Honest question, because I know multiple people who are not looking to jump ship since they already have the Plex Pass.

top 98 comments

sorted by: hot top controversial new old
[–] 101 points 5 months ago (4 children)

Lifetime subscriber when it was like $75 bux

Setup and runs on my NAS (unRAID) Uses a small GPU to transcode as needed Shared only with non technical family members

Has worked as is for YEARS.

So, the question is, am I looking for something to replace a working free (prepaid) solution I have? That answer is nope.

  • source
  • hideshow 4 child comments
  • [–] 30 points 5 months ago* (1 child)

    This is my POV. It already works perfectly, is prepaid, and is accessible to my nontechnical users. Switching would be a major pain for a worse experience.

    Also, Plexamp.

    Someday in the future no doubt Plex will enshittify for lifetime users such that it will justify a change, but that hasn't happened.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 12 points 5 months ago

    +1 to all of this. I paid for it when it was $90 lifetime, before either Jellyfin was popular before I heard of it, who knows. It works fine. No reason to put extra effort into replacing something that I have no problems or qualms with.

  • source
  • parent
  • [–] 134 points 5 months ago (28 children)

    Ease of use for my users across multiple platforms with minimal tech knowledge on their end. I'm sharing my library with ranges from 12yo to 70. I need it to "just work" and it does that perfectly.

  • source
  • hideshow 28 child comments
  • [–] 61 points 5 months ago (1 child)

    Same here. Plex just works for my folks with 0 tech literacy. I may try Jellyfin in the future, but I have a few friends that primarily access Plex via Playstation 4/5, and I know there's no support there yet.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 27 points 5 months ago (6 children)

    Couldn't upvote this harder. Tried Jellyfin for 5 mins and was super confused why I couldn't find sharing options. After googling and reading about reverse proxies and buying domains and shit I said fuck it and uninstalled

  • source
  • parent
  • hideshow 6 child comments
  • [–] -1 points 5 months ago (2 children)

    Totally understandable, however basic tailscale version is free and you can just have that installed on all of the connected devices as a "reverse proxy". You then use the ip adress from the server or main computer with the files and connect to its tailscale provided ip adress after turning it on and as long as you have port 8096 open on the server computer (http:/with your adress here:8096) you can connect to the server through the jellyfin app on the device you've installed it on.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 4 points 5 months ago

    Yeah, I think you lost them after the first paragraph. 😉

    I am tinkering constantly with my home setup, but I am lacking the time to set up everything to my liking.

    So I am using neither Plex or Jellyfin, I am using Kodi and have a Webdav share available for when I am away on holiday. 😬😁

    But then I am only sharing with my closest family in my home network. Somehow it seems everyone is providing a streaming service for half the neighborhood and the remote family (or possibly a polycule with the drama associated, IIRC).

  • source
  • parent
  • [–] -4 points 5 months ago (1 child)

    I never fully understood this argument as you would have to do that anyways with plex unless you're using their proxy which would just artificially rate limit all of your users. But I do realize that jellyfin doesn't have an email invite system in place which really is my biggest issue

  • source
  • parent
  • hideshow 1 child comment
  • [–] 10 points 5 months ago

    What's the "that" that you'd have to do anyway with Plex? I had to do nothing of the sort. I asky friends and family to make a Plex account and ask what email address they used. Then I give that email access to my library

  • source
  • parent
  • [–] [S] -3 points 5 months ago* (11 children)

    Did you try Jellyfin? I've had success with Jellyfin once I've been the one setting up the TV app, etc. It did just work, because users found it very simple in comparison to Plex. If anything, they like how Plex shows more things beyond the collection.

  • source
  • parent
  • hideshow 11 child comments
  • [–] 41 points 5 months ago (7 children)

    I've been the one setting up the TV app, etc.

    That is exactly the issue. I can’t personally set up the app for all my users. Most of them are not in my household.

  • source
  • parent
  • hideshow 7 child comments
  • [+] [S] -8 points 5 months ago (6 children)

    Me either, but I don't expect them to setup any sort of app themself (including Plex).

  • source
  • parent
  • hideshow 6 child comments
  • [–] 39 points 5 months ago (5 children)

    That's his point though, he does expect them to be able to set up themselves, and apparently Plex is good for that.

