11 ms·
Plex Security Incident
- toomuchtodo 1y agoRelated: Plex Update: Notice of a potential security incident - https://news.ycombinator.com/item?id=45174684 https://news.ycombinator.com/item?id=45174684
- BowBun 1y agoNot necessarily related, but I'll take the opportunity to share my dislike of this company. Like others, they built a loyal following around a set of features provided, no questions asked, to stream your content to your own devices. Over the last couple of years, Plex has continued to strip functionality, add paywalls, make deals with publishing companies, and take other actions that firmly put them in the 'enshittifaction' phase. They've capitalized on the community that gave them their success, so I've cashed out as well. At this point there is little need for those of us with some technical ability to use this software and all the bloat that comes with it. Jellyfin[1] is an excellent alternative that I've fully switched over to this last year. I will not let a company take ownership of my media library, ever. [1] https://jellyfin.org/ https://jellyfin.org/
- vachina 1y agoThey removed mobile device playback rights from users who paid for this feature specifically. Nobody in their right mind will do business with Plex.
- gchamonlive 1y agoDo I still need to mess with filenames in order to have jellyfin pick them up to create the library?
- BowBun 1y agoI haven't noticed this issue any more than Plex, seems to be more about having all the files in a clear folder for a show/season than the specific individual file names. But YMMV
- defrost 1y agoNot if: * they already have peer filename.nfo files with TVDB | IMDB | TMDB ID's * not if they have scene standard names AND are not ambiguous media names (eg: Utopia - which of the 5 possible series do you mean?) But these are issues all media libraries face. Group series episodes in per series (or even per season) folders and include a tvshow.nfo file with any IDs. eg: <episodeguide>{"tmdb":"328","imdb":"tt0983200","tvdb":"82616","tvrage":"7565","wikidata":"Q6805564"}</episodeguide> <id>82616</id> <imdbid>tt0983200</imdbid> <tmdbid>328</tmdbid> <uniqueid default="false" type="tmdb">328</uniqueid> <uniqueid default="false" type="imdb">tt0983200</uniqueid> <uniqueid default="true" type="tvdb">82616</uniqueid> <uniqueid default="false" type="tvrage">7565</uniqueid> <uniqueid default="false" type="wikidata">Q6805564</uniqueid> <premiered>1989-05-08</premiered> is over kill for Media Watch https://www.themoviedb.org/tv/328-media-watch https://www.themoviedb.org/tv/328-media-watch which just leaves the issue of TheMovieDB being weak on metadata for that series .. but can be completed from theTVDB https://www.thetvdb.com/series/media-watch https://www.thetvdb.com/series/media-watch
- unethical_ban 1y agoSoemtimes I have needed to rename files, but to me it is both sensible (how else to recognize a show, maybe a metadata file) and totally worth it. I don't want to need to have a centralized account to access my media library on my device. I don't want to have to pay monthly to enable hardware transcoding.
- gchamonlive 1y agoI can't because most of my media is in an off-site server and the mount point is readonly
- theshrike79 1y agoThen rename them at the off-site server? There are very specific and common standard on renaming video files to contain "metadata" so that every single tool doesn't have to use ffmpeg to investigate and try to guess the exact movie/tv show from the title. The Plex naming guidelines are pretty good: https://support.plex.tv/articles/naming-and-organizing-your-movie-media-files/ https://support.plex.tv/articles/naming-and-organizing-your-... Some people like to add resolution and audio track information to the file name too.
- nick_ 1y agoYes. This is the flaw in Jellyfin that makes it a non-starter for me. One time I spent like two hours updating all the metadata, and then some strangely worded button reset it all. Haven't used it since.
- pixl97 1y ago>then some strangely worded button reset it all "Reset universal entropy"
- vachina 1y agoIf you categorize your libraries into their correct directories (i.e. TV into TV, movies into movies), then no. Their metadata lookup is quite solid.
- gchamonlive 1y agoWill give it a try, thanks
- 0points 1y agoYou need to sometimes suffix the folder/file name with {imdb-tt1234} to make it match the correct movie/show. This is the same deal with Plex tho, although I found plex internal metadata engine to auto-match better than jellyfin currently does. You can help here though. Just come to https://www.themoviedb.org/ https://www.themoviedb.org/ and help us add metadata.
- gchamonlive 1y agoChanging files isn't really an option for me because my media stays in an off-site server and the mount point is readonly. I'll setup jellyfin and see which titles I'm unable to add and try to collaborate on metadata. It's always important to favor opensource. I can always have both services running side by side.
- 0points 1y agoYou can also manually match each movie from the jellyfin frontend, but the issue with going this path is that if you need to rebuild your jellyfin instance for some reason, you would need to redo all of this manual matching. So, the recommended path is to clean up the media files: https://jellyfin.org/docs/general/server/media/movies/ https://jellyfin.org/docs/general/server/media/movies/ https://jellyfin.org/docs/general/server/media/shows/ https://jellyfin.org/docs/general/server/media/shows/
- johnbellone 1y agoI have a “lifetime pass”. I’ve noticed some of these “features” creeping into the ecosystem (bloat), but I haven’t actually seen any stripped functionality. For the most part, it works as advertised. That being said, a lot of my mates are moving to Jellyfin. Nothing but good things from them.
