Plex’s crackdown on free remote streaming access starts this week
Plex’s crackdown on free remote streaming access starts this week
Roku users will be hit first.Scharon Harding (Ars Technica)
like this
⇧
Roku users will be hit first.Scharon Harding (Ars Technica)
like this
RandomLegend [He/Him]
in reply to along_the_road • • •like this
SuiXi3D, Chozo, Quantumantics, ammorok, yessikg and Rascal7748 like this.
CerebralHawks
in reply to RandomLegend [He/Him] • • •This is for remote streaming. Can Jellyfin be accessed outside the network? I thought that was the difference.
Like if I didn't like Plex and I ran Jellyfin (and I have done), I could access it locally but I couldn't access it, say, from a hotel a thousand miles away. Or it requires a lot more work (and maybe some paid service) to do.
Plex may have gone up, but a bunch of us got it for $100 or less years ago and we are not affected by the new limitations. Still free for our family members accessing remotely. Wasn't free for us to set up.
MisshapenDeviate
in reply to CerebralHawks • • •like this
TVA and ammorok like this.
Onomatopoeia
in reply to MisshapenDeviate • • •Doing it safely is pretty simple.
Install Tailscale at both ends. Done.
It's a fully encrypted mesh VPN.
If you need access without the TS client on the other end, that takes a little more work. Then you need to enable the Funnel option.
like this
yessikg likes this.
artyom
in reply to Onomatopoeia • • •Nnnnno, doesn't really work that way
CerebralHawks
in reply to MisshapenDeviate • • •Is a domain name strictly necessary though? You would need a static IP. I thought you needed something like a VPS or VPN — I know what a VPN is, but I think it was something with a similar acronym — and that was a service that cost money.
With Plex it just works. When I load up Plex on a remote machine, first it tells me my server is offline, because my server is a Mac and Macs are sleepy bois, so it wakes up the Mac, which wakes up the drives, and then the server loads up and I can play pretty much anything.
I've ran Jellyfin on both Mac (current setup) and Windows/Intel. I like Jellyfin overall, and it does some cool things Plex doesn't. Like you can fix details Plex won't let you. Like for some reason it only lists the foreign actors in anime, you can manually specify the English voices if you want. Plex doesn't let you do that and AFAIK there's no way to. (There should be an API out there that taps into a service that lets you access any language cast, and there should be a way to set it to dynamically change the cast to whatever language you h
... Show more...Is a domain name strictly necessary though? You would need a static IP. I thought you needed something like a VPS or VPN — I know what a VPN is, but I think it was something with a similar acronym — and that was a service that cost money.
With Plex it just works. When I load up Plex on a remote machine, first it tells me my server is offline, because my server is a Mac and Macs are sleepy bois, so it wakes up the Mac, which wakes up the drives, and then the server loads up and I can play pretty much anything.
I've ran Jellyfin on both Mac (current setup) and Windows/Intel. I like Jellyfin overall, and it does some cool things Plex doesn't. Like you can fix details Plex won't let you. Like for some reason it only lists the foreign actors in anime, you can manually specify the English voices if you want. Plex doesn't let you do that and AFAIK there's no way to. (There should be an API out there that taps into a service that lets you access any language cast, and there should be a way to set it to dynamically change the cast to whatever language you have selected.) But anyway, Jellyfin is somewhat fine, but to use it on other devices (e.g. an Apple TV box on the same network), you have to do a fair bit of configuring. It's not just, log into the account on your phone and type in the text on the screen. Jellyfin doesn't even prioritise Apple development, but they have come a long way.
MisshapenDeviate
in reply to CerebralHawks • • •Honestly the others in this comment section would be better to ask about accessing Jellyfin remotely, but I can tell you what I know.
If you go the VPN route, Tailscale is typically recommended, which appears to be free for personal use. It looks like these are the docs for using Tailscale with Jellyfin.
I host a couple services for my family using a reverse proxy (nginx through SWAG), and I have a free domain name with duckdns. This is not as secure as the above tailscale solution, but has worked for me so far. This is likely how I would add Jellyfin to my workflow, since I already have a reverse proxy and domain name.
Tailscale | Jellyfin
jellyfin.orgalk
in reply to CerebralHawks • • •nimble
in reply to CerebralHawks • • •Jellyfin* can be accessed outside of your network but it would be best to have set up a vpn so that it isn't open to anyone to try logging in
jellyfin.org/docs/general/post…
Edit: oops, meant jellyfin not plex lol.
