Also I use Jellyfin btw.
Oh god, its the new Arch isn't it...
No nix is the new arch.
Lol
I'm waiting to see the elusive Arch, Jellyfin Vegan stack in the wild. We know they exist and they are fucking telling everyone
Apparently not using Arch is the only thing keeping me from reaching my peak in life
You will find them in their natural habitat, the crossfit/hyrox gym.
Sure explains why Plex was so cagey and uninformative when they emailed everyone to update their servers a couple months back. Not so much as a CVE report or change set.
A vulnerability? No…. 4 of them. And they stack.
That kind of is the proper way to handle this. You don’t want to hint bad actors where to look and give people some time to update.
I just assumed it was because it lined up with them destroying the GUI, the new layout is the hot garbage that finally got my wife to opt for jellyfin.
Jellyfin has plenty of issues with public instances too. It's just the reality of exposing to the public internet, unless it's something that has a lot of dedicated work going into security it's going to have problems.
Could you specify any of those issues? I ask because the only one I'm tracking allows unauthenticated playback, but only if they know the path to the file on the machine which is very easy to change from default.
There have been a few major ones this year, I'm sure they are fixed at this point though. https://app.opencve.io/cve/?vendor=jellyfin
As someone who has nearly all internet facing software auto update with watchtower nightly my cortisol is so low
You mean watchtower by containrrr? That repo seems archived.
Also, if you don't mind me asking, how does that even work? There is a far from zero chance of potentially breaking changes on any given update, so with auto-updates, do you just accept that something might suddenly stop working, or do you just get notifications that a new version is available and update manually?
If it breaks I either fix it (often it's just an issue where the new version needs extra config added), or roll back to a backup and pin the old version temporarily if it really went wrong and I can't recover otherwise.
Backups run early AM before any auto updates start, and no one is using services and changing data then, so nothing should really ever be lost by rolling back.
My Plex is updated, and hiding behind a random-long-text-string wildcarded subdomain that (so far) has not been discovered.
My Crowdsec intercepted 5X the normal number of hacking attempts & port scans on October 17th... no doubt from dirtbags trying to exploit this.
Wildcard SSL does help a lot, since every subdomain isn't broadcast publicly in the issuer logs.
If you want to expose plex to the open Internet (not a VPN) Don't open the plex port to the internet. Turn off the "remote access" setting and run it behind a reverse proxy instead.
Hackers still doing cryptominers nowadays? C'mon, get with the times, install a LLM model on people's computers instead.
The cryptomining still potentially pays, the LLMs just cook the user’s hardware.
Running your own crypto miners doesn’t make sense anymore because the cost of electricity. Running a crypto miner using someone else’s electricity on the other hand…
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
Be civil.
No spam.
Posts are to be related to self-hosting.
Don't duplicate the full text of your blog or readme if you're providing a link.
Submission headline should match the article title.
No trolling.
Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details. Tags [CBH] or [AIP] are required, see the links in Rule 8 for details.
AI-related discussions and AI-involved promotional posts have additional requirements for tagging, as noted in Rule 7 and the AI & Promotional Post Expanded Rules post, and find example disclosures here.
Resources:
Any issues on the community? Report it using the report flag.
Questions? DM the mods!