4 ms·

I would love to give this a try but its software supply chain story seems like a car crash, with dependency bumps needed every few days: https://github.com/immi

by rlpb 1y ago

I would love to give this a try but its software supply chain story seems like a car crash, with dependency bumps needed every few days: https://github.com/immich-app/immich/commits/main/server/package.json https://github.com/immich-app/immich/commits/main/server/pac... I'm keen to use it as soon as the dependency story is mature (eg. it is packaged in Debian). This doesn't seem likely to happen any time soon. I'm sure many people won't care about this. But for me, it's a measure of quality. I expect to be able to deploy and not worry about it, except for security updates, for at least a couple of years, preferably more. Constantly moving dependencies spidering out to a multitude of other projects, and Docker Compose, provide no such confidence. Edit: Ironically, just after posting that I came across this, which I think proves why my concern is warranted: https://news.ycombinator.com/item?id=45169657 https://news.ycombinator.com/item?id=45169657 Debian isn't immune to this, but it's much harder for such an attack to be successful when dependencies aren't constantly changing.

dalenw 1y ago
To be fair, there’s a massive banner on their front page warning users it’s in beta. Until they settle on a proper release it’ll continue to be a bit chaotic. All software development is like that.
- izacus 1y ago
  This looks like one of those projects that will never settle and have a stable slower release cycle.
  - fivestones 1y ago
    I don’t think so. They are steadily approaching their defined and published goals for stable release. I’m guessing it will come this year.
  - rhizome 1y ago
    v0.46.4_p3
deleted 1y ago
[deleted]
Theodores 1y ago
To be honest, a decent image server that can be the root server for a CDN and do the right things with modern web formats is something that should be standard and built in by now, with nobody needing to build and install their own. That said, this is far better than my own non-existent image server. For me a measure of quality is the rendered HTML code, which should use all the content sectioning elements and not be bloated with gazillions of divs and classes. This software is well off the pace in this regard.
wer232essf 1y ago
[flagged]
WD-42 1y ago
This looks like a project that’s under heavy development (it is) responsibly keeping up with dependencies. This gives me more confidence, not less.
ta10496520945 1y ago
so you find it too immichure? <jk>
tootie 1y ago
Why is docker compose a red flag? That feels like a benefit to me.
- cowmix 1y ago
  100% -- firs time I have seen providing a docker compose file is a sign of weakness.
- tracker1 1y ago
  Yeah... I'm not sure that I've ever seen a complex app with multiple, separate service/database requirements (redis, pg, etc) packaged in a Linux distro repository... but I could be wrong.
  - dingnuts 1y ago
    controversial but docker compose is for development and demos. for prod give me a binary, a config file / systemd unit file, and tell me how to configure external dependencies and let me decide how to manage them. and if you're serious, k8s config. otherwise don't waste my time.
    - tootie 1y ago
      But this is for running on an old PC in your closet next to your router. Not serving 40k concurrent users. I would not even consider trying to scale it past a dozen family members. And anytime I run an upgrade or config change I just do it in prod.
    - tracker1 1y ago
      You can get all that information from a compose file.
    - pkulak 1y ago
      Waste your time? You know what would waste my time? Building out my own deployment of Redis/Postgres, all the dependencies, systemd services, ML server, and backup solutions (yes, the compose takes regular DB backups for you) and then keeping it all updated manually, just to host photos on my local network for my family of 4. Do you think making your life needlessly difficult is a feature? Then read the docs and deploy to a K8s cluster. Nothing is preventing you from doing that.
lhamil64 1y ago
I've been keeping my eye on Immich for a while and keep waiting for a stable release to try it out, but that hasn't happened yet. I'm also dreading having to setup proper backups if I were to switch to this over Google photos. My current solution is to backup critical homelab things to Google Drive automatically but I'd want a proper off-site backup if I were going to self host all my photos.
- para_parolu 1y ago
  I quite like their backup story. Immich has one folder that you need to backup. It stores file and dump of db that immich does on schedule. I don’t care that much about db dump but backuping photos os very easy
- pkulak 1y ago
  So you use Google Photos and backup to Google Drive? Sorry to say, but if Google ever decides to deactivate your account (which can and will happen for any reason, real or imagined), you lose everything. A stable release is only a couple months out. Maybe do a Takeout until then, and put it in S3 Glacier, or similar?
madeofpalk 1y ago
> Ironically, just after posting that I came across this, which I think proves why my concern is warranted: https://news.ycombinator.com/item?id=45169657 https://news.ycombinator.com/item?id=45169657 > Debian isn't immune to this, but it's much harder for such an attack to be successful when dependencies aren't constantly changing. Immich is more immune to this issue because they wait 5 days before raising PRs to bump dependencies, which is a good practice https://github.com/immich-app/.github/blob/main/renovate-config.json#L10C3-L10C33 https://github.com/immich-app/.github/blob/main/renovate-con...
- rlpb 1y ago
  OK, more maybe, but that is nothing next to Debian, where a huge Debian userbase settles on a single set of versions for all dependencies for a year (usually more) at a time.
  - madeofpalk 1y ago
    I would expect an operating system and a single application have a different approach to dependency management.
    - rlpb 1y ago
      Debian is both an operating system and a distribution of single applications. Its (excellent) dependency management applies to both. It doesn't have a software supply chain problem because it takes dependency management seriously.
tracker1 1y ago
Are there any/many applications that require a configured database (like PostgreSQL) and Redis/Valkey in Debian's package manager at all? Also, Docker-compose is pretty great in terms of getting complex applications up and running.
yesnomaybe 1y ago
You want to run it in docker and manage it with some tool. I use dockge and click the upgrade button every couple of days / weeks (when the app or website tells me). that's it. Immich is an excellent piece of software, I have switch all my photo needs from over 25 years to it. It will mature and it actually already is. Don't hold yourself back with such practicalities.
- deleted 1y ago
  [deleted]

by rlpb 1y ago

dalenw 1y ago

To be fair, there’s a massive banner on their front page warning users it’s in beta. Until they settle on a proper release it’ll continue to be a bit chaotic. All software development is like that.

