• 3 Posts
  • 447 Comments
Joined 3 years ago
cake
Cake day: July 3rd, 2023

help-circle






  • CrowdSec isn’t really for protection against novel threats. It’s just a crowdsourced Fail2Ban that’s extensible with custom rules.

    If you and I are both using CrowdSec, and some foreign machine is trying to brute force into one of my services, then when it tries to do the same to you it doesn’t even get the chance to try. It cuts down on the load.

    You can also define your own scenarios. Most of the rules it ships with block IPs using a leaky bucket method but I have a custom rule that instantly blocks anyone trying to log into anything using usernames like admin, root, pgadmin, etc.





  • Couple reasons.

    • Jellyfin is not security software, and given the inconsistency and general lack of polish of every other aspect of Jellyfin, its raw login page is not something I’d comfortably expose to the internet to begin with.
    • Quick connect is a poor, unintuitive imitation of Device Flow. A non-technical user would have to also have a Jellyfin app or bookmark in their phone already, and know where to navigate in it to reach the quick connect function. This on its own is insurmountable.
    • It’s not SSO. Jellyfin is yet another username and password they must remember when every single other thing I self host supports OIDC out of the box and they get one user account for everything.