Comment on Plex got hacked.

CriticalMiss@lemmy.world ⁨3⁩ ⁨months⁩ ago

• BackgrndNoize@lemmy.world ⁨3⁩ ⁨months⁩ ago

  Stuff like this can happen to any app, developers are only human, shit happens, but the bigger a company is, the bigger target it becomes, so there is some saftey in an open source app that’s not as popular, but then again a bigger company also has more resources to monitor for security breaches and quickly address them and push out a hot fix, can’t say I know how this works for smaller free open source apps

  source

  • Sneptaur@pawb.social ⁨3⁩ ⁨months⁩ ago

    I think the point here is that Jellyfin doesn’t have a centralized login or website like Plex does. An attacker would have to know about your server and log into it directly to get access. If you run it in a container, there isn’t a lot they can do other than trashing your media library, which you should have protected with filesystem snapshots anyway.

    source

    • purplemonkeymad@programming.dev ⁨3⁩ ⁨months⁩ ago

      Jellyfin doesn’t even have write access to my files. If they can get access into the container’s process then I guess they could add stuff to the web interface which could contain bad stuff.

      source

      • Sneptaur@pawb.social ⁨3⁩ ⁨months⁩ ago

        That’s also a viable solution, but for me I just use Btrfs snapshots on my NAS. My files are stored on a different device and the Jellyfin container only sees them as a mounted dir, not even aware that it’s an SMB mount.

        source
• TheGrandNagus@lemmy.world ⁨3⁩ ⁨months⁩ ago

  I enjoy using Jellyfin and hope it continues to improve, but it has some problematic security of its own.

  source

  • Logical@lemmy.world ⁨3⁩ ⁨months⁩ ago

    But if you just run it locally an a media server in your home, and you don’t expose the service to the internet, that doesn’t really matter? Though perhaps more people connect to their Jellyfin instances remotely than I realize.

    source

    • thax@lemmy.dbzer0.com ⁨3⁩ ⁨months⁩ ago

      It matters if someone manages to hide an exploit in jellyfin’s codebase, or more likely, a popular plugin. I imagine many folk have permissive outgoing firewall rules, in which case, an exploit could establish connectivity. Whether that eventually leads to privilege escalation on the jellyfin host would depend upon other variables.

      source
    • cosmo@lemmy.world ⁨3⁩ ⁨months⁩ ago

      Well. If you’re not streaming why have such a service in the first place? If I didn’t stream remotely with Plex (and share with my friends and family) I’d just go back to running Kodi on my htpc like I did ten years ago.

      source

      • nonfuinoncuro@lemmy.zip ⁨3⁩ ⁨months⁩ ago

        steam locally to multiple devices plus for remote streaming I just VPN into my home network

        source

        • -> View More Comments
  • bobzer@lemmy.zip ⁨3⁩ ⁨months⁩ ago

    For example?

    source

    • magguzu@midwest.social ⁨3⁩ ⁨months⁩ ago

      Have fun: github.com/jellyfin/jellyfin/issues/5415#event-17…

      source

      • bobzer@lemmy.zip ⁨3⁩ ⁨months⁩ ago

        Thank you. These should get fixed.

        But again, I can host behind a VPN and have zero risk here. I can work around my own shit, a Plex user can’t protect their data when Plex owns it.

        source
    • weirdbeardgame@lemmy.world ⁨3⁩ ⁨months⁩ ago

      Lack of built-in 2FA for one thing

      source

      • bobzer@lemmy.zip ⁨3⁩ ⁨months⁩ ago

        But it’s not difficult to integrate it yourself.

        It’s inherently different. Plex liked having your data and didn’t protect it.

        Jellyfins security is as good as the infrastructure you build yourself.

        source
• localhorst@sh.itjust.works ⁨3⁩ ⁨months⁩ ago

  🍮🇫🇮

  source
• Retro_unlimited@lemmy.world ⁨3⁩ ⁨months⁩ ago

  Just installed that yesterday lol

  source
• TheGreenWizard@lemmy.zip ⁨3⁩ ⁨months⁩ ago

  OK, coming from a Jellyfin user for years, its not like it’s impervious to any attacks.

  source