Comment on Plex vulnerabilities being exploited in the wild to drop a cryptominer

frongt@lemmy.zip ⁨8⁩ ⁨hours⁩ ago

• Auli@lemmy.ca ⁨8⁩ ⁨hours⁩ ago

  Kind of defeats the purpose of Plex and Jellyfin.

  source

  • peppericecream@lemmy.dbzer0.com ⁨7⁩ ⁨hours⁩ ago

    *defeats your purpose of Plex and Jellyfin

    I just want a media server. I have no use case to make it available to the public internet.

    source
  • Seralth@piefed.seralth.com ⁨6⁩ ⁨hours⁩ ago

    The only reason to expose it raw to the internet is because your hosting a piracy service.

    You can easily keep everything inside of a wireguard VPN and expose nothing directly.

    source

    • couldhavebeenyou@lemmy.zip ⁨5⁩ ⁨hours⁩ ago

      How do I get my grandparents tv on a vpn

      source
• pHr34kY@lemmy.world ⁨6⁩ ⁨hours⁩ ago

  If you don’t have ports open, you’re not an internet participant. You’re just spectating.

  source
• sanpo@sopuli.xyz ⁨8⁩ ⁨hours⁩ ago

  That’s pretty much the number one reason people say they won’t move to Jellyfin.

  Even though exposing your shit to Internet is a terrible idea for most people.

  source

  • Auli@lemmy.ca ⁨8⁩ ⁨hours⁩ ago

    I think people over blow how dangerous it is. Or maybe its better most people dont. I don’t know I know the issues and I take measures to mitigate them. Then if someone gets in they would be limited to vlan. And if somebody gets out of that good wasted so much effort for nothing since I have nothing that would be worth that much trouble.

    And before someone says identity pretty sire that has been in so many other leaks overt the years the information is pretty old.

    source

    • frongt@lemmy.zip ⁨8⁩ ⁨hours⁩ ago

      Even without data compromise or pivoting, they can still mine crypto on your hardware, launch a ddos, spam email, do botnet stuff, or host CSAM.

      source

      • fonix232@fedia.io ⁨4⁩ ⁨hours⁩ ago

        Not if your Jellyfin is set up correctly.

        Read-only, rootless container with only the cache/transcode/config folders mounted RW+noexec - ideally both with a volume size limit.

        Reverse proxy only the absolutely minimal ports needed, with some security measures (e.g. crowdsec transparent proxy, hooked up to both your firewall and reverse proxy to block malicious actors.

        source
  • magic_smoke@lemmy.blahaj.zone ⁨8⁩ ⁨hours⁩ ago

    Just throw a wireguard tunnel on your router and call it a day.

    source

    • Blue_Morpho@lemmy.world ⁨7⁩ ⁨hours⁩ ago

      That’s fine for your personal remote access but that doesn’t help your 80 year old mother in law watch videos of the grandchildren on a Roku.

      source

      • magic_smoke@lemmy.blahaj.zone ⁨2⁩ ⁨hours⁩ ago

        Been thinking of throwing together a set top box with everything made up for my grandfather so he can stream stuff from my jellyfin setup.

        I just need to find an ezpz enough to use frontend.

        source
      • Seralth@piefed.seralth.com ⁨6⁩ ⁨hours⁩ ago

        Slap a vpn on her computer or but a shitty dell from good will. Point the Roku at that and forward the traffic…?

        Like this is a solvable setup and forget about it for the next 5 years. Sort of set up.

        source
    • lama@lemmy.world ⁨6⁩ ⁨hours⁩ ago

      WG works for us, but isn’t scalable once it comes to sharing. It would provide too much friction for a lot of people

      source

      • sanpo@sopuli.xyz ⁨6⁩ ⁨hours⁩ ago

        It’s really not. If people are too lazy to install one VPN app and import the tunnel config, then they can pay for paid streaming instead.

        source
      • Seralth@piefed.seralth.com ⁨6⁩ ⁨hours⁩ ago

        I manage it with netbird.

        Just have em install netbird, if it’s on they can connect to my website. If it’s off they can’t.

        It’s literally three steps for each person, there’s ways to make this easy. It just requires the host to put in the leg work

        source