It’s not impossible, Far from it. The ids are not random uuids but hashes derived from the path. Since most people have a similar setup to organize their media, this gets trivial very fast
Comment on Sharing Jellyfin
daniskarma@lemmy.dbzer0.com 11 months ago
You can share jellyfin over the net.
The security issues that tend to be quoted are less important than some people claim them to be.
For instance the unauthorized streaming bug, often quoted as one of the worst jellyfin security issues, in order to work the attacker need to know the exact id of the item they want to stream, which is virtually impossible unless they are or have been an authorized client at some point.
Just set it up with the typical bruteforce protections abd you’ll be fine.
MaggiWuerze@feddit.org 11 months ago
synestine@sh.itjust.works 11 months ago
If you’re worried about it, make sure to not use a default path. Then legit clients are fine but these theoretical attackers get stymied.
MaggiWuerze@feddit.org 11 months ago
What? Why would I have to make my library harder to manage just because Jellyfin devs can’t get their act together? They should just start a api/v2 and secure it properly while allowing to disable the old one
synestine@sh.itjust.works 11 months ago
Ah, so you’re the kind who loves bitching about things online, but won’t lift a finger to defend themself, gotcha.
What I mentioned prior doesn’t change anything about library management in the slightest, you just wanted an excuse.
blitzen@lemmy.ca 11 months ago
I’m with you that you shouldn’t have to, but putting your media directory one level up in a randomly generated directory name isn’t too bad. ~/[random uuid]/media/… may not be a terrible idea in any case.
possiblylinux127@lemmy.zip 11 months ago
Fine is a relative term
You probably are fine but the company who is getting attacked by your compromised machine isn’t
daniskarma@lemmy.dbzer0.com 11 months ago
I don’t think jellyfin vulnerabilities could lead to a zombified machine.
Most Jellyfin issues I known are related to unauthorized API calls of the backend.
possiblylinux127@lemmy.zip 11 months ago
I think it is a matter of time honestly.
Jellyfin has grown enough in popularity that it is likely a target for a state actor looking to create some minions. Just because there isn’t any known remote code execution vulnerabilities doesn’t mean there couldn’t be one in the future.
Maybe I’m being paranoid but it seems way safer to just not expose Jellyfin.
daniskarma@lemmy.dbzer0.com 11 months ago
Any software can have zero-day exploits for that matter.