Hacker News Reader

Hacker News

Comment by foobarian | Hacker News Reader

Full thread

foobarian

> internet-facing Plex servers

This is terrifying. Who runs things like this open to the outside?

View on HN

> This is terrifying. Who runs things like this open to the outside?

Probably the majority of people with a Plex Pass subscription and most Plex users in general.

As far as I see it, Plex's primary purpose is to allow people who have extensive collections of legally obtained digital media to conveniently access it and share access to their friends and family on pretty much any random device from anywhere in the world.

All my home media devices run Kodi, they run Jellyfin, they run all sorts of fully open stuff, but when I travel Plex wins because it runs on basically anything that can stream video and I can sign in to it in seconds without needing to connect a VPN or enter my password on someone else's device.

Plex in particular is notoriously insecure. It should never be accessible to the open internet unless via a vpn like WireGuard. Just playing with fire otherwise.

Any citation for that or is that notoriety something that grew in your head?

Plex Media Server has had a relatively small but consequential CVE history. There are some isolated high-severity issues from 2018–2020, a pretty bad CVE in 2025, then these latest 2026 vulnerabilities.

That may be true, but how do you grant non-technical family/friends access? They don't even understand what a VPN is, let alone how to toggle one on/off to access the Jellyfin instance.

Additionally, if they try to connect from an Android TV / Fire Stick, where you can't configure a VPN (and use their ISP's modem, so no wireguard client on the router to transparently route to the subnet), what are you supposed to do?

I feel it may be easier long-term to just contain the Jellyfin daemon to only r/o access to media, putting it behind a subdomain like jellyfin.example.com, and use the dns-01 challenge via LE to only provision a wildcard cert for the domain (IE *.example.com).

Then, have nginx listen on 80/443 with a default server directive that returns 444 for any requests not to the (correct) jellyfin hostname (due to bots hammering 80/443 across the internet on webserver's direct IPs).

Its the only solution I can think of to make it easy for nontechnical users (everything just described is completely invisible to a regular client) while reducing the attack surface area of the daemon.

FWIW, with the aforementioned setup, I got 0 unauthorized requests to my jellyfin server. Just a bunch of bots hammering my IP's 80/443 ports directly with exploits for old (usually wordpress) vulns, but they were all served 444 (IE an immediate TCP connection close without nginx even responding to the request).

Tailscale is easy to explain.

"Install this app on your Apple TV or Android TV, login with your Gmail, and let me know your email address."

Yes I’ve successfully explained Tailscale to anyone that has had a corporate job and has experience having to log into a work computer VPN before accessing their work intranet

or has heard of anyone who has had one.

At least for me the issue is that most TVs don't have a tailscale app. I resolved this for my mother in law by setting up a permanent VPN to my house but that doesn't scale to all my friends.

https://news.ycombinator.com/item?id=47976708

I was on this same line of thinking a few months ago when I made the mistake of switching to T-Mobile Home Internet and discovered I'd been CGNAT'd

Every time I want to share with someone I have to stop and debate if I want to possibly have to drive over to their house etc.

So here's my attempt at solving the problem: https://pixelbrite.site/en/profiles

Can’t you use ipv6?

yes. But can my users? maybe.

My intention is to make it work with as little friction as possible

This is pretty cool! Your other stuff seems cool too (esp pixel prism). Are you planning to build a business around this?

I use a raspberry pi and nginx to forward my jellyfin over Tailscale. This works really well, Tailscale is low touch and nginx is battletested. Jellyfin appears as a local service to other devices and I manage the raspberry pi with NixOS which makes the setup easy and deployable. Just plug in the pre imaged raspberry pi.

If the alternative is dangerous exposure on the public internet, I'll choose either setting it up for them or just not sharing with them at all. Honestly I think all this widespread "family" sharing with 200 of your closest friends stuff is going to lead to another industry crackdown. I think it might be better for this stuff to stay a little geeky.

Almost all selfhosted services are in that bucket now. Everything from Plex, Jellyfin, to nextcloud or gitea/forgejo. Few months ago I went through all my setup and moved everything to a vpn. The only service I kept public is a static directory served by nginx where I keep some html food recipes I shared with a friend before.

It's less convenient to use and pretty much impossible to share with others. I can figure out a VPN on all my devices for the most part (except for a Boox ereader). Trying to get "family and friends" to install and maintain a VPN on their devices to be able to access services I share with them is a pipe dream.

Gitea got hit with a similar issue about a month back.

I feel generally okay about putting some services behind Authelia for family and friends.

Did you miss the point about working on random devices? That's the key to why I use Plex at all. If I have to install and set up a VPN client on it I'd just use Jellyfin because at that point I've limited myself to only my devices.

