- cross-posted to:
- selfhosted@lemmy.world
- homelab@lemmy.ml
- cross-posted to:
- selfhosted@lemmy.world
- homelab@lemmy.ml
We have recently experienced a security incident that may potentially involve your Plex account information. We believe the actual impact of this incident is limited; however, action is required from you to ensure your account remains secure.
What happened
An unauthorized third party accessed a limited subset of customer data from one of our databases. While we quickly contained the incident, information that was accessed included emails, usernames, securely hashed passwords and authentication data.
Any account passwords that may have been accessed were securely hashed, in accordance with best practices, meaning they cannot be read by a third party. Out of an abundance of caution, we recommend you take some additional steps to secure your account (see details below). Rest assured that we do not store credit card data on our servers, so this information was not compromised in this incident.
What we’re doing
We’ve already addressed the method that this third party used to gain access to the system, and we’re undergoing additional reviews to ensure that the security of all of our systems is further strengthened to prevent future attacks.
What you must do
If you use a password to sign into Plex: We kindly request that you reset your Plex account password immediately by visiting https://plex.tv/reset. When doing so, there’s a checkbox to “Sign out connected devices after password change,” which we recommend you enable. This will sign you out of all your devices (including any Plex Media Server you own) for your security, and you will then need to sign back in with your new password.
If you use SSO to sign into Plex: We kindly request that you log out of all active sessions by visiting https://plex.tv/security and clicking the button that says ”Sign out of all devices”. This will sign you out of all your devices (including any Plex Media Server you own) for your security, and you will then need to sign back in as normal.
Additional Security Measures You Can Take
We remind you that no one at Plex will ever reach out to you over email to ask for a password or credit card number for payments. For further account protection, we also recommend enabling two-factor authentication on your Plex account if you haven’t already done so.
Lastly, we sincerely apologize for any inconvenience this situation may cause you. We take pride in our security systems, which helped us quickly detect this incident, and we want to assure you that we are working swiftly to prevent potential future incidents from occurring.
For step-by-step instructions on how to reset your password, visit:https://support.plex.tv/articles/account-requires-password-reset
You don’t even have to hack jellyfin though. Quite a few endpoints aren’t behind authentication at all.
But that doesn’t help your case so I’m sure you’ll just downvote me.
Edit: For those who don’t know. https://github.com/jellyfin/jellyfin/issues/5415
Several issues. Some require being logged in with any account (to get other user information on the server, including admin)… others are endpoints that let media access if you guess a guessable md5 hash(which is normalized in docker setups in general… and standardized by *arr setups. So highly guessable if you use these tools… which most of you are). The sort of thing that media companies will absolutely abuse eventually if they’re not already doing it to collect proof that you’re hosting their content illegally. But I just find it laughable that this is the answer… but ya’ll are frothing at the mouth over plex leaking an email address… Oh no! not the email address you already get boatloads of spam at! However will you live!
I’m angry about both, yet still prefer Jellyfin. Why? I control everything about it. I self host it and can choose who has access (including putting it behind a VPN). I have the code so I can patch it if I choose. I can even disable the problematic endpoints of I’m fine with the repercussions.
With Plex, i have to live with their central servers. With Jellyfin, I don’t, and it’s much less likely a corpo comes after me specifically than happens to see something via a Plex compromise.
I think both are fine services, and I appreciate Plex’s response here. I still prefer Jellyfin.
While I whish access were secured at some point. I’m still yet to see one of those guessed hash attacks on the wild.
A good thing about Jellyfin is that we KNOW its insecurities because it’s open source.
Other software may be insecure like that but you would only know after an incident happens because you cannot audit the source code.
You don’t need to audit the source code to find vulnerabilities in endpoints. You need source code to know exactly why it’s vulnerable. Plex is constantly being tested by jackasses like me who try random shit. Hell we just got a forced patch for plex that they rolled out this month. https://forums.plex.tv/t/plex-media-server-security-update/928341
Yup, and that’s why I still use it despite its security issues. I run it in a rootless container, so even if there’s some sort of breach, it should be contained.
