this post was submitted on 23 May 2026
204 points (97.2% liked)

Selfhosted

60451 readers
731 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Detailed Rules Post

  1. Be civil.

  2. No spam.

  3. Posts are to be related to self-hosting.

  4. Don't duplicate the full text of your blog or readme if you're providing a link.

  5. Submission headline should match the article title.

  6. No trolling.

  7. Promotion posts require active participation, with an account that is at least 30 days old. F/LOSS without a paywall has exceptions, with requirements. See the rules link for details.

Resources:

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago
MODERATORS
 

Assuming the user will not be connecting over vpn, but is both remote and non-technical, how would you expose Jellyfin to them securely?

you are viewing a single comment's thread
view the rest of the comments
[–] PeriodicallyPedantic@lemmy.ca 7 points 1 month ago (2 children)

I'm kinda disappointed with this thread, I'm in a similar position to OP, but all the responses are just like "use a reverse proxy and make your URL hard to guess" and other measures which are not very secure. \

It seems like that's about as good as you can get at the moment, because the mobile apps barf if you try to add in auth in front of the reverse proxy, but a lot of people seem to be providing this advice like it's good enough rather than as good as you can get.

[–] frongt@lemmy.zip 2 points 1 month ago (1 children)

Well yeah, the "good as you can get" answers are "use a VPN" or "don't".

[–] PeriodicallyPedantic@lemmy.ca 1 points 1 month ago (1 children)

So every answer is as good as you can get?

[–] frongt@lemmy.zip -2 points 1 month ago

I suppose it depends on what you mean by "good as you can get".

[–] KneeTitts@lemmy.world 1 points 1 month ago (2 children)

Im confused as to what people think the security issue is? Do they think someone will brute force their username and password with a billion queries?

[–] mko@discuss.tchncs.de 3 points 1 month ago

That’s assuming an attacker will play nice with URL forming and discovering edge cases in POSTing shaped data to the service. Just encrypting is still weak security if the whole front-end web and API surface isn’t hardened.

[–] PeriodicallyPedantic@lemmy.ca 2 points 1 month ago (1 children)

Afraid people will use known vulnerabilities in common self-hosted software.

[–] KneeTitts@lemmy.world -3 points 1 month ago (1 children)

Sorry but are you guy not using Linux as your servers? Windows? Now I understand.

[–] PeriodicallyPedantic@lemmy.ca 2 points 1 month ago

Did you just suggest Linux has no vulnerabilities in any of its distros, and neither does any of the self-hosted services?