473
Why I moved my Plex library to Jellyfin after 14 years (the.unknown-universe.co.uk)
submitted 5 months ago by to c/selfhosted@lemmy.world
225 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 18 points 5 months ago (5 children)

Someone breakes in, then moves laterally to your home assistant running frigate to watch you sleep at night. Then uses your residential uplink as a proxy to resell on an open market.

After that, the possibilities are practically endless.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 5 points 5 months ago* (1 child)

    It's a rootless container. Chances are they are not going to do any of that.

    Things are on the internet all the time.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 3 points 5 months ago

    Yeah docker isn't the isolation sandbox some people make it out to be. It's not meant for that. You very well may have a setup that's meant for that but it's more than I'm willing to expose.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 3 points 5 months ago* (last edited 5 months ago) (2 children)

    No reason to connect jellyfin to any sort of local network, router will still hairpin for local connection.

    With that setup its honestly more secure than 99% of IOT devices, and like 50% of routers.

    edit: and if youre running it in the pentagon or something just toss authentication like keycloak in front of it, plus a bit of crowdsec/fail2ban and an IP whitelist, I'd be surprised if you'd even get an attack, much less one violating that strict of a threat models.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 3 points 5 months ago (1 child)

    Good grief. If you're doing all that, just set up Wireguard

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 5 months ago

    I mean containers make the networking pretty easy, everything beyond that is optional based on your threat model.

    Same as hosting anything networked, you can do it easy or do it safe.

    (but also wireguard is kinda an O(n) problem while exposing to wan is an O(1) problem - at least IT man hours wise)

  • permalink
  • fedilink
  • source
  • parent