Some clickbait nonsense. Genuinely.

This isn’t anything like what its trying to spark fear over. it requires a credential stuffing attack that needs the following:

1. A management interface exposed to the internet
2. A lack of controls related to who can log in and where from
3. The use of SSLVPN that does not utilize SAML or another form of OAuth

After all of that, and presuming they have a set of working credentials that have not been changed after the credentials were exposed in a breach, can they perform an attack.

Like with anything, working admin credentials will get you to a CLI, and from there you can do a lot. Protect your management interfaces. Do the bare minimum.

They didn’t give up, they pushed it back 6 months to wait out the shitstorm.

That seems like a rather arrogant tone to take. Reverse proxies are complicated. Easy to set up, but challenging to configure depending on what your needs are. Not everyone wants a homelab.

Everyone’s journey starts somewhere and sometimes people’s needs just don’t extend beyond the easier choices available.

Yes, in ways that were actually greatly beneficial. Some companies were complete vaporware, but it proved a huge boom for fibre optic infrastructure and on the whole, building out modern telecom infrastructure. In a few short years, people went from dialup and T1 connections to DSL and high-speed cable. People weren’t connected, and now they suddenly needed to be. It was an entirely new enterprise.

Unfortunately, these AI datacenters aren’t really the same. They’re not benefitting the public in a lasting sense. These are hot, they’re loud, and they’re expensive. The biggest benefits you may see from them after the bubble bursts is the infrastructure that was required to sustain them.

Improvements to sustainable, and cleaner energy sources are probably the biggest benefits. Reclaiming and rebuilding old nuclear plants, increased solar and wind projects. Governments that are willing to sell their constituents down a river for the business of a tech conglomerate won’t benefit from this, but for the states that are now passing legislation to require these kinds companies to put their money into the communities they want to operate in may build lasting improvements.

It’s a small silver lining, but it’s there. That said, I can only imagine that when these companies see their business begin to get buried under the landslide of debt and reality that they will do everything in their power to escape liability for the waste of resources.

Same, this seems incorrect

I was mostly making the comment in jest. I do rename, but my folder structures, as someone who downloads everything manually based on what I want to watch rather than doing the automated *arr stuff leaves it in directories only I consider sensible.

I have Jellyfin behind a reverse proxy that lives in a DMZ and a WAF to go with it. I’m sure there’s still room for watching an unauthenticated stream because I forgot to rename a folder somewhere, but it’s not exactly an attack vector I care about. I’m more concerned about DDoS or impersonation attacks, which I also attempt to mitigate via an LDAP implementation behind the scenes.

It’s not perfect, but it’s the best effort I can make at the moment.

Jokes on them, my paths are a shitshow and I can’t be bothered to organize them properly

You’ve got a couple benefits. If you have a domain name, and aren’t advertising it publicly, then you can use the reverse proxy to point that domain to a non-standard port that Jellyfin runs on.

Security through obscurity is not good security, but it does prevent the majority of port scanning attacks. You can also use fail2ban on the reverse proxy side to try and mitigate some attacks.