Live data from Hacker News

Plex: Important notice of a potential data breach

news.ycombinator.com

111–120 of 194 posts

Re: Plex: Important notice of a potential data breach

#111
I like that they're up front about this. Solved the problem in a couple of minutes.

I use a password manager with a very long randomly generated password for everything, so a hashed password leaking is essentially meaningless to me. Notifying me immediately so that I can change it ASAP is what matters.

The burner e-mail I use for stuff like this is listed in 25 other data breeches, too. I don't really care. Plex is amazing software.

I don't really understand the freak outs here.

Re: Plex: Important notice of a potential data breach

#112
post #108

Ugh, I feel like this is being a regular thing I need to look at with Plex... Has anyone tried any alternatives that have a decent Apple TV client? I have tried looking a couple times over the last couple years and that is always my blocking point. Ideally not a third party one, I know Jellyfin has a third party option but it always seems to have issues on my library and needs to update its cache (or something) and m…

If you only have apple clients (iOS, ipadOS, tvOS and macOS) you can try infuse. Its only a client, so you need to store your files somewhere (icloud, gdrive, you NAS) but it can then play all kinds of files and sync progress between different instances of it self. If you dont want transcoding on the server and only uses apple devices for playback it IMHO works much much better than real plex. It can also play at bei…

Maybe infuse is different if not pointed at jellyfin but that was the client that would have issues with my library. It would loose its cache or something, I don't remember now, all the time.

Re: Plex: Important notice of a potential data breach

#113
post #27

If true, then this will probably reignite discussions around Plex requiring that you authenticate with their servers when using the service to view content that you're hosting on your own hardware. If anyone is curious, then alternatives like Jellyfin exist. It's a bit different and may not have all the features you need, but it works quite well in my experience.

Perhaps the most important thing about Jellyfin is that it's open source. I really wish the project received a little bit more love.

Yes, it's shocking to me how many people are (apparently) willing to trust a closed source / SaaS product like Plex for this kind of thing.

Jellyfin may not be perfect but surely it's good enough for most use cases.

Re: Plex: Important notice of a potential data breach

#114

Earlier quoted context omitted.

The difference between email and password is you can validate a password with a hash, but you can’t send an email to a hashed address. Their db may be encrypted at rest, but a hacker could still compromise a system that has the key in memory.

> a hacker could still compromise a system that has the key in memory. Security is about layers. Simply because a hacker “could” do something, does not mean it’s a bad idea. Getting the encryption key when it’s not stored in the database requires the hacker to now have access not to just the database but to another system as well.

Invariably some developer would just store the key in a column next to the email address so they could process any transaction directly in the query.

But the hackers would have to know what algorithm was used :) That's a layer, right?

Re: Plex: Important notice of a potential data breach

#115

Earlier quoted context omitted.

Are there alternatives with smart tv apps?

Jellyfin has an official app for Roku but I am not sure about other platforms like webOS.

But full functionality on Roku is really lacking. They really have not put too much into the Roku client and made the Amazon client way better.

Re: Plex: Important notice of a potential data breach

#116
post #100

Earlier quoted context omitted.

Since you have an AppleTV, what is the advantage to you of using Plex instead of just an iTunes instance with Home Sharing turned on? Do you have non-Apple devices you're trying to stream to, or something else? I tried Plex years ago, and it wasn't to my liking because it was philosophically like Windows (Load the filename up with show information and constantly ping the internet for matches) instead of macOS (Metada…

Well are you pirating stuff? I've been using Plex for years now and so its mostly just what I know but when I first started using it the main things it did were a) handle codec issues (transcoding on the fly when needed) b) pulling metadata and images for movies and shows based on title and year in the file name. C) allow remote users (friends, family, etc) access to your library via the app, which works out to being…

Not pirating or buying from iTunes. I rip my own media — CDs, DVDs, blu-rays, and records — which means I don't have to worry about a million distant codecs. From your description, it sounds like that's the only benefit of using something like Plex.

Re: Plex: Important notice of a potential data breach

#117
post #90
post #27

Earlier quoted context omitted.

Perhaps the most important thing about Jellyfin is that it's open source. I really wish the project received a little bit more love.

I like Jellyfin, but I need the Samsung client to be finished first. At least it looks like it has been started: https://github.com/jellyfin/jellyfin-tizen

The build steps were a nightmare. That's mostly the fault of Samsung, but it was still very off-putting. Unless I was doing something wrong. It took me a couple full nights after work to finally get it done and on the TV, trying to set up Samsung's developer tools on multiple different machines. I dread having to do it again.

Re: Plex: Important notice of a potential data breach

#119

Like clockwork. I just joined recently and of course they have a breach. I knew I should've stayed away when they required an account for you to view your own media. Does Jellyfin let you get past this security issue?

From a comment further up, Jellyfin has an open issue on GitHub with a list of various security problems (most if not all of which come from Emby when they forked off of it). At least they're open about it, and working on it. It seems like running it on the public net might be a bad idea for the time being. But running it internally should be just fine.

I personally run Jellyfin, and aside from security issues, I'm quite pleased with it.

Re: Plex: Important notice of a potential data breach

#120
post #97

Earlier quoted context omitted.

This is exactly what I had happen as well. I'm going to give it some time. I also even went through these steps ( https://support.plex.tv/articles/204281528-why-am-i-locked-o... ) without success.

It didn't work for me after restarting with a new claim and when i checked the preferences it contained `PlexOnlineToken=""`. After removing the attribute entirely it was able to successfully reclaim the server.

I had the same "", but after restarting all the web interface says is Connecting. Then the server just doesn't show up in the list. Might just need to blow up my whole config and reimport everything.
Post reply on HN