5 ms·

Seriously! How do techies and devs of all people not understand that the cloud is someone else's computer, and that the best way to prevent leaks, exploitation,

Seriously! How do techies and devs of all people not understand that the cloud is someone else's computer, and that the best way to prevent leaks, exploitation, or abuse of user data is to prevent anyone from being able to decrypt it but the end users themselves. IMO this is the single greatest problem with the selfhosted community; the idea that E2EE is only necessary for passwords and other highly sensitive PII. It should be standard for anything hosted on someone else's computer. You might argue it's not neccessary for cat photos, but mistakes happen and you can accidentally upload things you don't intend to. You might argue it's not neccessary for games, ebooks or other copyrighted media, but the cloud provider could scan and delete anything you own that matches a hash of copyrighted material, at any time. You can accidentally paste a password, or other sensitive piece of text, into any text field of any website or application, and have it distributed to computers around the world. E2EE can mitigate against numerous attack vectors, and reduces the surface area and blast radius of most attacks. That also applies to your own computers, if someone steals your hardware or hacks into your network. It is vital in the age of AI where all of your data could be exploited for training and profit, or used against you. The only data that should not be E2EE is situations where it is technically impossible, or the data is explicitly shared as "public" (e.g. the clearnet).

drdexebtjl 3mo ago
I don’t agree E2EE is right for everything, and especially not for a personal photo library. I don’t want to hold the keys to my photo library on someone else’s computer. I want to actually have all the bits and all the hardware in my house. I want to have access to it even if the Internet ends.
- eddythompson80 3mo ago
  E2EE means the keys are on your own computer (or device or brain etc). The “someone else’s” computer is just hosting encrypted blobs.
  - drdexebtjl 3mo ago
    I understand what it is. I still don’t want the encrypted blobs outside my control. Sure, they’re useless without the keys. But the key is also useless without the blobs, in the sense that I don’t have my photos.
    - TalkingCodeMonk 3mo ago
      Sounds like you want your photos on a unencrypted HDD, which you can do regardless of whether or not a cloud service is E2EE, so I don't see how E2EE is an issue...
      - drdexebtjl 3mo ago
        No, I do not want that. I have my photos on an encrypted HDD, in a server running Immich in my basement, and I connect to it using WireGuard. Everything is encrypted at rest and in transit. There’s no cloud. I get to reap the benefits of not using E2EE encryption, like offloading machine learning tasks and transcoding to a server, and having extremely simple clients that don’t need to roll their own application-layer crypto. E2EE isn’t a silver bullet. It solves a specific problem — trusting the server — and introduces another — pushing complexity to the clients. If you already trust the server, because it’s running on your infrastructure, there are no upsides. And Immich was designed specifically for self-hosting. To not depend on the cloud. It makes no sense for it to make trade-offs that don’t benefit self-hosting.
- gf000 3mo ago
  Especially that it would come with the loss of quite a few features, or at least a significantly worse way to implement them. Like if you have to bring the data to your client device to do any kind of processing, you are quite bottlenecked when it comes to bulk operations (e.g. searching). Sure there is very interesting research into managing that (homomorphic encryption), but I think it only makes sense on a Google cloud/apple scale. For a small, self-hosted app, I would much rather have my own hardware with FS-level encryption , or some kind of trusted compute as a whole. I don't think this has to be solved by an image host service.
  - drdexebtjl 3mo ago
    Also bottlenecked when it comes to background operations. Trusting the server, all the app in your phone has to do in the sliver of CPU time the OS gives it in the background is send it off to the server, where it can do compute-intensive things like transcoding video. If you don’t trust the server, you’ll probably have to do these things while your app is in the foreground.
konart 3mo ago
> It should be standard for anything hosted on someone else's computer. As long you understand the risks. I'd rather have my family photos beying unencrypted than a very good possibilty of loosing them which happed more than once with other e2e things simply because I have no key to decrypt. Then again - if I have to chose I'd rather have the at my home lab.
- TalkingCodeMonk 3mo ago
  Why is there "a very good possibility" of losing your photos because they are E2EE? Do you not use a password manager and backup your data? There is no reason why E2EE services can't provide recovery or emergency access mechanisms, or implement plaintext export functionality from clients for storage elsewhere. Most reputable providers already have functionality to enable recovery and backup.
  - gf000 3mo ago
    > can't provide recovery or emergency access mechanisms If they can do that then they are not e2ee.
    - TalkingCodeMonk 3mo ago
      see other comment https://news.ycombinator.com/item?id=48772802 https://news.ycombinator.com/item?id=48772802
  - palata 3mo ago
    > How do techies and devs of all people not understand I find it interesting to start with this, and follow with: > There is no reason why E2EE services can't provide recovery or emergency access mechanisms If the service can help you recover your data after you lose the key, it means that they have the key, and therefore it's not end-to-end encrypted. That's the whole point of E2EE.
    - TalkingCodeMonk 3mo ago

