Hacker Newsnew | past | comments | ask | show | jobs | submit | mcherm's commentslogin

I don't think that's the real issue. The problems with billing and dashboards at cloud vendors are not new within the past few years, they have existed far longer than the LLM coding.


There is one little-discussed down side to ever shorter-lived certificates...


Letsencrypt is not the only acme authority. ZeroSSL is the other popular one. There are others.


ZeroSSL offered for free 3 single name certificates. The next plan was $180 yearly.

Actalis offered unlimited single name certificates. Why are ZeroSSL more popular?

Google offered unlimited certificates with multiple names and wild cards. But they required a GCP account seemingly. It would require to give Google personal information, a phone number, and automatic payment permission. And Google not disable your account because your spouse uploaded images for your child's doctor.

All others I saw charged for each certificate.


It's popular because Caddy uses it. I am not sure if it's default or just an option though.


Only if you’re reissuing right before expiration, which is a stupid thing to do. If you have a 47-day cert, best practice is to reissue on day 30, meaning LE would need to be down for more than two weeks before anything went wrong.

If this outage breaks your system, that’s entirely on you, not Let’s Encrypt.


Short-lived = 6 days. Even if you reissue after 2 or 3 days, that's… not a lot of breathing room.


You have to opt in, and they are honest about the tradeoffs when discussing them:

> Short-lived certificates are opt-in and we have no plan to make them the default at this time. Subscribers that have fully automated their renewal process should be able to switch to short-lived certificates easily if they wish, but we understand that not everyone is in that position and generally comfortable with this significantly shorter lifetime. We hope that over time everyone moves to automated solutions and we can demonstrate that short-lived certificates work well.

https://letsencrypt.org/2026/01/15/6day-and-ip-general-avail...


That's not really an answer, especially with:

> We hope that over time everyone moves to automated solutions and we can demonstrate that short-lived certificates work well.

They're expressly trying to show that this is a viable approach. It's actually kinda good that this outage, whatever it is, is happening now, as it's giving them a chance to demonstrate (or not) that they can deliver.


> no plan to make them the default at this time

At this time! Boil the frog slowly...


Is the frog the guy that still won't automate their certificates?


Mine are automated. Somehow it reminds me of prayer wheels though...


Forcing certificates to expire in less than a year means people don't forget how to update them, which is a big benefit.

And once people automate, short-lived certificates are a workable plan B for how to revoke certificates and have the revocation actually work.

These are both reasonable goals.


> people don't forget how to update them

Seriously? I don't even remember how the letsencrypt auto renew service is called. No idea how I did the initial setup either.


Yes, seriously. Forgetting how to set up the automation is a different and significantly smaller issue.


3-4 days is a ton of breathing room


You're holding your 6-day cert wrong


Chill, it's 2 hours. They recommend renewing at the first third of the 160 hrs.


Thought that was the iPhone 6



Only as long as LE isn’t down for 17 days, then we’re in big trouble.


If you're using ACME to handle certificate rotation, can't you just configure multiple providers?



Haven't you heard? Under the new form of government in the US, random tweets from the President ARE government policy, superseding laws and any act of Congress.

The Supreme Court has blessed this new form of government, declaring that the President is immune to all laws, but retaining for themselves the right to reverse any tweet on the "shadow docket".


It’s funny that you say that tweets are US policy when the Supreme Court struck down Trump’s tariffs.


The tariffs were in all sense US policy until they got struck down. There is nothing inconsistent here


In the intervening 6-12 months, they were policy. Since then he's tweet^H^H^H^H^Htruthedsome new tarriff policies that are currently in effect.


You're obviously trolling. Those are called "truths", and you know it!


Does it? How do you know?

If they start excluding random content (eg: .git) without effective notice, maybe they AREN'T backing up everything you think they are.


You don’t do quarterly restore tests?


How do you do that?

My naive idea: Download 100 TB every 3 month to a 2nd device, create a list of files restored, validate checksums with the original machine, make a list of files differing and missing, check which ones are supposed to be missing? That sounds like a full time job.


Now days its: hi claude, write script in language I hate the less which will ...


Some companies are in the business of trust. These companies NEED to understand that trust is somewhat difficult to earn, but easy to lose and nearly IMPOSSIBLE to regain. After reading this article I will almost certainly never use or recommend Backblaze. (And while I don't use them currently, they WERE on the list of companies I would have recommended due to the length of their history.)


> trust is somewhat difficult to earn, but easy to lose and nearly IMPOSSIBLE to regain

Eh, I don't agree. Case in point: Microsoft.

Or in other words: a sucker is born every minute.


That's why Microsoft isn't a company that relies on trust and doesn't really care about it. They rely on inertia to continue to exist because they used to be popular and so now we can't just get rid of them all at once.


Nobody who’s actually considered Microsoft trusts Microsoft. It’s just the devil you know and it’s not like there’s reasonable or trustworthy alternatives in most cases.


In my circles at least, people aren't using Microsoft products on their own. At home they either use Macs or Linux.

