Comment by weedfroglozenge
4 days ago
The bigger reason is Sonarr and Radarr opens you up to a plethora of attack vectors and realistically at this point you're probably already compromised.
4 days ago
The bigger reason is Sonarr and Radarr opens you up to a plethora of attack vectors and realistically at this point you're probably already compromised.
I don't see how. I run them with no public ingress, no plugins or mods. I don't torrent. I'm not sure there's really any attack vector worth worrying about. Certainly no more than many of the other services I host.
https://news.ycombinator.com/item?id=50108872
Unless there's a bug where jellyfin or plex decides to execute a random exe it tries to index, exploitation seems unlikely.
1 reply →
That’s been a thing for years. No one is actually running the exes, or at least they shouldn’t be. Its such a simple thing to prevent too…
Simply put, skill issue. Never ran into anything like this when using reputable private trackers and indexers.
what the hell are you smoking? even the silly article earlier had the caveat "Yeah it downloads EXEs but its up to you or your family to run them"
and that's totally ignoring the fact that it's only a supremely naive user that hasn't yet refined their filters to exclude dangerous extensions (or, if they're too lazy to do that, rely on one of the many many pre-assembled filter/grabber settings across the net which already do so.)
what fear-mongering and FUD-spread.
You may also want to warn the public about the dangers of having curl, wget, python or gcc installed.
They expose a PLETHORA of attack vectors! you're probably already compromised, realistically!"
... and they're actually more dangerous than a free-floating EXE.