> This is terrifying. Who runs things like this open to the outside?

Probably the majority of people with a Plex Pass subscription and most Plex users in general.

As far as I see it, Plex's primary purpose is to allow people who have extensive collections of legally obtained digital media to conveniently access it and share access to their friends and family on pretty much any random device from anywhere in the world.

All my home media devices run Kodi, they run Jellyfin, they run all sorts of fully open stuff, but when I travel Plex wins because it runs on basically anything that can stream video and I can sign in to it in seconds without needing to connect a VPN or enter my password on someone else's device.

To be fair, this is Plex's intended use case. It is not a bizarre or unsupported config to expose Plex to the internet. It is designed to be on the network so that many different invited users can all log in and access your media. This model doesn't work if they all need to be on a tailnet or similar. Maybe Plex is less secure than nginx serving a web page, but its just a matter of a trust threshold.

If it were just me using Plex then it would be different, but I can't realistically expect all my friends and family to get on a tailnet, and so I take the risk with an up-to-date Plex on the internet.

Many people, as your TV and sometimes friends have to connect to it and you don't want to explain Tailscale to them.

I'll fully admit I do.

The point of Plex is sharing your library with less ... technical users.

If I didn't want to do that, I'd not even use Jellyfin- SMB share and mpv would be fine with me.

You largely have to for Plex themselves to middleman access to your media collection.

I do run it open to the outside through cloudflare tunnels. I don't want to connect my TVs to tailscale every time to play a movie.

I do. I like to stream music from my server onto my phone when I'm out and about. And it's authenticated, so there's nothing terrifying about exposing it (security vulnerabilities aside, but that can happen to any software you expose).

Feeling very validated that I went with Iroh @ https://pixelbrite.site

Essentially every technical person I know.

Plex themselves literally recommend it and show a warning icon if it’s not accessible outside your local network. I always thought it was insane. To make matters worse their Synology package doesn’t auto update itself. I would guess there are a ton of vulnerable boxes sitting out there.

> This is terrifying. Who runs things like this open to the outside?

A budy of mine has got 30 000 movies and series. Better offer than Netflix (what, easily 4x more choice!?). He's got a 42U rack. He gives free access to his server to his friends and family: it's not a business (so what he risks is also very limited in the country he lives in, for he's not making a business out of it).

It's not because you and I don't run Plex servers accessible from the big bad Internet that others don't enjoy doing it.

Now concerning this miner: I've posted about it in the past here on HN but I only run Jellyfin on my LAN and it's only with throwaway containers: I've got a script that sets up movies/series named/organized the way Jellyfin likes it, then that volume is passed read-only to a transient podman container.

When we're done watching the movie, the podman container is deleted. It's over: it doesn't exists anymore.

All that I care about are data: like family pictures and movies (and, say, other movies).

My Jellyfin server is just a temporary "view" on my actual data.

I don't trust it and don't need to trust it: for it's only future after I'm done watching the movie is to be destroyed.