Removed by mod
Oh… You mean like half dozen or so times that I’ve already brought this up over the past 2 years on lemmy, and a while before that on Reddit? It’s only after I write a whole book on the matter that the upvotes kick in. And these discussions ALWAYS end up with much higher downvote ratios than most of the other stuff I comment on. Up to and including getting called names like “shill”.
Example of the last time this was brought up that I participated in… https://slrpnk.net/comment/15703455 (which got mod removed it seems… it’s still accessible to me on my server at https://lemmy.saik0.com/post/1622830) which was the “news” of a plex staff member leaving a comment for the plex app on the Google Play store…
Or this time… Where we were all complaining about the app redesign (which I also hate) https://lemmy.saik0.com/post/1517257… The root comment was lemm.ee though… which is gone. My comment starts at https://lemmy.saik0.com/comment/4476520.
I’ve discussed the matter ad nauseum… and more often than not it’s received pretty poorly. It’s not a cop out or “bitch-ass pre complaint” when I have the history to point at.
Edit: Oh and here too… https://beehaw.org/post/19228632
Have you tried being less of a prick about it?
I find I’m less of a prick about things if I’m not called things like “prick” and “shill”.
Yet here we are. You’ve fulfilled the prophesy! Thanks for making the world a better place.
Maybe if you keep getting called a prick and a shill it’s time to do some introspection.
Yeah you’re right. I should probably drop my lemmy instance. This place is a cesspool.
Bruh. You were being a prick about it long before he called you out on a being said prick. It’s why he called you a prick.
I feel at this point that you just wanted to write “prick” as many times as you could in one sentence… Have at it.
so what, first of all, you’re just assuming the person or people reading your comment will do the same thing that’s been done to you by others before, which is weird. I’ve had the same kind of comment downvoted and upvoted on different threads. not everyone sees every comment…
but even if you were 100% right, it’s still a bitch-ass pre-complaint. it’s one thing to start with “this is gonna be downvoted to hell but I’m still gonna say it” or something along those lines… what you said was specifically about the person you were replying to, and you even gave a reason like “oh this is gonna hurt your feefees so you’re gonna downvote it” it’s just weird. the vibes are off.
Oh no! Not the vibes! However shall I live without the vibes!
alone, probably
Married with kids… I don’t even get the pleasure of my own thoughts most days anymore…
Don’t expose jellyfin to the internet and it won’t be hacked. But you are forced to make a Plex account, if you want to use Plex.
So how are they hacking you? I mean I don’t see those issues as really bad. Should it be fixed yes can anyone really do anything bit that I can see. Am I missing something.
Don’t expose Jellyfin and you don’t have a competitor program that does what Plex does… stop recommending it as a replacement if it’s not a replacement. And this is ignoring that it’s recommended to expose to the internet on their own documents.
You’ve missed the point. You can’t be mad at plex for taking action and closing security gaps after becoming aware of them… then in the same breath recommend a service that can’t even be on the internet because it’s so poorly secured.
You can use Jellyfin with wireguard and still have what Plex does. Unless you want to run an open streaming service (which would probably be illegal in most countries anyway).
90% of Plex users probably don’t need what Plex does and would be happy with Jellyfin.
Okay… Run wireguard on a roku TV or other many other common media devices. You can’t…
You can use Plex and JF both without actually hosting illegal content. You should still be worried about devs who refuse to fix a basic security issue that they actively block from being merged.
probably… and 99% of users likely have no idea how to secure things properly on their own. Which makes this whole premise even more dangerous for the “typical” person.
Where’s the fun in that? We’re on Lemmy. Cut loose a little.
Well… I mean… you can host your spank bank materials there. Fun is what you make of it.
Sucks for you. Android TV boxes can, Linux Media PCs can. Weird. Almost like you’re pirating media and you can’t be asked for a bit more effort.
Sucks for LG tv people… and Samsung Tizen users… And all sort of other people too! But I guess you go out of your way to purchase hardware for everywhere that you go and want to watch TV then, eh?
