Does this introduce basic UX changes, like saying that a media will be permanently lost instead of "will be removed from Jellyfin" which is inaccurate?
Edit: And making it more secure? Just because it is commonly for LAN doesn't mean it can be insecure
> like saying that a media will be permanently lost instead of "will be removed from Jellyfin" which is inaccurate?
I don't know if that changed, but I gave jellyfin only read only access to my movies.
i believe the maintainers stance is that jellyfin should not be exposed and it should always be behind a vpn
I doubt that, how would that work? You would need to give all your friends a VPN login into your local network for all of their devices, including TVs.
or your friend can setup VPN on his Router box.
But then all of his traffic goes through my internet. Unless he has a special high end router that can only route specific domains.
You dont need high end box, a old mini pc running pfsense/opnsense is enough.
High end, as in feature rich.
If you think most non tech people can just casually find an old pc, install and setup pfsense, then you are out of touch with reality. And they also would have to let it run all the time and have space for it. That's just not something realistic. It's not an option for my friends. Might also break chromecast.
not necessarily always a VPN, but you can also use a reverse proxy like caddy or nginx where encryption and security are primary concerns instead of something non-essential like in jellyfin.
Their stance is actually that exposing it is fine
Frankly at this point, everything that is not explicitly fully public should be...
Unfortunately, yeah.
Including, but not limited to, sending passwords in cleartext on login.
As opposed to what? The password needs to reach the server. Encryption is the job of HTTPS.
... as opposed to using salted hashing like in every tutorial since 1990s.
I think you have some confusion between expectations upon the client and the server. This very site (and almost every other) sends your password in plaintext over form data when you sign in.
Hashing (and/or salting) a password client-side before sending it would offer next to no protection, as if the server is expecting this value and the attacker intercepts it, they could just replay the hashed value themselves. Why would they need to know the original password?
The salt for the password should also have been randomly generated when it was first created, and stored alongside the password in the database. The only way for the client to know this value would be to retrieve it based on username alone, when the request is first made. This would reduce the security of the system and allow a dedicated attacker much more leverage to try and crack that single password, if they knew only the username of the user.
The comment you're replying to is correct, encryption is the job of HTTPS.