Comment on Selfhosting Sunday - What's up?
jagged_circle@feddit.nl 4 days ago
Finally installed jellyfin when I realized I could use rclone to mount 10G of free disk space from box (with client side encryption using rclone) on my server.
Very easy to install on Debian, but the plugins are a security nightmare. Jellyfin devs are kinda dumb.
corsicanguppy@lemmy.ca 4 days ago
A LOT of plugins in many projects are a huge concern. I say this as someone who ran security for an OS for a while. It’s just people making bad decisions for everyone and then hand-waving the risks when questioned.
jagged_circle@feddit.nl 4 days ago
I dont mean the plugins themselves but the fact that there’s no way to safely download a plugin.
Even if the plugin really is benign, jellyfin will happily download something inauthentic and malicious befuarse there’s no cryptographic signature checks