Comment on Important Notice of Security Incident

bridgeenjoyer@sh.itjust.works ⁨6⁩ ⁨months⁩ ago

• icylobster@lemmy.world ⁨6⁩ ⁨months⁩ ago

  Plex hasn’t been getting better, but it still does what I need. I have a lifetime pass from years ago. If I was starting today I would be a lot less inclined to pay for Plex though. They keep adding things I don’t want.

  source

  • FreedomAdvocate@lemmy.net.au ⁨6⁩ ⁨months⁩ ago

    Plex has been getting better and better actually, but if you don’t want to pay for it then your experience will have gotten worse.

    source
• remon@ani.social ⁨6⁩ ⁨months⁩ ago

  Even is plex is “bad” now … it’s still way ahead of jellyfin.

  source
• Hupf@feddit.org ⁨6⁩ ⁨months⁩ ago

  Leave Plex

  Image

  alone!

  source
• FreedomAdvocate@lemmy.net.au ⁨6⁩ ⁨months⁩ ago

  Plex followed best practices and made sure that in the event of a data breach your accounts were safe, and alerted us promptly to the breach and reassured us that nothing private/of value was compromised.

  JellyFin knowingly leaves multiple API endpoints with zero authentication.

  I know which one I prefer, and it’s not the one with gaping security holes marked as “won’t fix”.

  source

  • filcuk@lemmy.zip ⁨6⁩ ⁨months⁩ ago

    People don’t seem to understand that no-one can reasonably stop a breach today.
    The question is whether the attackers got anything of value and how easy they got in.

    source

    • anas@lemmy.world ⁨6⁩ ⁨months⁩ ago

      This breach was, in fact, very preventable. Plex didn’t need to force users to authenticate with a central server to access their own self-hosted media in the first place.

      source

      • FreedomAdvocate@lemmy.net.au ⁨6⁩ ⁨months⁩ ago

        That’s not how “preventable” works.

        source
• TrickDacy@lemmy.world ⁨6⁩ ⁨months⁩ ago

  Seems unlikely that this happened. Most people on Lemmy despise Plex and forgive all the shortcomings of Jellyfin

  source

  • interdimensionalmeme@lemmy.ml ⁨6⁩ ⁨months⁩ ago

    What are the 3 biggest shortcomings of Jellyfin ?

    source

    • TrickDacy@lemmy.world ⁨6⁩ ⁨months⁩ ago

      So you didn’t care, just wanted to downvote. Cool.

      source

      • interdimensionalmeme@lemmy.ml ⁨6⁩ ⁨months⁩ ago

        I haven’t installed jellyfin, I’m never installing plex, I would just use samba shares over vpn instead of that.
        I wanted to know what’s the problem with jellyfin ?
        Is it more than the weekend-destroying linux-jankiness ?
        Because I can deal with that

        source

        • -> View More Comments
    • TrickDacy@lemmy.world ⁨6⁩ ⁨months⁩ ago

      Well it’s just generally buggy firstly. Glitchy UI for me especially for hours after I started scanning my media library.

      Also it has no built-in system for connecting from somewhere outside your home. You have to manage that yourself.

      Then there’s the fact that it’s got lots of security issues.

      source

      • interdimensionalmeme@lemmy.ml ⁨6⁩ ⁨months⁩ ago

        What do you mean with glitching UI ? Is it more than just not responding while scanning ?

        source

        • -> View More Comments
    • FreedomAdvocate@lemmy.net.au ⁨6⁩ ⁨months⁩ ago

      Ironically, security.

      source
  • bridgeenjoyer@sh.itjust.works ⁨6⁩ ⁨months⁩ ago

    Thats what I thought too. But I posted on ask lemmy, not here.

    source
• AmbiguousProps@lemmy.today ⁨6⁩ ⁨months⁩ ago

  I’d love to switch. I would do it right now, but the problem is that Jellyfin’s security isn’t better if you open it up to the internet. For example, I’d have to set up a VPN for my remote users for proper security, and most of my users are in other states, not technically inclined, and watch on their TVs. I’d have to at least support a raspberry pi for them, or some sort of site to site VPN, and if it goes down, I’ll be expected to fix it. On top of that, if I do a simple raspberry pi based VPN, it would be made even more complicated since they’d want it to work with their smart TVs.

