I feel like you’re overestimating the number of people who buy a Google or Samsung device because they want to install third party apps. A lot of them buy an Android device because they just don’t like Apple. Most folks don’t install anything from anywhere other than the Play Store because they don’t even know there are other choices.

In general, people’s preferences are most often born from whatever their first device was, and nothing more, with little interest in what they can do with it other than what’s required of them.

Like a well oiled machine by the end of it. You’d submit some information; likes, interests, hobbies, etc. and then you’d be paired with another participant based on a random draw with some selection restrictions (i.e. national vs international). You had roughly a month from being matched with someone to get a gift shipped out.

It was particularly fun to get to know the person both through their suggested interests but also to take a peek at the communities they participated in. You could post gifts you received to a gallery (which I wish they archived), confirming receipt and letting the sender know your appreciation.

Some people sucked, and wouldn’t deliver on their end, so there was a volunteer “elf” system that would let folks become secret santas for any recipient that was let down by their own santas. Not sending something generally got you banned from future participation, and filling the elf role would gain you general reputation within the program

The only thing I’ve missed, like truly missed about old Reddit was Secret Santa. There was something so fun about it, and the system was so good. I know it’s logistically challenging, even more so for a federated platform, but it was one of the things that made the site feel unique.

They’re actively producing DDR4 and 5, with Corsair notably having purchased supply from CXMT for use in their Vengance line, just not for North American distribution

It’s still not bad if you’re buying old SAS drives. At this point, anything 4TB or less is fine, and for most people that’s plenty to start with.

If you’re ripping DVD and BluRay content, you probably will gobble up space quickly without re-encoding it, but otherwise you can store content from streaming services with ease.

Have I gone my whole life doing cover letters “wrong”? I use them as an opportunity to talk about things I’ve worked on as it relates to the responsibilities of the job that a resume wouldn’t necessarily explain in depth. I’ve never treated it like I’m meant to ingratiate myself to anpotential employer for the chance. Usually the resume is “Here’s where I’ve worked and my roles there” and the cover letter is “Here’s what I’ve worked on and how that experience is relevant”

I’d be trading one smart mess for another, and paying more money to do it. My TV is from 2018, and when it’s hit 10 years old maybe I’ll think about it. But right now, there’s no reason for me to rush out and find something else when I know the Roku can’t phone home and Jellyfin works like I want it to. Besides, whether an account is required or not, I wouldn’t trust Google any more than Roku/Fox. I don’t know what I’ll buy next, but I’m not prepared to think about it right now.

It saddens me, as I liked Roku for being the least ad-ridden option of the bunch. The apps don’t advertise to me as I hover over them, and a DNS change renders the single poster-style advert on the screen inert.

I’ve got a couple Roku devices that realistically I’ll continue to use unless I manage to find a hospitality TV or something to replace my TCL with. I’d just use my PS5 if it weren’t for the fact Sony won’t approve Jellyfin’s app

Some clickbait nonsense. Genuinely.

This isn’t anything like what its trying to spark fear over. it requires a credential stuffing attack that needs the following:

1. A management interface exposed to the internet
2. A lack of controls related to who can log in and where from
3. The use of SSLVPN that does not utilize SAML or another form of OAuth

After all of that, and presuming they have a set of working credentials that have not been changed after the credentials were exposed in a breach, can they perform an attack.

Like with anything, working admin credentials will get you to a CLI, and from there you can do a lot. Protect your management interfaces. Do the bare minimum.

They didn’t give up, they pushed it back 6 months to wait out the shitstorm.

Yes, just not for the North American market

That seems like a rather arrogant tone to take. Reverse proxies are complicated. Easy to set up, but challenging to configure depending on what your needs are. Not everyone wants a homelab.

Everyone’s journey starts somewhere and sometimes people’s needs just don’t extend beyond the easier choices available.

Same, this seems incorrect

I don’t feel bad for Microsoft, but responsible disclosure is about more than that.

It’s ethical. It gives the developer time to correct an error before it has the potential to affect anyone using their products. When you don’t follow that process, whether one set out by the developer, or a best effort on your part, you are now contributing to the potential harm caused by that vulnerability.

This isn’t universal, and I have no doubt that Microsoft is also partly to blame, but there’s a significant element of attention seeking in the mix here. They could have reached out to other security researchers, validated the findings in private and found another channel to work through. Maybe he tried, but largely it seems like his actions are retaliatory and broadly harmful to anyone who has to administer these products.

I have a lot of respect for security researchers. My job relies on the work they do and the skill it takes to do it. But part of that relies on doing things in a way that minimizes potential harm.

I was mostly making the comment in jest. I do rename, but my folder structures, as someone who downloads everything manually based on what I want to watch rather than doing the automated *arr stuff leaves it in directories only I consider sensible.

I have Jellyfin behind a reverse proxy that lives in a DMZ and a WAF to go with it. I’m sure there’s still room for watching an unauthenticated stream because I forgot to rename a folder somewhere, but it’s not exactly an attack vector I care about. I’m more concerned about DDoS or impersonation attacks, which I also attempt to mitigate via an LDAP implementation behind the scenes.

It’s not perfect, but it’s the best effort I can make at the moment.

Jokes on them, my paths are a shitshow and I can’t be bothered to organize them properly

You’ve got a couple benefits. If you have a domain name, and aren’t advertising it publicly, then you can use the reverse proxy to point that domain to a non-standard port that Jellyfin runs on.

Security through obscurity is not good security, but it does prevent the majority of port scanning attacks. You can also use fail2ban on the reverse proxy side to try and mitigate some attacks.

It depends entirely on the implementation. Is it genuinely a “second factor”? Or are they just going to let you use one or the other? Because MFA is a real benefit to account security, even if SMS is the weakest version of it.

The trouble for me in this sense is that I have an AVR, I’d like CEC to work and I’d like an interface that was actually designed for a remote.

I’ve done this before, and frankly it’s just not as good. It works reasonably well, but an HTPC has never served as well as a purpose built piece of hardware or software, even if that’s the TV itself.

If I really wanted, I could buy a hospitality TV and use the RS232 to control it from the PC but I’m tired thinking about the ways that’s likely to fail.

This is what strong endpoint security is for. EDR software is also common. Routing everyone’s internet traffic is pretty strenuous.