  • source
  • parent
  • hideshow 5 child comments
  • [–] [S] -2 points 5 months ago (4 children)

    Yes, in my case I personally had to setup both clients (Plex and Jellyfin) for the family members myself.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 7 points 5 months ago (2 children)
  • [+] [S] -10 points 5 months ago (1 child)

    Ah, the answer to that.... I configured the server beforehand and installed it at their house as a gift, so I have persistent SSH access over VPN and can administer it remotely at will within tmux. Has worked for several years.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 5 months ago

    The extent of the setup for Plex is to log in with your email and password, pick which shared libraries you want to be pinned to your home screen, and then browse. My parents in their 70s were able to figure it out and all I had to do from my end was grant them access to the libraries I wanted to share with a simple check box.

  • source
  • parent
  • [–] 5 points 5 months ago*

    I use both at home, mostly plex though and I have about a dozen people who watch remotely and keeping the remote access private and secure I'm not putting jellyfin behind a public reverse proxy. Not feasible to setup wire guard for a dozen people across 4 states and troubleshooting those tunnels when Plex does all that for me. Plus Plex allows them to manage and reset their password without my intervention

  • source
  • parent
  • [–] [S] 6 points 5 months ago* (1 child)

    Had to find it, but there is a new tvOS app that looks very nice: Moonfin

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 5 months ago*

    Thanks do letting me know about this. I tried it and it does look good. Sadly for me at least it does perform well. Moves slow between options and libraries. And the Live TV Guide isn't working at all. That could be a me issue, but the slowness is unacceptable. Once I have more time I will play it more and probably reach out to the Dev.

  • source
  • parent
  • [+] -10 points 5 months ago* (last edited 5 months ago) (5 children)

    I've never understood this stance. You do you, but if I'm offering to host stuff for friends or family for free, they can at least learn to operate that thing on their end.

    Edited to add, wow I did not expect this to be such a hot take. Fuck me I guess lol.

  • source
  • parent
  • hideshow 5 child comments
  • [–] [S] 4 points 5 months ago (3 children)

    It seems to depend on how you are granting access and have configured the server... if they have to setup VPN access in order to access Jellyfin, as opposed to logging into plex website.

  • source
  • parent
  • hideshow 3 child comments
  • [+] -10 points 5 months ago (2 children)

    No, that doesn't change anything about what I said really.

    To me, if I'm hosting something for my friends and family, they can put in the effort to learn how to use it. Period. Whether that's as simple as logging in through a browser, installing an app, or using a VPN. They can learn, or they can pay for Netflix (as an example, since we're discussing a media server originally).

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 5 months ago (1 child)

    In my experience getting dozens of people on to my server, plenty will happily choose to pay for Netflix. I want people to choose my server over paid streaming, so I offer both Plex and Jellyfin, and to date not a single person has stuck with Jellyfin, and several have gotten my invite email, took a look at the FAQ on how to request media, and continued using paid streaming.

  • source
  • parent
  • hideshow 1 child comment
  • load more comments (1 reply)
  • [–] 32 points 5 months ago (11 children)

    The client apps on Apple TV are just not good. I have tried swiftfin which is slow and I find it not very visually appealing. There there is infuse which does look better, but is missing features and requires a subscription for full functionality. If there is a app I'm missing I would be happy to try it.

    I keep Jellyfin up to date and check in or it from time to time. Even have watchstate so my watched history stays updated. Hoping one day there will be a good Apple TV app and I could fully switch.

  • source
  • hideshow 11 child comments
  • [–] 8 points 5 months ago (2 children)

    Same boat on Swiftfin and Infuse.

    There’s one I recently found called Moonfin that does many things well. It’s my current go-to until official apps catch up.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 4 points 5 months ago (1 child)

    I hadn’t heard of Moonfin before, it looks promising as an Apple TV client. Any pitfalls with it?

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 5 months ago* (last edited 5 months ago)

    I use it on my tablet and it direct plays all of my (limited) media, and also handles and organizes downloads to the device with reencoding options. Playback is more reliable and efficient compared to Swiftfin. UI seems modeled after existing streaming services.

    They also have a plugin that “updates” your existing Jellyfin install so the features show up on the official client, but uses code injection which I didn’t like and so did not partake. The sense I get is that they push for features and implementation while official Jellyfin development takes a much more conservative approach. I hope they can work together some day.