  Again, I really want to switch. But Jellyfin needs to fix their security issues before I can. I’m also happy with the way Plex is reporting this, it’s above the standard “your data is lost” notifications.

  source

  • exu@feditown.com ⁨6⁩ ⁨months⁩ ago

    Most of these require some form of random id to exploit, which leaves you either brute forcing ids or brute forcing a user account

    source

    • MaggiWuerze@feddit.org ⁨6⁩ ⁨months⁩ ago

      Again, its not random. It’s not a UUID. Its an md5 hash of the filepath. Which is easily guessable since most people have a very similar if not identical folder structure, especially since a lot have it managed by the *arr suite. take that plus the publicly available release names for movies and you’re done

      source

      • ChairmanMeow@programming.dev ⁨6⁩ ⁨months⁩ ago

        Put your files in a randomly named root folder and it’s fixed. Even still, isn’t the worst they could do pirating your service?

        source

        • -> View More Comments
    • FreedomAdvocate@lemmy.net.au ⁨6⁩ ⁨months⁩ ago

      If you hand wave those away then you can’t possibly have any issue with Plex.

      source

      • exu@feditown.com ⁨6⁩ ⁨months⁩ ago

        I don’t have an issue with Plex. I don’t use it

        source
    • AmbiguousProps@lemmy.today ⁨6⁩ ⁨months⁩ ago

      I mean, that’s fine, but it’s still an issue and a risk that would cause me to want to use VPN for remote viewing. It doesn’t seem like security is Jellyfin’s priority at the moment, not that it’s Plex’s either, but it’s not to a place where it’s worth it to switch from a security standpoint, personally.

      source

      • MaggiWuerze@feddit.org ⁨6⁩ ⁨months⁩ ago

        Plex has a whole team dedicated to security. It’s obviously not perfect and it is a larger attack surface than Jellyfin, but I’ll take that any day over devs who treat security as an afterthought

        source

        • -> View More Comments
  • binarytobis@lemmy.world ⁨6⁩ ⁨months⁩ ago

    My big complaint with Jellyfin is that their documentation showed a “fast forward” hotkey that convinced me to switch from Plex, and when I started it up it was a misnamed “jump forward five seconds” button instead.

    It’s still better for my needs, but I remain angry.

    source
  • atomicbocks@sh.itjust.works ⁨6⁩ ⁨months⁩ ago

    This is the same reason I haven’t switched. My parents use it to watch the local OTA channels and I have zero intention of supporting a site to site VPN on their home network and multiple mobile devices.

    source
  • bagodogs@sh.itjust.works ⁨6⁩ ⁨months⁩ ago

    Jellyfin is great… As long as you’re the only one who needs to access the server. I’ve switched to using Jellyfin myself, but I still run Plex for others to access.

    I’ve found that I get a smoother playback experience on Jellyfin, but even outside of potential security issues, there are a still couple of features I miss from Plex.

    source

    • Seefoo@lemmy.world ⁨6⁩ ⁨months⁩ ago

      What are those features?

      source

      • bagodogs@sh.itjust.works ⁨6⁩ ⁨months⁩ ago

        One was automatic collections, but the plugin for this has since been updated, and the bug I was experiencing has been fixed. The one remaining feature that I’m missing is user ratings for media. On Plex I have automatic collections of movies that I’ve rated four and five stars, and it’s quite useful.

        source
  • TrickDacy@lemmy.world ⁨6⁩ ⁨months⁩ ago

    Thank you for that issues link. I keep trying jellyfin every now and then and I run into issues with general bugginess so I haven’t been able to switch. Seeing that it’s kinda full of security holes makes me even more reticent.

    source