Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Immich 3.0

github.com

Post reply on HN
Print view View original

281–290 of 313 posts

Re: Immich 3.0

#281

Post by drdexebtjl »

gf000 wrote: post #163
drdexebtjl wrote: post #125

Earlier quoted context omitted.

I don’t agree E2EE is right for everything, and especially not for a personal photo library. I don’t want to hold the keys to my photo library on someone else’s computer. I want to actually have all the bits and all the hardware in my house. I want to have access to it even if the Internet ends.

Especially that it would come with the loss of quite a few features, or at least a significantly worse way to implement them. Like if you have to bring the data to your client device to do any kind of processing, you are quite bottlenecked when it comes to bulk operations (e.g. searching). Sure there is very interesting research into managing that (homomorphic encryption), but I think it only makes sense on a Google…

Also bottlenecked when it comes to background operations.

Trusting the server, all the app in your phone has to do in the sliver of CPU time the OS gives it in the background is send it off to the server, where it can do compute-intensive things like transcoding video.

If you don’t trust the server, you’ll probably have to do these things while your app is in the foreground.

Re: Immich 3.0

#282

Post by eunice »

Panda4 wrote: post #56
oliyoung wrote: post #41

Immich is such a no-brainer replacement for Apple Photos or Google Photos, combined with VPN like Tailscale, it's almost a drop in replacement

Is there any side effects of leaving the phone connected to Tailscale VPN all day?

i've had tailscale almost permanently enabled for a couple of years at this point and it's never a problem (ios, nextdns with a tailscale specific profile rather than a pihole or something)

Re: Immich 3.0

#283

Post by skottenborg »

Saris wrote: post #45
nickthegreek wrote: post #11

Earlier quoted context omitted.

Man, I wish my experience was as nice. I used the proxmox lxc for it and after a 2 months of organizing I had some corruption and didn't have the fortitude to get through the debugging. It might have been related to a big version migration if I remember correctly. It turned me off the stack. The upgrading wasn't as turnkey as I wanted it to be and I dont think the case is different today. I just want to be able to or…

In proxmox restoring a backup is really easy, I'm surprised you didn't do that!

Yes! Or even better, use Proxmox snapshots during upgrades for easy rollback on failure

Re: Immich 3.0

#284

Post by olejorgenb »

FabCH wrote: post #133
NikxDa wrote: post #58

Earlier quoted context omitted.

Encryption at rest means they have the key. End to end means they don‘t. Huge difference!

Yes but magical homomorphic encryption aside, the person has conflicting requests at that point. They are asking for an image app that can’t view their images. That’s not an image app anymore, that’s just encrypted storage.

I think the idea is that the images are decrypted by the client. See how Ente does it: https://ente.com/architecture

Of course - this sacrifice quite a bit of functionality since more or less all functions which require looking at the pixels need to be client-side. But to be fair - the client is part of the "app", so it's not "just" encrypted storage.

Re: Immich 3.0

#285

Post by slaye »

owaislone wrote: post #274
slaye wrote: post #161

An incredible piece of software, on par with Google Photos. I've been using it behind Tailscale for months with no problems ever since I first got into homelabbing. Actually, moving from Google Photos to Immich after I hit my 100GB storage limit was the whole reason I got into self-hosting, and what a fun ride that has been! I can't believe self-hosted products of this caliber are free. Huge shout-out to HomeAssistan…

I've been considering it as well. I'm using 1.5TB in google one storage. mostly from photos/videos from the last decade from 4 family members. Have you thought about backups and redundancy? I was thinking of hosting it on my homelab with backups on some cheap cloud storage but almost any cloud storage ends up costing somewhat similar to Google One so I've been a bit reluctant. A good backup story is probably the only…

Immich promotes a 3-2-1 backup strategy in their docs you can read about: https://docs.immich.app/administration/backup-and-restore/

Admittedly I have not set up backups yet because my homelab setup is not very mature.

I'm running everything off a single mini PC connected to a fresh 1TB SSD. My next "homelab goal" is setting up a NAS/DAS once I can snag something affordable off eBay/FB Marketplace/Kleinanzeigen/etc.

I think there are some super cheap cloud storage solutions where you pay a lot less in costs to not have on-demand access. That is the route I was going to go personally.

Re: Immich 3.0

#286

Post by Cider9986 »

AussieWog93 wrote: post #82

So many comments here about missing end to end encryption, but seriously - why would anyone want this? Lets say burglars break in and steal your homelab. Because you don't have e2ee, they can see all the photos you saved of your dead grandmother! Oh no! Or, in the more likely scenario that something happens to your phone, the lack of e2ee means that even if you lost your keys you didn't lose the only memories that re…

>So many comments here about missing end to end encryption, but seriously - why would anyone want this?

