Plex Security Incident

I'll fill in what I can -

>- how easy is it to administer for clients outside of my network or possibly even outside my country?

Jellyfin is just the software, not a hosted solution. I use a simple server/seedbox, with sane configs (good providers have automated this), which results in a secure public-facing admin console with a username/password. They have basic user management features to include other users in your server.

> - how good is the app support? I transcode all of my media to AAC and h264 for compatibility

Jellyfin has a broad ecosystem of apps on a bunch of platforms, each with their pros and cons. I recommend poking around. When figuring my setup out, I downloaded 3 or 4 different Android apps to pick the one I liked (support for multiple servers which isn't a given in all the apps)

> -what about for streaming music? I really like Plex amp IMO Plex has always been substandard here since they hoisted the music interface into the same one they use for everything else, so it's really lacking in filters/administration features I depend on. That said Jellyfin supports music and has the same simple feature set.

> - what do you like the most about jellyfin

It's free and untethered to a company's whims. It also does a lot less of the social/DVR stuff that I have no interest in.

>- what do you miss most about Plex?

Their app experience was a bit more premium, and their support for multiple servers is better than Jellyfin since they own the servers/hosting to do it. I also really used to enjoy the 'remote' functionality where I could skip episodes by clicking next on the Plex app in my phone. This hasn't worked for a few years for me despite heavy troubleshooting.

> how easy is it to administer for clients outside of my network or possibly even outside my country?

You can run Jellyfin in any docker container. If you want to run it on a NAS in your home office and put it on the internet through ngrok or tailscale, you totally can. But you can host it pretty much wherever.

> how good is the app support? I transcode all of my media to AAC and h264 for compatibility

The official clients are just ok. They'll support all the file types you'd expect, but they're fairly slow and not great at streaming 4K. I pay for a client (Infuse Pro) that addresses a lot of those pain points, but it's been relatively poor at auto-detecting tv show metadata, so I'm still in the market for an app I'm happy with. Ideally an open source one.

> - what about for streaming music?

Technically works, but whether it's a good experience depends on the client you're using.

> - what do you like the most about jellyfin

Easy to set up. Great plugins for finding subtitles/artwork/metadata. Open source with good docs. Works with lots of clients. Easy to create and share accounts, and has fun features like synced remote viewing parties.

- what do you miss most about Plex?

The ads. jk never used it.

Not sure about jellyfin, but I really dig Emby. Just as convenient as Plex. I can't even remember why I switched to Emby over Plex, but I never looked back.

I ran plex for years but gave up once they started tracking all activity.

Jellyfin is way to administer. Clients are rough and often crash. Influx is often the best choice for IOS but has its own... weird decisions on how to handle libraries.

The main thing I miss is being able to download transcoded media for mobile devices so I can watch on a plane.

- just like any web service, reverse proxy with SSL, it has internal user management

- there are a variety of apps to choose from on ios/android, smart TVs might be limited or nonexistent (LG has a good one though)

- consider a separate dedicated tool for music, like Navidrome

- it's open source, its developers respect me and my users and do not abuse their access to them using dark patterns to extract revenue

- features that they have removed anyway (plugins, photo sync, plex cloud)

Plex works on chromecast etc, not for jellyfin

I have no idea how Plex runs their servers, but I've worked at companies where new systems are rolled out for new users/accounts, but old users/accounts are left on the "legacy" system (usually with the plan to migrate once the new system has been deployed and there is bandwidth available to handle the complexity of migrating users between systems). In particular, if you have a long-running service where some very old accounts might have special billing/pricing logic that you want to continue honoring but is difficult to implement in the new system, such a setup might make sense to continue long-term for a small subset of accounts.

Alternatively, maybe they mean that the limited subset of data was specifically the "email" and "password_hash" columns of the database ;P

Could be technically true in that they didn’t access every last bit of “user data” like support chat logs or whatever stored elsewhere, but they have phrased it that way to make it seem like less of a big deal. Just a guess.

Sharding the data across DB's, separate credentials for each DB.

It's easy to imagine Plex has some db sharding going on at their scale, or that they host in multiple geographic regions for regional compliance, or on multiple cloud providers.

Rows 1-200,000 instead of 1-1,000,000 I would presume.

One of the aspects of MtGox's database leak that I found most fascinating to watch was the public effort to figure out users' passwords from the hashes. Checking common passwords, patterns, and people's public interests on Twitter was all shockingly effective.

Technically you may have to burn more entropy than exists in the visible universe, so its a possible if in the case of the right hash and luck.

This is misleading, if the password is a certain length, then it might as well be considered secure. You could safely release hashes.

I'll pay you $10k if you can crack this sha512 hash.

I'd offer a million, but I don't have that kind of money.

5a55b7b0e1f9452f925b1aa43cf148081da58c66c735961d9a7cb699b2fd5b08bee6b24ec47fce0b93ba49df83641a30c7843dece49e0a0db5a7c50901492fdd

It's technically true that all cryptography is just slowing things down, but we are talking about heat death of the universe lengths of time for most crypto algorithms.

*assuming quantum computing doesn't take off or a fundamental flaw isn't found in the crypto.

Maybe this is naive, but in a good crypto system, I would hope "when" is measured in millions or billions of years given current hardware capabilities.

> (e.g. salt + pepper + argon2 w/high factors) they can still be reverse engineered. It is a matter of when, not if

How much compute/gpu and hard dollars would hackers need in order to reverse engineers those stollen passwords?

For all practical purposes what you're saying is just wrong.

I have a “lifetime pass”. I’ve noticed some of these “features” creeping into the ecosystem (bloat), but I haven’t actually seen any stripped functionality. For the most part, it works as advertised.

That being said, a lot of my mates are moving to Jellyfin. Nothing but good things from them.

I like Jellyfin, but I keep using Plex for two reasons.

First is subtitle support is quite limited in comparison. It fails more often than it works for me.

Second is the lack of skipping.

This is with the Android TV client, haven't really tried the others.

Do I still need to mess with filenames in order to have jellyfin pick them up to create the library?

  <episodeguide>{"tmdb":"328","imdb":"tt0983200","tvdb":"82616","tvrage":"7565","wikidata":"Q6805564"}</episodeguide>
  <id>82616</id>
  <imdbid>tt0983200</imdbid>
  <tmdbid>328</tmdbid>
  <uniqueid default="false" type="tmdb">328</uniqueid>
  <uniqueid default="false" type="imdb">tt0983200</uniqueid>
  <uniqueid default="true" type="tvdb">82616</uniqueid>
  <uniqueid default="false" type="tvrage">7565</uniqueid>
  <uniqueid default="false" type="wikidata">Q6805564</uniqueid>
  <premiered>1989-05-08</premiered>

One thing I'll note is that while I've found every device surface I've come across has a Plex app, that isn't true of Jellyfin. YMMV.

They removed mobile device playback rights from users who paid for this feature specifically. Nobody in their right mind will do business with Plex.

I have never had any of their streaming content pushed onto my homepage nor had my own media hidden in submenus. I don't see anything but my own media

Plex has their own streaming-with-ads. And one can load it with whatever you want, including home movies or DVD backups.