- BowBun 1y agoFor lifetime pass owners, I think you've dodged the features they've put paywalls up for. The big one is preventing free accounts from streaming to shared user libraries. So if you have your pass + 5 buddies sharing their plexes (and they don't have Plus), you cannot view their content I believe.
- blactuary 1y agoYou first post said "built a loyal following around a set of features provided, no questions asked, to stream your content to your own devices" and now you're saying they removed the ability for people to share content with each other if they are not paying customers.
- hamdingers 1y ago> but I haven’t actually seen any stripped functionality Plugins, the watch later list, the up next/playback queue, Plex Cloud/Cloud Sync, photo backup (this one hurt), privacy preferences were badly nerfed. Those are just the ones I miss, I'm sure there are more (like the short lived arcade thing).
- ewenjo 1y agoWatch Together is also being removed
- ajdude 1y agoWhich got a lot of people (including me, also a lifetime subscriber) in this thread absolutely livid: https://forums.plex.tv/t/allow-watch-together-for-tv-shows-mod-more-than-1-episode-at-a-time/644669 https://forums.plex.tv/t/allow-watch-together-for-tv-shows-m... (We were begging for them to fix the functionality of watch together for almost 5 years)
- magicalhippo 1y agoI like Jellyfin, but I keep using Plex for two reasons. First is subtitle support is quite limited in comparison. It fails more often than it works for me. Second is the lack of skipping. This is with the Android TV client, haven't really tried the others.
- BowBun 1y agoFair, I handle subtitles in my ingestion pipeline and so those are ready to go by the time Jellyfin gets involved. Skipping, do you mean skipping intros and such? Or something else?
- magicalhippo 1y ago> I handle subtitles in my ingestion pipeline What do you do? Separate file? Not sure if I've noticed a pattern other than "mostly doesn't work well". > Skipping, do you mean skipping intros and such? Sorry, I meant jumping back and forth. On Plex I can just press left/right arrows on the remote, and it jumps a few seconds. On Jellyfin I have to press ok/confirm to actually do the jump. Very annoying.
- theshrike79 1y agoThe *arr stack is what people usually use. Bazarr specifically in this case, it can search multiple locations for missing subtitles automatically.
- vachina 1y agoSome Plex clients will fail to direct stream DTS + PGS. Jellyfin somehow just works on all my devices.
- JamesSwift 1y agoJellyfin clients are the weakest aspect imo. Sort of hit or miss, and the ios client is inferior to a 3rd party paid offering (infuse)
- 0points 1y ago
- vlovich123 1y agoOne thing I'll note is that while I've found every device surface I've come across has a Plex app, that isn't true of Jellyfin. YMMV.
- vladmk 1y agounfortunately things like this happen a lot more than they should
- bronco21016 1y agoEdit: disregard. Just received the email. What’s the date of this release? There was a similar release a few months ago and I’m curious if I need to again reset my account.
- Someone1234 1y ago> Any account passwords that may have been accessed were securely hashed, in accordance with best practices, meaning they cannot be read by a third party. I am glad they were hashed, but that's a misleading statement. The point of hashing is to slow an attacker down, even with full best security practices (e.g. salt + pepper + argon2 w/high factors) they can still be reverse engineered. It is a matter of when, not if.
- mr90210 1y ago> (e.g. salt + pepper + argon2 w/high factors) they can still be reverse engineered. It is a matter of when, not if How much compute/gpu and hard dollars would hackers need in order to reverse engineers those stollen passwords?
- kstrauser 1y agoApproximately “infinite”.
- reactordev 1y agoThey borrow unsecured k8s clusters on AWS. That’s not redis running…
- pixl97 1y agoTechnically you may have to burn more entropy than exists in the visible universe, so its a possible if in the case of the right hash and luck.
- mvdtnz 1y agoFor all practical purposes what you're saying is just wrong.
- Someone1234 1y agoI've done so within the last year, successfully. Cost $7 for a single password in just compute and took about 17 hours (lowest, cheapest priority). So please explain your reply further. Also recall their claim for context of what I was replying to, and what you're here defending now. If their claim is credible what I did and what you're reiterating wasn't possible.
- whiterook6 1y agoI am a faithful Plex lifetime user and have never had problems. That said, I shouldn't be blinded by convenience. I hear jellyfin is a good alternative. Can someone share - how easy is it to administer for clients outside of my network or possibly even outside my country? - how good is the app support? I transcode all of my media to AAC and h264 for compatibility -what about for streaming music? I really like Plex amp - what do you like the most about jellyfin - what do you miss most about Plex? Thank you.
- ktm5j 1y agoNot sure about jellyfin, but I really dig Emby. Just as convenient as Plex. I can't even remember why I switched to Emby over Plex, but I never looked back.
- paulryanrogers 1y agoEmby performs better than Jellyfin IME, at least if you need it to work on older TVs. Though IDK if they still offer a lifetime (pay once) subscription.
