Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Plex Security Incident

links.plex.tv

Post reply on HN
Print view View original

71–80 of 94 posts

Re: Plex Security Incident

#71

Post by onehair »

whiterook6 wrote: post #14

I am a faithful Plex lifetime user and have never had problems. That said, I shouldn't be blinded by convenience. I hear jellyfin is a good alternative. Can someone share - how easy is it to administer for clients outside of my network or possibly even outside my country? - how good is the app support? I transcode all of my media to AAC and h264 for compatibility -what about for streaming music? I really like Plex am…

> what do you like the most about jellyfin

I own the instance that's running on my own homeserver. It does what I want it to do. Stream my media for me, other directly in the same network, or transcodes when I'm away.

Re: Plex Security Incident

#72

Post by whiterook6 »

onehair wrote: post #71
whiterook6 wrote: post #14

I am a faithful Plex lifetime user and have never had problems. That said, I shouldn't be blinded by convenience. I hear jellyfin is a good alternative. Can someone share - how easy is it to administer for clients outside of my network or possibly even outside my country? - how good is the app support? I transcode all of my media to AAC and h264 for compatibility -what about for streaming music? I really like Plex am…

> what do you like the most about jellyfin I own the instance that's running on my own homeserver. It does what I want it to do. Stream my media for me, other directly in the same network, or transcodes when I'm away.

I don't understand. I run a Plex instance on my home server as well. Are you referring to jellyfin not needing a centralized Plex account? Or do most Plex users rely on a plex-provided server?

Re: Plex Security Incident

#74

Post by 0points »

whiterook6 wrote: post #14

I am a faithful Plex lifetime user and have never had problems. That said, I shouldn't be blinded by convenience. I hear jellyfin is a good alternative. Can someone share - how easy is it to administer for clients outside of my network or possibly even outside my country? - how good is the app support? I transcode all of my media to AAC and h264 for compatibility -what about for streaming music? I really like Plex am…

> what do you like the most about jellyfin

- Not selling off my watching history to third parties. This is a privacy disaster still about to blow up. Expect holders of large plex libraries with pirated content to be lined up in court in the near future.

- Decentralized.

- Not parasiting on FOSS such as ffmpeg. Plex famously took everything from ffmpeg and gave nothing back, while making lots of money in the process.

Re: Plex Security Incident

#75

Post by 0points »

aeonik wrote: post #54
Someone1234 wrote: post #9

> Any account passwords that may have been accessed were securely hashed, in accordance with best practices, meaning they cannot be read by a third party. I am glad they were hashed, but that's a misleading statement. The point of hashing is to slow an attacker down, even with full best security practices (e.g. salt + pepper + argon2 w/high factors) they can still be reverse engineered. It is a matter of when , not i…

This is misleading, if the password is a certain length, then it might as well be considered secure. You could safely release hashes. I'll pay you $10k if you can crack this sha512 hash. I'd offer a million, but I don't have that kind of money. 5a55b7b0e1f9452f925b1aa43cf148081da58c66c735961d9a7cb699b2fd5b08bee6b24ec47fce0b93ba49df83641a30c7843dece49e0a0db5a7c50901492fdd It's technically true that all cryptography is…

sha* is a horrible choice for storing passwords. It's intended use is for verifying data integrity.

You should be using the solutions readily available instead of trying to reinventing the wheel, or avoid this subject altogether if you can't be bothered to educate yourself as to why.

This has been a decades-long issue, and it blows my mind how people in IT still didn't get the memo.

Use argon2, scrypt or even bcrypt who all are designed for keeping passwords secure with regards to brute force cracking.

Re: Plex Security Incident

#76

Post by 0points »

Someone1234 wrote: post #56
mvdtnz wrote: post #20

Earlier quoted context omitted.

For all practical purposes what you're saying is just wrong.

I've done so within the last year, successfully. Cost $7 for a single password in just compute and took about 17 hours (lowest, cheapest priority). So please explain your reply further. Also recall their claim for context of what I was replying to, and what you're here defending now. If their claim is credible what I did and what you're reiterating wasn't possible.