I sure as shit am not dragging a whole Media PC setup to a hotel with me. Or to my in-laws house. Or my aunt’s… But they all have a roku.
Your answer is effectively throw money and support at it… which isn’t really a good answer. Especially the moment the user isn’t strictly “you”.
I’m sure as shit not paying a third-party a subscription for piracy.
Push-pull, Plex kiddie. If it was easy, everyone would do it. I guess you don’t care enough about your own media being yours. I like security, it’s why I use a VPN with Jellyfin and don’t just freely give my media over to a company to take care of.
Checks the OP
Oh yeah, this entire thread is about Plex being hacked, not Jellyfin. I remember now. Why should any of us be on the backfoot if you guys are the ones fucking up?
I bet you’re wrong on this. You very likely either pay for a VPN subscription that you primarily have for torrenting content, or for usenet access to get content.
LMAO. I love that the previous sentence you admit to piracy then claim it all to be yours.
Neither do I. Now you’re just making shit up.
Didn’t bother reading any further
Endpoints that dont give you any data that would be considered a breach.
That unauthentic endpoint shit is so overblown. They should be authenticated and I hope it changes in the future, but its really not a serious issue. If they worry you, put the endpoints behind your own authentication through your reverse proxy.
Complete access to your media without authentication isn’t “don’t give you any data”.
Meanwhile you’re all frothing at the mouth cause Plex leaked email addresses and encrypted passwords.
And you’re correct. It’s not a breach… because it wasn’t protected to begin with.
Edit: You ninja edited your post… bad nettiquette.
Breaks every app for jellyfin including tv apps. So no. that’s not a valid answer.
Edit2: And I want to be clear about this… I don’t simp for Plex I want off of the platform too… But Jellyfin in it’s current state is a much worse security nightmare IMO. I can at least kill the plex relay binary and packet sniff it to know that it’s not sharing data I don’t want it to share. Jellyfin just lets everyone in that can guess a filepath (which you can “fix” by obfuscating it… but ask any security professional about that.) and somehow Jellyfin is the messiah? Devs ignoring a 5+ year old issue that already proof-of-concepted… is wild.
The media on my server is not what I’d consider private data, it’s just media. If someone wants to spend their time brute forcing randomized UUIDs to have a minuscule chance of viewing some media on my server, then I really couldn’t care less. Especially since they’re gonna get blocked by http probing detection after a few tries.
If someone could the emails and hashed passwords, then I would care about the spam I’d be constantly receiving after and the possibility of my friends and family’s passwords being exposed, as not all of them use secure passwords (despite my best efforts to convince them to change that).
Simply put, if I was using Plex right now, this breach would impact the many family members and friends using my server, something I’d feel guilty about. Meanwhile, with Jellyfin, none of these concerns would have any effect on them.
I edited it right after posting because I accidentally clicked post. Didn’t think you’d respond that fast.
This was my only comment in the thread. Kinda feels like your reply here is taking out your frustration with this entire thread on my reply.
I assumed you were talking about stuff besides media playback. There are other endpoints that can be secure using your reverse proxy without breaking any apps.
That’s not how the endpoint works. It is a randomized UUID.
Depending on your security posture, this may be an issue for you. It is not for me, and likely is not for many other users. My media is not sensitive information. My email and other identification info is.
Edit: formatting
It’s not. It’s an MD5 of the filepath. UUIDs are generic and random, not specifically tied to something.
https://github.com/search?q=repo%3Ajellyfin%2Fjellyfin+md5&type=code
If you do a basic search, you’ll find that most api endpoint generated values are simply md5 of the filepath. And they just call this a GUID in the code… it’s not. It’s completely determinable. And the problem with this is expounded considerably if you use a default docker config (so folder path is known) and an *arr stack (so filenames get standardized). How many people modify these things significantly? Pre-hash a few permutations and just check away… Get someone like Sony (who’ve installed rootkits on people’s computer before… so they don’t give a shit), and now you could find yourself in court.
https://github.com/jellyfin/jellyfin/blob/3936fc9f253d15ae31afbdfe5fcf1684c441263c/Jellyfin.Api/Controllers/VideosController.cs#L315 is the api call itself. No auth.
