(immich.app)

1045 points janpio | 1 comments | 22 Oct 25 20:53 UTC | HN request time: 0.204s | source

Show context

kevinsundar ◴[22 Oct 25 23:07 UTC] No.45676293[source]▶

This may not be a huge issue depending on mitigating controls but are they saying that anyone can submit a PR (containing anything) to Immich, tag the pr with `preview` and have the contents of that PR hosted on https://pr-<num>.preview.internal.immich.cloud?

Doesn't that effectively let anyone host anything there?

replies(5): >>45676432 #>>45676486 #>>45678610 #>>45679187 #>>45680250 #

rixed ◴[23 Oct 25 05:57 UTC] No.45678610[source]▶

>>45676293 #

So basically like https://docs.google.com/ ?

replies(1): >>45678742 #

1. jeroenhd ◴[23 Oct 25 06:14 UTC] No.45678742[source]▶

>>45678610 #

Yes, except on Google Docs you can't make the document steal credentials or download malware by simply clicking on the link.

It's more like sites.google.com.

↑

Google flags Immich sites as dangerous