[eddythompson80]

It would make hosting a "Family and/or friends" instance possible.

I do go back and forth on the accessibility tradeoffs of E2EE for average people though. In this scenario, lose or forget your key/password and you lose ALL of your photos which are very important to some people. Losing them is pretty catastrophic. Google Photos or iPhotos really gives people a sense of security about their photos.

ps: It would also make it easier to host cloud instances for Immich without encrypting the file system of a remote server/VPS. Especially when renting servers from small-time sellers, I'm always weary about how much I can really trust their employees access control. I know some level of trust is unavoidable with physical access, but how do they handle those disks during maintenance would also be relevant.

[bjackman]

I really don't think you want E2EE for this. I host storage for family and friends, I haven't set Immich up yet (don't think I'd have space for everyone's photos) but the choice is between:

1. "Hey just so you know, I have access to everything you upload here".

2. "Do NOT lose your password or your data will be GONE FOREVER and I CANNOT get it back".

I definitely prefer 1 and I'm sure my users do too. They shouldn't upload it if they didn't trust me anyway.

In my case I follow it up with "and I might actually go digging around in your files if I need to debug something or you're wasting disk space". But I think you could also follow it up with "but I do promise not to look" and that would be valid too.

This whole thing only makes sense for people you're pretty close to.

(I do tell people not to back up their password managers on my system though).

I guess maybe for Immich specifically it would be nice to have a "vault" feature where people can upload nudes etc where they are willing to trade risk of loss for privacy on a per-photo basis.

[palata]

I do agree that this is a use-case.

Now a use-case for E2EE is if you want to host it on a VPS, I would say. I wouldn't trust the VPS with the photos of my friends/family.

[bjackman]

Ah yeah I see. I guess the fallback there would be to split the service up into a remote encrypted storage layer that goes on the VPS and then host the actual service (with the decryption keys) locally?

But ISTR reading Immich kinda assumes the storage is on a plain local filesystem so you get perf issues if you do something clever under its feet. Could be out of date on that.

[palata]

> I guess the fallback there would be to split the service up

I feel like it may be different enough that it's just not worth doing for Immich. To me, if you want the convenience of Immich in a trusted server, then Immich is great. If you want to host on an untrusted server, Ente is more to the point.

Those are two different models:

- With Immich, the server can do a lot of stuff (like processing on the images) but at the cost of the server accessing the images.

- With Ente, the server cannot access the images (that's the feature) but at the cost of not being able to do that kind of processing.

I am happy both exist, I think there is space for both.

[eptcyka]

You can run it on an encrypted volume on a VPS. Technically, it is also possible to use confidential VMs, but I have not at all kept up with those developments these days. Confidential here means that the SoC/CPU provides the ability for VMs memory to be encrypted with a key that the host never has access to. There's also remote attestation for it. I personally like e2e encryption at the application layer in some applications, but I personally do not think that it'd be practical for immich unless they also do confidential compute for the classifiers and identifiers. That is something Apple can do because they have the capital, not an open source project.

[palata]

> You can run it on an encrypted volume on a VPS.

If you run it on an encrypted volume on the VPS, you get encryption at rest (e.g. if someone steals the disks, it's encrypted), but still your VPS provider is able to decrypt it (otherwise it just couldn't run).

[eddythompson80]

Normally I either encrypt a non-boot drive (if the VPS provider offers such a thing) or use gocryptfs. It’s still a pain though when reboots happen, unless you also put your key there. Application layer encryption makes it easier.

[tredre3]

gocryptfs is great, I use it to encrypt storage in embedded scenarios where the OS doesn't have the userspace tools or kernel modules to manage encrypted block devices.

[owaislone]

My cousin just dumped 50GB of photos from his weddings in a Google Drive folder and shared with his contacts. I wanted to extract photos of my immediate family members from it and just save those. I setup immich on my macbook to do this but sadly I found the face recognition is nowhere near as good as Google Photos. It missed a lot of photos with tricky angles. Other than that, everything else looked quite solid to me.

[owaislone]

Choosing 1 is totally fine but that doesn't mean it should not be possible to choose 2, right? Just because I don't need a feature doesn't mean I loudly complain when others ask for it.

[bastawhiz]

Two people in my life when I was a kid have since been sent to prison for pedophilia. There's a 0.0% chance I'm hosting encrypted media for anyone other than my spouse. The low but nonzero risk of the cops asking me about some encrypted files I'm holding for a friend simply would not be worth the risk for saving someone the tens of dollars a month to self host their own content.

[pydry]

You can host a family and friends' instance on your own hardware.

I have a small vps which just tunnels into a laptop running at home.

Half of the features of immich would become 10x harder to implement if encryption needed to be done client side.

[eddythompson80]

I meant hosting such instance with the bare minimum privacy considerations. Otherwise you would have to be honest with them that you’ll have complete access to all their photos and make sure they understand it. People’s camera roll is often akin to their text history or email. It can contain plenty of personal and private things. Just because we’re friends, or even siblings, it doesn’t mean it’s free-for-all access to everything.

Agreed on the difficulty of implementing server side features though, especially all the things people expect from a Google Photos alternative.

[wookmaster]

Who wants to be support for family and friends.