Plex Security Incident(links.plex.tv) |
Plex Security Incident(links.plex.tv) |
That said, I shouldn't be blinded by convenience. I hear jellyfin is a good alternative. Can someone share
- how easy is it to administer for clients outside of my network or possibly even outside my country?
- how good is the app support? I transcode all of my media to AAC and h264 for compatibility
-what about for streaming music? I really like Plex amp
- what do you like the most about jellyfin
- what do you miss most about Plex?
Thank you.
>- how easy is it to administer for clients outside of my network or possibly even outside my country?
Jellyfin is just the software, not a hosted solution. I use a simple server/seedbox, with sane configs (good providers have automated this), which results in a secure public-facing admin console with a username/password. They have basic user management features to include other users in your server.
> - how good is the app support? I transcode all of my media to AAC and h264 for compatibility
Jellyfin has a broad ecosystem of apps on a bunch of platforms, each with their pros and cons. I recommend poking around. When figuring my setup out, I downloaded 3 or 4 different Android apps to pick the one I liked (support for multiple servers which isn't a given in all the apps)
> -what about for streaming music? I really like Plex amp IMO Plex has always been substandard here since they hoisted the music interface into the same one they use for everything else, so it's really lacking in filters/administration features I depend on. That said Jellyfin supports music and has the same simple feature set.
> - what do you like the most about jellyfin
It's free and untethered to a company's whims. It also does a lot less of the social/DVR stuff that I have no interest in.
>- what do you miss most about Plex?
Their app experience was a bit more premium, and their support for multiple servers is better than Jellyfin since they own the servers/hosting to do it. I also really used to enjoy the 'remote' functionality where I could skip episodes by clicking next on the Plex app in my phone. This hasn't worked for a few years for me despite heavy troubleshooting.
You can run Jellyfin in any docker container. If you want to run it on a NAS in your home office and put it on the internet through ngrok or tailscale, you totally can. But you can host it pretty much wherever.
> how good is the app support? I transcode all of my media to AAC and h264 for compatibility
The official clients are just ok. They'll support all the file types you'd expect, but they're fairly slow and not great at streaming 4K. I pay for a client (Infuse Pro) that addresses a lot of those pain points, but it's been relatively poor at auto-detecting tv show metadata, so I'm still in the market for an app I'm happy with. Ideally an open source one.
> - what about for streaming music?
Technically works, but whether it's a good experience depends on the client you're using.
> - what do you like the most about jellyfin
Easy to set up. Great plugins for finding subtitles/artwork/metadata. Open source with good docs. Works with lots of clients. Easy to create and share accounts, and has fun features like synced remote viewing parties.
- what do you miss most about Plex?
The ads. jk never used it.
I think the final straw was Plex artificially blocking transcoding on Raspberry PI, even though it would work with a ton of work arounds.
- Not selling off my watching history to third parties. This is a privacy disaster still about to blow up. Expect holders of large plex libraries with pirated content to be lined up in court in the near future.
- Decentralized.
- Not parasiting on FOSS such as ffmpeg. Plex famously took everything from ffmpeg and gave nothing back, while making lots of money in the process.
Jellyfin is way to administer. Clients are rough and often crash. Influx is often the best choice for IOS but has its own... weird decisions on how to handle libraries.
The main thing I miss is being able to download transcoded media for mobile devices so I can watch on a plane.
I went to Jellyfin (plus Tailscale VPN). Some things are really nice, but others... well, it's an open-source project, and people only fix what they see as broken. So, I've tried restarting, only to lose every single customization I did. It's not worth my time to fill out their tickets and play that lottery, so I just accept the UI issues.
Then, mysteriously, Jellyfin also quit broadcasting remotely. A month later, its server wasn't even visible on my own LAN to my TV.
So I uninstalled BOTH Plex and Jellyfin, and reinstalled both. Jellyfin still doesn't connect right. And Plex works... until suddenly it doesn't, and I have to cycle through Off/On with "Allow remote connections", until it works again, mysteriously.
PRO'S OF EACH:
Plex: Much better support in TV libraries. No need for a VPN. Simpler UI.
