Plex warns users to patch security vulnerabilities immediately

[u/lurker_bee]

https://www.bleepingcomputer.com/news/security/plex-warns-users-to-patch-security-vulnerabilities-immediately/

[u/ranhalt]

Anyone on auto update has had this for months.

[u/OkZookeepergame4757 → u/ranhalt]

Wouldnt plex know this already

[u/MaskedBandit77 → u/OkZookeepergame4757]

Yeah, but they still need to let everyone know, because there are a lot of people who are not on auto update. 

[u/ocassionallyaduck → u/ranhalt]

I'm pretty sure this is a new one, not the one from months ago

[u/drawkbox]

The LastPass hack (one of the many) was through a Plex client hole on a devops dev machine that had the vault master password.

[u/peppruss]

I’ve been really enjoying Jellyfin sandboxed after moving away from Plex. Made a vibecoded rasbpi touchscreen interface that scans, updates, reboots and is also available as a quick web page. As they say, “anything is possible at zombo com… welcome… to zombo com.”

[u/Leaulo → u/peppruss]

What does this have to do with the topic?

Also doesn’t Jellyfin have an automatic scan feature? And if you installed it on Docker pretty sure it auto updates

[u/heroism777 → u/peppruss]

Honestly if there’s anything with security vulnerabilities it’s Jellyfin. It’s not like there’s a team of paid professionals patching it. It’s it all open source.

[u/peppruss → u/heroism777]

This is the beauty of it though, if you bring any skill to the table at all it’s whatever you want.

[u/probablytom → u/peppruss]

There are practical limits to that though, right? Because even if what you want is jellyfin but reliably secure, you'd have to be an outrageously talented dev working full-time to patch it. Past a certain point it can't really be "whatever you want" in a realistic sense.

I'm sure jellyfin is fantastic and I agree that the adaptability of an open-source system is a colossal strength in so many regards... but a paid team of professionals working constantly have a much better chance of making something secure. Matching that by "bringing skill to the table" simply underestimates the work required.

[u/2044onRoute → u/probablytom]

I envy the faith you have in a capitalistic company and their team of 'paid professionals'.

[u/KnitYourOwnSpaceship → u/[deleted]]

Lifetime pass, and it does exactly what I need.