Submitted 3 weeks ago by KarnaSubarna@lemmy.ml to selfhosted@lemmy.world
https://forums.plex.tv/t/important-notice-of-security-incident/930523
Additional read: bleepingcomputer.com/…/plex-tells-users-to-reset-…
Meanwhile I made a post asking if plex is bad now and most people on it said “no it’s great I paid for my lifetime pass years ago and its been the best!” Yeah, we know the truth now.
Jellyfin all the way.
Seems unlikely that this happened. Most people on Lemmy despise Plex and forgive all the shortcomings of Jellyfin
Thats what I thought too. But I posted on ask lemmy, not here.
What are the 3 biggest shortcomings of Jellyfin ?
I’d love to switch. I would do it right now, but the problem is that Jellyfin’s security isn’t better if you open it up to the internet. For example, I’d have to set up a VPN for my remote users for proper security, and most of my users are in other states, not technically inclined, and watch on their TVs. I’d have to at least support a raspberry pi for them, or some sort of site to site VPN, and if it goes down, I’ll be expected to fix it. On top of that, if I do a simple raspberry pi based VPN, it would be made even more complicated since they’d want it to work with their smart TVs.
Again, I really want to switch. But Jellyfin needs to fix their security issues before I can. I’m also happy with the way Plex is reporting this, it’s above the standard “your data is lost” notifications.
Jellyfin is great… As long as you’re the only one who needs to access the server. I’ve switched to using Jellyfin myself, but I still run Plex for others to access.
I’ve found that I get a smoother playback experience on Jellyfin, but even outside of potential security issues, there are a still couple of features I miss from Plex.
Most of these require some form of random id to exploit, which leaves you either brute forcing ids or brute forcing a user account
My big complaint with Jellyfin is that their documentation showed a “fast forward” hotkey that convinced me to switch from Plex, and when I started it up it was a misnamed “jump forward five seconds” button instead.
It’s still better for my needs, but I remain angry.
This is the same reason I haven’t switched. My parents use it to watch the local OTA channels and I have zero intention of supporting a site to site VPN on their home network and multiple mobile devices.
Thank you for that issues link. I keep trying jellyfin every now and then and I run into issues with general bugginess so I haven’t been able to switch. Seeing that it’s kinda full of security holes makes me even more reticent.
Plex followed best practices and made sure that in the event of a data breach your accounts were safe, and alerted us promptly to the breach and reassured us that nothing private/of value was compromised.
JellyFin knowingly leaves multiple API endpoints with zero authentication.
I know which one I prefer, and it’s not the one with gaping security holes marked as “won’t fix”.
People don’t seem to understand that no-one can reasonably stop a breach today.
The question is whether the attackers got anything of value and how easy they got in.
Even is plex is “bad” now … it’s still way ahead of jellyfin.
Plex hasn’t been getting better, but it still does what I need. I have a lifetime pass from years ago. If I was starting today I would be a lot less inclined to pay for Plex though. They keep adding things I don’t want.
Plex has been getting better and better actually, but if you don’t want to pay for it then your experience will have gotten worse.
Should have been put in the OP because people are going to jump the gun:
While we quickly contained the incident, information that was accessed included emails, usernames, securely hashed passwords and authentication data.
Any account passwords that may have been accessed were securely hashed, in accordance with best practices, meaning they cannot be read by a third party.
Still, always good practice to change your password after this sort of leak. However unlikely it is that someone could access your account, it’s never a bad idea.
If you use a unique password and have 2FA on there’s no real need, but yeah it can’t hurt.
Glad I started out with Jellyfin
I mean, jellyfin is absolutely even.more of a security nightmare than Plex, with multiple unfixed CVEs IIRC.
I use jellyfin also, but I only trust it not exposed to the internet at all. That is one very big area of improvement for them.
That and subtitle syncing.
Same here.
I am curious as to why people thing Plex is self hosting if Plex can change how your server functions? I have never personally considered it self hosting but do others still think it is?
Because you are hosting the server software on your own hardware. That’s literally self-hosting. Plex provides a way to remotely access your server through their own network as well, which is optional.