  • source
  • parent
  • [–] 6 points 5 months ago (4 children)

    I'm in the same boat. Considering swapping out for a Linux based media box instead of the AppleTV.

  • source
  • parent
  • hideshow 4 child comments
  • [–] [S] 5 points 5 months ago (3 children)

    Kodi works well as a frontend to Jellyfin and Plex

  • source
  • parent
  • hideshow 3 child comments
  • load more comments (1 reply)
    [–] 29 points 5 months ago* (12 children)

    Lifetime Pass holder here. Used to run Jellyfin alongside Plex. Had crashing issues and had to shut Jellyfin down for quite a bit. Came back after a while and started Jellyfin from scratch. None of my users ever chose Jellyfin over Plex.

    • The UI is slower (at least on Windows), clunkier, and uglier. Hopefully this gets fixed in the upcoming big update they have planned for the desktop client. Their Roku app is actually on par with Plex's though.
    • The admin dashboard is confusing and in my opinion awful.
    • Downloaded content is not viewable within the app on Android. This is the complaint I've heard the most from my user who made a significant effort to switch. Ironically, after the New Experience update this became less of an issue since Plex ruined downloads.
    • Plexamp's UI, radios, and sonic similarity feature were, last I checked, unmatched by a long-shot. I use my music library heavily. If I make the switch fully away from Plex, I'll probably opt for something more specialized like Navidrome.
    • Manually setting the edition of a movie is so much easier on Plex, and for someone who likes to have multiple editions, it's less confusing for the user to see each edition individually labelled in the library than selecting the movie and being expected to know which file name they should pick. Not every file is named to Jellyfin's standards because that would make them harder to add to my torrent client, and some don't have their editions in the file name at all and I just have them hand-labelled in Plex based on run time.
    • I'm still trying to setup my DVR in Jellyfin and can't get it to work. Plex works fine, Jellyfin just won't. It's a moot point at the moment, but once I do get it to work, unless things have changed over the years, the channel guide is a whole other set of challenges.

    I'm willing to deal with this personally simply because Plex creates just as much, if not more of a headache for me as an administrator and the bloat is ridiculous, but not a single one of my users has switched, and I don't blame them. They don't have to deal with the administrative difficulties, so there's no benefit to them except being able to download files to their system instead of just in the app, which none of them care about. If nobody is going to use it, my focus ends up being on Plex anyway. I have been pushing Jellyfin for a year and a half. None of my friends or family want to use it unless Plex borks something, and even then they want Plex back.

    Jellyfin just isn't on par with Plex, no matter how much I wish it was. It's death by a thousand cuts on both the user and administrative ends. It would be one thing if I were a free user or actively paying for Plex, but as a Lifetime Pass holder, I just can't justify it yet.

  • source
  • hideshow 12 child comments
  • [–] 5 points 5 months ago (4 children)

    I would recommend Symfonium for muaic listening.
    It has an insane feature set (and it can support both Plex and Jellyfin libraries

    One of my killer features of it are rolling cache. And you can decide how big and how it behaves to cache songs

    I use Jellyfin to listen music at best on desktop at work through the browser

  • source
  • parent
  • hideshow 4 child comments
  • [–] 1 point 5 months ago (3 children)

    Can you explain rolling cache? I'm pretty sure plexamp does this, but maybe I'm misunderstanding what you're referring to.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 2 points 5 months ago* (2 children)

    My phone UI is german so I translated it with google. Text should be accurate enough

    It's essentially like Spotify does it (probably)

    Should something be unclear, give me a heads up :)

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 5 months ago

    Nothing in the self hosted space is taken seriously on windows. There’s a reason for that. Jellyfin on Linux is fine. I’m a fucking smooth brain and if I can do it, a crack enhanced autistic monkey can do it.

    Plexamp is better. I will give you that. There’s nothing outright bad about jellyfins take on music. Apps like Discrete make it quite nice, but plexamp just satisfies that out-of-box itch.

