Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Plex Security Incident

links.plex.tv

Post reply on HN
Print view View original

51–60 of 94 posts

Re: Plex Security Incident

#51

Post by gchamonlive »

unethical_ban wrote: post #13
gchamonlive wrote: post #4

Earlier quoted context omitted.

Do I still need to mess with filenames in order to have jellyfin pick them up to create the library?

Soemtimes I have needed to rename files, but to me it is both sensible (how else to recognize a show, maybe a metadata file) and totally worth it. I don't want to need to have a centralized account to access my media library on my device. I don't want to have to pay monthly to enable hardware transcoding.

I can't because most of my media is in an off-site server and the mount point is readonly

Re: Plex Security Incident

#52

Post by magicalhippo »

BowBun wrote: post #25
magicalhippo wrote: post #16

Earlier quoted context omitted.

I like Jellyfin, but I keep using Plex for two reasons. First is subtitle support is quite limited in comparison. It fails more often than it works for me. Second is the lack of skipping. This is with the Android TV client, haven't really tried the others.

Fair, I handle subtitles in my ingestion pipeline and so those are ready to go by the time Jellyfin gets involved. Skipping, do you mean skipping intros and such? Or something else?

> I handle subtitles in my ingestion pipeline

What do you do? Separate file? Not sure if I've noticed a pattern other than "mostly doesn't work well".

> Skipping, do you mean skipping intros and such?

Sorry, I meant jumping back and forth. On Plex I can just press left/right arrows on the remote, and it jumps a few seconds. On Jellyfin I have to press ok/confirm to actually do the jump. Very annoying.

Re: Plex Security Incident

#53

Post by ewenjo »

hamdingers wrote: post #31
johnbellone wrote: post #7

Earlier quoted context omitted.

I have a “lifetime pass”. I’ve noticed some of these “features” creeping into the ecosystem (bloat), but I haven’t actually seen any stripped functionality. For the most part, it works as advertised. That being said, a lot of my mates are moving to Jellyfin. Nothing but good things from them.

> but I haven’t actually seen any stripped functionality Plugins, the watch later list, the up next/playback queue, Plex Cloud/Cloud Sync, photo backup (this one hurt), privacy preferences were badly nerfed. Those are just the ones I miss, I'm sure there are more (like the short lived arcade thing).

Watch Together is also being removed

Re: Plex Security Incident

#54

Post by aeonik »

Someone1234 wrote: post #9

> Any account passwords that may have been accessed were securely hashed, in accordance with best practices, meaning they cannot be read by a third party. I am glad they were hashed, but that's a misleading statement. The point of hashing is to slow an attacker down, even with full best security practices (e.g. salt + pepper + argon2 w/high factors) they can still be reverse engineered. It is a matter of when , not i…

This is misleading, if the password is a certain length, then it might as well be considered secure. You could safely release hashes.

I'll pay you $10k if you can crack this sha512 hash.

I'd offer a million, but I don't have that kind of money.

5a55b7b0e1f9452f925b1aa43cf148081da58c66c735961d9a7cb699b2fd5b08bee6b24ec47fce0b93ba49df83641a30c7843dece49e0a0db5a7c50901492fdd

It's technically true that all cryptography is just slowing things down, but we are talking about heat death of the universe lengths of time for most crypto algorithms.

*assuming quantum computing doesn't take off or a fundamental flaw isn't found in the crypto.

Re: Plex Security Incident

#55

Post by paulryanrogers »

draxter65 wrote: post #28

You have to be a fool to use Plex, not only you are pirating, but also relying on a 3rd party company to handle your authentication. They already got hacked multiple times, only a matter of time till there is some copyright law enforcement event too. If you really have to do it, use Emby or Jellyfin. At least those options are fully self hosted.

Plex has their own streaming-with-ads. And one can load it with whatever you want, including home movies or DVD backups.

Re: Plex Security Incident

#56

Post by Someone1234 »

mvdtnz wrote: post #20
Someone1234 wrote: post #9

> Any account passwords that may have been accessed were securely hashed, in accordance with best practices, meaning they cannot be read by a third party. I am glad they were hashed, but that's a misleading statement. The point of hashing is to slow an attacker down, even with full best security practices (e.g. salt + pepper + argon2 w/high factors) they can still be reverse engineered. It is a matter of when , not i…

For all practical purposes what you're saying is just wrong.

I've done so within the last year, successfully. Cost $7 for a single password in just compute and took about 17 hours (lowest, cheapest priority).

So please explain your reply further. Also recall their claim for context of what I was replying to, and what you're here defending now.

If their claim is credible what I did and what you're reiterating wasn't possible.

Re: Plex Security Incident

#57

Post by mvdtnz »

Someone1234 wrote: post #56
mvdtnz wrote: post #20

Earlier quoted context omitted.

For all practical purposes what you're saying is just wrong.

I've done so within the last year, successfully. Cost $7 for a single password in just compute and took about 17 hours (lowest, cheapest priority). So please explain your reply further. Also recall their claim for context of what I was replying to, and what you're here defending now. If their claim is credible what I did and what you're reiterating wasn't possible.

No you haven't, not for a reasonably strong password.

Re: Plex Security Incident

#58

Post by JamesSwift »

magicalhippo wrote: post #16
BowBun wrote: post #3

Not necessarily related, but I'll take the opportunity to share my dislike of this company. Like others, they built a loyal following around a set of features provided, no questions asked, to stream your content to your own devices. Over the last couple of years, Plex has continued to strip functionality, add paywalls, make deals with publishing companies, and take other actions that firmly put them in the 'enshittif…

I like Jellyfin, but I keep using Plex for two reasons. First is subtitle support is quite limited in comparison. It fails more often than it works for me. Second is the lack of skipping. This is with the Android TV client, haven't really tried the others.

Jellyfin clients are the weakest aspect imo. Sort of hit or miss, and the ios client is inferior to a 3rd party paid offering (infuse)

Re: Plex Security Incident

#59

Post by blactuary »

BowBun wrote: post #12
johnbellone wrote: post #7

Earlier quoted context omitted.

I have a “lifetime pass”. I’ve noticed some of these “features” creeping into the ecosystem (bloat), but I haven’t actually seen any stripped functionality. For the most part, it works as advertised. That being said, a lot of my mates are moving to Jellyfin. Nothing but good things from them.

For lifetime pass owners, I think you've dodged the features they've put paywalls up for. The big one is preventing free accounts from streaming to shared user libraries. So if you have your pass + 5 buddies sharing their plexes (and they don't have Plus), you cannot view their content I believe.

You first post said "built a loyal following around a set of features provided, no questions asked, to stream your content to your own devices" and now you're saying they removed the ability for people to share content with each other if they are not paying customers.

Re: Plex Security Incident

#60

Post by blactuary »

princevegeta89 wrote: post #44

I have been using Jellyfin for two years now. I am yet another happy user with no issues. I am happy that all my data is secure and there is nothing shady to happen. It was not surprising when Plex had a huge investment coming from VCs who might as well just be connected to the movie industry and Hollywood as a whole, when they committed the act of banning Hetzner and all of their data centers. They also had slowly b…

I have never had any of their streaming content pushed onto my homepage nor had my own media hidden in submenus. I don't see anything but my own media
Post reply on HN