Immich Machine Learning (ghcr.io/immich-app/immich-machine-learning:v3) uses a library called ONNX Runtime, from Microsoft.

This library has telemetry enabled by default, and the Docker build of Immich Machine Learning does not disable it.

I found out about this because my DNS logs were showing thousands and thousands of blocked queries to resolve mobile.events.data.microsoft.com.

I don't think this is acceptable for something that is going to process all my photos, especially since it goes to Microsoft, even if it's anonymised or whatever. The whole point of self hosting is avoiding shit like this.

Mitigations:

Add the environment variable ORT_DISABLE_TELEMETRY=1 to the immich-machine-learning container.

Aditionally, it is good practice to isolate all containers that do not need internet access from the internet. For example, with Docker compose, you can create an isolated network for Immich:

networks: immich-iso: internal: true driver: bridge 

Then, on all immich containers:

networks: - immich-iso 

Be sure to add your reverse proxy to this network so that it can access the Immich server.

This was reported to the Immich issue tracker in August and they have not addressed it yet.

Found an old Asus prebuilt in a closet and wondering if it makes sense to use as a starter box or not.

Specs:

• CPU: Intel i5-3340S (4c/4t, 3rd gen, 65W TDP)
• RAM: 4GB DDR3
• GPU: GT 620 2GB
• Storage: 500GB HDD
• PSU: 300W OEM

Is this worth tinkering with, or is 3rd gen Intel idle power so bad that I’d spend more on electricity than just buying a cheap N100 mini PC? Scrap it or keep it?

Hey everyone,

I've been doing some research as to what it takes to move off iCloud as I want to gain some autonomy moving between different desktop and mobile devices. Consequently, this means I'll have to take my family with me for most things.

Some of the candidates I've identified:

1. Passwords -> Vaultwarden
   
2. Photos -> Immich
   
3. Drive -> Seafile
   
4. Calendar -> Davis
   
5. Notes -> Memos
   
6. Notes/groceries -> KitchenOwl
   
7. Hide My Email -> Addy/Proton

I really wanted Immich to be the first as it would cut my iCloud storage bill, but we rely heavily on some of the shared libraries features. I looked into the Noodle Gallery fork, but I'm not quite ready to take that risk yet. So I started with Vaultwarden instead. I documented it in a YouTube video and a written guide with all the commands.

Some of my learnings:

- Switching was really easy: On the iPhone, "Export Data to Another App" moved passwords, passkeys and 2FA codes into the Bitwarden app effortlessly. The awesome CXP protocol makes this all possible.

- Family support isn't that hard either: I turned off sign-ups, created a Family organization, and moved shared logins into the shared collection. An email relay/server is not necessary as they can register with the invited address directly.

- Backups: I made sure I had a proper backup system in place first. I use Proxmox Backup Server.

- Updates: I used the Alpine version of the PVE helper script with automatic updates that run weekly.

- Remote access: By far the most intensive thing to set up. Technically not required, but this allows updates to your vault outside of the house. I initially set it up to use Tailscale with split-horizon DNS. The trade-off is that you need to have Tailscale active on your phone. There are tons of alternatives for this and I'll be tweaking this going forward. Maybe a move to Netbird or open access with better firewall rules.

If you're in the process of moving off iCloud or Google: I'd love to hear about your experiences and which services were the hardest to get the family on board with.