MaggiWuerze

Having an https connection doesn’t do shit if the Backend is insecure. The issue with exposing Jellyfin are not man in the middle attacks, but badly managed access controls and unsecured endpoints.

Thede issues and the unwillingness of the devs to fix them because they are hellbent on keeping a maximum of client compatibility is what makes it hard to trust the overall security of the project.

That’s why basically everyone, including the devs, says to not do that and instead rely on a vpn to mitigate security risks.

An encrypted tunnel and a reverse proxy are Ber different things. He (I) never talked about a tunnel and neither did the comment I (he) responded to

Reading comprehension and Jellyfin stanning don’t go well together

Feeling adventurous is exactly what you need if you decide to expose Jellyfin to the Internet (a reverse proxy adds nothing to security)

I never had the feeling the Jellyfin devs were were interested in outside contributions or ideas. A lot of the discussion in issues quickly gets passive aggressive from their side.

Sure, you’re not behind CGNAT?

Home Assistant has its own locally running voice assistant. There’s even hardware for it (think self hosted Alexa) that you can buy or build yourself

Yeah, the Steam update got me thinking MP was totally new, so I was planning to try that with some friends. Guess I’ll set up an B41 Server then, thanks!

Aaah, that makes sense. Thanks for explaining

Im kinda confused there. On steam the devs recently posted an update, that MP is now available, but it seems that it has been for a while?

Was it in beta up until now or was it fan made?

Its also possible for a webserver to offer two versions of an API. Add a new one that needs authentication, mark the old one as deprecated and add a checkbox to disable it. Then clients can update to use the secure one and if you use and unmaintained client you can enable the old insecure api

And you think if Jellyfin were a comparable size, there wouldn’t be just as many or more?

log in on a local IP and not the network name and it’s working again. but I’ll be moving to jellyfin from now after seeing this edit on the top post I felt like OP was not not really looking for input

I’m not gonna waste my time explaining how software might change over time, if you think you’ll never have to touch your Jellyfin server moving forward you’re sure to be disappointed

Or you could properly configure your server to recognise local ips

if your mail server blocks them they won’t show up there I think. It just refuses to accept the mail. Maybe check Nexxtcloud logs to see what happens when it tries to send the mail

do they not get sent or do you just not receive them (eg because your mail server blocks them as spam)? Do both come from the same address? Can you try to format the testmail the same way to see if they still arrive?

I have a Philipps OLED TV from 2019, with Android 9 or smth. But WebOS is a different beast.

The issue is their approach to security. I don’t trust them to properly secure their software, since they have proven to prefer client compatibility over security.

Yeah, but since you basically need a VPN to share Jellyfin safely, you now also need to install and maintain that on their end

I will not make myself the tech guy for half my friends and family, just because I can’t share Jellyfin safely without a vpn

Also the people that know how to set that all up and still expose a Jellyfin server to the public internet

Because Jellyfin users like to feel superior. Accepting that other people have other requirements from software is hard, especially when you feel like you choice is the only valid one.

As a long time Plex user, who has a Jellyfin running in parallel, just not shared, I will keep using Plex until they either force me off of it or Jellyfin manages to make accessing servers remotely easier and more secure.

Yeah, first thing I did after testing the new app. Still don’t know why they feel the need to push this out so aggressively instead of letting it run in parallel until its ready

If you have not set up a VPN for accessing your Jellyfin, I would suggest looking into the myriad of security issues the Jellyfin Backend has. Jellyfin has no business being accessible from the public internet

If they adhered to somewhat modern security principles for their Backend I wouldn’t mind hosting it behind a reverse proxy. But since large parts of the API is unauthorized and unprotected, I wont.

And I do not plan on supporting family and friends in setting up vpns on all of their devices

Or… You know… Jellyfin could make it so I don’t have to setup elaborate VPN schemes and have every user install that on every one of their devices. For example they could fix their security issues to make it safer to expose JF through a reverse proxy, bug they refuse to not break client compatibility

I’m not even against Jellyfin or anything, but as long as I have to build elaborate VPN solutions to continue sharing my content I’ll stick with Plex. Not even starting with the availability of clients on different platforms and the general lack of polish in Jellyfin first party UI (player and config).

I could live with most of that stuff if there was a way to share my library without becoming tech support for half my friends circle

User sharing without opening my Plex server to the public internet. For Jellyfin I would have to become a VPN provider and allow people into my private network to share it safely, since you wouldn’t want to have Jellyfin available to the internet with their stance on security

Not to rain on your parade, but the Plex App on my TV, with a library of almost 40TB also loads in seconds