The major problem (in my view) is that passwords are sent in clear-text (or close to) by the various apps that are available as part of the URL scheme. This makes passwords very easy to eaves-drop for somebody with a certain degree of knowledge.
The second major problem is that Subsonic stores all user details in clear-text (or close to), both login passwords and last.fm passwords together with email addresses. Since many people use the same password on different sites, this is of course unacceptable. I've addressed this issue in my Subsonic mod so that passwords are instead stores as salted hash sums. I've made this publicly available for Sindre to use but no response.
The third major problem is that Subsonic uses a four year old security framework called Acegi. Exploits have been reported for this. I've addressed this issue as well in my Subsonic mod, updating to the latest version of Spring security which is the successor of Acegi. I've made this publicly available too but no response.
The fourth major problem is that Subsonic is configured to run as root on non-windows installs (haven't checked permissions for Windows) which would give an intruder completely free hands to do whatever she/he wants to.
The fifth problem is that SSL isn't turned on by default, so even normal logins are quite possible to eavesdrop even if it's harder than wire-tapping the apps speaking to your server.
I'd say you obviously run a risk when you install software accepting connections from foreign machines. Not even that, software that allows users to configure which part of your hard drive to read files from, upload new files to your computer, and to execute commands. How could you not say you're running a risk?
If you want to learn more, read the Subsonic source code and make up your mind on whether it feels safe or not.
GJ51 wrote:Minor issues raised by users are addressed promptly by the developer.
I wish this was true... but what about
viewtopic.php?f=3&t=5996 ?
