5 ms·
I hate people who are demanding of open source projects but... doing performance improvements and adding comic book support before making the product secure eno
by altano 9d ago
I hate people who are demanding of open source projects but... doing performance improvements and adding comic book support before making the product secure enough to expose to the internet is wild prioritization and I don't know what else to say.
Or release native clients that can use OIDC.
Doing neither sucks =[.
- VladVladikoff 9d agoJust use Tailscale. It’s always 1 day away from an 0-day anyway.
- altano 9d agoYou can either require mesh vpn or make it easy for friends to access your library. You can't have both.
- sgc 9d agoI stay purely home network, as I suspect most do. So although I can see your use case, I can also understand why it's not a bigger priority than those other features.
- VladVladikoff 9d agoThen whitelist their ASN.
- nearlyepic 9d agoWhat about it is insecure with regards to exposing it to the internet?
- jaimex2 9d agoI think they are confusing Jellyfin with the crazy exploits in Plex recently.
- amiga386 9d agoThere's nothing wrong with exposing it to the internet. There have been exploits: https://github.com/jellyfin/jellyfin/security https://github.com/jellyfin/jellyfin/security The project is a fork of another project (Emby) and there has always been potential for user-supplied data ending up in command-line arguments, or exploitation of the (admin) user getting to upload various files. Nonetheless, all reported security bugs have been fixed promptly, and they're proactively sweeping through the full set of APIs they inherited, looking for possible exploit paths. Most exploits required an authenticated user. If you're concerned about this, you should run Jellyfin's docker image, with read-only mounts of your media library, and only give accounts to people you trust, which is how you should treat your personal media library anyway.
- altano 9d agohttps://github.com/jellyfin/jellyfin/issues/5415 https://github.com/jellyfin/jellyfin/issues/5415 A lot of Jellyfin's API doesn't require any authentication at all, as an example.
- gloflo 9d ago> ... > Is this a massive red-flag security risk that actively exposes your data to the Internet? No. > > At this point, this over-4-year-old issue has gotten posted to HackerNews more than enough times and gotten quite enough unhelpful peanut-gallery comments like those above..
- thesh4d0w 9d agoI've had my instance on the internet for years without issue. (Tailscale is great for me, but not feasible for family)
- deleted 9d ago[deleted]
- gloflo 9d agoSorry, but you are being one of those people there. Open source development lives on intrinsic motivation and community. If those things which you want, aren't things that motivate other to donate their free time to, you can implement them yourself, you can try throwing money at people to do it for you, you can take other unwanted chores from them to free their time, but you really ought not push negativity lime this.
- altano 8d agoYeaaahhhhhh, you’re totally right
- iAMkenough 9d agoWhat have you contributed to the project?
- lordfrikk 8d agoYou hate it so much that you're doing it yourself?