Is exactly the problem I have though with the evangelical preaching all about jellyfin here. I’ve brought this topic up probably about a half dozen times in the 2 years I’ve been on lemmy… and a while longer before on Reddit. DOZENS of people comment the same things you are… and get it completely wrong. And many more end up messaging me or responding that they had no idea this was an issue. Yet I continue to see people singing praises of Jellyfin! and how it must be so much more secure! When it completely isn’t. So many people brush it off… then flip their shit about Plex doing something.
If we’re talking “mitigations”. Plex is more secure by default… and if you want to get off their auth… you can access your network via VPN and set the VPN subnet as “local” so you don’t have to do their auth. But at least plex doesn’t just let unauthed people access whatever they can guess as a default out the box option. And certainly don’t have any security issues sitting around for 5+ years waiting for a dev to do something about it.
Edit: forgot to finish a thought. Finished it.
Edit2:
Which immediately points to Jellyfin… as if it was “better” somehow. while downplaying the actual issue without actually reading what I’m complaining about
Overblown if you have mitigations? Sure… but how many do? And why are we treating software that is taking actual actions to better security as “Worse” than something that can’t clear a simple problem in 5+ years because devs don’t want to “break compatibility”.
Edit3: OH! forgot this as well… “well they’d need to know where to find servers before they can access them to check!” Yup… hello shodan! https://www.shodan.io/search?query=jellyfin Would be trivial to make a script that does all of this and crawls shodan or other sources for domain/ip information. Hell you can probably just look up all LE certs issued that contain “jf” or “jellyfin” or other permutations of subdomains too. But shodan has a list of 11,788 when I check… that’s not insignificant…
Fair enough, I was not aware of this, and I wish the developers made this more clear in the issue thread. This does not change my point that my media is not confidential data. I do agree that it should be by default, but a “breach” where someone accesses a piece of media from my server has no tangible impact on me or my server. A breach that includes my email and account information, absolutely does.
I don’t entirely understand what this response has to do with what I said. I’m surprised to hear you say that people praise Jellyfin as being far more secure than Plex, as I have not heard that. Security has nothing to do with why I use Jellyfin over Plex.
I feel it’s overblown either way, as I don’t believe the average user considers their media sensitive enough for it to be an issue. I’m not treating Plex as worse. Again, I’M NOT THE ONE WHO SAID ANY OF THAT. I am simply stating that in this specific instance, this Plex breach has a worse impact than the Jellyfin security concerns you bring up.
My guy, I didn’t start the comment thread, I’m not the one who brought up Jellyfin. I also believe I responded to every point I made, while you ignored many of mine. I don’t know how you can say I’m not reading your comment. You’re being very weirdly hostile when I’m just trying to have a conversation. I don’t have significant stakes in either Plex or Jellyfin. I do prefer one, but I don’t give a shit what others want to use.
Just want to add that I’m not some completely uninformed user. I have a career in cybersecurity, as well as a degree and plenty of certifications. When discussing a vulnerability, we need to consider the actual risk of a vulnerability, using its likelihood of being exploited and its potential impact. The likelihood of someone attempting to brute force media on my Jellyfin is practically nonexistent, as they have essentially nothing to gain. At best, they find an episode of a show or movie that they could find elsewhere. The impact of someone exploiting this vulnerability is also practically nothing. They would get a stream of the video, minutely impacting the performance of my server.
Again, to be clear, I AGREE with sharing this information. People should be aware of this when using Jellyfin. However, it is not an issue for the majority of users. It is also not anywhere near as bad as a breach of actual account information, data that actually is sensitive. I do not agree with framing it to look like using Jellyfin should be considered generally insecure.
Edit: minor phrasing adjustments
Until a media company like Sony scans your server for their content and serves you a summons… Then it will have a significant impact on you. And I doubt the content that Plex leaked actually has any meaningful impact at all. It sucks… and is bad… but shit happens and nothing is perfect. I’m much more trusting of a company that actually responds and fixes problems that gets reported than one that hides in the corner with finger in ears for 5+ years.
