• 1 Post
  • 22 Comments
Joined 1 year ago
cake
Cake day: April 30th, 2024

help-circle
  • How does it differentiate an “AI crawler”, from any other crawler? Search engine crawler? Someone monitoring data to offer statistics? Archiving?

    This is not good. They are most likely doing the crawling themselves and them selling the data to the best bidder. That bidder could obviously be openAI for all we know.

    They just know that introducing the sentence “this is anti AI” a lot of people is not going to question anything.






  • daniskarma@lemmy.dbzer0.comtoSelfhosted@lemmy.worldSharing Jellyfin
    link
    fedilink
    English
    arrow-up
    3
    ·
    edit-2
    2 months ago

    IP addresses are fairly public.

    In order to get that kind of infection there need to be a serious vulnerability. None of the services I expose have those kind of vulnerabilities, and I keep them updated.

    A Zero-day may be possible, but it can happen with any software.

    Any way, even if some of my services got infected that way, I have them all in docker containers. If they managed somehow to insert any malicious software it would have disappeared in the next restart of the container.

    And in order to have a software that breaks out of the container it would need to also have some sort of zero-day docker exploit. Two zero-days needed for accomplish that…

    Every expose software I have is running on a caddy reverse proxy. And caddy is the only authorized author on my firewall so it gets more difficult to try to run an unexpected malicious software through it.




  • daniskarma@lemmy.dbzer0.comtoSelfhosted@lemmy.worldSharing Jellyfin
    link
    fedilink
    English
    arrow-up
    9
    arrow-down
    1
    ·
    2 months ago

    I have had jellyfin exposed to the net for multiple years now.

    Countless bots probing everyday, some banned by my security measures some don’t. There have never been a breach. Not even close.

    To begin with, of you look at what this bots are doing most of them try to target vulnerabilities from older software. I have never even seen a bot targeting jellyfin at all. It’s vulnerabilities are not worth attacking, too complex to get it right and very little reward as what can mostly be done is to stream some content or messing around with someo database. No monetary gain. AFAIK there’s not a jellyfin vulnerability that would allow running anything on the host. Most vulnerabilities are related to unauthorized actions of the jellyfin API.

    Most bots, if not all, target other systems, mostly in search of outdated software with very bad vulnerabilities where they could really get some profit.


  • daniskarma@lemmy.dbzer0.comtoSelfhosted@lemmy.worldSharing Jellyfin
    link
    fedilink
    English
    arrow-up
    50
    arrow-down
    5
    ·
    edit-2
    2 months ago

    You can share jellyfin over the net.

    The security issues that tend to be quoted are less important than some people claim them to be.

    For instance the unauthorized streaming bug, often quoted as one of the worst jellyfin security issues, in order to work the attacker need to know the exact id of the item they want to stream, which is virtually impossible unless they are or have been an authorized client at some point.

    Just set it up with the typical bruteforce protections and you’ll be fine.







  • I don’t know fully what’s they are doing. But here’s my workflow with watchtower.

    I have a cron task that runs watchtower every day on monitor-mode and only-once one time a day. That creates a list on what containers can be uograded. They using shourrr (it’s already integrated with watchtower it’s just an environment variable to do this) I send myself a message to my phone informing me of what updates are available. If I see fit to upgrade everything I just run watchtower once without monitor mode to upgrade all. I have pendant to automate this last part in a way that I just answer to the bot that’s informing me of the updates and should apply the command without having me ssh into the server. But as for now I have to ssh and run a script I have at hand to launch the upgrade with watchtower.

    There are some problematic containers that I don’t want to upgrade this way. For those I have their compose files version locked and I upgrade them manually when I want.