Collection of potential security issues in Jellyfin · Issue #5415 · jellyfin/jellyfin
github.com
Collection of potential security issues in Jellyfin This is a non exhaustive list of potential security issues found in Jellyfin. Some of these might cause controversy. Some of these are design fla...

Collection of potential security issues in Jellyfin This is a non exhaustive list of potential security issues found in Jellyfin. Some of these might cause controversy. Some of these are design fla…

  • @i_am_not_a_robot@discuss.tchncs.de
    1•4 hours ago

    I think in this case whether it’s distribution or not would have to go to court. It’s not intentended to be distribution. Depending on the judge and the lawyers it could be distribution or not distribution or the prosecution may have committed a crime in finding it.

    • Saik0English
      1•3 hours ago

      Sure. Now who here wants to litigate it and find out?

      the prosecution may have committed a crime in finding it.

      Web scanners/crawlers aren’t illegal though. And since it’s not authenticated there’s no attempt to break any security/authentication/encryption. You don’t get in trouble for finding a random URL in a google search and accessing it. You’d get in trouble if you had to bypass some security measure to get there.

      The point of this all is that these endpoints have no measure in place. Seemingly on purpose, and it’s documented by the maintainers that they don’t intend to fix it and leaving it open is intentional.

      You can gamble it. I won’t. I just can’t accept that “Jellyfin is better” that keeps getting pushed when big gaping problematic holes like this exist.

      • @i_am_not_a_robot@discuss.tchncs.deEnglish
        1•1 hour ago

        Trying hundreds or thousands of hashes against the servers of random unconsenting people on the internet is beyond what I would be comfortable with. People have been prosecuted for less. It’s not the same as a crawler where you try a few well known locations and follow links. You’re trying to gain access to a system that somebody did not intend for you to have access to.

        These endpoints probably don’t have protection because they were never designed to and it’s hard to add it later. Theoretically, if the IDs are random that’s probably good enough except that you wouldn’t be able to revoke access once somebody had it. The IDs probably aren’t random because at some point only the path is used. It’s how software evolves. It’s not on purpose that somebody may be able to guess the ID to gain access to it.