We’re on a thread where Plex is being derided for a security problem… Where the principal comment I responded to says “Glad I’m on Jellyfin”. This is an implicit “jellyfin doesn’t have this problem, it’s secure” statement. Otherwise there’d be no point or relevance to the comment for the topic at hand.
You wrote
You are perpetuating that Jellyfin is “secure” to use on the internet. I was directly referencing what you said. I’m not sure why you keep thinking I’m talking about something else.
I’m a CISO. I hire people like you and give you your job. I’m also no “completely random” but playing the appeal to authority card is stupid on a random internet forum. If I were to leak content secured by the applications that I have security ownership of. I’d be completely fucking jacked. Leaking emails and password hashes are meaningless… emails are all well known and password hashes means I just force reset the entire userbase and move on. Plex’s “leak” is annoying… but not actually sensitive at all. You should know this. It will take a significant amount of time for the bcrypt+salted+peppered passwords to actually be decrypted. There’s LOTS of time to hash that out, this email is the start of that process.
Now if your media isn’t worth securing… then why use authentication at all on Plex or JF? Why do you care about your account auth that protects your media if the media isn’t worth protecting? Why is it your default stance that exposing the media is such a nonissue… that your more worried about the data that secures your media more than the actual security of the media?
Unless you’re a media company like Sony, WB, or other company that actually has ownership rights of the IP that you’re storing. Remember… Sony has done things like install rootkits on their consumers computers in order to stop piracy. Why do you think that they’re above asking servers freely if they have their copyrighted content?
The impact isn’t a technical one. but a legal one. And JF could close that door and keep the media confidential in of itself so that this is a non-issue all together but specifically won’t because of “backwards compatibility”. But somehow you trust them to make secure decisions elsewhere with your content?
If you believe the threat of a company scanning a Jellyfin server in an attempt to find copyrighted media is a realistic one, then that’s fine. I do not.
As I said previously, friends and family use my server. Many who are likely to fall for phishing attempts after their email is leaked in a breach like this. I believe the likelihood of them receiving a malicious email from an attacker pretending to be Plex after a breach is much higher than a company successfully scanning my server for copyrighted materials.
Edit:
Like I’ve said a few times. I agree that this should be changed. I do very much hope that Jellyfin does so, and I do feel that it’s worth warning users about. I also still find Jellyfin to be a better option for me than Plex. My own risk tolerance allows for the incredibly tiny possibility a company successfully finds media on my server.
There is no point in continuing this discussion, as we simply disagree, and that is not going to change here.
So now your users could be phished by a Plex phish… which gets the attacker access to your plex instance upon success? But you already said that you don’t find that worth securing since in JF it’s not secure by default… I’m fully not understanding here. Is the worry that your users are reusing passwords?
Any user for your system getting an actual phish for plex will at worst get a request to pay for something. Of which I bet they’d talk to you about it as the server owner first since I doubt anyone would want to pay for something you’ve given them for free.
I’m not seeing the risk here. Want to expound on that? I can clearly see the risk of direct media access if copyright holders start making random claims for things they find on default insecure servers.
Love you for still trying. I don’t know how often I’ve written the same comment. They simply don’t care.
I think people think that I’m anti-jellyfin or something. I’d love to dump Plex… I WANT to dump it so bad (basically the day they did the arcade shit I’ve been highly turned off, what was that? 6 years ago?). But Plex is the best tool for what I need. Jellyfin could be there… But it’s not. Everytime I see it recommended blindly without the massive caveats (especially in the context of a random Plex fuckup that is substantially less of a problem) I just feel compelled to attempt to remind people. I dunno. Deaf ears maybe… but blind trust just because it’s open source isn’t the answer either. And honestly it turns me off contributing to some of the projects that I do because if I was to speak out about problems in those… how many people would listen?
The most succinct response I’ve seen on the matter “The statements The Jellyfin Project makes about exposing Jellyfin directly to the Internet, without a reverse proxy, is less about Jellyfin being insecure and more about there being no effort made to make Jellyfin secure.”