Also of course friends/family. The most technologically useless people I know can operate Plex and can access my collection with basically no support necessary.

I don't think any more than 5% of Plex users are using it for legally-obtained content.

You have no way of knowing and also how much content is legal or not

My plex library has my entire library that I’ve been curating since iTunes was released which is now predominantly FLAC files I buy from Bleep and Bandcamp

Every movie I have ever bought is there too. I suppose technically it’s all illegal right? I copied it. In some cases I even bypassed some things the DMCA outlawed to do so.

And so what?

It’s such a quaint sentiment in 2026 to care about illegal content when the entirety of the LLM industry did this, but far worse, at scale, and nobody has even charged Meta or anyone else with infringement.

Plex and their users is not the problem

> It’s such a quaint sentiment in 2026 to care about illegal content when the entirety of the LLM industry did this, but far worse, at scale, and nobody has even charged Meta or anyone else with infringement.

Two wrongs don't make a right. I try to obtain my content legitimately because all I can control in this world is whether I act right, not whether other people do.

Legal != moral

When laws are only enforced against an underclass, they are inherently immoral

What an unnecessary rant. I know the legality of my own Plex collection, which is zero.

Cool. The parent claim was that 5% of users were doing something. A claim which has no basis in evidence.

I am the parent claim mate, and I said "I think" not "I provably know for sure". Either way, I see no cause for your little rant.

I think 5% would be optimistic. One of the original 'Arr' apps was created by a Plex employee.

To be fair, this is Plex's intended use case. It is not a bizarre or unsupported config to expose Plex to the internet. It is designed to be on the network so that many different invited users can all log in and access your media. This model doesn't work if they all need to be on a tailnet or similar. Maybe Plex is less secure than nginx serving a web page, but its just a matter of a trust threshold.

If it were just me using Plex then it would be different, but I can't realistically expect all my friends and family to get on a tailnet, and so I take the risk with an up-to-date Plex on the internet.

Plex and Tailscale are notoriously tricky to get working together. Just any search of those two words returns pages of forum help topics

Many people, as your TV and sometimes friends have to connect to it and you don't want to explain Tailscale to them.

I do. I like to stream music from my server onto my phone when I'm out and about. And it's authenticated, so there's nothing terrifying about exposing it (security vulnerabilities aside, but that can happen to any software you expose).

If it's only your own clients connecting to it, have you looked into Tailscale? Even as a selfhost-all-the-things type of guy, I've been convinced. This is exactly why I started experimenting with it too, due to Android now allowing multiple VPNs at the same time. It replaced my previous setup of hosting parts of my homelab technically exposed to the internet, which were only used by my phone since it already had an always-active mullvad.

I tried it once but had some issues where it was hard to get the Tailscale DNS to play nicely with my container setup. It's been a couple of years so I may be misremembering, but I want to say the issue was that it only would resolve names to the IP of the host, not the containers themselves. That could've changed by now, of course.

Er? Android supports multiple VPNs at the same time on the same user profile? Since when exactly?

Whoops, unfortunate typo, meant to type "not". My issue was I already used the Mullvad VPN client, so I couldn't double-up with a personal wireguard VPN client for my homelab. Tailscale "solves" this by supporting mullvad exit nodes natively in the service via a direct partnership, so you can have "one" VPN with multiple nodes accessible.

Plex themselves literally recommend it and show a warning icon if it’s not accessible outside your local network. I always thought it was insane. To make matters worse their Synology package doesn’t auto update itself. I would guess there are a ton of vulnerable boxes sitting out there.

If you’re exposing anything on Synology to the Internet, you’re already playing with fire. Their packages (like Container Manager) are usually very far behind on security patches.

I think the current version of Docker engine Synology uses was end-of-life 2.5 years ago.

Synology NAS - an ugly doorstop with data loss resulting from its half-baked post-purchase attempts to enforce hardware vendor lock-in. (Was working fine w/ a Western Digital drive, the next day, boom.)

I’ve had a synology NAS that’s been running for 8 years. No data loss. I use random drives I had laying around. It’s not the fastest or fanciest, but I never had any experience with lock in. It’s got a 3rd party 10g card, more memory … nothing locked in.

good for you, I hope it lasts another decade+

just sharing my lived experience

Yeah, please avoid Synology, really. If you have it or need it DONT expose it to the internet.

It just has to pass through one port, right? Is that the kind of thing that's likely to be vulnerable on an outdated server?

What get me the most, are the rabid Plex fanbois swearing that having jellyfin open on the internet is such a baaaad idea and you should spend ~50~ ~100~ 500 bucks for a sub to Plex which totally don't expose the same risk

I wouldn't go that far. It's just Jellyfin is ugly as shit.

