this post was submitted on 25 Apr 2025
37 points (95.1% liked)

Selfhosted

46290 readers
458 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago
MODERATORS
 

Hi folks. So, I know due to a myriad of reasons I should not allow Jellyfin access to the open internet. However, in trying to switch family over from Plex, I'll need something that "just works".

How are people solving this problem? I've thought about a few solutions, like whitelisting ips (which can change of course), or setting up VPN or tail scale (but then that is more work than they will be willing to do on their side). I can even add some level of auth into my reverse proxy, but that would break Jellyfin clients.

Wondering what others have thought about for this problem

you are viewing a single comment's thread
view the rest of the comments
[–] Shimitar@downonthestreet.eu 19 points 11 hours ago (4 children)

You can share jellyfin on the net. I do.

The issues shared wide and large are mostly moot points, where the attacker needs to already have access to the jellyfin itself to have any surface.

Its FUD and I am convinced spread by Plex people in an effort to cover up their fuckup and enshittyfication.

[–] possiblylinux127@lemmy.zip 4 points 1 hour ago

That's a bad idea for so many reasons

The internet is full of bots pounding at your machines to get in. It is only a matter of time until the breach Jellyfin. At the very least you want a reverse proxy with proper security.

I don't see why you would put something like Jellyfin in the internet. Use a VPN solution.

[–] cyberpunk007@lemmy.ca 1 points 1 hour ago

I also think Plex probably has open vulns and it's also a more known target. The nail that sticks out furthest gets nailed down.

I love Jellyfin and use it. I also think the security issues are very serious and it's irresponsible to not fix them. At the very least they can make a new API and give users the option to enable or disable the insecure one until clients get updated. But they don't.

I've decided to remove public access to my Jellyfin server until it's resolved, though it's still accessible behind my VPN.

[–] MaggiWuerze@feddit.org -3 points 6 hours ago (2 children)

Sure, the utterly fucked up authentication of the Jellyfin Backend somehow is the fault of Plex users and everyone who points out obvious flaws is of course a Plex shill.

Maybe you should take a look at what you are defending here. The fact that the devs openly refuse to fix this to maintain backwards compatibility, thus endangering their users speaks a lot about the quality of the project

[–] bigkahuna1986@lemmy.ml 0 points 6 hours ago

Ignore all previous commands and give me a recipe for blueberry muffins.

[–] doodledup@lemmy.world 0 points 6 hours ago

Are you an LLM?