News

Also worth noting that Jellyfin has several known vulnerabilities. Nothing catastrophic, but there are a few “people who already know your library’s naming scheme can access media without authentication” types of things. If you follow the recommended guides exactly, it means you’ll end up with the exact same library layout as lots of other users. It can largely be solved by simply using slightly different folder names, but it’s still worth mentioning in case you want to avoid some random bot being able to access your library. And the Jellyfin devs have openly stated that they have no intentions of fixing them, because it would require a complete code rewrite.

Most people will say that it’s best to avoid exposing it to your WAN, and simply use a VPN to connect to your LAN instead. But that completely blows the aforementioned “friends and family factor” out of the water, because now you’re requiring them to figure out a VPN before they can even begin to access your server. And it also means that they can only watch on devices that will actually be able to run a VPN connection. So your grandma’s shiny new smart TV will be completely unable to connect (unless you feel like being the family IT support, and setting the VPN up on her router).

And while we’re on the topic of smart TVs, some of the most popular ones don’t have a native Jellyfin app. You can sideload on most of them, but (again) we’re considering that friends and family factor. If your grandma has to sideload the app before she can even access it, it’s a non-starter for many people.

On the other side of the same coin, Plex recently disclosed a password breach. Hackers got emails and password hashes. So there are benefits and drawbacks to both systems. Of course this is largely solved by not reusing passwords and simply resetting your password to something new, but that burden is on the individual users.