HN Reader

Always disliked Plex for them imposing themselves as a middleman to using the software locally, which is ultimately the root cause for this incident.

Related:

Plex Update: Notice of a potential security incident - https://news.ycombinator.com/item?id=45174684

I am a faithful Plex lifetime user and have never had problems.

That said, I shouldn't be blinded by convenience. I hear jellyfin is a good alternative. Can someone share

- how easy is it to administer for clients outside of my network or possibly even outside my country?

- how good is the app support? I transcode all of my media to AAC and h264 for compatibility

-what about for streaming music? I really like Plex amp

- what do you like the most about jellyfin

- what do you miss most about Plex?

Thank you.

> An unauthorized third party accessed a limited subset of customer data from one of our databases

How could only a subset be affected? Any architecture other than a "users" db table wouldn't make sense.

> Any account passwords that may have been accessed were securely hashed, in accordance with best practices, meaning they cannot be read by a third party.

I am glad they were hashed, but that's a misleading statement. The point of hashing is to slow an attacker down, even with full best security practices (e.g. salt + pepper + argon2 w/high factors) they can still be reverse engineered. It is a matter of when, not if.

unfortunately things like this happen a lot more than they should

What about the TOTP setup code? Has that one leaked? Is that recoverable?

Not necessarily related, but I'll take the opportunity to share my dislike of this company. Like others, they built a loyal following around a set of features provided, no questions asked, to stream your content to your own devices.

Over the last couple of years, Plex has continued to strip functionality, add paywalls, make deals with publishing companies, and take other actions that firmly put them in the 'enshittifaction' phase. They've capitalized on the community that gave them their success, so I've cashed out as well.

At this point there is little need for those of us with some technical ability to use this software and all the bloat that comes with it. Jellyfin[1] is an excellent alternative that I've fully switched over to this last year. I will not let a company take ownership of my media library, ever.

[1] https://jellyfin.org/

I have been using Jellyfin for two years now. I am yet another happy user with no issues. I am happy that all my data is secure and there is nothing shady to happen.

It was not surprising when Plex had a huge investment coming from VCs who might as well just be connected to the movie industry and Hollywood as a whole, when they committed the act of banning Hetzner and all of their data centers.

They also had slowly become just another low quality streaming service like Tubi or IMDb with really low quality content being pushed down onto the homepage and actually keeping your own media hidden somewhere in the submenus. With their updates they threw the entire UX upside down.

Plex has the most mature platform to be frank. But I am happy I jumped ship as soon as I saw their predatory practices. They are not going to stop.

They had this same thing happen in 2022, too. "a third-party was able to access a limited subset of data that includes emails, usernames, and encrypted passwords"

Edit: disregard. Just received the email.

What’s the date of this release? There was a similar release a few months ago and I’m curious if I need to again reset my account.

I switched to Emby already. Much better experience imo. External player support is great.

This is the exact reason you shouldn't use a "self-hosted" service that insists on phoning home before you can access media on your own damn server.

You have to be a fool to use Plex, not only you are pirating, but also relying on a 3rd party company to handle your authentication. They already got hacked multiple times, only a matter of time till there is some copyright law enforcement event too.

If you really have to do it, use Emby or Jellyfin. At least those options are fully self hosted.