Comment on Plex got hacked.

Grandwolf319@sh.itjust.works ⁨2⁩ ⁨months⁩ ago

• Mongostein@lemmy.ca ⁨2⁩ ⁨months⁩ ago

  No doubt. Why do you need an account on their servers to use a server on your own hardware? So dumb.

  source

  • Archer@lemmy.world ⁨2⁩ ⁨months⁩ ago

    The second I saw that I immediately looked for alternatives and abandoned plans to have my own Plex server. I knew it would enshittify fast when they can lock you out of your own server

    source

    • acosmichippo@lemmy.world ⁨2⁩ ⁨months⁩ ago

      fuck plex for plenty of other reasons, but you can disable authentication on local networks.

      source

      • Archer@lemmy.world ⁨2⁩ ⁨months⁩ ago

        Just a matter of time until they remove that

        source
  • 7U5K3N@lemmy.dbzer0.com ⁨2⁩ ⁨months⁩ ago

    For me… my server software is running. But the account doesn’t see it. And as such I can’t claim my server to get it back up and running.

    Fun times. Glad I changed my password. :/

    source
• aeternum@lemmy.blahaj.zone ⁨2⁩ ⁨months⁩ ago

  jellyfin is goated. Long live jellyfin!

  source
• thelittleblackbird@lemmy.world ⁨2⁩ ⁨months⁩ ago

  Y hope you know how to harden jellyfinn, because they are not better than plex team…

  source

  • Waryle@jlai.lu ⁨2⁩ ⁨months⁩ ago

    My Jellyfin is behind a Crowdsec + Cloudflare proxy with geoblocking and other protections + Reverse Proxy with additional protections, in a rootless Docker container with no access to the Docker socket, and has only access to a mounted folder which contains just downloaded movies and shows. The effort to break in is high, the reward very low.

    But the most important difference between Jellyfin and Plex is that neither Jellyfin devs nor Jellyfin instances have any personal or credit card information from their users, and therefore are way less a problem of hacked into.

    source

    • thelittleblackbird@lemmy.world ⁨2⁩ ⁨months⁩ ago

      Good to read you know how to implement some protection layers around your jellyfinn :)

      But most of the people (specially the plex ones) don’t have the technical background to deploy something like you have, and convince those people to do the switch without knowing how to protect themselves is not a wise thing to do. Specially when this time, plex response was perfectly fine :)

      source

      • Waryle@jlai.lu ⁨2⁩ ⁨months⁩ ago

        I already answered your second paragraph: Jellyfin holds no sensible data.

        And there is no central server gathering data from all users, an hacker would need to find and break in multiple Jellyfin instances, to get useless data from 1 to maybe 10 users each time.

        And Plex is not easier to install and secure than Jellyfin.

        source

        • -> View More Comments
      • dogs0n@sh.itjust.works ⁨2⁩ ⁨months⁩ ago

        But most of the people (specially the plex ones) don’t have the technical background

        Seems weird to say, because I had to setup Plex one time on a server for testing and it was a bit harder than setting up Jellyfin, so I wouldn’t call most Plex hosters dumb.

        Plus they are still hosting something on their servers, they would still need to secure it in some ways?

        source

        • -> View More Comments
  • daniskarma@lemmy.dbzer0.com ⁨2⁩ ⁨months⁩ ago

    Jellyfin dev team is not in charge of your self hosted security though. You know what you are getting, source code available, and it’s up to you setting the security.

    source

    • thelittleblackbird@lemmy.world ⁨2⁩ ⁨months⁩ ago

      But they are responsible for the unsecured / gruyere cheese product they ship.

      Jellyfinn has a lot of holes and it is easy to deploy it in a insecure way by not techie people. Last time I checked they even didn’t have a recommended practices for hardening it

      source

      • daniskarma@lemmy.dbzer0.com ⁨2⁩ ⁨months⁩ ago

        Not techie people are not going to be able to open it for internet access. If you have the knowledge to set a internet available service you should have the knowledge to be able to provide basic security.

        Most security issues with jellyfin are an issue only for a specific type of user. The one who is selling access to their server. The worst Jellyfin security issue makes selling access to your server a higher risk situation.

        I hope someday those issues would get patched, but I get why there are other priorities for the dev team right now, about issues that bother to a bigger majority of jellyfin users.

        source

        • -> View More Comments
  • rezifon@lemmy.world ⁨2⁩ ⁨months⁩ ago

    Every year Jellyfin improves and Plex further enshittifies. You’re fighting against the tide here.

    source

    • thelittleblackbird@lemmy.world ⁨2⁩ ⁨months⁩ ago

      ???

      This is not about enshitification. The best user friendly app can be a security nightmare and an utterly crap can be rock solid.

      It is not about that, not even development models or just rock star programmers.

      It is about who has a performing security team and who doesn’t.

      source

      • rezifon@lemmy.world ⁨2⁩ ⁨months⁩ ago

        None of Jellyfin’s security issues affect me.

        All of Plex’s shit does.

        source

        • -> View More Comments
• MaggiWuerze@feddit.org ⁨2⁩ ⁨months⁩ ago

  Good luck getting a similar reaction to the myriad of security issues Jellyfin had

  source

  • VeganCheesecake@lemmy.blahaj.zone ⁨2⁩ ⁨months⁩ ago

    Yeah, but you can run jellyfin with local accounts, entirely within a VPN. Pretty much makes most security issues irrelevant.

    source

    • MaggiWuerze@feddit.org ⁨2⁩ ⁨months⁩ ago

      Which is the exact mindset that enables Jellyfin devs to not fix those issues, congratulations

      source

      • VeganCheesecake@lemmy.blahaj.zone ⁨2⁩ ⁨months⁩ ago

        Maybe? Like, I’d very much prefer they fix them, even though they do not impact my use case. Still, they don’t.

        source

        • -> View More Comments