- platevoltage 1y agoI've been a paid user of Emby for years and it's been well worth it. I think the final straw was Plex artificially blocking transcoding on Raspberry PI, even though it would work with a ton of work arounds.
- unsnap_biceps 1y agoI ran plex for years but gave up once they started tracking all activity. Jellyfin is way to administer. Clients are rough and often crash. Influx is often the best choice for IOS but has its own... weird decisions on how to handle libraries. The main thing I miss is being able to download transcoded media for mobile devices so I can watch on a plane.
- BowBun 1y agoI'll fill in what I can - >- how easy is it to administer for clients outside of my network or possibly even outside my country? Jellyfin is just the software, not a hosted solution. I use a simple server/seedbox, with sane configs (good providers have automated this), which results in a secure public-facing admin console with a username/password. They have basic user management features to include other users in your server. > - how good is the app support? I transcode all of my media to AAC and h264 for compatibility Jellyfin has a broad ecosystem of apps on a bunch of platforms, each with their pros and cons. I recommend poking around. When figuring my setup out, I downloaded 3 or 4 different Android apps to pick the one I liked (support for multiple servers which isn't a given in all the apps) > -what about for streaming music? I really like Plex amp IMO Plex has always been substandard here since they hoisted the music interface into the same one they use for everything else, so it's really lacking in filters/administration features I depend on. That said Jellyfin supports music and has the same simple feature set. > - what do you like the most about jellyfin It's free and untethered to a company's whims. It also does a lot less of the social/DVR stuff that I have no interest in. >- what do you miss most about Plex? Their app experience was a bit more premium, and their support for multiple servers is better than Jellyfin since they own the servers/hosting to do it. I also really used to enjoy the 'remote' functionality where I could skip episodes by clicking next on the Plex app in my phone. This hasn't worked for a few years for me despite heavy troubleshooting.
- benoau 1y agoAlways disliked Plex for them imposing themselves as a middleman to using the software locally, which is ultimately the root cause for this incident.
- draxter65 1y agoYou have to be a fool to use Plex, not only you are pirating, but also relying on a 3rd party company to handle your authentication. They already got hacked multiple times, only a matter of time till there is some copyright law enforcement event too. If you really have to do it, use Emby or Jellyfin. At least those options are fully self hosted.
- paulryanrogers 1y agoPlex has their own streaming-with-ads. And one can load it with whatever you want, including home movies or DVD backups.
- imglorp 1y ago> An unauthorized third party accessed a limited subset of customer data from one of our databases How could only a subset be affected? Any architecture other than a "users" db table wouldn't make sense.
- reactordev 1y agoRows 1-200,000 instead of 1-1,000,000 I would presume.
- supportengineer 1y agoSharding the data across DB's, separate credentials for each DB.
- reassess_blind 1y agoCould be technically true in that they didn’t access every last bit of “user data” like support chat logs or whatever stored elsewhere, but they have phrased it that way to make it seem like less of a big deal. Just a guess.
- kingnothing 1y agoIt's easy to imagine Plex has some db sharding going on at their scale, or that they host in multiple geographic regions for regional compliance, or on multiple cloud providers.
- nimih 1y agoI have no idea how Plex runs their servers, but I've worked at companies where new systems are rolled out for new users/accounts, but old users/accounts are left on the "legacy" system (usually with the plan to migrate once the new system has been deployed and there is bandwidth available to handle the complexity of migrating users between systems). In particular, if you have a long-running service where some very old accounts might have special billing/pricing logic that you want to continue honoring but is difficult to implement in the new system, such a setup might make sense to continue long-term for a small subset of accounts. Alternatively, maybe they mean that the limited subset of data was specifically the "email" and "password_hash" columns of the database ;P
- princevegeta89 1y agoI have been using Jellyfin for two years now. I am yet another happy user with no issues. I am happy that all my data is secure and there is nothing shady to happen. It was not surprising when Plex had a huge investment coming from VCs who might as well just be connected to the movie industry and Hollywood as a whole, when they committed the act of banning Hetzner and all of their data centers. They also had slowly become just another low quality streaming service like Tubi or IMDb with really low quality content being pushed down onto the homepage and actually keeping your own media hidden somewhere in the submenus. With their updates they threw the entire UX upside down. Plex has the most mature platform to be frank. But I am happy I jumped ship as soon as I saw their predatory practices. They are not going to stop.
- blactuary 1y agoI have never had any of their streaming content pushed onto my homepage nor had my own media hidden in submenus. I don't see anything but my own media
- OptionOfT 1y agoWhat about the TOTP setup code? Has that one leaked? Is that recoverable?
- e40 1y agoDisappointed this was not mentioned!
- estimator7292 1y agoThis is the exact reason you shouldn't use a "self-hosted" service that insists on phoning home before you can access media on your own damn server.
- drewbitt 1y agoThey had this same thing happen in 2022, too. "a third-party was able to access a limited subset of data that includes emails, usernames, and encrypted passwords"
- ycombinatrix 1y agoI switched to Emby already. Much better experience imo. External player support is great.