The mountain of tech debt, cultural debt, and real debt this country has built up over the past few decades in service of the billionaire has allowed for a lot of insanity. Kind of feels almost intentional.

Why would they do the thing they do on the box, the website, in a little packet, and over the phone?..

Chestnut needs liquid refreshment man.

My bad. I misread your previous post, specifically around "I agree with the other guy". That being said, anyone with a functional device that can compute any amount of monero hashes is a proven target, granted, not specifically.

People like you in this industry are legitimately the reason botnets and significant compromise still exists. "You don't need to be a genius to do all this additional config to make this thing I'm referring to as secure, secure." Do you even read your own writings before you hit post? Also your final argument is so slathered in whataboutism I can't even. Yes, any internet connectivity is going to be less secure than an air gap, but when you're advising implementations you should keep security posture and best practices in mind. What you're speaking on is more complex than any one person's understanding of it due to significant layers of abstraction. Exhibit a? Ssh is not a codebase. It's a network protocol. The codebase is literally different depending on implementation yet you continue to talk about it as if it's a single piece of software that has been reviewed and like all ssh shares the same vulns but the software is entirely different depending on who implemented it so you have no real clue what you're talking about and it's actually sad people will be misled by your nonsense and false bravado. (https://en.wikipedia.org/wiki/Secure_Shell)

I want our children learning about arbitrary language rules rather than actual human culture... Fucking vultures man.

Agreed, but best practices are meant to deal with the very rare. They didn't put the vulnerabilities in the software due to negligence or malice, it's just an ever evolving arms race with cracks that show up due to layer upon layer of abstraction. Again I'm not saying to never expose ssh to the net, quite the opposite, but as a best practice you should never do it unless you fully understand the risk and are prepared to deal with any potential consequences. That's just a core tenant of understanding security posture.

"This race condition affects sshd in its default configuration." direct quote from the linked article, paragraph like... 3. I linked it so people could read, not speculate.

I linked a relevant vulnerability, but even ignoring that, pragmatically, you feel they'd be targeting specific targets instead of just what they currently do? (That, by the way, is automating the compromise of vulnerable clients in mass scale to power botnets). Any service you open on your device to the internet is inherently risky. Ssh best practices are, and have been since the early days, not to expose it to the internet directly.

It's difficult to say exactly what all a reverse proxy adds to the security conversation for a handful of reasons, so I won't touch on that, but the realistic risk of exposing your jellyfin instance to the internet is about the same as handing your jellyfin api over to every stranger globally without giving them your user account or password and letting them do whatever they'd like for as long as they'd like. This means any undiscovered or unintentional vulnerability in the api implementation could easily allow for security bypass or full rce (remote code execution, real examples of this can be found by looking at the history of WordPress), but by siloing it behind a vpn you're far far far more secure because the internet at large cannot access the apis even if there is a known vulnerability. I'm not saying exposing jellyfin to the raw web is so risky it shouldn't be done, but don't buy into the misconception that it's even nearly as secure as running a vpn. They're entirely different classes of security posture and it should be acknowledged that if you don't have actual use for internet level access to jellyfin (external users, etc, etc) a vpn like tailscale or zero tier is 100% best practice.

Honestly you can usually just static ip the reverse proxy and open up a 1:1 port mapping directly to that box for 80/443. Generally not relevant to roll a whole DMZ for home use and port mapping will be supported by a higher % of home routing infrastructure than DMZs.

Doesn't take that to leverage an unknown vulnerability in ssh like:

https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server

That's why it's common best practice to never expose ssh to raw internet if you can help it; but yes it's not the most risky thing ever either.