drdexebtjl 3mo ago

I don’t agree E2EE is right for everything, and especially not for a personal photo library. I don’t want to hold the keys to my photo library on someone else’s computer. I want to actually have all the bits and all the hardware in my house. I want to have access to it even if the Internet ends.

eddythompson80 3mo ago
E2EE means the keys are on your own computer (or device or brain etc). The “someone else’s” computer is just hosting encrypted blobs.
- drdexebtjl 3mo ago
  I understand what it is. I still don’t want the encrypted blobs outside my control. Sure, they’re useless without the keys. But the key is also useless without the blobs, in the sense that I don’t have my photos.
  - TalkingCodeMonk 3mo ago
    Sounds like you want your photos on a unencrypted HDD, which you can do regardless of whether or not a cloud service is E2EE, so I don't see how E2EE is an issue...
    - drdexebtjl 3mo ago
      No, I do not want that. I have my photos on an encrypted HDD, in a server running Immich in my basement, and I connect to it using WireGuard. Everything is encrypted at rest and in transit. There’s no cloud. I get to reap the benefits of not using E2EE encryption, like offloading machine learning tasks and transcoding to a server, and having extremely simple clients that don’t need to roll their own application-layer crypto. E2EE isn’t a silver bullet. It solves a specific problem — trusting the server — and introduces another — pushing complexity to the clients. If you already trust the server, because it’s running on your infrastructure, there are no upsides. And Immich was designed specifically for self-hosting. To not depend on the cloud. It makes no sense for it to make trade-offs that don’t benefit self-hosting.
gf000 3mo ago
Especially that it would come with the loss of quite a few features, or at least a significantly worse way to implement them. Like if you have to bring the data to your client device to do any kind of processing, you are quite bottlenecked when it comes to bulk operations (e.g. searching). Sure there is very interesting research into managing that (homomorphic encryption), but I think it only makes sense on a Google cloud/apple scale. For a small, self-hosted app, I would much rather have my own hardware with FS-level encryption , or some kind of trusted compute as a whole. I don't think this has to be solved by an image host service.
- drdexebtjl 3mo ago
  Also bottlenecked when it comes to background operations. Trusting the server, all the app in your phone has to do in the sliver of CPU time the OS gives it in the background is send it off to the server, where it can do compute-intensive things like transcoding video. If you don’t trust the server, you’ll probably have to do these things while your app is in the foreground.

konart 3mo ago

> It should be standard for anything hosted on someone else's computer. As long you understand the risks. I'd rather have my family photos beying unencrypted than a very good possibilty of loosing them which happed more than once with other e2e things simply because I have no key to decrypt. Then again - if I have to chose I'd rather have the at my home lab.

TalkingCodeMonk 3mo ago
Why is there "a very good possibility" of losing your photos because they are E2EE? Do you not use a password manager and backup your data? There is no reason why E2EE services can't provide recovery or emergency access mechanisms, or implement plaintext export functionality from clients for storage elsewhere. Most reputable providers already have functionality to enable recovery and backup.
- gf000 3mo ago
  > can't provide recovery or emergency access mechanisms If they can do that then they are not e2ee.
  - TalkingCodeMonk 3mo ago
    see other comment https://news.ycombinator.com/item?id=48772802 https://news.ycombinator.com/item?id=48772802
- palata 3mo ago
  > How do techies and devs of all people not understand I find it interesting to start with this, and follow with: > There is no reason why E2EE services can't provide recovery or emergency access mechanisms If the service can help you recover your data after you lose the key, it means that they have the key, and therefore it's not end-to-end encrypted. That's the whole point of E2EE.
  - TalkingCodeMonk 3mo ago