Yeah, me as well. I have a Jellyfin configured and ready to go, but since I share my Plex with a lot of users, half of whom would be turned off by the need of a vpn, I won’t switch until they’ve sorted their shit out.
That’s exactly it. And I feel the devs found that their users don’t care or will even defend it, so they won’t tackle it and avoid the problems that come with a rewrite of parts of their api. Plex gets flag for not adding quality of life features people want for the media player, but Jellyfin gets a pass for actual security issues.
I agree. I’d 100% love to dump Plex immediately, but trying to get my MIL across the country to setup a VPN is just not going to happen. Even if I ship a preconfigured raspberry pi over there, it won’t work for her TV and if it breaks, she’s gunna want me to go out there and fix it. If Jellyfin ever gets it together enough for that to no longer be necessary, I’ll leave plex. But for now, I’m gunna unfortunately stay with Plex
It seems strange to me that you feel a service which forces you to log into a cloud service then leaks private data is somehow better than a service that allows users to operate strictly offline.
Feels strange to me that we just accept
comments like these that imply that jellyfin is a direct replacement for Plex when you yourself say it’s not. Especially an implication that you’d only “hack one” when the software itself has a massive gaping hole on ALL installs. Your only saving grace is if you deviate from “standard” install procedures.
I’ve already mentioned it several times. I want to dump Plex. I don’t like the SSO that they solely control. I don’t like many of the changes that they’ve made in the 12 years I’ve been using it. It’s still the best product for watching my content.
Nobody is running Jellyfin strictly offline. At the bare minimum people leave it internet connectable to grab metadata and other resources, and more realistically in the context of a topic about Plex, Jellyfin would need to be internet accessible because that’s why people are using Plex. The jellyfin devs have already made it clear they don’t care about security issues. Why are you trusting the software when they ignore simple to fix issues that have merges waiting but they won’t implement because “reasons”. What other issues could be lurking leaving you open for liability? If someone can show you an issue from 5 years ago that is categorically a security issue and the devs refuse to fix it… you should also be questioning EVERYONE who advocates it’s use to replace a service that’s meant to be accessible in the way Plex is.
Edit: adding a little bit… forgot about it.
And? I mean they should be fixed but don’t see a real dangerous issue. Someone can stream my media randomly.
Personally I wish I could just make authentication optional on my jellyfin just like it is for peertube and funkwhale.
That would be a perfectly valid answer… But the Devs have posted several times that they’re not interested in resolving it.
I’d accept a checkbox on install of Jellyfin for “Check this box for better security… some unsupported software might not like this. Go to Options/blah/blah to change this later if you need to change this later.”
I’d probably shut the fuck up about this whole thing and dump Plex. But every single time Plex ends up in an article there’s people singing praises about Jellyfin when there’s completely open endpoints… It just baffles me. Downvotes be damned, I’ll bring it up though when I see it since the devs won’t bother telling people their software has a potentially big problem (especially if you use default configs, docker, and *arr stacks).
Sure you always seem like a shill. You might not be but it comes across. Plex is not perfect either and has had breaches and been used to hack someones machine. As far as I know jellyfish has bit been used in that space and these issues could not be used for that.
That person was using a horrifically out of date version of the plex server with known, documented, and already patched vulnerabilities.
Well its good to make sure people know about it, but I would think most admins already know and just don’t care. Its certainly not news to me, and doesn’t seem very useful in terms of actually exploiting anything.
I’m curious what youd think a kind of worst case scenario would be for any of the current jellyfin auth issues. Like what would someone with bad intentions be able to do?
I think the Plex issue with emails being stolen is a bigger problem because then those emails can get phished for their Plex accounts and possibility more. I still wouldn’t consider it a huge deal though, Plex handled it correctly.
My real issue with Plex and why I constantly shit on them is that they stole from XBMC and made a business model that monetizes piracy or at least tries to.
Stolen is a bit loaded in my opinion… XBMC was open source. All the parts that rely on that are available for free. Lots of websites out there sell shit… and run off of NGINX or Apache. taking open source things and building on them is common at this point.
