Comment

Comment on Immich relies on a third-party service that seems shady to me

xantoxis@lemmy.world ⁨1⁩ ⁨month⁩ ago

Seems like a very reasonable objection to me. I’d guess that most of us Immich users are using it in the first place because it improves the privacy of our photos, and a third party seeing our location data certainly undermines that.
I would have complained had I noticed, so you might be the first one to notice. Immich’s userbase isn’t huge right now, it’s definitely possible.
Featurewise, I’d like: a) a clearly documented way to disable map data leaving my server; b) a set of well-integrated choices (maybe even just two, as long as one of them is something like openstreetmap); c) the current configurability to be well documented.
I’d love it if all such outbound data streams are also documented. Many security and privacy-focused products give you a “quiet” mode of some kind, where you can turn off everything that sends your data somewhere else. It’s a requirement in many enterprise installations.

source

Sort:hotnew top

pcouy@lemmy.pierre-couy.fr ⁨1⁩ ⁨month⁩ ago
Thanks for the detailed feedback. According to one Immich dev, they used to use OSM’s raster tile provider but switched away from it since they were causing too much load on OSM’s servers.

There does not seem to be any non-commercial vector-tile provider at the moment (though OSM seems to be currently working on it), and it seems really overkill to try and self-host a tile provider (at least with the default level of details). Maybe the way is to find a balanced level of details that makes it reasonable to self host

source
- dan@upvote.au ⁨1⁩ ⁨month⁩ ago
  
  they were causing too much load on OSM’s servers.
  
  They could host their own OSM servers though, or at least a caching proxy.
  
  source
  - xantoxis@lemmy.world ⁨1⁩ ⁨month⁩ ago
    Home assistant’s main use case is showing you where your house is on a single map, though. Not sure how immich works, but if it’s one tile per photo with location data, that would be a MUCH bigger ask.
    
    source
    dan@upvote.au ⁨1⁩ ⁨month⁩ ago
    Oh yeah, that’s a good catch. Hosting their own proxy/CDN in front of OSM should be doable though.
    
    source
    -> View More Comments
lemmyvore@feddit.nl ⁨1⁩ ⁨month⁩ ago
You could also start by denying any outside connection to anything except private IP ranges for any docker container, and only allow it on a need to have basis.

It’s not enough to rely on the the good will and savvy of whoever made the software, you have to make the restrictions stick.

source
- pcouy@lemmy.pierre-couy.fr ⁨1⁩ ⁨month⁩ ago
  It’s the clients (web/android app, probably iOS too) that are making these requests.
  
  To the best of my knowledge, the Immich server inside the container is not making requests to the outside. It is merely sending a style.json to the client displaying a map, which then fetches tiles from the Cofractal URL inside this JSON.
  
  source