I do agree it’s an odd choice not to fix it, and I do wish they would. But for now it’s a risk I’m fine with taking. If my server gets DOSd in the future from multiple unauthenticated streams I sure will be a grumpy git and complain to them, but in the mean time uuh… sharing is caring? 😅

I think you’ve fundamentally misunderstood some of their communication.

There’s the issue I described earlier where it is possible to stream files unauthenticated if you know the folder structure on the video. The devs have responded that they won’t fix this. Outside of streaming content, there’s no other access through this mean. https://github.com/jellyfin/jellyfin/issues/1501

Then there’s the release of 10.11.7 that fixed a number of security issues. https://github.com/jellyfin/jellyfin/releases/tag/v10.11.7 with no major security issues since then. And all the issues were privilagr escalation for a normal user account on jellyfin. So the attacker would already needed to have an account on your server, and only the data that jellyfin could see was at risk, nothing escaped contagion so to say.

They also officially support a reverse proxy set up: https://jellyfin.org/docs/general/post-install/networking/reverse-proxy/.

I have no idea where you’ve got the idea where they themselves claim it’s unsecure to open it to the internet. Of course there’s always a risk associated with exposing something, but jellyfin doesn’t pose any larger risk than anything else you might publish.

Do you have any proof that it’s not secure?

Unfortunately for a Plex style easy to share library you need it to be centralized, handing over a lot of power to whoever is controlling it.

Why not? Unless you’re talking about unauthenticated steaming of media if you reverse engineer a servers folder structure.

While I don’t actually know if codeberg does have back up codes or not, I imagine they do and I’m quietly calling OP out for not saving them 😁

I had a scary situation once when changing my email address for my bitwarden account and didn’t think ahead that they’d probably log me out on all devices. Luckily I have a copy of all codes in an accessible place.

Do they not give you a recovery phrase or back up codes when you’re enable 2FA?

Tailscale has an option for OIDC. That should be avoiding the tech mafia enough no?

Oh yeah. Tbf, I had the same thought when I read the post as well. “This is very big brother, but good?”

Except you own everything generated by yourself and you’re not being exploited for someone else’s profit.

OP is still running 5 containers though? And why does a home server need to implement an IT security standard meant for large organisations? I hope you got an incident response policy written down, would be a shame to fail the next audit.

Yeah this is unfortunate news for me as well. I have a primary container I use for videos, and then a 10.10 server for music. 10.11 is borderline unusable for music for me, and I’ve tried everything for rescanning to completely redoing the server set up (rip accidentally deleting all my music playlists).

But i shall kill off the 10.10 container and hope a performance fix is in the works.

Advertisers don’t want to be viewed next to or adjacent to “problematic” content. Hence no swearing in the first 5 or so minutes in a YouTube video (right after add have played), self censoring words like cunt and suicide so algorithms don’t deprioritise you (again, because platforms make money from ads, so they won’t promote videos that aren’t as friendly).

It’s all in the service to appease advertisers, and they require platforms to roll out the red carpet wherever they tread.

With their 2.0 version they announced it as stable release. https://github.com/immich-app/immich/discussions/22546

I never used immich before then, but all updates I’ve done since starting (with docker) has worked flawlessly.

That’s a fair take. I can relate to the feeling of uncertainty. When I make small donations of a couple of euros I have to push away my feelings that the donation could be seen as insultingly low. It’s hard to judge what a “fair” price is. But after all, many donation buttons say “Buy me a coffee” so I would hope the amount is appreciated either way.

You’re not throwing money out the window though, you’re giving it directly to someone. Someone who has used their craft to create something that has value to you. I’m not necessarily criticising you for not donating, I just want to shift your perspective that your money wouldn’t be valued by other people.

I didn’t think much of what the “correct” location would be. But i have a general kinda everything share at /var/share/[music,books,video,user folders,repo]. And then any caching or config data sits in that dockers home folder under /etc/docker/[jellyfin,immich,kavita,etc] together with its docker-compose file. All docker services run under the group user so they all have access to the share.

With a quick look through the code I can see calls are being made to rebble.io and repebble.com. From there you can whois the domains.

Yeah that looks cool. I will give it a closer look tomorrow :)

Cool, I’ll check this out. Always a bit of a ball ache when I need to access the server while lying in and too lazy to get up. Using vim on a phone is always an adventure in patience.