Plex is starting to enforce its new rules, which prevent users from remotely accessing a personal media server without a subscription fee.

If anyone needs it: https://jellyfin.org/

you are viewing a single comment's thread
view the rest of the comments
[–] 7 points 11 months ago* (last edited 11 months ago) (10 children)

Jellyfin is notoriously full of security holes. It's recommended to not expose it to the Internet. It's also easy easier on Plex, at least until this bullshit, to have a random non-techie family member sign in to your Plex server from anywhere. I never liked Plex and never got into it, but I see why people used to prefer it.

I think Emby is a good middle ground for people looking to jump ship from Plex. But I switched to jellyfin from my lifetime Emby sub because the plug-in community there feels dead and Emby development felt dead in the water.

  • source
  • parent
  • hideshow 10 child comments
  • [–] 16 points 11 months ago (9 children)

    Please do explain or link sources to what you think are “security holes”.

  • source
  • parent
  • hideshow 9 child comments
  • [–] 13 points 11 months ago* (8 children)

    It has several unsecured endpoints.

    https://github.com/jellyfin/jellyfin/issues/5415

    If you read the comments the devs know it's a serious issue but don't want to break backwards compatibility fixing them. Their solution for now is to warn people of the risks of exposing their instance to the Web. Which I don't think they're doing a great job of.

  • source
  • parent
  • hideshow 8 child comments
  • [–] 17 points 11 months ago (6 children)

    Aside from most of those being “potential issues”, which weren’t proven, the rest are GETs of things that do not need to be secret, things like album art and list of installed plugins. Besides the one plugin issue, which was an actual security issue, which was fixed over a year and a half ago. https://github.com/jellyfin/jellyfin/pull/11436

    Contrast that with Plex which has numerous high severity CVEs that include things like remote code execution, directory traversal, and more.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 2 points 11 months ago (1 child)

    list of installed plugins.

    Yeah, as you said, that's a pretty serious security issue. That's a data leak that explicitly lays out the shape of your attack surface. It tells the attacker exactly what additional software your server is running and if any of it includes known vulnerabilities, the attacker now knows how to gain access.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 0 points 11 months ago

    That only works if the plugins are somehow accessible through an api controller, which as far as I’m aware, is not how jellyfin plugins work. So no, it wouldn’t increase your attack surface at all.

  • source
  • parent
  • [–] 2 points 11 months ago (3 children)

    You’re aware those CVEs are only relevant for ancient versions of Plex and were fixed long ago?

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 11 months ago (1 child)

    They are not marked as resolved.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 11 months ago*

    CVEs don’t get issued “resolved” statuses… They are either reserved, published, or rejected (technically NVD have a few extra for published). That’s just junk data in that tool you’re using. Use authoritative sources like cve.org or nvd.nist.gov.

    You can see the CPEs on NVD and they’re old versions of Plex (and were old when the vulns were published).

  • source
  • parent