Saik0

Okay? And that is equally bad. What’s the point? We should be striving for less IMO.

Now realize those things are internet connected… and that video was definitely uploaded.

I rather not need mass surveillance to buy a fucking snickers.

Uh… Well, no? I mean you can go see for yourself. Click an article. Media is there. https://library.kiwix.org/viewer#wikipedia_en_all_maxi_2024-01/A/User:The_other_Kiwix_guy/Landing

I don’t know exactly what subsets of stuff this is, as I know that wikipedia is about 1/2 petabyte total data all in. But this specific zim export is all English articles with some media. I believe that ALL the English articles is about 50GB and the other 55-ish GB is just media. It’s definitely cutdown, but not devoid.

Wikipedia is 109.89GB… You could have enough space on your phone that you’re reading this post on.

Download your own copy of wikipedia.

https://library.kiwix.org/#lang=eng is one of many tools out there that can help you get a copy and even get it running in docker.

More copied of the data, less possible to take it all down.

Trying hundreds or thousands of hashes against the servers of random unconsenting people on the internet is beyond what I would be comfortable with

And installing a rootkit just because a customer put my music disc in a computer would be beyond what I’m comfortable with. However we know they’ve done it, and more or less got away with it.

Thank you for this list. We are aware of quite a few, but for reasons of backwards compatibility they’ve never been fixed. We’d definitely like to but doing so in a non-disruptive way is the hard part.

While I’m sure that some of the answer is in not having dev time to fix it… Their response makes it seem like they’re not fully interested in fixing it for other reasons… In the case of this response, “Backwards compatibility”.

Sure. Now who here wants to litigate it and find out?

the prosecution may have committed a crime in finding it.

Web scanners/crawlers aren’t illegal though. And since it’s not authenticated there’s no attempt to break any security/authentication/encryption. You don’t get in trouble for finding a random URL in a google search and accessing it. You’d get in trouble if you had to bypass some security measure to get there.

The point of this all is that these endpoints have no measure in place. Seemingly on purpose, and it’s documented by the maintainers that they don’t intend to fix it and leaving it open is intentional.

You can gamble it. I won’t. I just can’t accept that “Jellyfin is better” that keeps getting pushed when big gaping problematic holes like this exist.

I’m insufferable? You’re the one relying on personal attacks to make your point. Then run away with tail between legs when I show you 1) how it’s not the same as your case and 2) how other current internet operations WOULD be the same, and there’s no lawsuits in regards to those things.

You’re wrong, period. Stop trying to debate laws interpretation of a country you don’t even speak the language of.

LMFO. I actually speak English, French, Polish, and German (in proficiency order) and have an EU citizenship.

I just happen to live in the USA. So congrats, you’re wrong again. Try not to resort to personal attacks next time. You’ll look much less silly.

YOUR intention doesn’t matter. You don’t maintain the jellyfin code. The actual code designers specifically left the endpoints open for “compatibility”. There was a conscious decision for those endpoints to not require authorization, and worse, IT’S DOCUMENTED. This is not like the case you’re quoting. If accessing endpoints without auth was ever illegal, almost all IoT devices would be illegal, a good chunk of gaming and other services would be illegal, etc… This premise is asinine.

You realize that google and other sites regularly scan and capture direct links to websites without ever giving a shit about a login page somewhere else on the site. You don’t see lawsuits against any of those crawlers, nor the people who click the crawled links when they return in a search result. This is the exact same premise.

Or even just on a differently vlan that you want to go through your reverse-proxy because that is where your security features are to separate you from shit you don’t trust.

Article 323-1 : you access my server without my authorization -> 3 years of prison, 100k€ fine

Bullshit. Notice the term is fraudulent. They are not making a bad login or accessing anything that requires authorization. There is no requirement here that simply accesses a web page is sufficient.

Article 323-3 : you touch my data in any way -> 5 years of prison, 150k fine

Again FRAUDULENT. Since it’s public access, there’s nothing illegal happening here. Further any company that would be scanning for this material to build a lawsuit would have the legal right to reproduce the content (eg a law-firm that was contracted by universal, sony, etc…)

It requires authentication or bypass of functioning code to be fraudulent. Making calls to apis that have no authentication cannot be illegal. This is literally how a good chunk of the internet itself works. If it was illegal the internet wouldn’t exist in your country.

Edit: Just to make it clear. It’s not a “flaw”. The github link itself shows that the managers of jellyfin are aware of the problem and intentionally do not “fix” it as they want backwards compatibility.

I was testing a 2fa based one the other weak and jellyfin was the service I decided to test with. Ultimately didnt like it so I rolled ot back.I’d have to go look it up to get you a name.

Look at the rest of this thread though… many people are just fine with “this is FUD, I’m going to keep doing it!”

Still, posts like this raise awareness of the problem.

deleted by creator

There is no authentication occurring. There is no “hacking” here. Nothing about scanners or bots scraping unauthenticated endpoints is illegal. This would be admissable.

No. None of the items are closed. Click the “closed” items. All of them are “Not planned. Duplicate, see 5415”.

Edit: The biggest issue of unauthenticated streaming of content… https://github.com/jellyfin/jellyfin/issues/13777

Last opened last week. closed as duplicate. it’s unaddressed completely.

No. None of the items are closed. Click the “closed” items. All of them are “Not planned. Duplicate, see 5415”.

No. None of the items are closed. Click the “closed” items. All of them are “Not planned. Duplicate, see 5415”.

Keeping that copy on a web accessible platform that is accessible by anyone on the internet(unauthenticated) isn’t covered by your rights at a bare minimum.

Depending on the content “timing” if they trigger on something that doesn’t have a physical/consumer release yet… or all sorts of other “impossible” conditions. This is obviously reliant on what content you actually have on your server.

It’s still something regardless that it’s best not to invite.