I dropped it in favor of Jellyfin some time back, but this was a good excuse to go ahead and delete my family's accounts.
this post was submitted on 09 Sep 2025
238 points (99.6% liked)
Selfhosted
51348 readers
69 users here now
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
-
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
-
No spam posting.
-
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
-
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
-
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
-
No trolling.
Resources:
- selfh.st Newsletter and index of selfhosted software and apps
- awesome-selfhosted software
- awesome-sysadmin resources
- Self-Hosted Podcast from Jupiter Broadcasting
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
founded 2 years ago
MODERATORS
Glad I started out with Jellyfin
I mean, jellyfin is absolutely even.more of a security nightmare than Plex, with multiple unfixed CVEs IIRC (software, not website or forum)
I use jellyfin also, but I only trust it not exposed to the internet at all. That is one very big area of improvement for them.
That and subtitle syncing.
load more comments
(1 replies)
Went there to update my password but got reminded what a horrible experience Plex is these days, so deleted my account instead.
Wdym it's like a couple of clicks
They're probably just using some shit browser or something. I had no issues either.
Same lol, using jellyfin now instead
load more comments
(21 replies)
Should have been put in the OP because people are going to jump the gun:
While we quickly contained the incident, information that was accessed included emails, usernames, securely hashed passwords and authentication data.
Any account passwords that may have been accessed were securely hashed, in accordance with best practices, meaning they cannot be read by a third party.
Still, always good practice to change your password after this sort of leak. However unlikely it is that someone could access your account, it's never a bad idea.
If you use a unique password and have 2FA on there’s no real need, but yeah it can’t hurt.
load more comments
(2 replies)
Meanwhile I made a post asking if plex is bad now and most people on it said "no it's great I paid for my lifetime pass years ago and its been the best!" Yeah, we know the truth now.
Jellyfin all the way.
Plex followed best practices and made sure that in the event of a data breach your accounts were safe, and alerted us promptly to the breach and reassured us that nothing private/of value was compromised.
JellyFin knowingly leaves multiple API endpoints with zero authentication.
I know which one I prefer, and it’s not the one with gaping security holes marked as “won’t fix”.
People don't seem to understand that no-one can reasonably stop a breach today.
The question is whether the attackers got anything of value and how easy they got in.
This breach was, in fact, very preventable. Plex didn’t need to force users to authenticate with a central server to access their own self-hosted media in the first place.
That’s not how “preventable” works.
Seems unlikely that this happened. Most people on Lemmy despise Plex and forgive all the shortcomings of Jellyfin
load more comments
(10 replies)
Even is plex is "bad" now, it's still years ahead of jellyfin.
I'd love to switch. I would do it right now, but the problem is that Jellyfin's security isn't better if you open it up to the internet. For example, I'd have to set up a VPN for my remote users for proper security, and most of my users are in other states, not technically inclined, and watch on their TVs. I'd have to at least support a raspberry pi for them, or some sort of site to site VPN, and if it goes down, I'll be expected to fix it. On top of that, if I do a simple raspberry pi based VPN, it would be made even more complicated since they'd want it to work with their smart TVs.
Again, I really want to switch. But Jellyfin needs to fix their security issues before I can. I'm also happy with the way Plex is reporting this, it's above the standard "your data is lost" notifications.
Edit: here's a link to the related GitHub issue I've been following: https://github.com/jellyfin/jellyfin/issues/5415
And @Saik0Shinigami@lemmy.saik0.com has a great thread explaining more: https://lemmy.today/comment/18923504
load more comments
(23 replies)
Plex hasn't been getting better, but it still does what I need. I have a lifetime pass from years ago. If I was starting today I would be a lot less inclined to pay for Plex though. They keep adding things I don't want.
Plex has been getting better and better actually, but if you don’t want to pay for it then your experience will have gotten worse.
load more comments
(1 replies)
view more: next ›