Networking | Jellyfin
jellyfin.orgGraveyardOrbit
in reply to nimble • • •superglue
in reply to GraveyardOrbit • • •nimble
in reply to GraveyardOrbit • • •Vpn was my recommendation. You can leave it open to anyone, or put it behind a separate auth page. Or whatever you want.
My jellyfin is local only. If i wanted to give you access to it, i could flip a switch right now. That's what the many reverse proxy options detailed in the link i gave discuss
coyotino [he/him]
in reply to GraveyardOrbit • • •It can be, speaking from extensive personal experience. I followed their Reverse Proxy guides, now my tech-illiterate friends access my server over https via a duckdns url.
GraveyardOrbit
in reply to coyotino [he/him] • • •coyotino [he/him]
in reply to GraveyardOrbit • • •Maybe not for the server administrator, but for users, it's mega easy. Download Jellyfin app on TV. Enter URL for server. Login like a normal streaming service. Done. As far as I know, Plex requires these same steps, so if Plex works for your 89 year old grandparents, Jellyfin would as well.
In what way is the API insecure? What types of attacks are you concerned about?
GraveyardOrbit
in reply to coyotino [he/him] • • •Here is the primary writeup of the issues. My main problem is the way jellyfin staff handled this critique by downplaying and refusing to fix it
github.com/jellyfin/jellyfin/i…
Collection of potential security issues in Jellyfin
GermanCoding (GitHub)coyotino [he/him]
in reply to GraveyardOrbit • • •I posted this below in reply to a similar comment. If you don't like the way the devs have handled the raising of concerns, then fine, that's kind of a judgment call and I can't tell you what you should feel comfortable with. In my limited experience with the Jellyfin devs (including reading through the responses on that thread you linked), I do not personally get the impression that they are downplaying or refusing to correct issues. To me, it seems more like they are prioritizing some issues over others, and the outstanding security issues seem pretty minor for most use cases.
I posted this below in reply to a similar comment. If you don't like the way the devs have handled the raising of concerns, then fine, that's kind of a judgment call and I can't tell you what you should feel comfortable with. In my limited experience with the Jellyfin devs (including reading through the responses on that thread you linked), I do not personally get the impression that they are downplaying or refusing to correct issues. To me, it seems more like they are prioritizing some issues over others, and the outstanding security issues seem pretty minor for most use cases.
coyotino [he/him]
2025-11-26 19:20:59
octobob
in reply to coyotino [he/him] • • •Damage
in reply to octobob • • •Otherwise, Jellyfin has apps for TV, smartphones and so on; you input address, user and password the first time and that's it.
octobob
in reply to Damage • • •AbeilleVegane
in reply to octobob • • •RandomLegend [He/Him]
in reply to CerebralHawks • • •I also bought Plex years ago for 87€ but i gifted that account to a friend once i got jellyfin up and running.
You're right - Jellfyin doesn't have a native built-in way to access it from outside. That's the reason Plex intercepts with their own servers when you do remote streaming, that's one of the aspects you pay for.
Using tailscale (free and setup in like 5 min) you can access jellfin from everywhere. Easy peasy.
Rumor says that Plex also denies you remote access when you use a VPN or mesh like tailscale.... so ymmv
remon
in reply to RandomLegend [He/Him] • • •Never had any issues remote streaming via VPN.
like this
TVA likes this.
CodingCarpenter
in reply to RandomLegend [He/Him] • • •fascicle
in reply to CerebralHawks • • •I ran jellyfin for a little while back when Plex used to charge people a fee for using mobile
Barbecue Cowboy
in reply to fascicle • • •octobob
in reply to fascicle • • •PabloSexcrowbar
in reply to CerebralHawks • • •artyom
in reply to CerebralHawks • • •Yes. Jellyfin is just a Docker container. It can be accessed the same as any other Docker container. Plex simplifies this because they can basically configure all the DNS stuff for you, because it goes through their DNS. But either can be accessed.
More specialized knowledge to configure Tailscale or a reverse proxy, yes. I use Yunohost which makes all of this a whole lot simpler.
smiletolerantly
in reply to artyom • • •like this
fif-t likes this.
artyom
in reply to smiletolerantly • • •T (they/she)
in reply to CerebralHawks • • •like this
yessikg likes this.
