Plex has announced a massive price increase on the service’s Lifetime Plex Pass. On July 1, the lifetime subscription option will go from $249.99 to $749.99, an increase of 200%. The price hike will only apply to new subscribers, with no changes to monthly or annual subscription pricing.
Are you accessing your media from outside of your network?
I have heard that you need to set up a VPN for Jellyfin to securely use your media library remotely. Plex handles all of that for me so that I don’t need to deal with it.
I have a jellyfin server set up that you access like this:
https://my.servername/jellyfin
Username and password is all you need aside from that. Apps for most platforms or access in a web browser.
The sad reality is that Jellyfin’s authentication system is insecure, and there are “anyone can view your content without a valid login” exploits that are not going to be patched. The only way to stop someone would be to include a secondary username+password on your reverse proxy, to prevent attackers from even reaching your Jellyfin login page. Because if you can reach Jellyfin’s login page, you can exploit it without logging in. But that would break basically everything except for web browsers, because none of the various apps have support for more than Jellyfin’s authentication.
I mean, that’s not great, but it’s also not very concerning to me. Like the risk of someone doing that, and the potential harm resulting seems minimal to me.
The problem is that every single person uses the Trash Guide to set up their system. And the guide includes instructions on how to set up your file names.
You’re correct that in isolation the risk is minimal. But nearly every setup is using the trash guide’s suggested naming scheme, which makes guessing it dead simple.
I’m not familiar with the trash guide. I set mine up with swizzin community edition.
Edit: either way though, what is the real risk? Someone streams your media without your permission?
You do know that there are security issues with that, right? For example, if someone can guess your media files they can watch them https://github.com/jellyfin/jellyfin/issues/5415
Thanks for this. There is a lot of apologia in the FOSS community, and Jellyfin fans are some of the worst. I have 100% seen comments along the lines of “lol I’ve had my Jellyfin port forwarded for years and I’ve been fine” as if it’s a valid security audit. The unfortunate fact is that Jellyfin is not secure, and the devs have openly stated that they have no intention of ever fixing these vulnerabilities. Because fixing them would require completely divesting from the Emby fork that the entire project was originally built on.
Jellyfin should never be available externally. And that means anything incapable of running a VPN will be incapable of connecting.
Yup, but all that being said I still run Jellyfin and have no intention of switching to Plex. And while I would like to see them fix these issues, I understand (in part) why they won’t and I’m okay with my tail scale setup. Also the vast majority of issues are very minor, but the ability to watch any media without login is so major that I think it’s worth bringing up every time someone mentions exposing Jellyfin online.
Some of those aren’t great, but I don’t consider any of them critical in terms of risk. I understand that others may feel differently.
Agree, I don’t consider most of them a risk, but I do like to bring this to the attention of people who are exposing Jellyfin to the web so they can make an informed decision.
You should not expose a Jellyfin server to the open internet.
I do not, and don’t plan to. Probably wouldn’t be that hard to set up though as someone familiar with nginx.
I guess Plex uses their own VPN under the hood then to make it more convenient?
Yep, and it generally has fewer sharp corners. Like last time I checked, in order to set up quick sync, you have to manually check each codec you want to offload to hardware. And if you select one that isn’t supported by your hardware, you find out when you try to play that. So it means carefully cross-referencing with the Wikipedia page for your quick sync version. Plex just has an enable hardware transcoding check box and it figures it out for you.
There’s also some features like smart playlists that I remember needing to set up plugins for whereas Plex supports it out of the box.
Of course ther are other things where jellyfin comes out ahead, like surround to stereo down mixing - I could never get the center channel (dialog) to be at a good volume when down mixed to stereo on my TV, but it just works and produces the correct volume in jellyfin.
But ultimately I think what causes all my users to prefer Plex is that the official app is polished and consistent across all platforms. The official jellyfin one looks like a programmer put it together with bootstrap components, and my favorite alternatives (like findroid) are in active development (I do donate on a reoccurring basis though in hopes that it reaches a level of polish matching Plex)
I don’t think transcoding is that difficult if you’ve already set up your own server. Like, that’s only a thing the admin would have to figure out and it’s a quick lookup.
I do agree with the client UI issue tho, and would like to add that the lack of a per-user watchlist is a pretty baffling decision given that it’s been widely requested for years and years and it would make it enormously more comfortable.
Wait, Jellyfin doesn’t have per user watch lists? Forget making it externally available to other people, this is something I need within my own household. I haven’t installed Jellyfin yet, but I had not anticipated this feature being absent. How do you work around it?
It’s not, and I didn’t say it was hard. Just that it’s a sharp corner that jellyfin should fix if they want to make it as one click as Plex is. It’s another part of the setup where you have to pay attention and get every check box right or it’ll not work as intended. I found it annoying to have to look it up and I’ve been in software for 15 years. I don’t doubt that any newb would find it frustrating. I remember seeing that it was planned to have hardware transcoding codec support auto detected but IDK if that has happened yet.
It’s especially annoying because jellyfin doesn’t just copy the support matrix into their docs, and the one on Wikipedia is by processor generation codename, so you have to look up your processor and get the codename, then reference the Wikipedia table and go down each codec and not make a mistake. Even though it’s “not hard” I still go back to that section because I second guess that I checked everything right thinking that I’ve caused some issues with a mistake. It’s additional cognitive load that isn’t worth defending if you want jellyfin to be good.