• 0 Posts
  • 28 Comments
Joined 2 years ago
cake
Cake day: August 9th, 2023

help-circle
  • You don’t have to take my word on this, but when you have so many vulnerabilities, the foundation and knowledge about security practices by the developers is missing some key ingredients.

    I use Jellyfin. I like jellyfin. I would like people to use jellyfin, but do it responsibly.

    Citing backwards compatibility is not an acceptable answer either. If individual endpoints and/or protocols (web sockets) are being addressed as separate issues, then there is no overall filter for the most basic thing as checking if the user is authenticated, you know a potential attacker will look for more.

    Will they target jellyfin instead of your average government website with a low budget and similar issues? Unlikely, but possible if the level of effort is low and can potentially create a large botnet, maybe?

    You handle these with overall filters (or whatever they are called on c#) and white lists if something truly needs not to have it instead of reacting when someone reports it.

    The simple fact that some of the code was sending api keys as GET parameters (which get logged cross every access log in the middleware on its way to the target server) and it didn’t raise any flags seems sufficient enough to suggest DO NOT expose jellyfin directly to the internet.










  • I don’t use them, but I do work in tech and oopsies do happen even with a properly configured k8s set of clusters or well managed bare metal infrastructure and well trained engineers. A developer could not be fully aware of something as simple as logs going to a file being something that can bring down capacity due to evicted pods on k8s for example.

    It does sound like the post is beating around the bush on terms of what caused the outage, but if their post mortem acknowledged fully what it was and decent steps being taken to mitigate it, short and long term it could still be a lesson learned. Generally it’s not possible to just correct something that quickly on complex systems or environments that have been used to a certain workflow as much as customers and users would like (developers like anyone else make mistakes).

    Whether a noobie mistake on the code review process or something else if they are honest and clear it can still impress people willing to migrate. Using MS teams and O365 at work it feels like there is an intermittent outage every other month.






  • Not sure if the UK is similar to where I lived, but they were the worst “cloud” provider I’ve ever used. Want to shut down the instance you had to recreate it with a different OS? Good luck getting it back online as they are out of capacity. Also, if you accidentally deleted one of the default network components it was impossible to recreate it without incurring a cost kind of going against anything you learned about cloud computing and “infrastructure as code”. It was a glorified GUI.

    Edit: I’m just glad my current employer does not use anything oracle as their support is also famously bad.



  • It’s shit for automating things and especially useless outside the Apple ecosystem, but it does offer the option to turn off sharing.

    Apple ID -> Find My -> Share My Location

    Since it’s closed source it’s possible they still capture the location and I would t trust it, but in practice anyone that you’ve allowed to see your location (for an hour, day, while on-route) gets a “location unknown” on their app of the toggle is off.


  • Great points, as someone who is very happy with their current home automation and services, checking in the config files to a git repo was the critical step. Also backup volumes since many containers tend to store state in some binary or internal DB. At the very least try restoring the config to verify you have what’s needed. The containers should start even if they have no media on it.

    In terms of tinkering not being fun anymore. That’s okay, sometimes you need a break.

    A point that is sometimes not brought up enough in my opinion is to plan for loses. What can you afford to lose if you can’t backup everything (due to price, etc.)? config files and photos or personal data are relatively small (compared to something like a media library) and should be prioritized.