Plex has overhauled its apps from the ground up to make them easier to navigate. The teams says it will be able to roll out new features faster as well.
I agree with you, however Jellyfin is not intrinsically more secure than any other piece of software. You have to be very careful how you go about deploying it if you open up external access, as you are dependent on the Jellyfin devs to fix vulnerabilities and they aren’t actually being paid to do this. If you’re paranoid about privacy, you should be paranoid about this too; the people sending subpoenas aren’t above port-scans on ISP subscribers, they did it back in the early days of torrents.
You get control and privacy, but you also get responsibility. It’s a trade-off, and one I’d certainly make if Jellyfin were more mature. That’s just me though, I’ve been hosting my own stuff for about a decade now and I can set up an isolated environment for Jellyfin to run within. Plex is a lot more newbie-friendly and I’d still recommend it for most folks unless they for sure know what they’re doing.
As an aside, these concerns are common to all FOSS software that don’t have deep-pocketed backers. Jellyfin is likely never getting those, unfortunately. I hope they can find some other way of sustaining themselves, they’ve not got much money for the scale of development needed and it’s all volunteer-driven today.
The way I do it with webservices is that I serve them all from virtual hosts. Scan my IP on port port 80? 301 moved permanently to same host port 443. 443? Welcome to nginx! Which webservice is actually served depends on the hostname being requested. The hostnames are just part of a wildcard subdomain with a matching wildcard certificate, so you can’t derive the hosts from the blank landing page’s cert. Though one option would be to disable https when no matching virtual host is found.
I know this isn’t protection against sophisticated attackers, but nobody uses my home services except me when I’m not home so the exposure is very limited.
Anyhow, with Plex you have a central provider who, if I’m not mistaken, knows a lot about how their customers use their product. The angle of attack is different.
I agree with you, however Jellyfin is not intrinsically more secure than any other piece of software. You have to be very careful how you go about deploying it if you open up external access, as you are dependent on the Jellyfin devs to fix vulnerabilities and they aren’t actually being paid to do this. If you’re paranoid about privacy, you should be paranoid about this too; the people sending subpoenas aren’t above port-scans on ISP subscribers, they did it back in the early days of torrents.
You get control and privacy, but you also get responsibility. It’s a trade-off, and one I’d certainly make if Jellyfin were more mature. That’s just me though, I’ve been hosting my own stuff for about a decade now and I can set up an isolated environment for Jellyfin to run within. Plex is a lot more newbie-friendly and I’d still recommend it for most folks unless they for sure know what they’re doing.
As an aside, these concerns are common to all FOSS software that don’t have deep-pocketed backers. Jellyfin is likely never getting those, unfortunately. I hope they can find some other way of sustaining themselves, they’ve not got much money for the scale of development needed and it’s all volunteer-driven today.
https://opencollective.com/jellyfin
I want them to keep going, and I’ve even donated to them. I still don’t think it’s at a place to replace Plex for most people yet though.
The way I do it with webservices is that I serve them all from virtual hosts. Scan my IP on port port 80? 301 moved permanently to same host port 443. 443? Welcome to nginx! Which webservice is actually served depends on the hostname being requested. The hostnames are just part of a wildcard subdomain with a matching wildcard certificate, so you can’t derive the hosts from the blank landing page’s cert. Though one option would be to disable https when no matching virtual host is found.
I know this isn’t protection against sophisticated attackers, but nobody uses my home services except me when I’m not home so the exposure is very limited.
Anyhow, with Plex you have a central provider who, if I’m not mistaken, knows a lot about how their customers use their product. The angle of attack is different.