i should be gripping rat

  • 90 Posts
  • 352 Comments
Joined 2 years ago
cake
Cake day: June 16th, 2023

help-circle



  • I posted this below in reply to a similar comment. If you don’t like the way the devs have handled the raising of concerns, then fine, that’s kind of a judgment call and I can’t tell you what you should feel comfortable with. In my limited experience with the Jellyfin devs (including reading through the responses on that thread you linked), I do not personally get the impression that they are downplaying or refusing to correct issues. To me, it seems more like they are prioritizing some issues over others, and the outstanding security issues seem pretty minor for most use cases.


  • idk the full history, but Joshua’s comment here does not give me the impression of devs that are just deliberately ignoring security issues. It seems like they are simply balancing priorities, which is what all good devs should do. Personally I like that client compatibility is valued over everything else - I would be pissed if they broke the Fire TV client to fix a minor security hole on a niche Linux distro, because then one of my users would be SOL. And as Joshua says in that comment:

    many other options are now open to us in a post-10.11 landscape now that we have a proper library database ready.

    So it seems like now they are better set up to address the security issues without breaking compatibility.


  • So, I am not going to deny that those security issues exist, but it seems like they would only pop-up in niche situations, or only if someone already had access to your admin profile. Most people are using Jellyfin to share their media with themselves and their tech-illiterate friends in family. In that use case, the only people who even know my server URL are people I have shared that info with privately. Nobody is trying to hack my admin account.

    Now, I am no infosec expert. Maybe there are folks that are trying to run larger operations, and for those people I can understand why these security issues may become concerning if you don’t have a tight handle on the circle of people that have access to your server. That said, it’s also a bit silly to expect a free, open source solution to meet your needs in that scenario, anyway. If you know and understand the issues that well, then maybe go join the dev team and patch the holes. That is the beauty of open source, anyone can jump in and fix it.















  • not sure what beef you have with GN, but they’ve seemed pretty rock-solid reliable to me for years now. Just good, detailed benchmarking and high-quality journalism. Unlike many tech channels and blogs, they actually cite their sources thoroughly.

    And for the record, the Kraken Z7 I bought 6 years ago and mounted vertically is still running quite strong, despite gamers nexus all but telling me I was an asshole for mounting it that way because it was going to die within 2 years and I’ll have only myself to blame.

    Quick google is pulling up no parts called “Kraken Z7” so not exactly sure what you’re talking about. I think you’re referring to this AIO mounting video they did 5 years ago? Generally speaking, computer parts are subject to a binning process, which means not all parts are created equal. Just because your AIO has lasted 6 years with a suboptimal orientation doesn’t mean that every Kraken Z7 will last 6 years in that orientation. In that video, Steve uses a lot of qualifying language. In the chapter testing vertical orientation, he even specifically says “this one is more about noise than performance”. They also say that you could mount vertically with the tubes towards the bottom of the radiator, and that would solve most of the issues. They supplied tons of testing and evidence proving that their recommended orientations would work best. I’m not sure how you heard “this could shorten the life of your AIO” and took that as a personal attack, but sure. Take it out on GN i guess.