bone@desk: ~/backbonebrief90×28 · utf-8 · no network calls

cover · Guides · 10 Nov

The finishing pass: plugins, metadata and subtitles

The scan gets a library working. What makes it feel owned is the poster, the match, and knowing which two plugins are worth the restart.

JellyfinGuidesone operator

The Jellyfin plugin catalogue filtered to Available, showing a grid of plugin cards with names and versions. — The plugin catalogue on Jellyfin 12.4, filtered to Available. Thirty-six plugins beyond the six that ship. Most of them are for libraries this server does not have.

filter/ to focus

latest — newest firstnewest first

Linuxnspawn 3.x serves a Docker socket on the host, and it hands out root9 Nov

SecurityPyPI's new Security tab says where a release came from, and that is not a verdict9 Nov

SecurityPwnEscape Part 2: from a Firecracker guest to root on the host, in a setup without the jailer6 Nov

SecurityAlpine's sshd could be logged into without a password, and the upgrade alone does not close it5 Nov

SecuritySourceHut's closed registration was closed in the page, not in the handler5 Nov

Securityzlib 1.4 fixes an 8 MB overwrite and a miniunz that could leave the extraction directory5 Nov

SecurityDebian's apt can be tricked into swapping a package after it has been verified4 Nov

SecurityTwo Critical Puppet bugs are fixed, and your autosign config decides how exposed you were4 Nov

PracticesForgejo drops OpenID 2.0 in v19, and your deadline depends on your release track3 Nov

SecurityUbuntu has CVE-2026-98432 fixes for 22.04 and newer, but only in -proposed2 Nov

SecurityVaultwarden 1.37.5 fixes two private advisories, and its config check now refuses to start2 Nov

ReleasesHomebridge 2.5.0 is a Matter release: new device types, and fixes for identity and cache1 Nov

sections9

swap bay96 brands

Google PhotosImmich

DropboxSyncthing

1PasswordVaultwarden

SlackMattermost

feedok

/rss.xml60 items

full textyes

trackingnone

How to subscribe

newswire — what changedservice only

SecurityLet's Encrypt moves to 64-day certificates in February, and renewal maths has to move with it1 Nov

ReleasesMealie 3.30.0 lets you own the AI prompt, time each step, and plan a whole week31 Oct

ReleasesMemos 26.10.0 signs API clients out, stops reading /etc/secrets and makes export an admin job31 Oct

SecurityThe official Claude Code extension bundle on the Cursor Marketplace carried an SSH backdoor30 Oct

SecurityCVE-2026-98432 is a Linux TCP use-after-free, and Anthropic's model reached root with it30 Oct

Releasesborgmatic 2.2.0 keeps Borg deduplicating the tarballs you back up29 Oct

The whole wire →

guides — the long reads4 shown

guideJellyfin in an evening10 Nov

guideImmich is worth the evening8 Nov

guideImmich, PhotoPrism or Ente: which photo library to run7 Nov

guideReadeck saves the page, not the link7 Nov

No trackers · no analytics · no third-party callsbackBone Brief · one operator, sources on the page