izacus 1y ago
This looks like one of those projects that will never settle and have a stable slower release cycle.
- fivestones 1y ago
  I don’t think so. They are steadily approaching their defined and published goals for stable release. I’m guessing it will come this year.
- rhizome 1y ago
  v0.46.4_p3

deleted 1y ago

[deleted]

Theodores 1y ago

To be honest, a decent image server that can be the root server for a CDN and do the right things with modern web formats is something that should be standard and built in by now, with nobody needing to build and install their own. That said, this is far better than my own non-existent image server. For me a measure of quality is the rendered HTML code, which should use all the content sectioning elements and not be bloated with gazillions of divs and classes. This software is well off the pace in this regard.

wer232essf 1y ago

[flagged]

WD-42 1y ago

This looks like a project that’s under heavy development (it is) responsibly keeping up with dependencies. This gives me more confidence, not less.

ta10496520945 1y ago

so you find it too immichure? <jk>

tootie 1y ago

Why is docker compose a red flag? That feels like a benefit to me.

cowmix 1y ago
100% -- firs time I have seen providing a docker compose file is a sign of weakness.
tracker1 1y ago
Yeah... I'm not sure that I've ever seen a complex app with multiple, separate service/database requirements (redis, pg, etc) packaged in a Linux distro repository... but I could be wrong.
- dingnuts 1y ago
  controversial but docker compose is for development and demos. for prod give me a binary, a config file / systemd unit file, and tell me how to configure external dependencies and let me decide how to manage them. and if you're serious, k8s config. otherwise don't waste my time.
  - tootie 1y ago
    But this is for running on an old PC in your closet next to your router. Not serving 40k concurrent users. I would not even consider trying to scale it past a dozen family members. And anytime I run an upgrade or config change I just do it in prod.
  - tracker1 1y ago
    You can get all that information from a compose file.
  - pkulak 1y ago
    Waste your time? You know what would waste my time? Building out my own deployment of Redis/Postgres, all the dependencies, systemd services, ML server, and backup solutions (yes, the compose takes regular DB backups for you) and then keeping it all updated manually, just to host photos on my local network for my family of 4. Do you think making your life needlessly difficult is a feature? Then read the docs and deploy to a K8s cluster. Nothing is preventing you from doing that.

lhamil64 1y ago

I've been keeping my eye on Immich for a while and keep waiting for a stable release to try it out, but that hasn't happened yet. I'm also dreading having to setup proper backups if I were to switch to this over Google photos. My current solution is to backup critical homelab things to Google Drive automatically but I'd want a proper off-site backup if I were going to self host all my photos.

para_parolu 1y ago
I quite like their backup story. Immich has one folder that you need to backup. It stores file and dump of db that immich does on schedule. I don’t care that much about db dump but backuping photos os very easy
pkulak 1y ago
So you use Google Photos and backup to Google Drive? Sorry to say, but if Google ever decides to deactivate your account (which can and will happen for any reason, real or imagined), you lose everything. A stable release is only a couple months out. Maybe do a Takeout until then, and put it in S3 Glacier, or similar?

madeofpalk 1y ago

> Ironically, just after posting that I came across this, which I think proves why my concern is warranted: https://news.ycombinator.com/item?id=45169657 https://news.ycombinator.com/item?id=45169657 > Debian isn't immune to this, but it's much harder for such an attack to be successful when dependencies aren't constantly changing. Immich is more immune to this issue because they wait 5 days before raising PRs to bump dependencies, which is a good practice https://github.com/immich-app/.github/blob/main/renovate-config.json#L10C3-L10C33 https://github.com/immich-app/.github/blob/main/renovate-con...

rlpb 1y ago
OK, more maybe, but that is nothing next to Debian, where a huge Debian userbase settles on a single set of versions for all dependencies for a year (usually more) at a time.
- madeofpalk 1y ago
  I would expect an operating system and a single application have a different approach to dependency management.
  - rlpb 1y ago
    Debian is both an operating system and a distribution of single applications. Its (excellent) dependency management applies to both. It doesn't have a software supply chain problem because it takes dependency management seriously.

tracker1 1y ago

Are there any/many applications that require a configured database (like PostgreSQL) and Redis/Valkey in Debian's package manager at all? Also, Docker-compose is pretty great in terms of getting complex applications up and running.

yesnomaybe 1y ago

You want to run it in docker and manage it with some tool. I use dockge and click the upgrade button every couple of days / weeks (when the app or website tells me). that's it. Immich is an excellent piece of software, I have switch all my photo needs from over 25 years to it. It will mature and it actually already is. Don't hold yourself back with such practicalities.

deleted 1y ago
[deleted]