  • source
  • parent
  • [–] 1 point 5 months ago (1 child)

    It's a small piece in your observation but I've been on the hunt for an android client for jellyfin with downloads that are.. usable. Fladder has been so far the only one where this seemed to work okay-ish (it's still slow, and I noticed it doesn't detect if the device supports Dolby vision to force transcoding). But still, if your one user is still trying.. maybe it helps them a lil.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 21 points 5 months ago (5 children)

    I’m not switching at this time because I already bought a lifetime pass about 7 years ago. If ANY of my functionality gets changed by Plex then I’ll be switching

  • source
  • hideshow 5 child comments
  • [+] -10 points 5 months ago (4 children)

    They already changed the authentication system a few years ago. Everything goes through their server now. You can't self-host it.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 3 points 5 months ago

    I don't know what this means and maybe I'm just not techy enough, but all my shit is on my PC, and if my PC is turned off it doesn't work. Are you saying it goes through their servers? I'm just curious why it matters.

  • source
  • parent
  • [–] 37 points 5 months ago (1 child)

    WhatI've noticed is that people who prioritize privacy and just want to watch their downloads on their tv usually use jellyfin and people who prioritize ux slickness and want to run an IPTV service for their friends and family usually use plex.

  • source
  • hideshow 1 child comment
  • [–] 2 points 5 months ago

    It's not a matter of privacy vs UX. I actually think Plex has ruined their UX. But if you have friends and family, some are tech-illiterate, some have their own media servers, and you all want to share with each other quickly and easily, Plex is the only viable option. Same if it's just you, but you travel a lot, and want to watch something from your home server without lugging around a device that has access to your VPN and a screen/hdmi-out.

    Jellyfin is really only viable if it's just you on your own network.

  • source
  • parent
  • [–] 18 points 5 months ago (3 children)

    I got started with jellyfin and never used Plex but there's a bunch of rough edges:

    • No apps on several smart tv/streaming stick stores, Vizio has an app for plex but not jellyfin so I would need to buy a new streaming device. Yes smart tvs spy on you but the alternatives people recommend either spy on you just as much or are expensive (Nvidia shield) and most of them still require side loading so it's a major obstacle for sharing with anyone else.
    • Casting from the mobile app won't play at full resolution, you can get around this by using VLC as your player and casting from that but that causes it to frequently lose watch progress. Also stopping casting or playing the next episode doesn't work properly with VLC and you need to rapidly mash "back" to get into the jellyfin app again and queue up a new episode.
    • The current release of Jellyfin desktop won't play audio for iptv streams, this is fixed in the dev branch but I have yet to find a build without other critical bugs so I'll likely need to wait for the next release which currently has no target date.
    • The browser version has spotty controller support that stops working constantly. When it does work it lacks any way to access context menus to mark shows as watched etc. If you're using a flatpak browser to run it on steam deck or whatever, you'll have codec and passthrough issues (Chrome is the only flatpak with decent codec support).
    • Others have mentioned the security issues which you can bypass by putting authentik or something in front of it but then you can only share with people using browser.
  • source
  • hideshow 3 child comments
  • [–] [S] 1 point 5 months ago (2 children)

    What about exposing through Pangolin tunnel, Cloudflare Tunnel, Tailscale Funnel approach? Would that allow proper client access?

  • source
  • parent
  • hideshow 2 child comments
  • [–] 4 points 5 months ago (1 child)

    Cloudflare doesn't allow streaming large quantities of data through their tunnels. At least it's against their ToS.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 5 months ago

    When setup with tunnels, cloudflare doesn't see any media traffic. Cloudflare only needs to serve the auth and handshakes. The actual traffic is IP to IP, TLS encrypted if you setup a domain correctly. Or just use something like tailscale that sets up the certificates and domains for you.

  • source
  • parent
  • [–] 16 points 5 months ago* (5 children)

    I tried Jellyfin probably 2 years ago and it was fine but Plex is just "plug n play" in regard to my family setting it up themselves with little help from me.

    Plexamp is the only way I stream music too so that's a big reason why I won't move yet.

  • source
  • hideshow 5 child comments
  • [–] 1 point 5 months ago (4 children)

    Navidrome plus Arpeggi, Narjo or Symphonium are pretty much equivalent

  • source
  • parent
  • hideshow 4 child comments
  • [–] 2 points 5 months ago (2 children)

    That’s a lot of apps to replace the functionality of one. Pass.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 15 points 5 months ago (1 child)

    Have lifetime already. No reason to jump. Generally it just works.

