of Jellyfin's API doesn't require any authentication at all, as an example.
- gloflo 24d ago> ... > Is this a massive red-flag security risk that actively exposes your data to the Internet? No. > > At this point, this over-4-year-old issue has gotten posted to HackerNews more than enough times and gotten quite enough unhelpful peanut-gallery comments like those above..
- VladVladikoff 24d agoJust use Tailscale. It’s always 1 day away from an 0-day anyway.
- altano 24d agoYou can either require mesh vpn or make it easy for friends to access your library. You can't have both.
- sgc 24d agoI stay purely home network, as I suspect most do. So although I can see your use case, I can also understand why it's not a bigger priority than those other features.
- VladVladikoff 23d agoThen whitelist their ASN.
- thesh4d0w 24d agoI've had my instance on the internet for years without issue. (Tailscale is great for me, but not feasible for family)
- deleted 24d ago[deleted]
- gloflo 24d agoSorry, but you are being one of those people there. Open source development lives on intrinsic motivation and community. If those things which you want, aren't things that motivate other to donate their free time to, you can implement them yourself, you can try throwing money at people to do it for you, you can take other unwanted chores from them to free their time, but you really ought not push negativity lime this.
- altano 23d agoYeaaahhhhhh, you’re totally right
- iAMkenough 23d agoWhat have you contributed to the project?
- lordfrikk 23d agoYou hate it so much that you're doing it yourself?