The problem with Plex is it isn’t fully hosted. Plex controls user passwords. You can’t use it without logging into their servers.
On a side note: you can remotely access any service running on home network via Tailscale[1] / Cloudflare Tunnel. Your services are never exposed on Internet. Moreover, you don’t need to rely on Plex for that.
[1] tailscale.com [2] developers.cloudflare.com/…/connect-networks/
By your logic the *arr suite isn’t self hosted either since they rely on metadata cache servers.
In fact Jellyfin relies on external services for their metadata too!
Plex is self hosting, the auth is not.
Actual answer.
So is the auth needed to set up your plex in the first place? It has been forever sence I used it.
why stop there! let’s do the same for all the “self-host” projects that use CDNs or remotely hosted resources.
it’s not self-hosted unless it’s 100% hosted locally.
Right, he who does not rely on someone elses DNS-server shall throw the first stone!
How is that any different than any other software package? Unless you’re coding it yourself, things can be changed without your permission.
And even if you do code it yourself, you may have dependencies that do undesirable things outside your control.
Jellyfin I don’t have to update if I don’t want to. Jellyfin can’t force me to update by taking a function I currently have away or force my to pay to keep using it the way I currently am. With open code I can fork it and keep it at the version I want if I choose.
You are a bot? That’s what I’m seeing in Boost anyhow
Just asking a question looking for answers, not a not. Cheers mate.
Plex can't catch breaks recently.
Self hosting does come with risks though. People should be on notice.
In general, for self-hosting, we hardly rely on remote service/server. The whole idea of self-hosting is to shun dependency on external service/server, and run everything on your own hardware and network. So that every aspect of the service is in your control.
Well plex can't be run without it pinging the mother ship...
But I get your point. I don't open shit up for remote use.
Jellyfish cannot to setup to securely and safely be exposed to the Internet. It is only safe to access through a VPN. That rules it out as an option for sharing with friends, family, or even my own spouse. You call it phoning home to the mother ship; I call it paying Plex to manage user authentication for me. Until Jellyfin’s security holes are patched and it becomes clear that the Jellyfin developers actually care about security, it stays locked down to my LAN. Setting up a VPN is difficult for the average user on a good day, impossible in some circumstances on even the best of days, and is not access I want to hand out (and support) to all the people I share my Plex with anyway.
Not really true for self hosting a media library though, as this all relies on indexers, torrent sites, Usenet providers, metadata providers, subtitle providers, etc. If you host it for others outside of your household, you also rely on your ISP, their ISP, etc.
I dropped it in favor of Jellyfin some time back, but this was a good excuse to go ahead and delete my family’s accounts.
floofloof@lemmy.ca 3 weeks ago
Went there to update my password but got reminded what a horrible experience Plex is these days, so deleted my account instead.
JustARaccoon@lemmy.world 3 weeks ago
Wdym it’s like a couple of clicks
kbobabob@lemmy.dbzer0.com 2 weeks ago
They’re probably just using some shit browser or something. I had no issues either.
Squizzy@lemmy.world 3 weeks ago
I’ll probably get the lifetime pass after seeing how cumbersome setting up jellyfin is.
princeofspace@lemmy.world 3 weeks ago
Jellyfin setup is fairly effortless. They have a very long way to catch up on apps though. That’s all that’s keeping me in plex.
kylian0087@lemmy.dbzer0.com 3 weeks ago
Installing jellyfin is as easy as setting up any self hosted thing though… Just use docker compose if you want simplicity.
ChairmanMeow@programming.dev 3 weeks ago
It takes fairly little effort to set up Jellyfin. I think there’s scripts these days that set up the entire arr stack for you in a matter of minutes.
TheGreenWizard@lemmy.zip 3 weeks ago
Personally, I found it as easy as Plex. I started my self hosting journey with Plex and Minecraft servers on a windows pc. Now I’m launching docker containers over ssh and lxc containers in proxmox for Jellyfin. Minecraft is still the hardest thing to host lol
KarnaSubarna@lemmy.ml 3 weeks ago
:D
twotonebax@lemmy.world 2 weeks ago
Same lol, using jellyfin now instead