When was the last time you tried it? I used to agree, but at least as of last year, it must've undergone a UI overhaul as now it looks quite nice imo.

You largely have to for Plex themselves to middleman access to your media collection.

I'll fully admit I do.

The point of Plex is sharing your library with less ... technical users.

If I didn't want to do that, I'd not even use Jellyfin- SMB share and mpv would be fine with me.

> This is terrifying. Who runs things like this open to the outside?

A budy of mine has got 30 000 movies and series. Better offer than Netflix (what, easily 4x more choice!?). He's got a 42U rack. He gives free access to his server to his friends and family: it's not a business (so what he risks is also very limited in the country he lives in, for he's not making a business out of it).

It's not because you and I don't run Plex servers accessible from the big bad Internet that others don't enjoy doing it.

Now concerning this miner: I've posted about it in the past here on HN but I only run Jellyfin on my LAN and it's only with throwaway containers: I've got a script that sets up movies/series named/organized the way Jellyfin likes it, then that volume is passed read-only to a transient podman container.

When we're done watching the movie, the podman container is deleted. It's over: it doesn't exists anymore.

All that I care about are data: like family pictures and movies (and, say, other movies).

My Jellyfin server is just a temporary "view" on my actual data.

I don't trust it and don't need to trust it: for it's only future after I'm done watching the movie is to be destroyed.

I'm finding the idea of spawning then killing Jellyfin over and over again like Groundhog Day really funny

Neat! So when you're on your tv stick or whatever, before deciding that you want to watch any movie in particular (so before the ephemeral jellyfin container is running), how does the movie selection process work?

And how did you set up the trigger to automatically spin up the ephemeral jellyfin container when a movie is selected?

Thanks!

Me. Or I did back when I used it. Now I’m on Jellyfin but the point is the same.

I share my Plex/Jellyfin with a couple dozen friends and family members, all of varying levels of technical knowledge. “Install an app called Jellyfin on your smart TV” is complicated enough for most people. “Also search for another app called Tailscale and now log in with my credentials, yes it’s going to ask for control over your device’s network acces, don’t worry, it’s fine!” So now it’s just a public URL served up with Caddy.

Nothing bad has happened yet, there’s not much valuable on this machine other than CPU cycles and movies I definitely obtained legally, and I would notice right away if a cryptominer jacked up the CPU to 100%.

Essentially every technical person I know.

Feeling very validated that I went with Iroh @ https://pixelbrite.site

This is my first time hearing about Pixel Brite, what's the history behind it?

It's my love letter to owning multimedia. I'm focused on minimizing friction; all comms go over Iroh, and it even works in the browser via webrtc (as of yesterday). No network expertise required.

History- I started it last year the night before my birthday so I guess it's kinda like a midlife crisis. I've been working on it relentlessly since and kind of want a real job at this point just so I can take PTO.

testflite@pixelbrite.site if interested

Do you intend this to be a freemium alternative akin to Plex, or plan to open source it and more of an alternative to Jellyfin?

My goal is: if you want the best free player, you'll pick pixel brite. if you want the best paid player, you'll pick pixel brite.

There's going to be a very generous free tier and everyone's getting Pixel Brite+ for the foreseeable future.

Free includes all the table stakes features; hardware acceleration, remote access, adaptive bitrates, gapless, lossless, etc.

I may limit superfluous things like the metadata fidelity, make you watch one of those old timey before-the-movie reels "Let's all goto the lobby and get ourselves some snacks!", disable niceties like automatically playing similar music when the queue ends (like Spotify), themes... things like that.

What are your thoughts? Is there anything in particular you're looking out for?

For me personally it's open source I was looking for. But I totally understand if it's not aligned with the business value.

It helps me guard against things like "Hey, this company decided to remove this feature that I use a lot (cough cough, watch together on Plex), or put something behind a paid wall where it was previously free".

With open source, I can at least fork/pin it from some version and merge things from upstream that I want, which is the reason why I was looking at Jellyfin.

I do run it open to the outside through cloudflare tunnels. I don't want to connect my TVs to tailscale every time to play a movie.

Didn’t cloudflare’s TOS prohibit streaming media ? At least last time I checked 2-3 years ago.

It's a remote media streaming tool as much as a local one.

I run jellyfin on the open internet through caddy. I've done a few things to the configuration to secure it, like user-agent restrictions and fail2ban for login failures, and excessive 400 series errors. I keep it up to date.

Why wouldn't they?

The chief complaint is really an indictment of every piece of shit modern web app backend.

That's half the utility of it. Friends and family use it, I use it when traveling.

Reply on news.ycombinator.com