You brute forced a random argon2 hashed password using cheap compute in 17 hours?

Granted the suggested defaults for argon2 is like ~0.1 second per verification on a rather beefy CPU, in 17h that's about 620 000 guesses.

Your cheap compute would likely perform worse.

That is beyond improbable. You are making it up.

Re: Plex Security Incident

#77

Post by 0points »

magicalhippo wrote: post #16
BowBun wrote: post #3

Not necessarily related, but I'll take the opportunity to share my dislike of this company. Like others, they built a loyal following around a set of features provided, no questions asked, to stream your content to your own devices. Over the last couple of years, Plex has continued to strip functionality, add paywalls, make deals with publishing companies, and take other actions that firmly put them in the 'enshittif…

I like Jellyfin, but I keep using Plex for two reasons. First is subtitle support is quite limited in comparison. It fails more often than it works for me. Second is the lack of skipping. This is with the Android TV client, haven't really tried the others.

> First is subtitle support is quite limited in comparison.

I always watch with subtitles, but haven't noticed worse support in jellyfin vs plex, really. Granted, I mostly use srt/ssa (text based subtitles).

> Second is the lack of skipping.

You just need to install the intro skipper plugin :)

https://github.com/intro-skipper/intro-skipper

Re: Plex Security Incident

#78

Post by 0points »

gchamonlive wrote: post #4
BowBun wrote: post #3

Not necessarily related, but I'll take the opportunity to share my dislike of this company. Like others, they built a loyal following around a set of features provided, no questions asked, to stream your content to your own devices. Over the last couple of years, Plex has continued to strip functionality, add paywalls, make deals with publishing companies, and take other actions that firmly put them in the 'enshittif…

Do I still need to mess with filenames in order to have jellyfin pick them up to create the library?

You need to sometimes suffix the folder/file name with {imdb-tt1234} to make it match the correct movie/show.

This is the same deal with Plex tho, although I found plex internal metadata engine to auto-match better than jellyfin currently does.

You can help here though. Just come to https://www.themoviedb.org/ and help us add metadata.

Re: Plex Security Incident

#79

Post by 0points »

blactuary wrote: post #60
princevegeta89 wrote: post #44

I have been using Jellyfin for two years now. I am yet another happy user with no issues. I am happy that all my data is secure and there is nothing shady to happen. It was not surprising when Plex had a huge investment coming from VCs who might as well just be connected to the movie industry and Hollywood as a whole, when they committed the act of banning Hetzner and all of their data centers. They also had slowly b…

I have never had any of their streaming content pushed onto my homepage nor had my own media hidden in submenus. I don't see anything but my own media

Then you must either:

a) be running an ancient plex version, before they rolled all of that crap out.

b) edited your home screen to remove all of those "plex offers".

Re: Plex Security Incident

#80

Post by magicalhippo »

0points wrote: post #77
magicalhippo wrote: post #16

Earlier quoted context omitted.

I like Jellyfin, but I keep using Plex for two reasons. First is subtitle support is quite limited in comparison. It fails more often than it works for me. Second is the lack of skipping. This is with the Android TV client, haven't really tried the others.

> First is subtitle support is quite limited in comparison. I always watch with subtitles, but haven't noticed worse support in jellyfin vs plex, really. Granted, I mostly use srt/ssa (text based subtitles). > Second is the lack of skipping. You just need to install the intro skipper plugin :) https://github.com/intro-skipper/intro-skipper

Hm, I too primarily have srt's. No idea why just says "failed to load" or somesuch and I haven't been arsed to figure out why when I can just hop over to Plex and watch.

That said, I've had a few HDR movies which Jellyfin handled a lot better, so it's a bit here and there.

As for skipping, I primarily skip backwards when I miss dialog (so much mumbling these days), or forward when it's a TV show which has segments I don't care too much about, like say some irrelevant love subplot.

Post reply on HN