this post was submitted on 28 Nov 2025
565 points (98.1% liked)

Selfhosted

53785 readers
438 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

  1. Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.

  2. No spam posting.

  3. Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.

  4. Don't duplicate the full text of your blog or github here. Just post the link for folks to click.

  5. Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).

  6. No trolling.

  7. No low-effort posts. This is subjective and will largely be determined by the community member reports.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 2 years ago
MODERATORS
 

Plex is starting to enforce its new rules, which prevent users from remotely accessing a personal media server without a subscription fee.

If anyone needs it: https://jellyfin.org/

you are viewing a single comment's thread
view the rest of the comments
[–] tyler@programming.dev 14 points 3 weeks ago (12 children)

Please do explain or link sources to what you think are “security holes”.

[–] roofuskit@lemmy.world 16 points 3 weeks ago* (last edited 3 weeks ago) (11 children)

It has several unsecured endpoints.

https://github.com/jellyfin/jellyfin/issues/5415

If you read the comments the devs know it's a serious issue but don't want to break backwards compatibility fixing them. Their solution for now is to warn people of the risks of exposing their instance to the Web. Which I don't think they're doing a great job of.

[–] warm@kbin.earth 4 points 3 weeks ago (1 children)

Isn't that the point of major version upgrades? To make breaking changes?

[–] MaggiWuerze@feddit.org 7 points 3 weeks ago

Its also possible for a webserver to offer two versions of an API. Add a new one that needs authentication, mark the old one as deprecated and add a checkbox to disable it. Then clients can update to use the secure one and if you use and unmaintained client you can enable the old insecure api

load more comments (9 replies)
load more comments (9 replies)