docker-jitsi-meet VS ms-teams-rce

Jitsi Meet for selfhosted Video Meetings

With this version I am facing the same issue as describef by you. This version is broken: https://github.com/jitsi/docker-jitsi-meet/issues/1377

Most video conferencing suites allow starting a call with video disabled so they don't block you from using only audio all the time. Most video suites will also provide either a docker container or suite of containers via docker-compose to get you started quickly. Personally, I host Jitsi using https://github.com/jitsi/docker-jitsi-meet. If you want to try before you host then you can use https://meet.jit.si/ which is the free/public Jitsi instance. They don't require accounts to try. When you host it yourself, there's even an end-to-end encryption option you can enable.

proxy_http_version 1.1 may not be necessary. I copied it from the nginx configuration files included in the official jitsi docker images. I think they are making sure that no HTTP 1.0 requests are made because websockets aren't supported on 1.0. It would be rare for a device to use 1.0 these days, though.

If you need to configure options that are not supported through the ".env" file then, first, be sure to open an issue because the Jitsi maintainers intend for ".env" to manage all the configurations. From there, you can inject only your configuration overrides for the config.json by mounting it in your container as "/config/custom-config.json". This would look like a ' - "/path/to/my/config.json:/config/custom-config.json' entry in the "volumes" section of your docker compose. See https://github.com/jitsi/docker-jitsi-meet/issues/768 for a discussion on this.

https://github.com/jitsi/docker-jitsi-meet/blob/master/docker-compose.yml <-- this is the docker-compose.yml in the official repository, did you tried it?

download the latest release from https://github.com/jitsi/docker-jitsi-meet/releases (at time of writing stable-6173: release)

+1 Jitsi, but host it yourself! This is the Docker install that let's you customize the experience. Browser or app based, platform-agnostic, fully encrypted back to your container, with the option to register a SIP endpoint for people to be able to dial into the conference via your IP PBX and do audio-only conferencing. Jitsi does ALMOST everything that Teams / Zoom can do but for regular conferences with screen sharing, it's hard to beat. I built a web scheduler that initializes meetings via JWT so no inadvertent meetings can start without the organizer, solving one of the drawbacks.

Jitsi is pretty secure and private with using meet.jit.si their server. Also it supports all the devices Android IOS PC and Mac. For your small group I would give it a shot and see what you think. As for server, yes it can be done - https://www.osradar.com/deploy-jitsi-meet-server-with-docker/ or https://github.com/jitsi/docker-jitsi-meet I had issues with Android getting connected so we just use meet.jit.si and it all works fine with 3 people.

Just adding this here for people who think Teams is secure: https://github.com/oskarsve/ms-teams-rce

So als Beispiel https://github.com/oskarsve/ms-teams-rce

> They tend to react with "either you can show us that this is a real danger or we'll ignore it".

This is a bit of a Catch-22 situation, as I get the feeling that proving the danger would often involve doing things that bounty programs specifically forbid, such as "Moving beyond “proof of concept” repro steps"[0]. That may be part of the reason why Microsoft got away with such a stingy response to the RCE vulnerability found in Teams by Oskars Vegeris.[1]

[0] https://www.microsoft.com/en-us/msrc/bounty-online-services?...

[1] https://github.com/oskarsve/ms-teams-rce/blob/main/README.md

There's another angle to this that was discussed on the Risky Business[0] podcast a while back, namely the security angle. As the recent Microsoft Team's vulnerability[1] illustrated, with many Electron apps any XSS vulnerability turns into RCE. Personally I am moving away from Slack, Discord, and other electron apps like them. The browser sandbox ensures that XSS is "only" XSS and doesn't turn into RCE as well.

0: https://www.risky.biz/

1: https://github.com/oskarsve/ms-teams-rce