Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Immich 3.0

github.com

Post reply on HN
Print view View original

101–110 of 313 posts

Re: Immich 3.0

#101

Post by Grombobulous »

1una wrote: post #97
Grombobulous wrote: post #94

Earlier quoted context omitted.

If you are okay with internet exposure on some level, Cloudflare Tunnel is a really fantastic product: https://developers.cloudflare.com/tunnel/ It’s obviously not a magical security layer that eliminates all issues related to public Internet exposure, but in my opinion it is good enough for the average home user.

Note that Cloudflare Tunnel blocks requests above 100MiB, which makes it impossible to upload long videos. This is being addressed in https://github.com/immich-app/immich/pull/22385

Oh good callout, I had only tried it for not-giant-upload services.

Re: Immich 3.0

#102

Post by rmunn »

KomoD wrote: post #76
Panda4 wrote: post #56

Earlier quoted context omitted.

Is there any side effects of leaving the phone connected to Tailscale VPN all day?

Could impact battery usage, possibly? But the way I do access Immich externally is not with Tailscale directly on my phone but involves exposing a caddy instance, running on a $1 VPS, to the internet. If requests include a specific very long header (which I randomly made up), it then forwards those requests to my real Immich instance, which runs on my NAS. Headers can be configured within the mobile app. It has worke…

Here's some data. Well, technically anecdata, I suppose.

My phone has been powered on but inactive all night; I charged it to 80% before going to bed, then unplugged it and left it where I can reach it from my bed, as is my habit. (I'm in an Asian timezone, in case you hadn't guessed, so it's morning for me while it's evening in America right now). Its battery is now at 73%. The Android battery report says 6% battery usage from Kindle (makes sense, I started reading a book when I woke up), 0.7% from Signal (haven't sent any messages yet today but have received a few), and 0.3% from Tailscale.

So when you're not using the Tailscale network actively, you'll hardly notice the battery drain.

Re: Immich 3.0

#103

Post by whalesalad »

AussieWog93 wrote: post #82

So many comments here about missing end to end encryption, but seriously - why would anyone want this? Lets say burglars break in and steal your homelab. Because you don't have e2ee, they can see all the photos you saved of your dead grandmother! Oh no! Or, in the more likely scenario that something happens to your phone, the lack of e2ee means that even if you lost your keys you didn't lose the only memories that re…

You solve this by communicating with it via encrypted methods, like HTTPS, and using a storage volume that is encrypted and gets unlocked at boot.

Re: Immich 3.0

#104

Post by ls612 »

kpozin wrote: post #70
Panda4 wrote: post #56

Earlier quoted context omitted.

Is there any side effects of leaving the phone connected to Tailscale VPN all day?

If Tailscale is on, I can't concurrently run a DNS-blocking local VPN, so I see ads in mobile Chrome.

Put a Pihole container on your homelab which you have the Tailscale exit node on and then set it as the forced Tailnet DNS.

Re: Immich 3.0

#105

Post by buildbot »

stogot wrote: post #55
ivanjermakov wrote: post #53

Earlier quoted context omitted.

Beware that migrating back from Immich to iCloud/Google is not something Immich cares about. There is no "download all" anywhere, best way is to go to the server and get raw files from there. https://github.com/immich-app/immich/discussions/14365

There’s no download all in apple photos either unless they added it

CMD-A then export all X unmodified originals works fine

Re: Immich 3.0

#106

Post by gchamonlive »

AussieWog93 wrote: post #82

So many comments here about missing end to end encryption, but seriously - why would anyone want this? Lets say burglars break in and steal your homelab. Because you don't have e2ee, they can see all the photos you saved of your dead grandmother! Oh no! Or, in the more likely scenario that something happens to your phone, the lack of e2ee means that even if you lost your keys you didn't lose the only memories that re…

If they steal your homelab, e2ee doesn't help, it's encryption at rest. E2ee is for rogue devices sniffing the network, which is more or less of a concern depending on your setup. I'd not have unencrypted traffic in my network if I had for instance those shady TV boxes.

Re: Immich 3.0

#107

Post by hokumguru »

gchamonlive wrote: post #106
AussieWog93 wrote: post #82

So many comments here about missing end to end encryption, but seriously - why would anyone want this? Lets say burglars break in and steal your homelab. Because you don't have e2ee, they can see all the photos you saved of your dead grandmother! Oh no! Or, in the more likely scenario that something happens to your phone, the lack of e2ee means that even if you lost your keys you didn't lose the only memories that re…

If they steal your homelab, e2ee doesn't help, it's encryption at rest. E2ee is for rogue devices sniffing the network, which is more or less of a concern depending on your setup. I'd not have unencrypted traffic in my network if I had for instance those shady TV boxes.

TLS?

Re: Immich 3.0

#108

Post by drdaeman »

AussieWog93 wrote: post #82

So many comments here about missing end to end encryption, but seriously - why would anyone want this? Lets say burglars break in and steal your homelab. Because you don't have e2ee, they can see all the photos you saved of your dead grandmother! Oh no! Or, in the more likely scenario that something happens to your phone, the lack of e2ee means that even if you lost your keys you didn't lose the only memories that re…

I have an use case.

I have a multi-region homelab cluster and I share some photos with my friends in the US and my parents in Russia. I’m auto-uploading full library (basically replacing iCloud/Google Photos) and I can share links to selected photos or albums (a reachable node will be determined by a split-view DNS). All without risks of exposing my full photo archive in case either node gets seized or otherwise compromised.

(Now, this is what I’m trying to do. I set things up, but it’s not really functional at the moment, because Ente is buggy af, and I haven’t yet learned how to rebuild and debug their iOS app.)

Re: Immich 3.0

#109

Post by sylens »

Grombobulous wrote: post #93
AussieWog93 wrote: post #87

Earlier quoted context omitted.

I hear ya, I was being a little bit over the top. But I really do think that for every one user who would turn on e2ee and get some genuine benefit out of it, there would be a dozen that turn it on because "encryption good" and accidentally lose all their data.

True, e2ee is pretty scary as far as data loss. Still, good application design can help mitigate that. Apple does it with their e2ee recovery methods, although Ente does rely on a recovery key that you should print out and put in a safe as well as store in other safe locations. But also, what I love about the E2EE of Ente is that I can securely use a cloud hosted provider but then my home NAS backups are unencrypted.…

Yeah Immich and Ente are going for two different use cases. While Ente can be self hosted, I view it as more of an escape hatch if they ever enshittify vs how I would start off using the service. I like not having to manage ingress for a photos service so my family can use it but others cannot

Re: Immich 3.0

#110

Post by drdaeman »

gchamonlive wrote: post #106
AussieWog93 wrote: post #82

So many comments here about missing end to end encryption, but seriously - why would anyone want this? Lets say burglars break in and steal your homelab. Because you don't have e2ee, they can see all the photos you saved of your dead grandmother! Oh no! Or, in the more likely scenario that something happens to your phone, the lack of e2ee means that even if you lost your keys you didn't lose the only memories that re…

If they steal your homelab, e2ee doesn't help, it's encryption at rest. E2ee is for rogue devices sniffing the network, which is more or less of a concern depending on your setup. I'd not have unencrypted traffic in my network if I had for instance those shady TV boxes.

That’s incorrect. E2EE means encrypted data leaves the device, stored encrypted, and server(s) have no keys to decrypt it, only your (or other) client software does.
Post reply on HN