Comment by altano
11 hours ago
I hate people who are demanding of open source projects but... doing performance improvements and adding comic book support before making the product secure enough to expose to the internet is wild prioritization and I don't know what else to say.
Or release native clients that can use OIDC.
Doing neither sucks =[.
What have you contributed to the project?
Just use Tailscale. It’s always 1 day away from an 0-day anyway.
You can either require mesh vpn or make it easy for friends to access your library. You can't have both.
Then whitelist their ASN.
I stay purely home network, as I suspect most do. So although I can see your use case, I can also understand why it's not a bigger priority than those other features.
Sorry, but you are being one of those people there. Open source development lives on intrinsic motivation and community. If those things which you want, aren't things that motivate other to donate their free time to, you can implement them yourself, you can try throwing money at people to do it for you, you can take other unwanted chores from them to free their time, but you really ought not push negativity lime this.
I've had my instance on the internet for years without issue. (Tailscale is great for me, but not feasible for family)
What about it is insecure with regards to exposing it to the internet?
There's nothing wrong with exposing it to the internet.
There have been exploits: https://github.com/jellyfin/jellyfin/security
The project is a fork of another project (Emby) and there has always been potential for user-supplied data ending up in command-line arguments, or exploitation of the (admin) user getting to upload various files. Nonetheless, all reported security bugs have been fixed promptly, and they're proactively sweeping through the full set of APIs they inherited, looking for possible exploit paths.
Most exploits required an authenticated user.
If you're concerned about this, you should run Jellyfin's docker image, with read-only mounts of your media library, and only give accounts to people you trust, which is how you should treat your personal media library anyway.
https://github.com/jellyfin/jellyfin/issues/5415
A lot of Jellyfin's API doesn't require any authentication at all, as an example.
> ...
> Is this a massive red-flag security risk that actively exposes your data to the Internet? No.
>> At this point, this over-4-year-old issue has gotten posted to HackerNews more than enough times and gotten quite enough unhelpful peanut-gallery comments like those above..
I think they are confusing Jellyfin with the crazy exploits in Plex recently.