Appoxo
in reply to RandomLegend [He/Him] • • •MaggiWuerze
in reply to RandomLegend [He/Him] • • •coyotino [he/him]
in reply to MaggiWuerze • • •MaggiWuerze
in reply to coyotino [he/him] • • •coyotino [he/him]
in reply to MaggiWuerze • • •MaggiWuerze
in reply to coyotino [he/him] • • •Collection of potential security issues in Jellyfin
GermanCoding (GitHub)coyotino [he/him]
in reply to MaggiWuerze • • •So, I am not going to deny that those security issues exist, but it seems like they would only pop-up in niche situations, or only if someone already had access to your admin profile. Most people are using Jellyfin to share their media with themselves and their tech-illiterate friends in family. In that use case, the only people who even know my server URL are people I have shared that info with privately. Nobody is trying to hack my admin account.
Now, I am no infosec expert. Maybe there are folks that are trying to run larger operations, and for those people I can understand why these security issues may become concerning if you don't have a tight handle on the circle of people that have access to your server. That said, it's also a bit silly to expect a free, open source solution to meet your needs in that scenario, anyway. If you know and understand the issues that well, then maybe go join the dev team and patch the holes. That is the beauty of open source, anyone can jump in and fix it.
MaggiWuerze
in reply to coyotino [he/him] • • •The main issue there isn't the fact that these issues exist. The problem is the Jellyfin devs attitude towards them, most of these problems have been known for years (more than five in some cases) but are largely ignored. Client compatibility is valued over everything else.
There have been plenty of suggestions, ideas and even PRs, but the devs priorities don't allow for any security centered patches to get merged
coyotino [he/him]
in reply to MaggiWuerze • • •idk the full history, but Joshua's comment here does not give me the impression of devs that are just deliberately ignoring security issues. It seems like they are simply balancing priorities, which is what all good devs should do. Personally I like that client compatibility is valued over everything else - I would be pissed if they broke the Fire TV client to fix a minor security hole on a niche Linux distro, because then one of my users would be SOL. And as Joshua says in that comment:
So it seems like now they are better set up to address the security issues without breaking compatibility.
Collection of potential security issues in Jellyfin
GermanCoding (GitHub)MaggiWuerze
in reply to coyotino [he/him] • • •rose56
in reply to RandomLegend [He/Him] • • •RandomLegend [He/Him]
in reply to rose56 • • •i also would be on Tizen OS, got myself a cheap used NVidia Shield TV and use this now. debloated it etc.
Magnitudes of order better experience than fucking Tizen
HulkSmashBurgers
in reply to along_the_road • • •like this
SuiXi3D and yessikg like this.
fonix232
in reply to along_the_road • • •Okay, let's clarify something.
Plex has been essentially "giving away" a service for the better part of what, 20 years?
And that service is the remote proxying of your server and its access. Basically, you didn't need to open a port, expose your server to the public, Plex provided a proxy through which you could stream to your heart's content, knowing that your server is both accessible and (more or less, more than if you managed it yourself in most cases) secure.
Now obviously, they are a company and thus need to make revenue to continue developing the server, clients, and maintaining the infrastructure. Mind you, Plex has 25 million active monthly users... Even if just 10% of that is active at any given moment, streaming at 10Mbps... that's 25 MILLION megabits per sec. 25 thousand gigabits. 25 terabits. PER. SECOND. Being proxied through infra Plex has to pay for. Your average proxy/CDN dataserver unit can do usually around 100 gigabit, meaning Plex needs 250 of those. Just to serve 10% of the userbase.
And don't forget that, unlike "traditional
... Show more...Okay, let's clarify something.
Plex has been essentially "giving away" a service for the better part of what, 20 years?
And that service is the remote proxying of your server and its access. Basically, you didn't need to open a port, expose your server to the public, Plex provided a proxy through which you could stream to your heart's content, knowing that your server is both accessible and (more or less, more than if you managed it yourself in most cases) secure.
Now obviously, they are a company and thus need to make revenue to continue developing the server, clients, and maintaining the infrastructure. Mind you, Plex has 25 million active monthly users... Even if just 10% of that is active at any given moment, streaming at 10Mbps... that's 25 MILLION megabits per sec. 25 thousand gigabits. 25 terabits. PER. SECOND. Being proxied through infra Plex has to pay for. Your average proxy/CDN dataserver unit can do usually around 100 gigabit, meaning Plex needs 250 of those. Just to serve 10% of the userbase.
