The big thing for me is privacy and control.
Plex requires Cloud access via accounts.
This is a sitting duck for subpoenas to mass punish media libraries once copyright holders get a more friendly government that cares less about citizens rights (which is coming up here soon).
Nothing about my jelly fin instance leaks my information to anyone else’s servers.
You can’t say the same about Plex.
I agree with you, however Jellyfin is not intrinsically more secure than any other piece of software. You have to be very careful how you go about deploying it if you open up external access, as you are dependent on the Jellyfin devs to fix vulnerabilities and they aren’t actually being paid to do this. If you’re paranoid about privacy, you should be paranoid about this too; the people sending subpoenas aren’t above port-scans on ISP subscribers, they did it back in the early days of torrents.
You get control and privacy, but you also get responsibility. It’s a trade-off, and one I’d certainly make if Jellyfin were more mature. That’s just me though, I’ve been hosting my own stuff for about a decade now and I can set up an isolated environment for Jellyfin to run within. Plex is a lot more newbie-friendly and I’d still recommend it for most folks unless they for sure know what they’re doing.
As an aside, these concerns are common to all FOSS software that don’t have deep-pocketed backers. Jellyfin is likely never getting those, unfortunately. I hope they can find some other way of sustaining themselves, they’ve not got much money for the scale of development needed and it’s all volunteer-driven today.
https://opencollective.com/jellyfin
I want them to keep going, and I’ve even donated to them. I still don’t think it’s at a place to replace Plex for most people yet though.
The way I do it with webservices is that I serve them all from virtual hosts. Scan my IP on port port 80? 301 moved permanently to same host port 443. 443? Welcome to nginx! Which webservice is actually served depends on the hostname being requested. The hostnames are just part of a wildcard subdomain with a matching wildcard certificate, so you can’t derive the hosts from the blank landing page’s cert. Though one option would be to disable https when no matching virtual host is found.
I know this isn’t protection against sophisticated attackers, but nobody uses my home services except me when I’m not home so the exposure is very limited.
Anyhow, with Plex you have a central provider who, if I’m not mistaken, knows a lot about how their customers use their product. The angle of attack is different.