Edit: Fuck, hit enter early… one moment. Edit2: here we go…
you have your setup… you configured it like the git repo said too and even used the container guide told you to (https://jellyfin.org/docs/general/installation/container/). You have now standardized the path… because the internal path that is recommended in the official compose will likely not change… (especially in the linuxserver version, https://hub.docker.com/r/linuxserver/jellyfin). Then you hear about *arr stack stuff and how people evangelize that on this platform too ( I’m one of them!). Standard naming convention gets applied there too…
So now bigbucksbunny.mov is stored on /data/movies/bigbucksbunny(2008)/bigbucksbunny.mov. You can pre-calc that md5 hash and probably nail people right now and get a result. Now be SONY or some other lawsuit happy studio. Grab a list of all your releases and precompile common paths and names (this would like be something that an LLM would be good at doing… fetching lists of paths that people post on reddit and other places)… generate the MD5 list. Maybe 1000 permutations of your top 10 movies… bonus points if there’s no physical release (since you could claim that you ripped the content yourself… can’t do that on streaming only content). Curl through the list of 10000 variants… if you get a hit on anything then you know they have your content… and it’s publicly accessible (which could be argued in court for distribution… though I’m not a lawyer and don’t know how reasonable that is.) You as the owner would then be on the hook… and lawsuits would commence promptly.
This is a potential “worse case” in my mind. Of course because they have evidence of access direct from your system, they can then subpoena access to the whole system… where your whole library becomes available for them to search further for more copyright violations and now your in real deep shit to explain to the courts.
Now… if you’re in a country that doesn’t care! Cool… just stop recommending Jellyfin to those that would get fucked by this. Are there ways to mitigate this highly? Absolutely… fail2ban, anubis, cloudflare bot detection shit, changing paths or adding GUID to your media library path… all can probably fix this… But none of that is in the jellyfin docs… and NOBODY else seems to mention it except for me when this discussion comes up… So how many people are actually doing it?
I mean they could also just go to Plex and ask them what’s on your server. And don’t say they don’t know considering they sent emails about what you watched. And Plex is getting into the data selling game. I am surprised this hasn’t been done.
There we go. Finally this argument came up… Plex doesn’t have a list of whats on your server.
They don’t. The metadata of “what you watched” recently isn’t attached to what data source it was watched from. You can go a search for a movie that isn’t on your server, click it and mark as watched and it will show up on that email list. You can also disable that function all together and then nothing is synced to them. You can also make a claim that they know what you have since you probably pull metadata on those items from them. Except you can pull metadata on just about anything without having the content at all.
But once again… I’d love to get off of Plex. I want to actively get off of Plex. But Jellyfin is a worse pot to jump into.
Okay so they violated the GPL to produce their product, it started off on good terms and contributing back up stream but then they got greedy and decided to stop giving back, On top of that they also provide nothing upstream to FFMPEG or any other of the open source projects they benefited massively from… basically they are leeches of open source software… but you are technically correct [1] to say its not literally stealing.
[1] The best kind of correct
I just edited what I meant to originally send… Now I’m replying so you get flagged and can look at it. Sorry that I fat fingered the enter button and jacked up the thread. My bad.
That makes sense, I appreciate you taking the time. Its certainly not a very big issue for me personally, and i do have other mitigations in place for more general attacks like fail2ban, but not everyone is in the same situation so its a valid concern to mention.
I do think you’re overestimating the risk, Studios are unlikely to go to such lengths when there are bigger, easier targets. Still, it’s not entirely negligible, even if the exploit seems fairly benign to me personally.
My thinking as a sysadmin is if someone has security concerns, they wouldnt be JUST with jellyfin in most cases, you’d be securing an entire server (or paying someone else to handle that part), so its issues to keep in mind sure, but the mitigation would be mainly outside of jellyfin specifically anyway, thus why its not really mentioned in jellyfin’s docs or considered a big concern by the devs.
So I’m not really disagreeing with anything you’ve said, but I you haven’t changed my mind either, I’m still going to recommend jellyfin over plex.