I trust GrapheneOS's security 10x more than my server. Why would I want encryption on messaging, if it's 'just for messaging my grandma'. My data is important to me and I want to keep it secure, even if I don't have a high threat model. E2ee should be the baseline, there's no reason to make security worse on purpose. Encryption in this case is important because it allows defense in depth, it allows others to know their photos are private when using my server and it prevents data access if someone has physical access.

Why trust two devices when one trust one device do trick?

> Or, in the more likely scenario that something happens to your phone, the lack of e2ee means that even if you lost your keys you didn't lose the only memories that remain of your grandma - you just copy across the .jpgs to a new device.

Yes, that's what happens when you lose your keys with e2ee. Every e2ee service is like this. Apple photos, Ente photos, Signal. If I couldn't manage a few words, why would I trust myself to manage a whole server?

Re: Immich 3.0

#287

Post by troupo »

cromka wrote: post #280
troupo wrote: post #223

Earlier quoted context omitted.

> No. They're not. You export photos using Google Takeout, iCloud has something similar. So, they are black boxes that don't make things easy or convenient for people. E.g. Google Takeout separates images and their metadata. With people running into issues like this: https://www.reddit.com/r/googlephotos/comments/1lqx331/googl... (as comments point out, Google just randomly changes file names as well, which breaks im…

This is why I said A-B testing would be important. BUT, that's irrelevant: their own iOS app butchers Live Photos and there's unresolved bugs that get hardly any traction. This isn't rocket science here, no wild-guessing, they get access to the Photo library like any other app using their SDK. They just lose those Live Photos when backing up to immich and no one got to the bottom of it. WHY do you keep ignoring that…

> WHY do you keep ignoring that aspect that I have mentioned like 3 times by now?

Which aspect? The only "aspect" you're talking about is, basically, "immich should make this fully documented easily and trivially implemented batch backup from iCloud Photos/Google Photos".

I mean, even live photos isn't documented anywhere, and Apple changes how it's implemented from time to time (e.g. moving from JPEG + MOV to HEIC + H.265).

Re: Immich 3.0

#288

Post by flossly »

FabCH wrote: post #279
colonCapitalDee wrote: post #271

Earlier quoted context omitted.

E2EE, by definition, means that the server storing the data can't decrypt it. Your server can decrypt the data. Thus, it's not E2EE. Is this a problem? No. You've decided that the server is trusted (a "peer device"), so it's fine if the server can decrypt the data. That's a perfectly reasonable security posture, but it's still not E2EE.

I don’t think there is a formal definition of E2EE. Here’s Wikipedia’s definition: „End-to-end encryption (E2EE) is a method of implementing a secure communication system where only the sender and intended recipient can read the messages“ Note the complete lack of client/server distinction. It’s simply about intended recipients.

In many cases "transport encryption" would also fit that definition.

E2ee is quite well established imho. The server at Hetzner (a.k.a. "someone else's computer") is NOT to be trusted in e2ee schemes. Until today I'd be willing to say everyone agrees on this, but now I doubt that :)

Re: Immich 3.0

#289

Post by rirze »

AussieWog93 wrote: post #82

So many comments here about missing end to end encryption, but seriously - why would anyone want this? Lets say burglars break in and steal your homelab. Because you don't have e2ee, they can see all the photos you saved of your dead grandmother! Oh no! Or, in the more likely scenario that something happens to your phone, the lack of e2ee means that even if you lost your keys you didn't lose the only memories that re…

You know why. I know why.

The people who care about this disproportionately collect distasteful media and would be in criminal proceedings if their material was uncovered.

Re: Immich 3.0

#290

Post by wookmaster »

AussieWog93 wrote: post #82

So many comments here about missing end to end encryption, but seriously - why would anyone want this? Lets say burglars break in and steal your homelab. Because you don't have e2ee, they can see all the photos you saved of your dead grandmother! Oh no! Or, in the more likely scenario that something happens to your phone, the lack of e2ee means that even if you lost your keys you didn't lose the only memories that re…

I have no idea, I use wireguard to access it. I have disk encryption setup. They'd need to hack my linux server SSH which I have protection turned on to shut it down after failed attempts. It would be a challenge to get access to my photos on disk. They could steal my phone and access through the app if they could get them all before I disabled access since Im using encrypted icloud account.

In the end who would want all my photos for that amount of work lol?

Post reply on HN