HereIAm

I do agree it’s an odd choice not to fix it, and I do wish they would. But for now it’s a risk I’m fine with taking. If my server gets DOSd in the future from multiple unauthenticated streams I sure will be a grumpy git and complain to them, but in the mean time uuh… sharing is caring? 😅

I think you’ve fundamentally misunderstood some of their communication.

There’s the issue I described earlier where it is possible to stream files unauthenticated if you know the folder structure on the video. The devs have responded that they won’t fix this. Outside of streaming content, there’s no other access through this mean. github.com/jellyfin/jellyfin/issues/1501

Then there’s the release of 10.11.7 that fixed a number of security issues. github.com/jellyfin/jellyfin/releases/…/v10.11.7 with no major security issues since then. And all the issues were privilagr escalation for a normal user account on jellyfin. So the attacker would already needed to have an account on your server, and only the data that jellyfin could see was at risk, nothing escaped contagion so to say.

They also officially support a reverse proxy set up: jellyfin.org/docs/general/…/reverse-proxy/.

I have no idea where you’ve got the idea where they themselves claim it’s unsecure to open it to the internet. Of course there’s always a risk associated with exposing something, but jellyfin doesn’t pose any larger risk than anything else you might publish.

Do you have any proof that it’s not secure?

Unfortunately for a Plex style easy to share library you need it to be centralized, handing over a lot of power to whoever is controlling it.

Why not? Unless you’re talking about unauthenticated steaming of media if you reverse engineer a servers folder structure.

Sure, but the issue remains the same; they absolutely knew what those symbols would be interpreted as, and still went aged with it.

Tailscale has an option for OIDC. That should be avoiding the tech mafia enough no?

Oh I’ve actually heard of Pluto.tv and watched it somewhere.

I’m not trying to make a point, I’m just curious how many this impacts and so on. I imagine it will go down similar to Netflix account sharing crackdown; generally viewed unfavourably, but will convert enough users to pay for it to be worth it.

How is Plex used if you aren’t using it to stream your self hosted media? I remember seeing channels and such before. Is all the official stuff licensed content? I can’t imagine their offering is very competitive.