Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Immich 3.0

github.com

Post reply on HN
Print view View original

121–130 of 313 posts

Re: Immich 3.0

#121

Post by BeetleB »

hamdingers wrote: post #92
BeetleB wrote: post #83

Earlier quoted context omitted.

Are you saying there are never backward incompatible changes? Are you saying there's no need to back up the underlying DB? Are you saying I can keep an insurance running for, say, three years and it'll be trivial to upgrade after that?

I'm saying your contribution is outdated and irrelevant, and my primary intention in commenting is to label it as such for any passers-by who might think you're talking about the current state Immich. That sad, I'm happy to answer your questions. I've run Immich in docker for 3 years with automatic updates through watchtower. Updates are frequent but require no effort from me and have never broken anything, nor is th…

I'm glad you're happy with it, and perhaps Immich will continue to remain secure. 3 years is comforting.

I will note that the last solution I used was fine for over a decade before it broke (and eventually the project died). For much of the time I was using it, it was the primary open source self hosting solution.

So one of my criteria is: "If the project dies, can I maintain it?" Obviously, I can't use that approach for everything (limited skills and time) - I do use NextCloud, for instance (which, BTW, is fairly painful for some of the reasons I listed above). But wherever I can (and wherever it's important), it's best to develop your own stack.

Best to think in the long term. But yes, for sure, there are down sides to my approach.

Re: Immich 3.0

#122

Post by TalkingCodeMonk »

drdexebtjl wrote: post #117
AussieWog93 wrote: post #82

So many comments here about missing end to end encryption, but seriously - why would anyone want this? Lets say burglars break in and steal your homelab. Because you don't have e2ee, they can see all the photos you saved of your dead grandmother! Oh no! Or, in the more likely scenario that something happens to your phone, the lack of e2ee means that even if you lost your keys you didn't lose the only memories that re…

I think the point of E2E encryption is that you could host it with a cloud provider and the provider would not be able to see your data. Kind of like how Proton Drive claims it does not know which files you have. This would force features like semantic search, face detection, video transcoding and thumbnail generation into the clients instead. Immich assumes trusting the server to have access to your photos is fine.…

Seriously! How do techies and devs of all people not understand that the cloud is someone else's computer, and that the best way to prevent leaks, exploitation, or abuse of user data is to prevent anyone from being able to decrypt it but the end users themselves.

IMO this is the single greatest problem with the selfhosted community; the idea that E2EE is only necessary for passwords and other highly sensitive PII. It should be standard for anything hosted on someone else's computer.

You might argue it's not neccessary for cat photos, but mistakes happen and you can accidentally upload things you don't intend to. You might argue it's not neccessary for games, ebooks or other copyrighted media, but the cloud provider could scan and delete anything you own that matches a hash of copyrighted material, at any time. You can accidentally paste a password, or other sensitive piece of text, into any text field of any website or application, and have it distributed to computers around the world.

E2EE can mitigate against numerous attack vectors, and reduces the surface area and blast radius of most attacks. That also applies to your own computers, if someone steals your hardware or hacks into your network. It is vital in the age of AI where all of your data could be exploited for training and profit, or used against you. The only data that should not be E2EE is situations where it is technically impossible, or the data is explicitly shared as "public" (e.g. the clearnet).

Re: Immich 3.0

#123

Post by thatsJustBadUX »

cevn wrote: post #100
Panda4 wrote: post #56

Earlier quoted context omitted.

Is there any side effects of leaving the phone connected to Tailscale VPN all day?

I remember having problems using tailscale vpn 24/7 and pihole on my home network with the phone pointed at the 192.168 address for DNS. Pages would take 5s to resolve and start loading. Unfortunately, Pihole was less important than Tailscale and I have to put up with mobile ads.

If you're on Android and don't like mobile ads [Morphe](https://morphe.software/) might be worth a look.

Re: Immich 3.0

#124

Post by gchamonlive »

AussieWog93 wrote: post #120
gchamonlive wrote: post #114

Earlier quoted context omitted.

It's encryption both at rest and on transit. At rest there are levels of encryption, at object level or at filesystem level. E2ee for immich would mean the objects are encrypted and transmitting the data is encrypted. If the scenario is the server is stolen, you need encryption at rest. Even at FS level is enough.

