392
Plex Announces Massive Price Hike on Lifetime Subscription Plans (www.ign.com)
submitted 4 months ago by to c/selfhosted@lemmy.world
213 comments fedilink hide all child comments
 

Plex has announced a massive price increase on the service's Lifetime Plex Pass. On July 1, the lifetime subscription option will go from $249.99 to $749.99, an increase of 200%. The price hike will only apply to new subscribers, with no changes to monthly or annual subscription pricing.

you are viewing a single comment's thread
view the rest of the comments
[–] 6 points 4 months ago* (7 children)

The fact that's needed at all is the problem. Developers need to stop making monolithic structures that have access to everything ever and putting it on the user to maintain to maintain a VPN network for security.

There's no reason I should not be able to just use an nginx reverse proxy for remote access to my jellyfin and have that be safe. It should at worst give people a copy of my media if there's a security issue.

Personally I went out of my way to make this be the case, i have my instance locked into an unprivileged lxc whitelist only on syscalls which took a while to figure out the minimum needed for function but I got there. The host System is using the hardened kernel from Upstream and a series of sysctl lockdowns for example P Trace is not allowed even if you are the root user.

So I do indeed just nginx reverse proxy my instant because the worst case scenario even if they got complete shell access to the system they would be locked into an unprivileged container that had no access to any files other than my media files but the fact that I have to go to this level is already ridiculous

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 10 points 4 months ago

    It should at worst give people a copy of my media if there's a security issue.

    that's not the worst possibility. the worst possibility is an RCE into your server.

    Personally I went out of my way to make this be the case, i have my instance locked into an unprivileged lxc whitelist only on syscalls which took a while to figure out the minimum needed for function but

    that's a pretty exotic setup. Exciting, but for most people learning to manage a VPN is easier

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 4 months ago (5 children)

    It should at worst give people a copy of my media if there's a security issue.

    that's not the worst possibility. the worst possibility is an RCE into your server.

    Personally I went out of my way to make this be the case, i have my instance locked into an unprivileged lxc whitelist only on syscalls which took a while to figure out the minimum needed for function but

    that's a pretty exotic setup. Exciting, but for most people learning to manage a VPN is easier

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 6 points 4 months ago (4 children)

    I am aware that an rce is the worst possibility I'm saying it shouldn't be. The web portion is already its own isolated binary that you have to install but it's designed with seemingly very little attention to security.

    To the point that jellyfin has already had several major RCE and despite having full support for running over the web with http developers are basically just like you should not be using this without a VPN which is overall a pretty pathetic stance for a media server

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 3 points 4 months ago (2 children)

    Recently nginx had an RCE, so if your web server interface has an RCE, it doesn't matter if jellyfin code is top-notch, if you happen to use a proxy with RCE in front of it. Wireguard has never had an RCE and I'm relatively certain it never will, because I believe you must be in possession of some keys to go very deep in the wireguard code, which in itself is not very large piece of code.

    But yes, in principle I agree that we should code securely instead of depending on VPN to solve it for us, unfortunately it's not the reality today. Memory safe programming languages help, but don't completely protect against logic errors. VPN is general is pretty good for defence-in-depth.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 4 points 4 months ago (1 child)

    The nginx rce relied an a series of requirements that affect almost nobody. You had to be using a very specific module and processing a specific type of data reverse proxy was not affected.

    But regardless I get your point that anything can have an RCE. However as you say at the end in principle that does not mean you should just give up and expect external projects to handle your security. VPN is a great way to access your services and it is good defense and depth, but for the sake of being a successful project to the masses? It's basically a dead end Road

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 4 months ago

    but for the sake of being a successful project to the masses? It's basically a dead end Road

    I think that's why we should still have requirements against software we run (although as some funnily say, we are free to get a refund), but not pretend that the software is more secure than it is known to be. sad that we need a VPN for security, but it is what it is.

    I don't know how could we get our devs to be more attentive to security.

  • permalink
  • fedilink
  • source
  • parent