this post was submitted on 26 Sep 2025
694 points (96.0% liked)

Selfhosted

51838 readers
1123 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago
MODERATORS
ruud@lemmy.world
CannaVet@lemmy.world
Loki@lemmy.world
HybridSarcasm@lemmy.world
devve@lemmy.world
HybridSarcasm@lemmy.hybridsarcasm.xyz
694
FFS Plex, the server is on my local network (no.lastname.nz)
submitted 3 days ago* (last edited 3 days ago) by BlueEther@no.lastname.nz to c/selfhosted@lemmy.world
330 comments fedilink hide all child comments
 

Well I already have jellyfin running in a container, just have to figure out how to get mum's TV to work with it I guess

log in on a local IP and not the network name and it's working again. but I'll be moving to jellyfin from now

you are viewing a single comment's thread
view the rest of the comments
[–] Strit@lemmy.linuxuserspace.show 20 points 3 days ago (1 children)

From one of the Jellyfin devs in the issue you linked, posted in April this year:

Now, let's address this clearly once and for all. What is possible is unauthenticated streaming. Each item in a Jellyfin library has a UUID generated which is based on a checksum of the file path. So, theoretically, if someone knows your exact media paths, they could calculate the item IDs, and then use that ItemID to initiate an unauthenticated stream of the media. As far as we know this has never actually been seen in the wild. This does not affect anything else - all other configuration/management endpoints are behind user authentication. Is this suboptimal? Yes. Is this a massive red-flag security risk that actively exposes your data to the Internet? No.

At this point, this over-4-year-old issue has gotten posted to HackerNews more than enough times and gotten quite enough unhelpful peanut-gallery comments like those above.. We are limiting this issue to Jellyfin collaborators only at this point. Most of the big items are already tracked elsewhere (specifically, unauth playback) or have already been fixed. And many other options are now open to us in a post-10.11 landscape now that we have a proper library database ready.

[–] TrickDacy@lemmy.world -2 points 3 days ago (3 children)

That only addresses one of several items.

[–] Strit@lemmy.linuxuserspace.show 10 points 3 days ago (1 children)

Yes, but it's always the one people come back too.

They mention the other issues are either being tracked elsewhere or already solved.

At the end of the day, it's a community project, done by primarily volunteers, who is not making any money doing this. No VC funding to hire developers to take care of these issues.

[–] TrickDacy@lemmy.world 3 points 3 days ago

I understand there's an explanation for it. Doesn't make these things not things to consider when choosing one's solution

[–] somerandomperson@lemmy.dbzer0.com 6 points 3 days ago (1 children)

But it's FOSS, compared to Plex. And it also does not ask for money for anything.

You can also add more security yourself if you want to. Not by coding new stuff into jellyfin, but by adding some sort of auth BEFORE jellyfin.

[–] Chewy7324@discuss.tchncs.de 2 points 3 days ago* (last edited 3 days ago) (1 children)

Setting up auth before Jellyfin breaks clients. This is not an option. Edit: Unless you meant VPN like Tailscale, but then you'd have to install Tailscale too, which I don't want to explain to others.

[–] somerandomperson@lemmy.dbzer0.com 1 points 3 days ago (1 children)

Tailscale needs you to explicitly add your device to the tailnet, so it's some form of authentication.

Also, why don't you want to explain tailscale? It's really simple.

[–] Scrollone@feddit.it 1 points 3 days ago (1 children)

Good luck installing Tailscale on my friends' LG webOS TVs.

[–] Chewy7324@discuss.tchncs.de 2 points 2 days ago

And making sure Tailscale auto launches on a FireTV stick is a pita too. Telling them to open Tailscale on each start is not an option.

[–] scrubbles@poptalk.scrubbles.tech 1 points 3 days ago

Feel free to go read the multiple writeups from the maintainers that go over each one, we don't need to copy them all here into the comments for you.