🇨🇦

  • 4 Posts
  • 37 Comments
Joined 2 years ago
cake
Cake day: July 1st, 2023

help-circle
  • Usually that does the trick for me too; but this morning it just would not cooperate no matter what I tried.

    Seems to be playing ball again, for now.

    I have a feeling this is more to do with Android/Google not wanting to give up control more than anything. If googles stuff always works, but third party stuff is mysteriously always glitchy; users are going to gravitate to google and their ever growing monopoly…







  • I’m so tired of seeing this overblown reaction to ancient non-news.

    Yes, there are some minor vulnerabilities in Jellyfin; but they really really aren’t concerning.

    Unauthenticated, a random person could potentially (with some prior knowledge of this specific issue, and some significant effort randomly generating media UUIDS to tryout) retrieve/playback some media unauthorized. THATS IT. That’s the ONLY real concern. And it’s one you could mitigate with a fail2ban filter if you were that worried about it.

    The other ‘issues’ here, are the potential for your already authenticated users to attack each others settings. Who do you share your server with that you’re concerned about them attacking each other???

    Put this to bed and stop fussing over it. It’s genuinely not worth your time or attention. Exposing Jellyfin to the net is fine.

    Dev comment on the situation: (4 days ago) https://github.com/jellyfin/jellyfin/issues/5415#issuecomment-2825240290



  • Where in the world did you get that idea?

    VPNs serve three functions:

    • add a layer of encryption so your local network operator and ISP can’t inspect your traffic, its contents and its true destination. (this is what OP is looking for)

    • make it appear to the service you are connecting to, that you are connecting from a different location than where you actually are. (for example make Netflix think you’re in a different region to show you different content)

    • provide secure access to private services that are not exposed directly to the Internet. IE securely connecting devices on seprate LAN networks together over the Internet via an encrypted tunnel. This is a VPNs true purpose and how they are primarily used in Professional/Comercial settings. (pretty much every corporation you’ve ever interacted with runs a VPN that connects its stores/warehouses/offices together)


  • I really don’t like the idea of every device automatically having a publicly reachable IP.

    There’s certainly situations where that would be nice; but I’m quite fond of most equipment and services being behind a router and it’s firewall, requiring explicit configuration to be exposed to the open net.

    Nobody outside my home network ever needs access to my toaster… (btw, why tf is my toaster wifi enabled…?)






  • Rebooting just seems like a very roundabout, slow and inefficient way to get back to that initial state you describe.

    It’s exactly what the reboot process is designed to do; return you to that fully encrypted pre-boot state. There would be no purpose to implementing a second method that does the exact same thing.


  • Much of the data on your phone, including critical information that’s required to run the operating system and make the device function, is fully encrypted when the device is off/rebooted.

    While in this locked down state, nothing can run. You don’t receive notifications, applications can’t run in the background, even just accessing the device yourself is slow as you have to wait for the whole system to decrypt and start up.

    When you unlock the device for the first time; much of that data is decrypted so that it can be used, and the keys required to unlock the rest of the data get stored in memory where they can be quickly accessed and used. This also makes the device more vulnerable to attacks.

    There’s always a trade off between convenience and security. The more secure a system, the less convenient it is to use.


  • Single party consent means one of the people being recorded must give permission to record … full stop.

    This is true.

    What you don’t understand is that a person does not have to be actively speaking or being directly spoken to in order to be a part of a conversation. Simply being present, with the other participants fully aware of your presence while continuing to converse makes you part of their conversation and thus a party able to consent to it’s recording.

    The key there is that the other participants are aware of your presence. You’re not hiding around a corner, listening in unbeknownst to them; the people conversing are entirely aware that you are present and likely listening.


  • By your rational a police agent without a warrant could walk by and say “hello”, plant a listening device, then record your conversation because he said hello at the start.

    No. In that situation a third party inserted themselves into your conversation entirely of their own volition.

    This is like you walking up to someone that’s streaming/vlogging in public, beginning an unrelated conversation in front of them; then you getting upset that they are recording the conversation that you began in their presence. Even if you weren’t aware they were streaming; you were the one that inserted yourself into that situation. They didn’t walk up to/join you; you made them a party by bringing the conversation to them.


    A really big part of these types of legal situations is ‘reasonable expectation of privacy’. The people inside a vehicle are all pretty close together and obviously going to be able to hear the conversions that are happening. It’s unreasonable to expect the driver who’s head is ~3 feet from you isn’t privy to your conversation.



  • Canada has single-party consent laws when it comes to audio recording.

    I hate this use and that I’m arguing devils advocate here, but legally speaking; If the driver opted-in to the program, audio in the vehicle can legally be recorded because the driver is considered a party to the conversion that’s happening within their vehicle (even without actively participating in that conversion). They can record and distribute that recording however they like (including to lyft to be transcribed).

    Lyft wouldn’t be able to record vehicle audio without the consent of the driver at the minimum; but they aren’t necessarily required to gain consent or even inform the other passengers. As shitty as that is.

    Don’t treat your driver like they don’t exist and keep private conversations for when your actually in private. Even a regular cab driver could be privately recording you; regardless of ‘company policy’.


    Another way to think of this is: You can record the audio in your immediate vicinity (ie, anything you can naturally hear) without having to gain consent from or inform everyone around you. Same concept.