And don't forget that, unlike "traditional streaming platforms" where CDNs can greatly amplify bandwidth (due to repeating same content to thousands/millions of people), Plex can't easily utilise this infrastructure approach, AND they have to constantly stream INTO the proxy as well as outwards (a CDN pulls in the source file once and then distributes it, Plex literally needs to pull the data stream on-demand, without storing it).
I don't like these restrictions they're putting in, "enshittifying" the service - e.g. if I have my server forwarded properly and don't need to go through their proxy, I should be given a free pass (albeit I already have that since I bought lifetime Plex Pass), but I do get how it would be annoying for the average user to not realise why they're asked to pay when their friend isn't.
remon
in reply to fonix232 • • •Streaming traffic doesn't usually go through Plex's server, though. That only happens with "indirect streams", which usually means something is wrong with your connection and they are capped at like 2 mbps.
fonix232
in reply to remon • • •Streaming traffic has to go through the Plex proxies if your server isn't exposed to the internet (meaning proper port forwarding, no CG-NAT and no other ISP fuckery that would prevent such functionality).
Of the 25 million users of Plex, how many do you think have the setup (either the ability or availability) that supports direct playback remotely?
Ideally yes, only basic things like authentication and server mapping should go through the main Plex servers but sadly this isn't the case. And Plex has provided that service for years, for free. Them asking money for a service that isn't free to run, is fair game.
What isn't fair is how they've been doing it.
remon
in reply to fonix232 • • •I think of those that run their own server and use remote streaming at all, the vast majority. All it takes is to forward one port in the router.
Of the 8 plex servers I have access to, all have direct streaming. And mine as well, of course.
ITGuyLevi
in reply to remon • • •Yeah, been a lifetime Plex pass holder for a long time, it was fun but it still doesn't support OAuth and now they are forcing ads before local TV streams now. I realize the latter is probably more on the Roku side of the house as my shield hasn't started doing that yet.
Really live TV is the last thing holding me onto Plex, well that and I really do love Plexamp and the sonic analysis bit Plex can do. Plex's days are sadly numbered for this selfhoster.
remon
in reply to ITGuyLevi • • •What do you need OAuth for? Also I never really used the live TV thing, I pretty much exclusively stream from my or other people's libraries.
As long as they don't mess with the lifetime pass and start charging me or my friends for accessing my library, I really have no quarrels with Plex.
fonix232
in reply to remon • • •Centralised Auth stack for all your services.
I for example just put together a neat pocketID+Crowdsec+Caddy stack, and via OAuth I can easily manage everything. Every service that integrates with OAuth makes it super simple to create new users automatically with limited scopes, all directly fed by PocketID, allowing me to expose my services to the open web without fear of being hacked (crodsec being the fallback if shit would hit the fan, blocking all the community-sourced known threat actors and suspicious behaviour like port probing, login stuffing, etc.).
ITGuyLevi
in reply to remon • • •fonix232
in reply to remon • • •Given the prevalence of one click install NASes (and by that I mean that Plex is a one click install, or even the whole *arr stack), I wouldn't be sure.
Also that doesn't account for people who are limited by available ISPs - some of us only have the choice of a single ISP, who might not be offering static IP, and CG-NAT makes port forwarding impossible. IPv6 would fix that but given we're not much better off than we were ten years ago... I don't have high hopes.
bamboo
in reply to fonix232 • • •They are requiring Plex Pass for all remote sessions, even ones which don't go through plex servers, where your client connects to your remote plex server directly. IMO, this should not require Plex Pass if the remote stream is not going through Plex's server.
Also since the April 2025 update where they required the payment, the "new experience" apps have been terrible, and people have been side loading the old apps because they retain core functionality. Maybe there was a technical reason to release new apps to enforce the Plex Pass requirements, but it has been a terrible experience being told to pay money and then getting a worse experience, compared to what was free a year ago.
like this
yessikg likes this.
scops
in reply to bamboo • • •For me, the value add of Plex is their maintenance and support of the apps on various platforms and the authentication and connection management. I do have my server port forwarded, so there's no reason for them to handle my media streams. Being able to tell a new user that all they need to do is download an app from a trusted app repository and create a free account so I can invite them to my libraries is a super simple experience for most skill levels and well worth the $60 or so I spent on a lifetime Plex pass over a decade ago.
