I do understand and share people's hatred of corporate-owned, centralised cloud AI.
I understand (though share to a lesser degree) people's ethical concerns about how these models were trained (copyright has been broken for a while now, this just exacerbates it).
But this level of outrage about using local models on an opt-in basis strikes me as hysterical.
The critical part is: how many supposed "quality" alternatives have been proven not to do any logging? Mullvad has been proven to be solid. They were raided and had jolly little to hand over to authorities on their customers.
How many of the other VPN services can say that about themselves?
I've seen Immich mentioned around here before, but I've honestly never set up even a real homelab or sever before, so that's a bit daunting.
I haven't been in this space for too long either, but immich is what brought me here. I tried it out locally - no deecated server, just spun up immich on my desktop machine to try it out. And it was just so good it made me want to have a server and learn the ropes.
I'd recommend you try it out this way too. We'll see each other on the other side of that rabbit hole. ;)
That's an accurate diagnosis. U.S. big tech companies all follow the same playbook: use VC to buy off or price-dump to death all of your competitors. Become a monopoly. Then enshittify and extract the maximum amount of wealth from b2b and retail customers by increasing the cost of your services.
Any sane country would have drowned these companies in anti-trust cases and carved them up. But political leadership at the time was too high on neoliberal free market ideology and the fairytales these self-styled "tech geniuses" wove around themselves. Now big tech has effectively bought off the U.S. government.
They're in for a nasty surprise when they find out that the U.S. is not the world, and the rest of the world can do pretty well without the U.S....
Good luck expanding that to the rest of the world which is just discovering that, while not perfect, China's open weights models are
a) good enough for 95% or all companies out thereb) a lot cheaper, also because they'rec) self-hostable, meaning: they'll always be available, unlike U.S. cloud AI which you'll be cut off from whenever Diaper Donnie feels it's time for yet another bribe.
I second this. Firmware on these controllers is really hit and miss. My first controller (gen 5, iirc) worked flawlessly out of the gate. My second (gen 6 (?)) would co connect and then disconnect again. A firmware update (on Windows, grml) did the trick back then (and now I'm not touching that shit again).
It's a mixed bag really. Disabling JavaScript thwarts a lot of tracking efforts. But at the same time it puts you into a very small niche of users that, combined with other data points (user agent, IP location) makes you pretty fingerprintable.
I feel you. Handoff was dodgy af. I've switched to BasicSync for this very reason. It's a minimal Frontend, handling only execution conditions on Android. All config is done through the webUI. It works great and avoids some, if not all of the trust issues.
It feels like nitpicking, but there's a relevant difference here. If you can only access the weights (and not the training data and the learning algorithms used), it's hard to get (say) a Chinese model to freely talk about Tiananmen Square Massacre. (Just tried it locally on Deepseek R1; it's doable, but takes some prompt hacking.) The models may be freely available, but there's bias and censorship baked into them.
Immich is dead-easy to set up on its own. I'm a great fan and have been running it for >2 years now.
That said, I don't think it'll work for you because:
I gather you have little experience in self-hosting services. Sure, one can learn all that, but if you're becoming a parent soon, your priorities will be elsewhere (as they should).
self-hosting stuff isn't a one-shot - it does come with maintenance costs. You need to keep your boxes up to date, swap out dead hardware, manage backups... You may not have time for that.
Running immich itself is relatively easy. But running it securely is a different can of worms. Immich is a young project, written by enthusiasts, but not vetted for security like professionally-deployed software is. Thus, it's not advisable to expose it to the open internet. Since you want to share access to others, you'd have to setup Wireguard VPN tunnels for your relatives, which complicates matters.
Obviously, I'm making a lot of assumptions about you. Whether these are true is up for you to decide.
Thanks for providing some evidence at last. You're not wrong on many of those points, but not entirely right either.
Phone numbers are an issue, true, though you can get around that using a burner SIM or even a virtual phone number. Also, contact discovery has been working without exposing your phone number for over a year now.
a phone from Google or Apple
The phone can be made by anyone. The OS needs to be Android or iOS at some point, which is unfortunate; pure (desktop) Linux usage isn't possible. That said, deGoogled Android has been around for more than a decade, allowing you to use Android in a privacy-friendly way. So if you want, you absolutely can avoid being tied to Google and use Signal.
As you can see, there's a lot more nuance here than "Signal isn't private"; privacy, after all, isn't binary, but rather a gradient. For what it's worth, Signal is more private than many messengers out there by a long shot, and it allows you to use it in more privacy-friendly ways if you so desire. While there are messengers out there that go even further in terms of security, privacy and decentralisation, a lot of them come with usability and convenience drawbacks. The way I see it, Signal sits in a Goldilocks Zone of "private enough" (for most threat models) and "convenient enough" for mainstream adoption. You can have the most secure and air-tight messenger; if there's nobody there to talk to, it's no more than a technically sophisticated brick. For now, Signal may be our best shot for mainstream adoption of reasonably private and secure messaging. If your threat model is higher than that of average Joe, by all means, go for Briar, SimpleX chat or any of the more hardcore options.
Ignore the downvotes. That's a fair question to ask, but one that does have answers. Signal is FOSS, has E2EE and was audited several times, so we know that
it did not contain any backdoors at the time of the audit
it will not for the foreseeable future (they'd be visible in the client code)
I need not trust the server code since messages are E2EE
Thus, while mistakes do happen and can open up severe vulnerabilities, cf. Heartbleed, there's reason to assume that Signal is relatively secure. Signal's centralisation of server infrastructure is a valid concern, but not for security, but rather for
privacy (they might capture metadata, although it appears they don't; nation-state actors trying to subpoena user data have so far only gotten "date of registration" and "last online", which appears to be all they're storing; that's as close to "zero knowledge" as you get)
availability (as the recent AWS outage has shown, which took out Signal as well)
I do understand and share people's hatred of corporate-owned, centralised cloud AI.
I understand (though share to a lesser degree) people's ethical concerns about how these models were trained (copyright has been broken for a while now, this just exacerbates it).
But this level of outrage about using local models on an opt-in basis strikes me as hysterical.
Feel free to change my mind.