lime!Dec 8

What's the security situation when opening a jellyfin server up for casting?

https://feddit.nu/post/16103837

What's the security situation when opening a jellyfin server up for casting? - Feddit.nu

when reading through the jellyfin with chromecast guide [https://gist.github.com/Vigrond/1de5fc5ff468a48f053fd455a69c8766] i realized that it would probably be less effort to just let the casting api be public, with the added bonus that i could then cast my library to any device that supports it. but that seems like it would paint a giant target on the server. what’s the recommended way of doing stuff like this? ideally i want to be able to go to someone’s house and just play some of my media on their tv. not that any of this is doable in the near future, since i’m behind cgnat and won’t get my colocated bounce server up until spring.

Show threaddogs0nDec 9

As long as your jellyfin server is properly configured behind a reverse proxy, letting it be accessible publicly on the internet is fine.

Obviously everyone has their own threat model, but it’s not that big of a threat in this case (personally I don’t care).

Show threadRicaz

This. People are overly paranoid nowadays.

I have had SSH open directly to my main PC for 15 years and never had any issues except spam logins.

Same with :443 to my nginx.

Dec 10 at 11:39amWeb
Show threaddogs0nDec 10

I agree, there is a lot of paranoia, but honestly that’s probably a good thing, because the people who are paranoid might not know that much, so a good amount of paranoia is healthy there.

The chance of being exploited is very low for me to care too too much. Why spend countless days locking up my entire infra when there’s a very low low chance anyone could exploit me in the first place (obviously get your setup to a good standard, I don’t recommend not reading up on anything and exposing server, etc. Just for me, I don’t need to over do it).

That being said, personally I have ssh behind a vpn because that’s a very important service that only I am accessing anyways, so it makes sense for me to disable that attack vector.