Jellyfin: Ability to create Collections, which are basically filter-defined libraries. Without rearranging any files, you can build a Collection of Star Wars movies, or all movies directed by Scorsese, or any arbitrary bunch of media files at all, really. Optionally, you can reduce your library clutter with these Collections: a library named Science Fiction can have all of your Star Wars movies listed as a single item (that Collection). Basically, sub-libraries, but they aren't restricted to one library's contents (Star Wars might contain a documentary on "The Making Of" that isn't actually stored in Science Fiction).
Same issue for me. The client app used to have a "remote servers" configuration option. You had to manually set up port forwarding and get the configuration perfect, which I suspect was beyond your average Joe. But once you did it was rock solid.
They now have some automagic arrangement based on uPnP which anybody can use, when it works. But it doesn't always work and because they've removed the old manual option when it doesn't work, there is no remote access for you. You would hope they would add some debugging and doco to give you some visibility into what it depends on so you can isolate the problem, but no, they provide nothing.
- there are a variety of apps to choose from on ios/android, smart TVs might be limited or nonexistent (LG has a good one though)
- consider a separate dedicated tool for music, like Navidrome
- it's open source, its developers respect me and my users and do not abuse their access to them using dark patterns to extract revenue
- features that they have removed anyway (plugins, photo sync, plex cloud)
I own the instance that's running on my own homeserver. It does what I want it to do. Stream my media for me, other directly in the same network, or transcodes when I'm away.
How could only a subset be affected? Any architecture other than a "users" db table wouldn't make sense.
Alternatively, maybe they mean that the limited subset of data was specifically the "email" and "password_hash" columns of the database ;P
Plex Update: Notice of a potential security incident - https://news.ycombinator.com/item?id=45174684
I am glad they were hashed, but that's a misleading statement. The point of hashing is to slow an attacker down, even with full best security practices (e.g. salt + pepper + argon2 w/high factors) they can still be reverse engineered. It is a matter of when, not if.
What’s the date of this release? There was a similar release a few months ago and I’m curious if I need to again reset my account.
Over the last couple of years, Plex has continued to strip functionality, add paywalls, make deals with publishing companies, and take other actions that firmly put them in the 'enshittifaction' phase. They've capitalized on the community that gave them their success, so I've cashed out as well.
At this point there is little need for those of us with some technical ability to use this software and all the bloat that comes with it. Jellyfin[1] is an excellent alternative that I've fully switched over to this last year. I will not let a company take ownership of my media library, ever.
It was not surprising when Plex had a huge investment coming from VCs who might as well just be connected to the movie industry and Hollywood as a whole, when they committed the act of banning Hetzner and all of their data centers.
They also had slowly become just another low quality streaming service like Tubi or IMDb with really low quality content being pushed down onto the homepage and actually keeping your own media hidden somewhere in the submenus. With their updates they threw the entire UX upside down.
Plex has the most mature platform to be frank. But I am happy I jumped ship as soon as I saw their predatory practices. They are not going to stop.
a) be running an ancient plex version, before they rolled all of that crap out.
b) edited your home screen to remove all of those "plex offers".
If you really have to do it, use Emby or Jellyfin. At least those options are fully self hosted.
I'll pay you $10k if you can crack this sha512 hash.
I'd offer a million, but I don't have that kind of money.
5a55b7b0e1f9452f925b1aa43cf148081da58c66c735961d9a7cb699b2fd5b08bee6b24ec47fce0b93ba49df83641a30c7843dece49e0a0db5a7c50901492fdd
It's technically true that all cryptography is just slowing things down, but we are talking about heat death of the universe lengths of time for most crypto algorithms.
*assuming quantum computing doesn't take off or a fundamental flaw isn't found in the crypto.
It isn't academic either. I have broken tons of cryptographic hashes in my career. Most of my colleagues have too. From DES through bcrypt over tens of years. The cost/performance has slowed, but the techniques haven't changed one bit because PEOPLE haven't changed one bit.
Obviously nobody can crack a sha512 hash likely containing a randomly generated cryptographic number. But that's irrelevant, because we're discussing the Plex security incident where humans created passwords, and humans today, tomorrow, and ten years ago are just as incapable of creating good passwords.
So their claim that these hashes "cannot be read" is inaccurate. If you have a modest budget and want to target a handful of accounts, there are multiple CHEAP cloud services that will happily sell you compute to do so.
You should be using the solutions readily available instead of trying to reinventing the wheel, or avoid this subject altogether if you can't be bothered to educate yourself as to why.