Your recommendation should change depending on the needs of the person you are recommending too. If you recommended I change to jellyfin you would be wrong, for example.
This is fear mongering. Feel a duty to call it out so it doesn’t scare someone out of experiencing the joys of Jellyfin.
Good job! You understand that servers serve data! You are very smart!
That’s rich coming from you
Do you think your bank serving your data/account access to someone that isn’t you would be acceptable?
After all, their servers are just serving data, therefore they’re correctly doing their job, right?
Good servers would serve data only to those authenticated to receive it! Which Jellyfin clearly isn’t.
You’re literally in a thread where the OP topic is Plex getting hacked. I guess more secure on paper is good enough for willful ignorance.
I’m in a thread where Plex admits, responds, then TAKES ACTION. Versus the open source project that’s known about an issue for 5+ years… and sticks their fingers in their ears and tells you that you’re the problem.
I guess that we’ll just reward that project that’s lucked itself into not having an issue rather than a product that actually is trying.
Edit: Oh… and the actual “loss” of data matters here… My email isn’t special. My username isn’t special… The hashed and salted password isn’t special to me. None of this data matters to me in the slightest in this instance. However, potentially probing the content on my server directly DOES matter to me.
deleted by creator
The only “Sensitive” item is the password… But it’s hashed and salted using bcrypt. And for me personally… it’s unique. Therefore non-important. Further their recommendation to replace the password is sufficient. Not sure how me pointing out this fact is “shill”. but you do you.
If installing wireguard and using proper opsec is hard then I guess they’re right.
You paid good money for it. Should Jellyfin users get a refund? PM me, I’ll send all of you $0 in XMR.
Already beaten to death this argument. You get wireguard installed on a “smart” TV and then that argument will matter to me.
When you get supported hardware, you mean…
Doesn’t matter if your info is stolen?
Name email address, password, access history, and probably IP and location…
And that’s just what they disclosed, but they don’t have any timeline or real actions taken to prevent continued access. They don’t even tell you what exactly has been accessed: “information that was accessed included emails, usernames, securely hashed passwords and authentication data.”. It’s really not text book response for a security breach.
But all of that is less important to you than the fact you have Avengers: Endgame in your library?
They are leeches taking money from you, but you 'd defend them even if they killed your dog.
Edit: it’s the third time in a decade Plex got hacked. Please list instances where jellyfin leaked the data of all their users.
Interesting that you assume this is the list of taken things when that wasn’t what was disclosed to us. And Plex has been absolutely forthcoming with this in the past.
Literally everyday since those attack vectors are actively open right now and have been open for 5+ years (jellyfins whole lifetime) and proof of concepted for the developers that whole time.
They do give what has been taken, tho not the complete list so what exactly is anyone’s guess. By authentication data I assume the history of logins. What I listed is nearly literally what they said.
That’s not exploitation nor any proof of any data being leaked. Plex was hacked three times, not theoretically like jellyfin, but 3 actual times their service was breached and hackers stole data…
You do you and keep using it if that makes you feel good, but saying jellyfin is less secure than Plex at this point is laughable.
The proof of concept is in the original JF issue on github. It’s not theoretical. It’s just not known to be actively abused right now… It could very well be abused… and I actually even made my own proof of concept that works. Nothing stops someone from cluing Sony’s lawyers in on the matter and handing over the proof of concept for money… Then what do you do? Just because we “think” it’s not being abused doesn’t mean that you ignore it.
You can probably leave your front door unlocked… until one day somebody just walks in and takes your stuff. They may only take stuff that you don’t find important, that makes it okay right?
I geoblock everywhere but my home town and VPN everyone else, plex kiddie. If Jellyfin can’t do security, do it yourself and get to whitelisting and blacklisting. You can, can’t you, or do Plex users get confused when they see a wireguard private key?
Weird, I’d more think Plex users to be the lazy type to install their systems by copying and pasting from ChatGPT.
Well, see, if I used jellyfin I’d have to be at my mothers more often to fix her shit…and I really dont want to be at her house more than I have to.