I get that there are use cases where it makes more sense to go with a completely free solution like JellyFin, but many critics of Plex act like ALL they are doing is serving user-supplied media on a web server, and that's a gross misrepresentation of their offering.
I don't love the IPTV stuff that they do, but it's not that difficult to tweak the current app so that only my libraries are shown. Compared to an experience like my smart TV which is shoving ads down my throat and adding steps to get to the apps I want, it's an
... Show more...For me, the value add of Plex is their maintenance and support of the apps on various platforms and the authentication and connection management. I do have my server port forwarded, so there's no reason for them to handle my media streams. Being able to tell a new user that all they need to do is download an app from a trusted app repository and create a free account so I can invite them to my libraries is a super simple experience for most skill levels and well worth the $60 or so I spent on a lifetime Plex pass over a decade ago.
I get that there are use cases where it makes more sense to go with a completely free solution like JellyFin, but many critics of Plex act like ALL they are doing is serving user-supplied media on a web server, and that's a gross misrepresentation of their offering.
I don't love the IPTV stuff that they do, but it's not that difficult to tweak the current app so that only my libraries are shown. Compared to an experience like my smart TV which is shoving ads down my throat and adding steps to get to the apps I want, it's an experience I can live with if it keeps Plex in the black.
RunJun
in reply to along_the_road • • •I used Plex, and have a lifetime account, for the past decade. I just switched over to Jellyfin this week.
Feel free to ask any questions that you have about differences or my opinion.
like this
yessikg likes this.
Lionel CoupouchettyRamouchetty
in reply to RunJun • • •Same here, had a lifetime license very early, ultra cheap but stopped using it a longtime ago, I think they changed the license or something along those lines that made me not trust them anymore.
I used kodi for a longtime but recently switched to jellyfin, never been happier.
Seeing they turned into another one of those big companies that just whant to trap you I'm even happier with my choice
@along_the_road
anon
in reply to RunJun • • •Anything you're missing from Plex?
Regarding the big picture interface:
RunJun
in reply to anon • • •anon
in reply to RunJun • • •octobob
in reply to RunJun • • •How well does remote viewing work on jellyfin? I have a lot of friends and family that use my Plex, I've also had a lifetime pass for pushing a decade.
Like how easy is it to send an invite and the person be rolling with no technical setup from me? I just sent a Plex invite last week to my friend's brother who did some plumbing work on my house, dunno if I'll even ever see that dude again haha. I'm certainly not goin over to his house to set something up.
Or my dad struggles enough with it as it is, he's 70 next year so I get it. But that might be more of a problem with the Plex app on his ancient smart TV.
This is a big reason I stick with Plex.
Damage
in reply to octobob • • •Not OP, never used Plex, I make accounts for people and send them the address, username and password, that's it.
As for the work I had to do, I run Proxmox so I copy pasted a command from the PVE community scripts, and set up a reverse proxy.
Proxmox VE Helper-Scripts
Proxmox VE Helper-Scriptsblitzen
in reply to Damage • • •Damage
in reply to blitzen • • •blitzen
in reply to Damage • • •With Plex, everyone has their own accounts they are responsible for. They create the account and set the password. You give those accounts access.
I couldn’t stand the onslaught of “what’s my passwords.”
Damage
in reply to blitzen • • •RunJun
in reply to octobob • • •I haven’t set this up myself as my internet provider doesn’t do a public IP address per customer. I never even corrected it with plex.
But as far as I’ve heard, the difficult part is setting it up on the host side with tailscale. From your dad’s side, it should just be entering your IP and then the user/password.
imetators
in reply to octobob • • •I have Jellyfin instance open to the internet. Not many people use it besides me (and even I use it seldom for now) but I have like 3 people beside me that have tried it out.
I am not sure if there is invite capability or anything. But the way I did it is just create logins and basic passwords for my friends and family and tell them that they should change it upon first login.
As for streaming - I did watch couple of movies outside home through android app and had no issues with anything quality or connection-wise. It just worked.
PhAzE
in reply to RunJun • • •RunJun
in reply to PhAzE • • •like this
yessikg likes this.
BryceBassitt
in reply to along_the_road • • •Damage
in reply to along_the_road • • •T (they/she)
in reply to Damage • • •like this
yessikg likes this.
1hitsong
in reply to Damage • • •I work on Jellyfin. I once posted saying Plex is not a competitor because we are not in a race, so there is no such thing as "winning."
So... many... angry... responses.