This has been a decades-long issue, and it blows my mind how people in IT still didn't get the memo.
Use argon2, scrypt or even bcrypt who all are designed for keeping passwords secure with regards to brute force cracking.
How much compute/gpu and hard dollars would hackers need in order to reverse engineers those stollen passwords?
So please explain your reply further. Also recall their claim for context of what I was replying to, and what you're here defending now.
If their claim is credible what I did and what you're reiterating wasn't possible.
That being said, a lot of my mates are moving to Jellyfin. Nothing but good things from them.
Plugins, the watch later list, the up next/playback queue, Plex Cloud/Cloud Sync, photo backup (this one hurt), privacy preferences were badly nerfed.
Those are just the ones I miss, I'm sure there are more (like the short lived arcade thing).
First is subtitle support is quite limited in comparison. It fails more often than it works for me.
Second is the lack of skipping.
This is with the Android TV client, haven't really tried the others.
I always watch with subtitles, but haven't noticed worse support in jellyfin vs plex, really. Granted, I mostly use srt/ssa (text based subtitles).
> Second is the lack of skipping.
You just need to install the intro skipper plugin :)
Skipping, do you mean skipping intros and such? Or something else?
Jellyfin somehow just works on all my devices.
* they already have peer filename.nfo files with TVDB | IMDB | TMDB ID's
* not if they have scene standard names AND are not ambiguous media names (eg: Utopia - which of the 5 possible series do you mean?)
But these are issues all media libraries face.
Group series episodes in per series (or even per season) folders and include a tvshow.nfo file with any IDs.
eg:
<episodeguide>{"tmdb":"328","imdb":"tt0983200","tvdb":"82616","tvrage":"7565","wikidata":"Q6805564"}</episodeguide>
<id>82616</id>
<imdbid>tt0983200</imdbid>
<tmdbid>328</tmdbid>
<uniqueid default="false" type="tmdb">328</uniqueid>
<uniqueid default="false" type="imdb">tt0983200</uniqueid>
<uniqueid default="true" type="tvdb">82616</uniqueid>
<uniqueid default="false" type="tvrage">7565</uniqueid>
<uniqueid default="false" type="wikidata">Q6805564</uniqueid>
<premiered>1989-05-08</premiered>
which just leaves the issue of TheMovieDB being weak on metadata for that series .. but can be completed from theTVDB https://www.thetvdb.com/series/media-watch
This is the same deal with Plex tho, although I found plex internal metadata engine to auto-match better than jellyfin currently does.
You can help here though. Just come to https://www.themoviedb.org/ and help us add metadata.
I don't want to need to have a centralized account to access my media library on my device.
I don't want to have to pay monthly to enable hardware transcoding.
Their metadata lookup is quite solid.
Granted the suggested defaults for argon2 is like ~0.1 second per verification on a rather beefy CPU, in 17h that's about 620 000 guesses.
Your cheap compute would likely perform worse.
That is beyond improbable. You are making it up.
That said, I've had a few HDR movies which Jellyfin handled a lot better, so it's a bit here and there.
As for skipping, I primarily skip backwards when I miss dialog (so much mumbling these days), or forward when it's a TV show which has segments I don't care too much about, like say some irrelevant love subplot.
"Reset universal entropy"
(We were begging for them to fix the functionality of watch together for almost 5 years)
What do you do? Separate file? Not sure if I've noticed a pattern other than "mostly doesn't work well".
> Skipping, do you mean skipping intros and such?
Sorry, I meant jumping back and forth. On Plex I can just press left/right arrows on the remote, and it jumps a few seconds. On Jellyfin I have to press ok/confirm to actually do the jump. Very annoying.
Bazarr specifically in this case, it can search multiple locations for missing subtitles automatically.
I'll setup jellyfin and see which titles I'm unable to add and try to collaborate on metadata. It's always important to favor opensource. I can always have both services running side by side.
So, the recommended path is to clean up the media files:
There are very specific and common standard on renaming video files to contain "metadata" so that every single tool doesn't have to use ffmpeg to investigate and try to guess the exact movie/tv show from the title.
The Plex naming guidelines are pretty good: https://support.plex.tv/articles/naming-and-organizing-your-...
Some people like to add resolution and audio track information to the file name too.