Everyone here had 2FA on their account, right?
Right??
Plex: Important notice of a potential data breach
121–130 of 194 posts
Re: Plex: Important notice of a potential data breach
#122I'm a long time Plex user, and I have not received this email. Not sure if I should be worried or if the breach has just affected a subset of users. I use random unique passwords for everything anyway, as long as no credit card details were taken it shouldn't be a big deal hopefully. I was able to log into the site now and no message was displayed at all. Edit: Not sure why I would be getting down-voted for this. Sec…
I got the email about an hour ago.
Understand that sending emails that are not SPAM, to potentially millions of people is NOT a trivial exercise.
Re: Plex: Important notice of a potential data breach
#123It's funny that everyone here is expecting airtight security practices, proper vulnerability disclosure and general trustworthiness from an app that's a tiny step above the likes of BitTorrent and PopcornTime.
That's like saying torrents are only used for piracy, TOR only for buying drugs, and crypto only for laundering money.
Re: Plex: Important notice of a potential data breach
#124I wonder if "we discovered suspicious activity on one of our databases" == SQL injection?
I've been through this exercise before with one of my businesses, and I disclosed what/where the injection was and what our mediation was for the problem.
I don't understand the outrage though from this community. I don't think there is a large web business today that hasn't been through an SQL injection compromise. Even the largest platforms in the world like Facebook, etc have had an issue like this crop up.
Re: Plex: Important notice of a potential data breach
#125Earlier quoted context omitted.
I like Jellyfin, but I need the Samsung client to be finished first. At least it looks like it has been started: https://github.com/jellyfin/jellyfin-tizen
The build steps were a nightmare. That's mostly the fault of Samsung, but it was still very off-putting. Unless I was doing something wrong. It took me a couple full nights after work to finally get it done and on the TV, trying to set up Samsung's developer tools on multiple different machines. I dread having to do it again.
Does it work OK? Was it worth the effort?
Re: Plex: Important notice of a potential data breach
#126Earlier quoted context omitted.
Kodi's pretty good too, and doesn't insist on showing unrelated online content you don't care about like Plex seems to.
Kodis always been the better option if you're remotely technical.
I ran Kodi for years, but "always"?
* Kodi only works on my local network. It requires exposing my file shares on whatever VLAN my Kodi devices are on.
* Kodi is a pain to configure. To point it at the aforementioned file shares, I need to copy an XML configuration file, and getting this onto every device is a chicken and egg problem.
* Kodi requires each client to scan and sync the entire library at its CPU and bandwidth limits. My Plex server automatically scans and indexes my media.
* Plex allows me to access my content at the office, while travelling, and to share with friends
* Kodi doesn't transcode, requiring all of my client devices to have enough power and bandwidth to do so locally. Plex makes it much simpler to (for instance) stream a 4k video to a low power device
I know enough to have ran Kodi for years and intentionally switched to Plex full time
Re: Plex: Important notice of a potential data breach
#127Earlier quoted context omitted.
Plex doesn't require account linking IIRC, it's heavily suggested but you can just access Plex locally without an account.[1] But otherwise I've switched to Infuse[2] since then, it indexes sources reliably on its own (no manual editing though) and saves the entire need for a server if you use it with some cloud storage. Basically replaced my Plex server, with the added bonus of out-of-home streaming without needing…
This is not correct. I've tried the LAN no-login settings and it does not work for many devices (Roku/smart tv/phones). They also fail if you're not on the same subnet as Plex. For this infuriating reason, moving off of Plex is on my to-do list.
yup--the weekend my internet went out was a real eye-opener and a number of things in my house got the axe including plex. i use kodi now and while its UX is nowhere near as good as plex, at least it works with a LAN-only connection
Re: Plex: Important notice of a potential data breach
#128It's funny that everyone here is expecting airtight security practices, proper vulnerability disclosure and general trustworthiness from an app that's a tiny step above the likes of BitTorrent and PopcornTime.
That's like saying torrents are only used for piracy, TOR only for buying drugs, and crypto only for laundering money.
There are a distressing amount of people on this website who believe all three of those things.
Re: Plex: Important notice of a potential data breach
#129And now the sender sending the "reset password" email is blacklisted by spamcop, I presume because they are sending so many emails from a server that normally doesn't much. They are not having a good day. http://www.spamcop.net/w3m?action=checkblock&ip=192.254.122....
> Causes of listing > System has sent mail to SpamCop spam traps in the past week (spam traps are secret, no reports or evidence are provided by SpamCop) Sounds like their spam trap is broken.
As someone who works in email delivery, spamcop is broken alot of the time...
Re: Plex: Important notice of a potential data breach
#130If true, then this will probably reignite discussions around Plex requiring that you authenticate with their servers when using the service to view content that you're hosting on your own hardware. If anyone is curious, then alternatives like Jellyfin exist. It's a bit different and may not have all the features you need, but it works quite well in my experience.
People on HN always complain about this. But the reality is that the one time payment you (maybe) gave for Plex is not enough to make a viable company. So they have to offer complementary products and for that you need an online account.
Normal people also want to have features like remote streaming, subtitles fetching, familly sharing, etc which are hard to do without centralized accounts. Not even mentionning securing your paid features which you have to do to survive. And that customer doesn't care about the login as long as it is up.
I don't anything plex could do to please this particular demand would ever be enough so for me they do well to ignore it since removing that would effectively kill their business.