    No need to have another project while Plex still works fine.

  • source
  • hideshow 1 child comment
  • [–] 6 points 5 months ago

    Same. Got it cheap. Untill they break lifetime. Why bail? I'm not compromising my own experience because someone else was too cheap, lazy or slow.

    Is it messed up what they are doing? Yeah. But that's not my fault. Nor is someone missing out on the very clear signposts about what was going to happen. I'm not sacrificing my user experience and investment to justify someone else's missed opportunity or vendetta.

  • source
  • parent
  • [–] 14 points 5 months ago (17 children)

    I'm not using Plex, but I feel like I can answer my complaints about using jellyfin.

    My biggest complaint is the lack of clients. It is such a pain in the butt to install jellyFin on all of my products.

    My second complaint is the security design. They've had open issues about unauthenticated endpoints for three or four years now. And whenever the issue gets so old that it starts to look bad, they refactor the issue into a newer issue abd bury it in the sand.

    For a while this was done under the guise of maintaining legacy client support, but just recently it looks like they're starting to focus on more security, and I've noticed some of those security holes are being closed finally, but it's a major concern for me that they've been open for as long as they have.

  • source
  • hideshow 17 child comments
  • [–] 5 points 5 months ago (16 children)

    My second complaint is the security design. They've had open issues about unauthenticated endpoints for three or four years now. And whenever the issue gets so old that it starts to look bad, they refactor the issue into a newer issue abd bury it in the sand.

    You mean that one issue that is still open and linked in the "security and quality" tab on github?

  • source
  • parent
  • hideshow 16 child comments
  • [–] 4 points 5 months ago* (last edited 5 months ago) (15 children)

    i feel like one issue is a bit of a downplay here, considering that it's 12 different issues being shown as one mega issue. but yes that has most of them

    But that's also the most recent version of it. Some of those issues that they have listed there has had previous issues that were closed to be consolidated into that mega issue, which then was closed to be split into their own issues again.

  • source
  • parent
  • hideshow 15 child comments
  • [–] 1 point 5 months ago (14 children)

    i feel like one issue is a bit of a downplay here,

    But how does it matter if the issue is closed or open? It is linked and stated early and tracked.

    That issues get merged and closed is quite normal when there arw duplicates.

    Also, i think the oppoaite. The issues get 'upplayed'. Which one of these are you actually worried about? And how does they affrct you?

  • source
  • parent
  • hideshow 14 child comments
  • [–] 2 points 5 months ago (11 children)

    Doesn't it affect all of us in that we cannot safely run it exposed to the internet? I mean I still yolo it and run my jellyfin completely exposed because there's no way I'm guiding anyone through setting up wire guard or configuring clients to do additional auth, but still. I would love to not worry about that.

  • source
  • parent
  • hideshow 11 child comments
  • [–] 2 points 5 months ago (10 children)

    The question is, are the vulnerabilities actually a risk for your setup?

    Should they be fixed? Absolutely.

    But do they affect you? For me its basically a no.

    A vulnability can be a nothing burger or critical issue that needa to be fixed. But it depends.

  • source
  • parent
  • hideshow 10 child comments
  • [–] 1 point 5 months ago (9 children)

    If it's a nothing burger then they should come out and say it's fine to run your instance publicly then

  • source
  • parent
  • hideshow 9 child comments
  • [–] 1 point 5 months ago (8 children)

    No, it is impossible to certify security, it's only possible to certify insecurity.

    They could only say something like "it's designed to run exposed" or something like it.

    You can pay for the audit if you like and still there would be no certainty.

    I assume, before they say something like that they want a completely new API. But this would break every single client.

  • source
  • parent
  • hideshow 8 child comments
  • [–] 1 point 5 months ago* (last edited 5 months ago) (7 children)

    How come this is not an issue for other projects then? Why isn't Overseer also saying "don't host this publicly because we can't also can't guarantee perfect security? Is the issue really just that they can't prove security or is there an actual security issue with the API? From what you're saying it sounds like the only issue is that they haven't done an audit but that it's otherwise fine, but other people are saying there are actual security holes regardless of whether an audit is performed.

