Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WiiFin – Jellyfin Client for Nintendo Wii

github.com

Post reply on HN
Print view View original

61–70 of 131 posts

Re: WiiFin – Jellyfin Client for Nintendo Wii

#61

Post by shiroiuma »

MaxikCZ wrote: post #56
notpushkin wrote: post #55

Earlier quoted context omitted.

> Reverse proxy itself will do barely any defense, what you need in combination is an authgate What’s your threat model?

Same as anyones: random bots scanning IP/ports to find established services and trying exploits from the book.

With a reverse proxy, I don't see how this would work. The whole way the reverse proxy works is you use a subdomain name ("jellyfin.yourdomain.org") to access Jellyfin, rather than some other service on your server. The reverse proxy sees the subdomain name that was used in the HTTP request, and routes the traffic based on that. Scanning only the IP address and port won't get attackers to Jellyfin; they need to know the subdomain name as well.

Re: WiiFin – Jellyfin Client for Nintendo Wii

#62

Post by dmos62 »

ssl-3 wrote: post #45
lamasery wrote: post #44

Earlier quoted context omitted.

Get your elderly mother an Apple TV and infuse, then connect with Tailscale. It’s pretty friggin’ smooth in daily operation. Apple TV’s UI is no easier to get lost in than Roku, and actually has fewer pitfalls if you toggle one setting (the one that makes one home tap open the Apple TV app, and a second press while in that app actually go home, by default; switch that to always go home on any press of that button no…

Perhaps. Y'all (collectively) have some good ideas. But she likes the Roku. She's even got silicone skins for the remotes (plural; spares!), and two of them are tethered near the chairs that her and dad tend to sit in. Also: The Roku stuff already exists, and is paid for, and it works with Plex (without a VPN, because my local Plex container didn't come with the caveat to avoid exposing it to the world). Buying them…

Sad to hear about people getting stuck in weak ecosystems.

By the way, I switched from Jellyfin to plain SMB + Nova Player (Android), which has basically the same interface, but no user profiles, and works over SMB, obviously. No transcoding, best format support, and best performance for large files I've found yet for my TCL Android TV.

Re: WiiFin – Jellyfin Client for Nintendo Wii

#63

Post by 542458 »

ZeWaka wrote: post #58
lamasery wrote: post #18

Earlier quoted context omitted.

> The only hiccup was when she tried to watch during one of her lectures. I had to explain that Jellyfin is only at home ;) (for now) Tailscale got me outside-the-home Jellyfin with a grand total of maybe 30 minutes of effort, including signing up, getting my server connected, and getting it on my MacBook, AppleTV, and phone. I'd never used it before.

Combine with a $5 VPS and nginix reverse proxy to make this true for any device, even ones without tailscale!

Or Cloudflare Argo tunnels for $0/mo :)

Re: WiiFin – Jellyfin Client for Nintendo Wii

#64

Post by stijnveken »

monocasa wrote: post #15

Has anyone tried to horizontally scale jellyfin to running on a multi node cluster? I'm wanting to set it up for around 20 households to share, and with transcoding that exceeds a single (cheap) node.

I only have an cpu with hardware acceleration that is used for transcoding and even that can handle a couple of streams transcoding simultaneously. The biggest thing is getting people to use clients that support direct play.

Re: WiiFin – Jellyfin Client for Nintendo Wii

#65

Post by zhivota »

nout wrote: post #11

Jellyfin is great in that it just works. I managed to install it on Samsung TV with Tizen OS and it has been just solid experience for many years now.

I love it mostly as well so far, the only sticking point on both my TVs is constantly having to re-enter my server IP address. It sticks around for a couple days, then it's gone again.

Re: WiiFin – Jellyfin Client for Nintendo Wii

#66

Post by tech234a »

Mashimo wrote: post #60
random_human_ wrote: post #57

Earlier quoted context omitted.

If you expose Jellyfin on 443, have HTTPS properly set up (which Caddy handles automatically), your admin password is not pswd1234 (or you straight up disable remote admin logins), and use a cheap .com domain rather than your IP--what is the actual attack surface in that case? As far as I can remember that is more or less what is usually suggested by Jellyfin's devs, and I have yet to see something that convinces me…

He claims there are known exploits. Though I also want to know if this is really true.

https://github.com/jellyfin/jellyfin/issues/5415

Re: WiiFin – Jellyfin Client for Nintendo Wii

#67

Post by rauland »

monocasa wrote: post #15

Has anyone tried to horizontally scale jellyfin to running on a multi node cluster? I'm wanting to set it up for around 20 households to share, and with transcoding that exceeds a single (cheap) node.

Jellyfin isn't designed to be clustered.

For your use case, deploying multiple instances would be the way to go.

Re: WiiFin – Jellyfin Client for Nintendo Wii

#68

Post by haunter »

mystraline wrote: post #25
lamasery wrote: post #10

Forced server transcoding for everything. Ouch. Thought maybe at least mpeg2 or something would play directly.

Intel ARC 380's are ideal at 4k realtime transcoded streams. And theyre cheap as well. You could probably do a sticky round robin reverse proxy with a few backends doing transcode. The biggest issue is bandwidth, but you probably knew that.

Even better is a passive cooled GPU like the Palit 3050 KalmX https://www.palit.com/palit/vgapro.php?id=5147 Too bad they are not producing them anymore

Re: WiiFin – Jellyfin Client for Nintendo Wii

#69

Post by notpushkin »

shiroiuma wrote: post #61
MaxikCZ wrote: post #56

Earlier quoted context omitted.

Same as anyones: random bots scanning IP/ports to find established services and trying exploits from the book.

With a reverse proxy, I don't see how this would work. The whole way the reverse proxy works is you use a subdomain name ("jellyfin.yourdomain.org") to access Jellyfin, rather than some other service on your server. The reverse proxy sees the subdomain name that was used in the HTTP request, and routes the traffic based on that. Scanning only the IP address and port won't get attackers to Jellyfin; they need to know…

The only tricky part here would be to make sure you’re doing a wildcard certificate, so that your subdomain doesn’t appear in Certificate Transparency logs.

Re: WiiFin – Jellyfin Client for Nintendo Wii

#70

Post by random_human_ »

tech234a wrote: post #66
Mashimo wrote: post #60

Earlier quoted context omitted.

He claims there are known exploits. Though I also want to know if this is really true.

https://github.com/jellyfin/jellyfin/issues/5415

The absolute worst thing I can see in there is that an third party who somehow managed to get a link to one of your library items (either directly from you or from one of your users--or by spending the next decade bruteforcing it I guess) could stream said item: https://github.com/jellyfin/jellyfin/issues/5415#issuecommen...

Everything else looks to me like unimportant issues, that would provide someone who's already logged in as a user minor details about your server.

Post reply on HN