• 4 Posts
  • 163 Comments
Joined 9 months ago
cake
Cake day: January 24th, 2024

help-circle


  • None. Dashy’s authentication was famously literally security theatre even with Keycloak. You could just pause the load in browser and have full access to the config. Because it let you iframe whatever you could now do so with local services to enum. Somehow Jellyfin is unbustable though. So it’s a bit of a crapshoot. Look at past vulnerabilities. Stuff like XSS unless stored you don’t need to worry about, clickjacking, tab nabbing etc. On the other hand anything that’s arbitrary file read, SQLI, RCE, LFI, RFI, SSRF etc. I would look at seriously. E.g. don’t make your 13ft public because it can be used to literally enumerate your entire private network.












  • LainTrain@lemmy.dbzer0.comtolinuxmemes@lemmy.worldSnap out of it
    link
    fedilink
    arrow-up
    1
    arrow-down
    4
    ·
    19 days ago

    I don’t like middle grounds in my packages, what can I say.

    Docker containers are treated as immutable and disposable to me, like a boot CD, for each, I write a shell script to generate both a .conf if needed, a docker-compose.yml and run the container.

    They’re plug’n’play separate parts to the rest of the OS, while packages are about integrating nicely with the rest of the OS, in a non-snowflakey, non-disruptive manner.

    I also hate .conf.d folders and always deleted them. One program, one .conf.