Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Immich 3.0

github.com

Post reply on HN
Print view View original

211–220 of 313 posts

Re: Immich 3.0

#211

Post by pydry »

alper wrote: post #201
AussieWog93 wrote: post #82

So many comments here about missing end to end encryption, but seriously - why would anyone want this? Lets say burglars break in and steal your homelab. Because you don't have e2ee, they can see all the photos you saved of your dead grandmother! Oh no! Or, in the more likely scenario that something happens to your phone, the lack of e2ee means that even if you lost your keys you didn't lose the only memories that re…

Privacy extremists are always very vocal but most people do not care at all about this. Maybe people have pornography production streams they want to manage using Immmich?

Im wary about having my PII hosted on vpses which I suppose makes me a privacy nut. I just host immich on an old laptop and use the VPS to establish a wireguard tunnel.

I think it's ridiculous to expect immich to rearchitect everything in order to make it better able to run on untrusted hardware. It should stick to doing what it is good at.

Re: Immich 3.0

#212

Post by p4bl0 »

I teach a free software development course to my undergrad students. It's really exciting to stumble upon one of the work they did for my class in the wild (it's the first listed bug fix — which is the last of the three pull requests this student got merged in Immich during my course). I feel so proud! :)

Re: Immich 3.0

#213

Post by V__ »

liotier wrote: post #195
l11r wrote: post #80

Earlier quoted context omitted.

Are there any side effects of leaving Immich public? I think people overestimate the risks. Just update your stuff regularly, follow simple rules, and set up something like CrowdSec. I know it's simpler to just use Tailscale and similar tools, but recently I see the trend that people don't even consider otherwise.

> Are there any side effects of leaving Immich public ? Yes: it is necessary to share selected albums through public URL.

There is a project, which proxies album requests to a private immich instance, if one doesn't want to expose it: https://github.com/alangrainger/immich-public-proxy

Re: Immich 3.0

#214

Post by TalkingCodeMonk »

palata wrote: post #202
TalkingCodeMonk wrote: post #136

Earlier quoted context omitted.

Why is there "a very good possibility" of losing your photos because they are E2EE? Do you not use a password manager and backup your data? There is no reason why E2EE services can't provide recovery or emergency access mechanisms, or implement plaintext export functionality from clients for storage elsewhere. Most reputable providers already have functionality to enable recovery and backup.

> How do techies and devs of all people not understand I find it interesting to start with this, and follow with: > There is no reason why E2EE services can't provide recovery or emergency access mechanisms If the service can help you recover your data after you lose the key, it means that they have the key, and therefore it's not end-to-end encrypted. That's the whole point of E2EE.

> That's the whole point of E2EE.

No it's not. The point of E2EE is that only the client apps decrypt/encrypt content, and the server just processes the encrypted bits. Most E2EE service providers do this by encrypting your encryption key. That's how you can login on other devices without you having to store and import an encryption key every time. When you login they send you an encrypted blob that contains your encryption key, which is decrypted client side, then the key is used to decrypt your data locally on the client. This does not break E2EE, but it does mean you have to trust the provider, which is why most of them are entirely open source.

Sharing and emergency access also use similar public key cryptography techniques to provide shared access to E2EE data. A similar principle applies to your phones encryption aswell, and is the reason you can wipe/reset your device in seconds, instead of minutes/hours. They only wipe the encryption key; not the encrypted data.

Re: Immich 3.0

#215

Post by TalkingCodeMonk »

gf000 wrote: post #164
TalkingCodeMonk wrote: post #136

Earlier quoted context omitted.

Why is there "a very good possibility" of losing your photos because they are E2EE? Do you not use a password manager and backup your data? There is no reason why E2EE services can't provide recovery or emergency access mechanisms, or implement plaintext export functionality from clients for storage elsewhere. Most reputable providers already have functionality to enable recovery and backup.

> can't provide recovery or emergency access mechanisms If they can do that then they are not e2ee.

see other comment https://news.ycombinator.com/item?id=48772802

Re: Immich 3.0

#216

Post by firen777 »

> Upload asset directly to album on the mobile app

Does this fix this problem? https://github.com/immich-app/immich/discussions/12748

It's a pretty big issue for me having multiple devices and multiple people who want to pool pictures of our cats together in one album.

Currently I have to do this kind of set up:

1. Syncthing sync our photos back to the homelab server hosting immich - /mnt/Syncthing/a1/cats/ - /mnt/Syncthing/a2/cats/ - /mnt/Syncthing/b/cats/

2. cron job copying (hard-link) the photos to a folder mounted as read-only external library volume - /mnt/immich/ext-lib/cats/

3. cron job to run a script that automatically creates albums from external library folder structure: https://github.com/Salvoxia/immich-folder-album-creator

4. cron job clean up photos in the syncthing folder that are older than a year to free up space for our phones (~1TB total. Yes we have problem)

--------------

That said, congrat on the 3.0 release. Although I'm slightly bumped out because I literally just discovered this program a month ago and stabilized my self-host set up just one week ago.

Re: Immich 3.0

#217

Post by imalerba »

AussieWog93 wrote: post #82

So many comments here about missing end to end encryption, but seriously - why would anyone want this? Lets say burglars break in and steal your homelab. Because you don't have e2ee, they can see all the photos you saved of your dead grandmother! Oh no! Or, in the more likely scenario that something happens to your phone, the lack of e2ee means that even if you lost your keys you didn't lose the only memories that re…

I just want to be able to share my hosted service with other people and not have the responsibility of being able to access their photos. Me or anyone that happens to gain access to my server.

Re: Immich 3.0

#218

Post by Mashimo »

palata wrote: post #204

How does the mobile app sync work with Immich? My use-case is that I want to install the mobile app on the phone of my relatives (including iPhones), and it should keep syncing their pictures "forever" even though they never, ever open the app. I tried Nextcloud, but the apps/server end up failing to sync after at most a couple month, and it's painful to recover from that. So it doesn't work for me. I have been consi…

With works for me on Android with Pixel phone, after I added Immich to the list of apps that can work in the background.

But as you can see in the linked release note, they made a lot of change to background sync on Android and iOS. It should (TM) work out of the box now.

Re: Immich 3.0

#219

Post by reorder9695 »

konart wrote: post #129
TalkingCodeMonk wrote: post #122

Earlier quoted context omitted.

Seriously! How do techies and devs of all people not understand that the cloud is someone else's computer, and that the best way to prevent leaks, exploitation, or abuse of user data is to prevent anyone from being able to decrypt it but the end users themselves. IMO this is the single greatest problem with the selfhosted community; the idea that E2EE is only necessary for passwords and other highly sensitive PII. It…

> It should be standard for anything hosted on someone else's computer. As long you understand the risks. I'd rather have my family photos beying unencrypted than a very good possibilty of loosing them which happed more than once with other e2e things simply because I have no key to decrypt. Then again - if I have to chose I'd rather have the at my home lab.

I'd personally rather have E2EE and periodically back things up to an encrypted hard drive so any losses aren't catastrophic, but I am probably more cynical than most in my trust of companies/other people with my data and am technical so understand the risk model both ways better than most people.

Re: Immich 3.0

#220

Post by mvdtnz »

ivanjermakov wrote: post #53
oliyoung wrote: post #41

Immich is such a no-brainer replacement for Apple Photos or Google Photos, combined with VPN like Tailscale, it's almost a drop in replacement

Beware that migrating back from Immich to iCloud/Google is not something Immich cares about. There is no "download all" anywhere, best way is to go to the server and get raw files from there. https://github.com/immich-app/immich/discussions/14365

It's just files on a disc drive. Why do you need a button for this?
Post reply on HN