Selfhosted

60076 readers

657 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam.
Posts here are to be centered around self-hosting. Please ensure it is clear in your post how it relates to self-hosting.
Don't duplicate the full text of your blog or git here. Just post the link for folks to click.
Submission headline should match the article title.
No trolling.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago

MODERATORS

curbstickle@anarchist.nexus

curbstickle_lw@lemmy.world

Sharing Jellyfin (poptalk.scrubbles.tech)

submitted 1 year ago by scrubbles@poptalk.scrubbles.tech to c/selfhosted@lemmy.world

30 comments fedilink hide all child comments

Hi folks. So, I know due to a myriad of reasons I should not allow Jellyfin access to the open internet. However, in trying to switch family over from Plex, I'll need something that "just works".

How are people solving this problem? I've thought about a few solutions, like whitelisting ips (which can change of course), or setting up VPN or tail scale (but then that is more work than they will be willing to do on their side). I can even add some level of auth into my reverse proxy, but that would break Jellyfin clients.

Wondering what others have thought about for this problem

you are viewing a single comment's thread
view the rest of the comments

[–] Darkassassin07@lemmy.ca 2 points 1 year ago

I'm so tired of seeing this overblown reaction to ancient non-news.

Yes, there are some minor vulnerabilities in Jellyfin; but they really really aren't concerning.

Unauthenticated, a random person could potentially (with some prior knowledge of this specific issue, and some significant effort randomly generating media UUIDS to tryout) retrieve/playback some media unauthorized. THATS IT. That's the ONLY real concern. And it's one you could mitigate with a fail2ban filter if you were that worried about it.

The other 'issues' here, are the potential for your already authenticated users to attack each others settings. Who do you share your server with that you're concerned about them attacking each other???

Put this to bed and stop fussing over it. It's genuinely not worth your time or attention. Exposing Jellyfin to the net is fine.

Dev comment on the situation: (4 days ago) https://github.com/jellyfin/jellyfin/issues/5415#issuecomment-2825240290