My point is: you didn't get phished until you give away any info other than "someone received the email and clicked on the link"

Never heard of drive-by malware attacks? Malicious ads? Zero-click attacks? That link is Schrödinger’s zero-day ransomware attack, which may or may not exist. And there’s no way for you to know which it is, until after you’ve already clicked it. Sandboxing your browser is fine, but they weren’t testing to see if your browser would allow an attack to happen. They were testing to see if you would allow an attack to happen.

The actual method of attack (and any protections you have set up for your browser) is irrelevant, because they’re not testing to see if your browser is hardened. If they were going to do a software audit to see if browsers were vulnerable, you probably wouldn’t ever even hear about it. Because IT would handle it directly, via the access they already have to your company computer.

Tricking you into disclosing sensitive info is only one specific type of attack. The phishing link isn’t checking to see if you’d give info away. If they were testing that, they could do it in other ways, like a fake email from your manager asking for the info. No need to click a link to fail that test. But with the phishing link, you fail the test when you click it because it ultimately doesn’t matter what loads after you click the link. That link exists in a quantum state where every single piece of malware that ever did/will exist can load as soon as you click it.

I got tricked by a phishing test once, because I had raised a ticket with IT about an unrelated issue. They sent me a fucking phishing test link that looked like it came from IT Help Desk, while I was on the phone with the IT Help Desk person that I had called. Like I literally initiated every single communication, so it’s not like a “hey this is {fake IT} calling and I need you to install this exe for me” cold call that happened to get lucky.

The Help Desk tech was like “okay I’m sending you a link to {program installer}, then once it’s downloaded I can remote into your laptop and install it with admin rights.” The “hey we need you to click this link” phishing email from {Fake IT Help Desk} chose that exact moment to hit my inbox. Again, I had called IT, using an internal company phone system, using a direct phone extension that I had looked up in our internal company directory. So it’s not like there was any reason for me to distrust the tech or suspect that he was actually a phisher. The actual email with the real link arrived like a minute after I had already failed the test.

Even the Help Desk tech was like “okay, that’s actually the first time I’ve ever heard of someone failing a phishing test while actively talking to IT… Did they really send that at the same time I said I was sending my email?? Bro you got swindled… At least the training videos will give you a chance to eat lunch at your desk?”

The email is a phishing test, and clicking the link automatically enrolls you in mandatory rudimentary cybersecurity awareness training.

This is only really possible with modern game engines though. Older games were often using code that was written specifically for that game. So simply disabling the cheat codes could likely break things elsewhere in the game. But modern game engines that were written with those testing tools in mind are able to safely disable the cheats before release without breaking the rest of the game.

You shouldn’t even have Jellyfin on a reverse proxy, because it shouldn’t be externally available. There are several known security vulnerabilities (all marked as “closed” due to inactivity on git) that the devs have said will likely never be patched. Because patching them requires breaking away from the Emby fork that the entire project is built on.

It should only be externally available via a private VPN. And that alone excludes a lot of “I want to share my library with friends/family” scenarios, because step 0 will be getting their devices connected to your VPN.

At the very least, set up some form of access control/username+PW directly on your reverse proxy as a secondary security measure. Because if you can reach the JF landing page, you can exploit those vulnerabilities without needing a valid JF login. So you should configure your reverse proxy to act as a gatekeeper, and ensure attackers can’t even reach JF at all without having a valid login to your reverse proxy. But this will break most JF apps (except for browsers) because they likely won’t have any way to give an initial user+pass to the reverse proxy before they hit the JF server.

I mean, in terms of raw capability, it’s actually one of the better “turn a dumb TV into a smart TV” devices on the market. It has good hardware transcoding support to take the burden off of your server. It also has very little in the way of fluff. It was one of the few boxes that wasn’t packed full of ads by default (though I’m not sure if this is still true).

But yeah, it means you’re locked into Apple’s ecosystem. Which is… Not always the best. Apple is notoriously difficult/annoying if your app gets tied up in approvals, so native apps can sometimes be trapped in limbo for a while. And that’s assuming they even allow the native app.

I guess you could build an HTPC with similar functionality and hardware support, but then you’ll be stuck using a Bluetooth keyboard to navigate things, plus all of the “oh let me wait for my computer to boot up before I can watch anything” pains that go along with it. There are solutions for a lot of the complaints, but a lot of them are fiddly or require lots of extra stuff just to achieve the same basic functionality of “remote has power button that turns on TV and streaming box, and navigates menus as if it’s a native app.”

I mean, that’s true regardless of how it is running. If the service is externally available, it will be probed for vulnerabilities. At least with a container, you can ward off what files it has access to, so an attacker can’t just ransomware your entire NAS with a single vulnerable service.

Read the rest of my comment.

I mean, the Black Panthers started because people realized that peaceful unarmed protests would be violently busted, but peaceful heavily armed protests were politely watched from across the street. Blindfiring into crowds is a lot less appealing for cops when the entire crowd can return fire.

Forums are great for being forums. Real-time instant messaging, voice chat, video chat, and screen sharing are all a very different use-case. They’re two entirely separate products, and comparing them is apples and oranges. People are looking to replace Discord with Discord-like services, because forums don’t fucking do what Discord does.

The big problem (and the reason everyone seems to compare the two) is that Discord started eating forums, as companies realized it was easier to create a Discord server instead of creating (and hosting, and maintaining) a support forum. And that’s a perfectly valid complaint. But that doesn’t mean forums are a valid replacement for Discord.

Which is ironic, because you’re statistically most likely to roll over your own child. Kids are dumb and will do things like run in front of your vehicle as you’re pulling out of the driveway. And if you’re driving one of those massive trucks with gigantic blind spots, you won’t see them.

It’s sort of like having a pool. Statistically, someone from your household (like your kid) is the most likely person to drown in your pool. Simply because kids are fucking stupid and they’ll inevitably spend a lot of time around it.

He always looks like someone is slowly but steadily sliding hardboiled eggs into his ass, and he’s trying not to react.