    Like, I'm fine running stuff publicly that hasn't been audited like most of the stuff I self host. Why are people treating jellyfin differently than other self hosted projects that haven't been audited?

  • source
  • parent
  • hideshow 7 child comments
  • [–] 1 point 5 months ago* (6 children)

    I am saying that the mentioned security vulnerbility is not as big as ppm make it to be. The bad thing right now is that IF you know the exact path of a media item you can probe if its there. As soon as you varg your path by just single character from the default/guides that are out there, this is basically no longer practical.

    Is this ok? No. But to fix this, every Client would be broken.

    The current API dies not follow modern security practices since some are not or partially autheticated. Thats basically inherited by Emby.

    That is the current main issue and needs to be dealt with.

    I assume that after the last EFcore (database handling) this gets addressed since now the API can be designed around the standerized databade calls.

    Also overseer is also not saying "pls host on the public internet". If you do so, you are on your own. Why jellyfin gets treaded different? I do not know.

    EDIT: I guess at least some ppl, use this as a comfortable excuse to stay on Plex. "But it is insecure... so i can not set it up"

  • source
  • parent
  • hideshow 6 child comments
  • [–] 1 point 5 months ago* (5 children)

    Ok, well you just made it sound like the main issue was the lack of audit /guarantee and not an actual security issue. I don't think breaking clients is an excuse not to at least get started putting forward a date, even if it's a year in the future, where clients need to be updated by. Sure Overseeer isn't begging people to put it on the internet, but there aren't any known vulnerabilities to my knowledge, same with vaultwarden. Imo it's a big win to getting more people comfortable using jellyfin if they can put their foot down and say clients need to update, or stay on the old version. Every time there's Plex drama, it seems like the list of reasons people don't want to spend time to migrate isn't getting whittled down much. I've donated hundreds of dollars over the years at this point to jellyfin proper as well as several clients hoping things could move faster. Like imagine if the Overseeer devs designed a frontend. There's nothing that jellyfin can't technically do that I find missing, but it feels like a death by a thousand cuts.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 1 point 5 months ago (4 children)

    Just because you do know any or that there are no know to the public does not mean it is secure. Do we know if the plex communication with your server is secure? No one cares, because no one is looking into it.

    The main issue, is that ita not that simple to get new versions on the closed eco systems on many smart TV, especially when you are just a single dev and no company who can throw money on the problem.

    As I said, the issue is not that big, and mainly an excuse for most ppl. The API break will come, hopefully sooner than later, but it needs to be carefully designed, to prevent issues in the future.

    But again, the current issue is not that much of a problem. I do not see the benefit of anyone to probe my server if i have certain media files on there. And i do not use the default paths.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 1 point 5 months ago (3 children)

    Sure not knowing of an issue doesn't mean it's secure, but that doesn't also mean that projects with known issues aren't a problem... Like if you want jellyfin to be popular you should want this to be fixed - I don't get this attitude from people who main jellyfin who seem opposed to pushing for it to be better. It not being a big issue is your own personal opinion - it's obvious that known security issues sitting around for a long time bothers a lot of people so the sooner it gets addressed, the fewer reasons people have to stick with Plex. That's a good thing right?

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 5 months ago (2 children)

    I am saying all this because it's more blown up than it is. I have said in basically every single post that it needs to be fixed right? So pls do not suggest that I do not want it to get better.

    But, this link to the collection of vulnerabilities gets posted on every argument without any explanation and or classification. Which is also not ok.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 1 point 5 months ago* (last edited 5 months ago) (1 child)

    For starters, it being brought up wouldn't be an issue if there was some timeline to fix it and the response wasn't just "it's too hard and would break clients", and secondly, I think it's not congruent with wanting to improve jellyfin if your reflex is immediately to say that nothing is truly secure. Could you imagine if next cloud had a similar issue and put it off for more than 5(?) years?? Is that really not enough time to get the clients and apps in order? They should just put the issue to rest so we can move on with making jellyfin better. I don't think anyone wants it to remain an issue for another 5 years, and I think calling that blown out of proportion is kinda ridiculous.

    Like if 5 years ago they said you have 5 years to update your app, we could have had this issue checked off and nobody would be able to complain about it or use it as an excuse not to switch, so the next best time to set a deadline would be now. They should just as soon as possible say you have a couple years to update your apps, at least schedule a date years in the future to rip off the bandaid instead of kicking it further down the road.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 5 months ago

    I think it's not congruent with wanting to improve jellyfin if your reflex is immediately to say that nothing is truly secure.

