Notice to Huntarr users

Apps and Virtualization
,
1

I just saw on reddit that apparently huntarr is highly insecure and exploitable (including api keys and credentials for any attached *arr instances, and even more and worse things that I dont fully understand) in several different ways by anyone on the network, and potentially the internet if you expose your server. I try to ignore stupid iNtErNeT dRaMa, especially when hot off the presses like this, but the maintainer

  1. Banned the guy who brought up the security concerns (and did the pen testing after being banned)
  2. Banned and deleted posts of others who brought it up or called him out
  3. Made r/huntarr private
  4. Scrubbed and deleted his reddit account
  5. Deleted/privated the huntarr github

which is extremely sus, or at the very least highly undesirable behavior if genuinely not an admission of guilt from him. Ill be removing my instance out of an abundance of caution, but of course this is one guy on the internet making these claims and everyone knows people tell the truth, the whole truth and nothing but the truth on the internet at all times without fail, so its up to you to make your own decisions. Here is the thread for anyone interested which includes the entire security writeup:

https://www.reddit.com/r/selfhosted/comments/1rckopd/huntarr_your_passwords_and_your_entire_arr_stacks/

5 Likes
2

That’s all you need to know.

If this happens with any software or service, I will never touch it. Getting technical is moot at this point.

3 Likes
3

It’s certainly not the right thing to do, but deleting critical posts and banning such users isn’t exactly unheard-of. But deleting the whole project? That sounds a lot like cutting off your nose to spite your face.