You can avoid most security issues (with any sort of server) by not exposing it publicly. Use a VPN like Tailscale to connect remotely. If you share the server with friends or family, share it with them over Tailscale and use an ACL to configure which services they can access on your server.
It’s a good practice to NOT expose services to the internet unless it’s really needed. If they’re only for your use, then the entire world doesn’t need access. This isn’t specific to Jellyfin.
All software has the potential to have security issues.
If a service is publicly accessible, anyone can access it. Even if it’s secured, there can be security issues in the auth layer of the app, improperly secured endpoints, etc.
If a service is only available over VPN, nobody can access it unless they’re on the VPN. The service isn’t visible over the public internet and other people won’t even know it exists. You can require two factor auth to connect to the VPN.
I’m not sure why you seem to think that a private network isn’t more secure than a public network. There’s a reason why practically every company requires people working remotely to connect to a VPN to access company resources.
I never said anything about using the VPN as an ACL. All I said was to only expose the service over the VPN. That doesn’t necessarily mean that the app doesn’t have authentication or authorization.
I’m also only talking about residential use cases, where it’s a common practice (when not using a VPN) to just expose everything via port forwarding. Businesses aren’t setting up Jellyfin on their servers.
true, fun fact a VPN is also an application with an auth layer. dun dun dun!
Sure, but someone would have to first get on the VPN, and then find vulnerable apps once on the internal network, as opposed to just scanning the internet for public-facing vulnerable systems. Wireguard (and thus Tailscale) doesn’t respond to port scans at all - it only responds to packets that are signed with a known key.
Admittedly, networking and network security isn’t my specialty so I’m absolutely sure you’ve got more knowledge in this area.
It’s not really a hassle though. It’s just a one time setup. Tailscale can stay connected all the time, since by default only Tailscale IPs are routed via it (so it won’t affect LAN or internet access)
If you want less hassle then use a Debrid service like Premiumize or Real-Debrid.
You can’t throw shade on Jellyfin, leave plex out of the discussion and then claim to run neither and essentially not caring…
Why participate at all with this argument??
Yeah I should’ve probably emphasised that Plex isn’t free of security vulnerabilities either, but I didn’t because I never even considered running it on my server, given the insane price.
Why participate with this argument? I was hoping to be proven wrong on the claim that jellyfin is insecure.
I was hoping to be proven wrong on the claim that jellyfin is insecure.
The constant argument being parotted (IMO a bit extra overblown) that you can read files by knowing the file path and being able to access the stream urls without authentication.
So if I know /data/media/movie/A Super Secret Movie [2026] (not unlikely due to assumed default paths with docker installations)
and https://jellyfin.example.local/
I can supposedly guess that the URL is https://jellyfin.example.local/video/source=?1029rifos0xomsoc93 and access the stream.
Is it an issue? Yes, you are bypassing active authentication
What is the actual security problem? You can be ddosed by being streames to death? Oh no, what will I do /s
If anyone else can give a more grave exampe why it’s worse than the above example: Please do. I don’t see the issue besides bypassing authentication.
Isn’t jellyfin full of security vulnerabilities? (Not to defend Plex, just a thought. This is why I don’t have a video streaming server at all.)
You can avoid most security issues (with any sort of server) by not exposing it publicly. Use a VPN like Tailscale to connect remotely. If you share the server with friends or family, share it with them over Tailscale and use an ACL to configure which services they can access on your server.
deleted by creator
It’s a good practice to NOT expose services to the internet unless it’s really needed. If they’re only for your use, then the entire world doesn’t need access. This isn’t specific to Jellyfin.
All software has the potential to have security issues.
deleted by creator
If a service is publicly accessible, anyone can access it. Even if it’s secured, there can be security issues in the auth layer of the app, improperly secured endpoints, etc.
If a service is only available over VPN, nobody can access it unless they’re on the VPN. The service isn’t visible over the public internet and other people won’t even know it exists. You can require two factor auth to connect to the VPN.
I’m not sure why you seem to think that a private network isn’t more secure than a public network. There’s a reason why practically every company requires people working remotely to connect to a VPN to access company resources.
deleted by creator
I never said anything about using the VPN as an ACL. All I said was to only expose the service over the VPN. That doesn’t necessarily mean that the app doesn’t have authentication or authorization.
I’m also only talking about residential use cases, where it’s a common practice (when not using a VPN) to just expose everything via port forwarding. Businesses aren’t setting up Jellyfin on their servers.
Sure, but someone would have to first get on the VPN, and then find vulnerable apps once on the internal network, as opposed to just scanning the internet for public-facing vulnerable systems. Wireguard (and thus Tailscale) doesn’t respond to port scans at all - it only responds to packets that are signed with a known key.
Admittedly, networking and network security isn’t my specialty so I’m absolutely sure you’ve got more knowledge in this area.
deleted by creator
The VPN isn’t “on top of” anything, it’s instead of everything.
deleted by creator
Eh, that’s too much hassle just for streaming video. I’ll use good old torrents downloaded directly to my computer.
It’s not really a hassle though. It’s just a one time setup. Tailscale can stay connected all the time, since by default only Tailscale IPs are routed via it (so it won’t affect LAN or internet access)
If you want less hassle then use a Debrid service like Premiumize or Real-Debrid.
And plex is entirely secure?
What was it again with security and closed source vs OSS?
Is the plex relay for remote access really secure?
Or has just nobody bothered checking it?
I never said that. I don’t run a media server at all because every streaming software has its own flaws.
You can’t throw shade on Jellyfin, leave plex out of the discussion and then claim to run neither and essentially not caring…
Why participate at all with this argument??
Yeah I should’ve probably emphasised that Plex isn’t free of security vulnerabilities either, but I didn’t because I never even considered running it on my server, given the insane price.
Why participate with this argument? I was hoping to be proven wrong on the claim that jellyfin is insecure.
The constant argument being parotted (IMO a bit extra overblown) that you can read files by knowing the file path and being able to access the stream urls without authentication.
So if I know
/data/media/movie/A Super Secret Movie [2026](not unlikely due to assumed default paths with docker installations)and
https://jellyfin.example.local/I can supposedly guess that the URL is
https://jellyfin.example.local/video/source=?1029rifos0xomsoc93and access the stream.Is it an issue? Yes, you are bypassing active authentication
What is the actual security problem? You can be ddosed by being streames to death? Oh no, what will I do /s
If anyone else can give a more grave exampe why it’s worse than the above example: Please do. I don’t see the issue besides bypassing authentication.
That’s one of the ones we know about. Consider the ones that might exist that haven’t been found yet.
It’s impossible to prove a negative, that there are no vulnerabilities.