MaggiWuerze

Having an https connection doesn’t do shit if the Backend is insecure. The issue with exposing Jellyfin are not man in the middle attacks, but badly managed access controls and unsecured endpoints.

Thede issues and the unwillingness of the devs to fix them because they are hellbent on keeping a maximum of client compatibility is what makes it hard to trust the overall security of the project.

That’s why basically everyone, including the devs, says to not do that and instead rely on a vpn to mitigate security risks.

An encrypted tunnel and a reverse proxy are two very different things. He (I) never talked about a tunnel and neither did the comment I (he) responded to

Reading comprehension and Jellyfin stanning don’t go well together

Feeling adventurous is exactly what you need if you decide to expose Jellyfin to the Internet (a reverse proxy adds nothing to security)

I never had the feeling the Jellyfin devs were were interested in outside contributions or ideas. A lot of the discussion in issues quickly gets passive aggressive from their side.