Not sure why you're continuing to argue, GP's right. e2ee means that the encryption keys are stored client-side by the intended recipient. It's not just in transit and in rest.

Freedom of speech

Re: Immich 3.0

#125

Post by drdexebtjl »

TalkingCodeMonk wrote: post #122
drdexebtjl wrote: post #117

Earlier quoted context omitted.

I think the point of E2E encryption is that you could host it with a cloud provider and the provider would not be able to see your data. Kind of like how Proton Drive claims it does not know which files you have. This would force features like semantic search, face detection, video transcoding and thumbnail generation into the clients instead. Immich assumes trusting the server to have access to your photos is fine.…

Seriously! How do techies and devs of all people not understand that the cloud is someone else's computer, and that the best way to prevent leaks, exploitation, or abuse of user data is to prevent anyone from being able to decrypt it but the end users themselves. IMO this is the single greatest problem with the selfhosted community; the idea that E2EE is only necessary for passwords and other highly sensitive PII. It…

I don’t agree E2EE is right for everything, and especially not for a personal photo library.

I don’t want to hold the keys to my photo library on someone else’s computer. I want to actually have all the bits and all the hardware in my house. I want to have access to it even if the Internet ends.

Re: Immich 3.0

#126

Post by eddythompson80 »

drdexebtjl wrote: post #125
TalkingCodeMonk wrote: post #122

Earlier quoted context omitted.

Seriously! How do techies and devs of all people not understand that the cloud is someone else's computer, and that the best way to prevent leaks, exploitation, or abuse of user data is to prevent anyone from being able to decrypt it but the end users themselves. IMO this is the single greatest problem with the selfhosted community; the idea that E2EE is only necessary for passwords and other highly sensitive PII. It…

I don’t agree E2EE is right for everything, and especially not for a personal photo library. I don’t want to hold the keys to my photo library on someone else’s computer. I want to actually have all the bits and all the hardware in my house. I want to have access to it even if the Internet ends.

E2EE means the keys are on your own computer (or device or brain etc). The “someone else’s” computer is just hosting encrypted blobs.

Re: Immich 3.0

#127

Post by _flux »

gonzalohm wrote: post #23
jasonvorhe wrote: post #20

Earlier quoted context omitted.

S3 has many open implementations you can self host. Some are quite lean even. Unless you need really complex IAM stuff it's a solid and rather simple experience to run it.

Yeah but Immich provides a lot more features than just storage

Wouldn't it then be reasonable to focus on those many features, instead of storage? I would enjoy using with S3, as expanding S3 storage is easier than expanding the storage of a virtual machine: usually it happens automatically.

Of course this topic has been discussed: https://github.com/immich-app/immich/discussions/1683

Re: Immich 3.0

#129

Post by konart »

TalkingCodeMonk wrote: post #122
drdexebtjl wrote: post #117

Earlier quoted context omitted.

I think the point of E2E encryption is that you could host it with a cloud provider and the provider would not be able to see your data. Kind of like how Proton Drive claims it does not know which files you have. This would force features like semantic search, face detection, video transcoding and thumbnail generation into the clients instead. Immich assumes trusting the server to have access to your photos is fine.…

Seriously! How do techies and devs of all people not understand that the cloud is someone else's computer, and that the best way to prevent leaks, exploitation, or abuse of user data is to prevent anyone from being able to decrypt it but the end users themselves. IMO this is the single greatest problem with the selfhosted community; the idea that E2EE is only necessary for passwords and other highly sensitive PII. It…

> It should be standard for anything hosted on someone else's computer.

As long you understand the risks.

I'd rather have my family photos beying unencrypted than a very good possibilty of loosing them which happed more than once with other e2e things simply because I have no key to decrypt.

Then again - if I have to chose I'd rather have the at my home lab.

Re: Immich 3.0

#130

Post by konart »

stogot wrote: post #55
ivanjermakov wrote: post #53

Earlier quoted context omitted.

Beware that migrating back from Immich to iCloud/Google is not something Immich cares about. There is no "download all" anywhere, best way is to go to the server and get raw files from there. https://github.com/immich-app/immich/discussions/14365

There’s no download all in apple photos either unless they added it

You can download all you Apple data now, including photos.

https://privacy.apple.com/account -> "Get a copy of your data"

Then you will need to chose the maximum size of an archive part and wait for link to a download page.

Post reply on HN