Comment

Comment on Plex vulnerabilities being exploited in the wild to drop a cryptominer

Auli@lemmy.ca ⁨2⁩ ⁨weeks⁩ ago

I think people over blow how dangerous it is. Or maybe its better most people dont. I don’t know I know the issues and I take measures to mitigate them. Then if someone gets in they would be limited to vlan. And if somebody gets out of that good wasted so much effort for nothing since I have nothing that would be worth that much trouble.

And before someone says identity pretty sire that has been in so many other leaks overt the years the information is pretty old.

source

Sort:hotnew top

frongt@lemmy.zip ⁨2⁩ ⁨weeks⁩ ago
Even without data compromise or pivoting, they can still mine crypto on your hardware, launch a ddos, spam email, do botnet stuff, or host CSAM.

source
- fonix232@fedia.io ⁨2⁩ ⁨weeks⁩ ago
  Not if your Jellyfin is set up correctly.
  
  Read-only, rootless container with only the cache/transcode/config folders mounted RW+noexec - ideally both with a volume size limit.
  
  Reverse proxy only the absolutely minimal ports needed, with some security measures (e.g. crowdsec transparent proxy, hooked up to both your firewall and reverse proxy to block malicious actors.
  
  source
  - Blue_Morpho@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
    The start of this thread is “number one reason people don’t move to Jellyfin is ease of remote access.”
    
    30 years ago I was compiling slackware and configuring dns servers, and setting up BGP on Ciscos. But a few hours of attempting to setup Jellyfin was a failure. It was far more complex than setting up dns/bind.
    
    source
    fonix232@fedia.io ⁨2⁩ ⁨weeks⁩ ago
    It's literally just:
    
    create docker container
    
    forward FOUR ports: 8096, 8920, 7359(udp) for discovery, and 1900(UDP) for DLNA to local network
    
    forward a SINGLE port via reverse proxy: 8096 if your proxy handles HTTPS, 8920 if you want Jellyfin to handle HTTPS
    
    I highly doubt that if somehow you were setting up BGPs at Cisco, this incredibly straightforward port setup somehow got the best of you.
    
    source
    -> View More Comments
    fonix232@fedia.io ⁨2⁩ ⁨weeks⁩ ago
    Beside, that wasn't even the topic. We were discussing - or rather, I was proving to the above commenter - that setting up Jellyfin in a way that does not allow an intruder to crypto mine or host CSAM or use your device as a proxy, is incredibly easy.
    
    Port setup and it's perceived impossibility by you has naught to do with that topic.
    
    source