Privacy first

[g2ufVmt4]

I still remember the day Jellyfin was forked from Emby. I didn't see the point of trying Plex since it went centralized. The whole point of this, for me, was privacy first.

Jellyfin sends your library contents to third-party metadata providers in real time as it's added, or periodically for the rest.

Preventing that requires significant technical effort if you're not willing to disconnect entirely, and isolating outbound traffic well enough to actually stop the leak isn't something most users can pull off, let alone something that should be the bar for "privacy first."

To put it bluntly: I don't see how one prevents the instance being fingerprinted and your habits being monetized by third parties short of that effort.

The project has shifted toward scaling with features and supporting everything, while the backlog of security and privacy issues keeps growing with less attention. I recall a report of media being accessible without authentication around the 10.8.x era that got closed without what looked like an actual fix.

I also want to point out that I'm holding the project to the standard it has shown, and that's why this post exists. Its not meant as criticism, but rather the opposite.

I hope it encourages some talk about whether it's possible to mitigate outgoing connections to some extent. On that note, I'm a bit shocked that the official docs only really flesh out instructions for a single specific third party provider that requires central registration: Tailscale. It's a VPN that itself needs an account with an outside company just to function, which sits strangely next to a project whose whole pitch is privacy first. Why is that the recommended path?

I also welcome thoughts on addressing what I mentioned or if im in the wrong. Hopefully, the gist of my post makes sense.

Appreciated

[TheDreadPirate]

You can already disable pulling from online metadata providers easily. In each library you can uncheck each metadata provider for each category. Once all the online metadata providers have been disabled, Jellyfin will then only use whatever local metadata is available.

Regarding media downloading without authentication, I believe the issue you're talking about was fixed in 10.8.9.

[g2ufVmt4]

Appreciate the reply and fair point. I realize I was a bit unclear. I'm not trying to disable metadata retrieval, I believe there's a way to get the same functionality while reducing what the instance leaks to third parties in the process.

I already do this by routing metadata retrieval through a Tor proxy. But it was genuinely not trivial to set up correctly, and a small misconfiguration silently breaks the whole point of it.

Which is my point. Most people self-hosting assume some baseline of privacy and have no reason to question if this is something to even think about, let alone how to address it. A short wiki note on the documentation, mentioning that third party providers receive your library contents as it's added, and how to route that through a proxy if you need to mitigate such, would go a long way and costs literally nothing.

On that same note, the docs' only real remote-access writeup is Tailscale, which requires an account with an outside company.

That sits oddly next to "privacy first," especially with not a single mention of self hosted alternatives like wireguard, openvpn, or even ipsec existing and don't require trusting any third party at all.

Regarding the auth issue, I only brought it up as one example supporting the broader point, not as the thing I want to debate here. I'll leave it there rather than get into whether it's actually resolved, since that's a separate, developer focused discussion. What I'm raising is more about user awareness and choice, which isn't really something you can verify with a test case on this.

[TheDreadPirate]

While I see your point, Jellyfin does have far far better privacy due to the lack of centralized accounts and phoning home. I would argue that most people don't care THAT much about privacy and accept that there is going to be some level of tracking simply by accessing a web page, period, since most sites maintain some level of IP logging and ISP DNS logging.

For the people that find that level of tracking unacceptable and want true, no-compromise, anonymity they will find their own way. But that is an infinitesimally small percent of Internet users, period.

Additionally, that would be a non-trivial expansion of Jellyfin's functionality and code base, beyond the core functionality of being a media server, for an already very large and complex FLOSS project.

Even providing documentation or guides for achieving true anonymity would then increase the already large troubleshooting surface area as we would then become responsible for helping achieve that.

TLDR; It is simply out of scope.

[g2ufVmt4]

I'm not asking for building anonymity features or take on any support on such. I agree with you there.

What I'm pointing out is much smaller: a documentation note about metadata providers so people can themselves can make a choice is trivial to implement. Lets not forget:the only remote-access path is documented behind a third party.

I don't understand how its outside any scope to question third party services being promoted like this? It really comes of as utterly backwards when one is told its outside the scope to question such. It should be opposite.

"Most people dont care that much": its an assumption and exactly why its worth mentioning. Its not the same as users not needing to be aware of such.

Comparing against a centralized competitor doesnt really answer if jellyfin is meetings any expectations that users naturally have.

I guess tailscale accounts are within the scope