upvote

points

by yunaflox8 hours ago |
comments
upvoteby Mashimo4 hours ago|
next
[-]
> like saying that a media will be permanently lost instead of "will be removed from Jellyfin" which is inaccurate?

I don't know if that changed, but I gave jellyfin only read only access to my movies.

reply
upvoteby frez18 hours ago|
prev|
next
[-]
i believe the maintainers stance is that jellyfin should not be exposed and it should always be behind a vpn
reply
upvoteby Mashimo4 hours ago|
parent|
next
[-]
I doubt that, how would that work? You would need to give all your friends a VPN login into your local network for all of their devices, including TVs.
reply
upvoteby mrheosuper3 hours ago|
parent|
[-]
or your friend can setup VPN on his Router box.
reply
upvoteby Mashimo3 hours ago|
parent|
[-]
But then all of his traffic goes through my internet. Unless he has a special high end router that can only route specific domains.
reply
upvoteby mrheosuper2 hours ago|
parent|
[-]
You dont need high end box, a old mini pc running pfsense/opnsense is enough.
reply
upvoteby Mashimo1 hours ago|
parent|
[-]
High end, as in feature rich.

If you think most non tech people can just casually find an old pc, install and setup pfsense, then you are out of touch with reality. And they also would have to let it run all the time and have space for it. That's just not something realistic. It's not an option for my friends. Might also break chromecast.

reply
upvoteby alacritas06 hours ago|
parent|
prev|
next
[-]
not necessarily always a VPN, but you can also use a reverse proxy like caddy or nginx where encryption and security are primary concerns instead of something non-essential like in jellyfin.
reply
upvoteby paddim84 hours ago|
parent|
prev|
next
[-]
Their stance is actually that exposing it is fine
reply
upvoteby unsnap_biceps7 hours ago|
parent|
prev|
next
[-]
Frankly at this point, everything that is not explicitly fully public should be...
reply
upvoteby yunaflox7 hours ago|
parent|
prev|
[-]
Unfortunately, yeah.
reply
upvoteby RajT888 hours ago|
prev|
[-]
Including, but not limited to, sending passwords in cleartext on login.
reply
upvoteby post-it6 hours ago|
parent|
[-]
As opposed to what? The password needs to reach the server. Encryption is the job of HTTPS.
reply
upvoteby izacus3 hours ago|
parent|
[-]
... as opposed to using salted hashing like in every tutorial since 1990s.
reply
upvoteby jack-cooper2 hours ago|
parent|
[-]
I think you have some confusion between expectations upon the client and the server. This very site (and almost every other) sends your password in plaintext over form data when you sign in.

Hashing (and/or salting) a password client-side before sending it would offer next to no protection, as if the server is expecting this value and the attacker intercepts it, they could just replay the hashed value themselves. Why would they need to know the original password?

The salt for the password should also have been randomly generated when it was first created, and stored alongside the password in the database. The only way for the client to know this value would be to retrieve it based on username alone, when the request is first made. This would reduce the security of the system and allow a dedicated attacker much more leverage to try and crack that single password, if they knew only the username of the user.

The comment you're replying to is correct, encryption is the job of HTTPS.

reply