Jellyfin 12.0
24 points by lilac
24 points by lilac
personal anecdote: I’ve been running the jellyfin 12 release candidates for several weeks and it’s been rock solid. a few nice ui improvements, the apple tv app recently got a huge upgrade that aligns well with this release. if you’ve tried jellyfin before but found it lacking, maybe try giving it another look. it’s really quite good now!
I have been dabbling with streaming services. You pay, but you still get ads. No sir, you must pay more! They also frequently struggle to pick up where I left off with a show. They suck.
Jellyfin rules
Not a huge fan of the "we made this release, it's a tough one to update to, and we kinda expect bugs to pop up, but you should still update ASAP because there are security issues as enumerated here: area1, area2, area3." messaging.
Either tell people to update ASAP due to issues and keep the details under wraps for a while longer (or at least: don't make it trivial to find them), or backport fixes (which might be hard, hence I'd expect the first one.)
As it is the announcement reads like a tutorial "How to create your very own Jellyfin 10.x-based botnet in 1 day or less."
It's not really hard to upgrade, it just takes a bit longer since it needs a database migration, clean up, and full scan.
Either tell people to update ASAP due to issues and keep the details under wraps for a while longer (or at least: don't make it trivial to find them)
Not really possible in an open source project, the moment it's part of a release it will be blatantly obvious. Regardless, the majority are not accessible to an unauthenticated attacker, only the "misconfigured server" one.