    At no point in life I said that.

    Jellyfin has proven with the latest RCEs that they can handle relevant critical security vulnabilities.

    As always, jellyfin does not have that much relevant contributers, and a lot of work has been done in recent time. It is very easy to lean back and say what they should or should not have been doing.

    Breaking Clients would make the project not usable for many ppl or at least decrease the usability.

    As i have already said, getting uodatea on those closed eco systems can be a nightmare.

  • source
  • parent
  • [–] 1 point 5 months ago* (1 child)

    I don't think downplaying them is the way to go though, Some of these issues have been in existence since 2019.

    Like I mentioned though, it does seem like its starting to be worked on, a few of them are in progress the one I really don't like is #13991 which is a combination of:

    • #13982 which allows for an alternative user to be able to interact with the client readonly as if they are another user as long as they have the user id and any valid auth token (which includes that current users auth token). original issue: #5210 2/10/2021; status: partially mitigated 5/11/24 with v10.9 which locked modifying data behind elevation but getting the data still is able to be done in select endpoints still
    • and #13990 Which gives any user with standard login access(like say the common family tv's account) the ability to access the getUser endpoint and retrieve said previous user id. In progress since 12/2/25 reported via the megathread creation 3/8/2021

    For example I just made a user with no access period to any collection, just a login access and took the auth token for the user. I was able to grab every user on the servers ID including hidden and administrative users as well as users who don't use jellyfin's auth system, then couple that to see what the users login method was, when their last access was, what folders they were allowed to use[note these are represented as id's the client can't actually parse them so you need to traverse the api for it], how many max sessions they could have, etc. without actually having access or logging in as that user or even being an administrator. If you snag an admins userid it even gives you internal server data such as logging paths that the server uses on the dashboard, the transcode path, the metadata path, what networking settings the server is using such as trusted ip nets the port jellyfin is using by default your certificate file and password if configured[although password may be ommited/the field left blank i didn't test internal certs]. From there you can even recurse through the folder UUID's provided via "enabledfolders" and the other folder restrictions on the users endpoint and get the name of the folders which could leak personal information about the library or the user because the 403 request it returns leaks the name of the library as part of the error message. "username is not allowed to access Library name"

    Thankfully it's finally being worked on but, I do think it's worth stating the timeframe on them and that those issues do still exist.

    Just like I think it's worth stating that media endpoints are still fully unauthenticated as well, so as long as you can guess the full file path, you can md5 it and get unauthenticated media paths, but that's in progress as well, its just super slow because that breaks third party clients.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 5 months ago

    I don't think downplaying them is the way to go though, Some of these issues have been in existence since 2019.

    I am not downplaying them. And yes they should get fixed. But this attack needs access to an account on your server.

    so as long as you can guess the full file path,

    Yes, also should be fixed, probably by some sort of salt and authentication, but can be easily prevented by adding a random character in the base/root path to the media. Especially with docker or similar, thats an 1 min fix.

    And even if not? What then? Why would someone want to attack that?

    Those are not good, no. But no deal breakers and actually more blown up then downplayed imho.

  • source
  • parent
  • [–] 14 points 5 months ago (2 children)

    Jellyfin is great and I run both. However, sharing access with family is a PITA compared to Plex. I paid for Plex Pass lifetime at the $75 and have no reason to fully move. Keeping Jellyfin around in case Plex tries to rug pull lifetime passes, though.

  • source
  • hideshow 2 child comments
  • [–] 2 points 5 months ago (1 child)

    I set up tailscale on my jellyfin box and my family can use their phone to access the server by turning on tailscale (just open the app and toggle it on then open jellyfin) and cast to their Tv. Not as smooth as plex but works for us and the tailscale means its all encrypted.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 5 months ago*

    I use GeoIP restrictions on WAN and use a TLS offload on a load balancer in front. Problem is the older members in my family look at me weird when I give them a URL, username, and password. They just ask if they can use their Apple or Google account "like we do with Plex". So....for now Plex stays.

  • source
  • parent
  • load more comments
    view more: next ›