Selfhosted
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
view the rest of the comments
You can share jellyfin over the net.
The security issues that tend to be quoted are less important than some people claim them to be.
For instance the unauthorized streaming bug, often quoted as one of the worst jellyfin security issues, in order to work the attacker need to know the exact id of the item they want to stream, which is virtually impossible unless they are or have been an authorized client at some point.
Just set it up with the typical bruteforce protections and you'll be fine.
Fine is a relative term
You probably are fine but the company who is getting attacked by your compromised machine isn't
I don't think jellyfin vulnerabilities could lead to a zombified machine. At least I've not read about something like that happening.
Most Jellyfin issues I know are related to unauthorized API calls of the backend.
I think it is a matter of time honestly.
Jellyfin has grown enough in popularity that it is likely a target for a state actor looking to create some minions. Just because there isn't any known remote code execution vulnerabilities doesn't mean there couldn't be one in the future.
Maybe I'm being paranoid but it seems way safer to just not expose Jellyfin.
Any software can have zero-day exploits for that matter.
That's is absolutely true
Avoid exposing things unless you really need to and follow best practices.
It's not impossible, Far from it. The ids are not random uuids but hashes derived from the path. Since most people have a similar setup to organize their media, this gets trivial very fast
If you're worried about it, make sure to not use a default path. Then legit clients are fine but these theoretical attackers get stymied.
What? Why would I have to make my library harder to manage just because Jellyfin devs can't get their act together? They should just start a api/v2 and secure it properly while allowing to disable the old one
I’m with you that you shouldn’t have to, but putting your media directory one level up in a randomly generated directory name isn’t too bad. ~/[random uuid]/media/… may not be a terrible idea in any case.
This. Just setup fail2ban or similar in front of Jellyfin and you'll be fine.