Collection of potential security issues in Jellyfin This is a non exhaustive list of potential security issues found in Jellyfin. Some of these might cause controversy. Some of these are design fla…

  • Pete Hahnloser@beehaw.org
    link
    fedilink
    English
    arrow-up
    9
    ·
    10 days ago

    Who has the technical wherewithal to run Jellyfin but leaves access on the open web? I get that sharing is part of the point, but no one’s putting their media collection on an open FTP server.

    The level of convenience people expect without consequences is astounding. Going to be away for home for a few days? Load stuff onto an external SSD or SD card. Phoning home remotely makes no sense.

    • Kusimulkku@lemm.ee
      link
      fedilink
      arrow-up
      8
      ·
      9 days ago

      Friends, family using Jellyfin is the reason many have it directly available (and not behind VPN for example).

    • Omgboom@lemmy.zip
      link
      fedilink
      arrow-up
      4
      ·
      edit-2
      9 days ago

      I get that sharing is part of the point, but no one’s putting their media collection on an open FTP server.

      You would be very wrong about that. You can even search open FTP servers using Google

      http://palined.com/search/

      • Pete Hahnloser@beehaw.org
        link
        fedilink
        English
        arrow-up
        2
        ·
        edit-2
        9 days ago

        OK. I’ll revise. No one with any sense is doing this. “Hi, RIAA and MPAA, come after me” is an asinine approach. I realize we have at least one generation unfamiliar with Napster, KaZaa and LimeWire, which replaced ratio FTP servers (which in turn replaced F-Servs in IRC). This is terrible online hygiene. You don’t leave your media out there for all to see. At least password protect access before linking to your friends.

    • jarfil@beehaw.org
      link
      fedilink
      arrow-up
      1
      ·
      8 days ago

      The typical guides for installing Jellyfin and friends, stop at the point where you can access the service, expecting you to secure it further.

      Turns out, the default configuration for many (most) routers, is to allow external access to anything a local service will request it to allow, expecting you to secure it further.

      Leaving it like that, is an explosive combo, which many users never intended to set up, but have nonetheless.