Linux enthusiast, family man and nerd

  • 4 Posts
  • 243 Comments
Joined 2 years ago
cake
Cake day: August 24th, 2023

help-circle
  • Ghost needs emails for a couple of reasons.

    1. (Required) Ghost does not do user passwords. They use magtic links, which they send out via email when signing in. It’s just how they have chosen to do it. You can ask them why they don’t want to save passwords.

    2. (Optional) Ghost has a newsletter function. If you enable it, you need to setup a bulk email service, like Mailgun. Even regular SMTP won’t really work there. It can send out a newsletter everytime a blog post is published, so the members will get notified.

    I recently had to do this email dance with a Ghost instance setup, where most of the email ports are blocked on the network. I know how you feel. I also wanted to just use passwords, but not currently possible with Ghost.

    Other services might do the same as Ghost. I do host many services, that does not require email setup though.


















  • From one of the Jellyfin devs in the issue you linked, posted in April this year:

    Now, let’s address this clearly once and for all. What is possible is unauthenticated streaming. Each item in a Jellyfin library has a UUID generated which is based on a checksum of the file path. So, theoretically, if someone knows your exact media paths, they could calculate the item IDs, and then use that ItemID to initiate an unauthenticated stream of the media. As far as we know this has never actually been seen in the wild. This does not affect anything else - all other configuration/management endpoints are behind user authentication. Is this suboptimal? Yes. Is this a massive red-flag security risk that actively exposes your data to the Internet? No.

    At this point, this over-4-year-old issue has gotten posted to HackerNews more than enough times and gotten quite enough unhelpful peanut-gallery comments like those above… We are limiting this issue to Jellyfin collaborators only at this point. Most of the big items are already tracked elsewhere (specifically, unauth playback) or have already been fixed. And many other options are now open to us in a post-10.11 landscape now that we have a proper library database ready.