We grew up compiling Linux kernels when Microsoft was busy spreading FUD about how dangerous it would be to unleash open source and use open source. That using Linux on something critical like servers would lead to absolute chaos because the kernel wasn't written by someone who knew how to move Mt. Fuji.

I imagine Backblaze will soon realize why good PR firms are so expensive.


So you are suggesting that a private communications and messaging system that proports to offer reliable anonymity is a reasonable use case for more-or-less unsupervised development by Claude? Because that is just the sort of use case where I would NOT trust an unsupervised AI.


That is probably the reason they added the /s at the end


How does my attention, the time I spend reading news.ycombinator.com, pay for the site? I DON'T run an ad blocker, but I am not watching any ads here.


HN regularly runs ads for YC companies. https://news.ycombinator.com/jobguide.html


HN is a recruitment tool for Y Combinator. Someone is paying for it with their attention.

Did you think they are running it out of the goodness of their heart?


The significance of the changeover would be much more impactful if the chart showed a longer history.


It's the third sentence of the article:

> the district court ruled that using the books to train LLMs was fair use but left for trial the question of whether downloading them for this purpose was legal.


No, those are separate issues.

The pipeline is something like: download material -> store material -> train models on material -> store models trained on material -> serve output generated from models.

These questions focus on the inputs to the model training, the question I have raised focuses on the outputs of the model. If [certain] outputs are considered derivative works of input material, then we have a cascade of questions which parts of the pipeline are covered by the license requirements. Even if any of the upstream parts of this simplified pipeline are considered legal, it does not imply that that the rest of the pipeline is compliant.


Consider the net effect and the answer is clear. When these models are properly "trained", are people going to look for the book or a derivative of it, with proper attribution?

Or is the LLM going to regurgitate the same content with zero attribution, and shift all the traffic away from the original work?

When viewed in this frame, it is obvious that the work is derivative and then some.


That is your opinion, but the judge disagreed with you. The decision may have been overturned on appeal, but as it stands, in that courtroom, the training was fair use.


I can memorize a song and it will be fair use too, but it won't be anymore once I start performing it publicly. Training itself is quite obviously fair use, what matters is what happens next.


This is also, unfortunately, the only way this can be settled. Making LLM output legally a derivative work would murder the AI golden rush and nobody wants that


Many people are taking what I believe to be the wrong message here.

I believe the author's intent was (or should have been) to describe how THEY wanted to receive communication, not how EVERYONE should.

A skilled communicator will craft their message for the audience. Some want "just the facts" with no social lubricant. Others want the banter to build person-to-person relationships. Some want a quick statement of context for everything. If you can adjust the message to the audience you will be more successful at working with them.

I have begun including "how I want you to communicate with me" as part of my standard "introduce myself to new team members" talk.


> I believe the author's intent was (or should have been) to describe how THEY wanted to receive communication, not how EVERYONE should

I thought that would be too obvious to state.


Most of your post discusses communication in general terms. When you say that it’s unprofessional and rude to begin a Slack message with a greeting before getting to the meat of the issue, there’s no indication at all that you only meant this to apply to Slack messages sent to you personally.

At one point you say, “Nobody reads ‘hope you had a great weekend’ and thinks better of the person who wrote it.” Who is going to read that and think that “nobody” only applies to you?

If you really meant this to describe how you want to receive communication, not how everyone should, well, this is an example of catastrophically bad communication. Maybe you’d benefit from some of the mindset that leads people to write and appreciate useless greetings.


> At one point you say, “Nobody reads ‘hope you had a great weekend’ and thinks better of the person who wrote it.” Who is going to read that and think that “nobody” only applies to you?

I argued why I believe this does not a good way of communication in business or professional-focused environment, because as explained, habitual padding tends to train readers to skim, because they learn that the lines often contain little of substance. For people who value directness (which, in my experience, includes many in serious professional settings) this kind of attitude is not appreciated. That said, it is simply my own rationale for preferring a more direct style of communication.

>Maybe you’d benefit from some of the mindset that leads people to write and appreciate useless greetings.

I come from a culture where elaborate politeness and social niceties are not only common but often expected, and I do practice them in the appropriate contexts. However, when the goal is to build something, solve a problem, or exchange ideas efficiently, I prefer a norm I explained, that is, directness and the substance of the message to take over.


As you said yourself, this is very culture dependent.

In my culture, elaborate politeness is NOT expected, and when I first started working with foreigners I had some funnily awkward (awkwardly funny) social interactions where they greeted me with customary "How are you? How was your day" and I started politely but awkwardly going over my day thinking "this is not your damn business".

My point being, if you work in a culture that expects some behaviour, it is necessary to follow it. Breaking the protocol (even by omission) is a signal in itself, and if the signal is understood as "I don't like you" or "I am rude" or "I am better than you" then it's counterproductive. Especially important if you're not close with the person communicating with, so misunderstandings are likely.


How does this jibe with describing how you want to receive communication, not how everyone should?


Interesting, perhaps the message was too narrowly, directly-focused and was missing necessary social context?

This feels like a koan about the subjectivity of which details are important to include.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: