> This is terrifying. Who runs things like this open to the outside?

Probably the majority of people with a Plex Pass subscription and most Plex users in general.

As far as I see it, Plex's primary purpose is to allow people who have extensive collections of legally obtained digital media to conveniently access it and share access to their friends and family on pretty much any random device from anywhere in the world.

All my home media devices run Kodi, they run Jellyfin, they run all sorts of fully open stuff, but when I travel Plex wins because it runs on basically anything that can stream video and I can sign in to it in seconds without needing to connect a VPN or enter my password on someone else's device.

Many people, as your TV and sometimes friends have to connect to it and you don't want to explain Tailscale to them.

Feeling very validated that I went with Iroh @ https://pixelbrite.site

You largely have to for Plex themselves to middleman access to your media collection.

Essentially every technical person I know.

I do. I like to stream music from my server onto my phone when I'm out and about. And it's authenticated, so there's nothing terrifying about exposing it (security vulnerabilities aside, but that can happen to any software you expose).

I do run it open to the outside through cloudflare tunnels. I don't want to connect my TVs to tailscale every time to play a movie.

> This is terrifying. Who runs things like this open to the outside?

A budy of mine has got 30 000 movies and series. Better offer than Netflix (what, easily 4x more choice!?). He's got a 42U rack. He gives free access to his server to his friends and family: it's not a business (so what he risks is also very limited in the country he lives in, for he's not making a business out of it).

It's not because you and I don't run Plex servers accessible from the big bad Internet that others don't enjoy doing it.

Now concerning this miner: I've posted about it in the past here on HN but I only run Jellyfin on my LAN and it's only with throwaway containers: I've got a script that sets up movies/series named/organized the way Jellyfin likes it, then that volume is passed read-only to a transient podman container.

When we're done watching the movie, the podman container is deleted. It's over: it doesn't exists anymore.

All that I care about are data: like family pictures and movies (and, say, other movies).

My Jellyfin server is just a temporary "view" on my actual data.

I don't trust it and don't need to trust it: for it's only future after I'm done watching the movie is to be destroyed.

Plex themselves literally recommend it and show a warning icon if it’s not accessible outside your local network. I always thought it was insane. To make matters worse their Synology package doesn’t auto update itself. I would guess there are a ton of vulnerable boxes sitting out there.