Hacker Newsnew | past | comments | ask | show | jobs | submit | mcherm's commentslogin

I did.

Then the rules were changed.


I don't think that's the real issue. The problems with billing and dashboards at cloud vendors are not new within the past few years, they have existed far longer than the LLM coding.


There is one little-discussed down side to ever shorter-lived certificates...


Letsencrypt is not the only acme authority. ZeroSSL is the other popular one. There are others.


ZeroSSL offered for free 3 single name certificates. The next plan was $180 yearly.

Actalis offered unlimited single name certificates. Why are ZeroSSL more popular?

Google offered unlimited certificates with multiple names and wild cards. But they required a GCP account seemingly. It would require to give Google personal information, a phone number, and automatic payment permission. And Google not disable your account because your spouse uploaded images for your child's doctor.

All others I saw charged for each certificate.


It's popular because Caddy uses it. I am not sure if it's default or just an option though.


Only if you’re reissuing right before expiration, which is a stupid thing to do. If you have a 47-day cert, best practice is to reissue on day 30, meaning LE would need to be down for more than two weeks before anything went wrong.

If this outage breaks your system, that’s entirely on you, not Let’s Encrypt.


Short-lived = 6 days. Even if you reissue after 2 or 3 days, that's… not a lot of breathing room.


You have to opt in, and they are honest about the tradeoffs when discussing them:

> Short-lived certificates are opt-in and we have no plan to make them the default at this time. Subscribers that have fully automated their renewal process should be able to switch to short-lived certificates easily if they wish, but we understand that not everyone is in that position and generally comfortable with this significantly shorter lifetime. We hope that over time everyone moves to automated solutions and we can demonstrate that short-lived certificates work well.

https://letsencrypt.org/2026/01/15/6day-and-ip-general-avail...


That's not really an answer, especially with:

> We hope that over time everyone moves to automated solutions and we can demonstrate that short-lived certificates work well.

They're expressly trying to show that this is a viable approach. It's actually kinda good that this outage, whatever it is, is happening now, as it's giving them a chance to demonstrate (or not) that they can deliver.


> no plan to make them the default at this time

At this time! Boil the frog slowly...


Is the frog the guy that still won't automate their certificates?


Mine are automated. Somehow it reminds me of prayer wheels though...


Forcing certificates to expire in less than a year means people don't forget how to update them, which is a big benefit.

And once people automate, short-lived certificates are a workable plan B for how to revoke certificates and have the revocation actually work.

These are both reasonable goals.


> people don't forget how to update them

Seriously? I don't even remember how the letsencrypt auto renew service is called. No idea how I did the initial setup either.


Yes, seriously. Forgetting how to set up the automation is a different and significantly smaller issue.


3-4 days is a ton of breathing room


You're holding your 6-day cert wrong


Chill, it's 2 hours. They recommend renewing at the first third of the 160 hrs.


Thought that was the iPhone 6



Only as long as LE isn’t down for 17 days, then we’re in big trouble.


If you're using ACME to handle certificate rotation, can't you just configure multiple providers?



Haven't you heard? Under the new form of government in the US, random tweets from the President ARE government policy, superseding laws and any act of Congress.

The Supreme Court has blessed this new form of government, declaring that the President is immune to all laws, but retaining for themselves the right to reverse any tweet on the "shadow docket".


It’s funny that you say that tweets are US policy when the Supreme Court struck down Trump’s tariffs.


The tariffs were in all sense US policy until they got struck down. There is nothing inconsistent here


In the intervening 6-12 months, they were policy. Since then he's tweet^H^H^H^H^Htruthedsome new tarriff policies that are currently in effect.


You're obviously trolling. Those are called "truths", and you know it!


Does it? How do you know?

If they start excluding random content (eg: .git) without effective notice, maybe they AREN'T backing up everything you think they are.


You don’t do quarterly restore tests?


How do you do that?

My naive idea: Download 100 TB every 3 month to a 2nd device, create a list of files restored, validate checksums with the original machine, make a list of files differing and missing, check which ones are supposed to be missing? That sounds like a full time job.


Now days its: hi claude, write script in language I hate the less which will ...


Some companies are in the business of trust. These companies NEED to understand that trust is somewhat difficult to earn, but easy to lose and nearly IMPOSSIBLE to regain. After reading this article I will almost certainly never use or recommend Backblaze. (And while I don't use them currently, they WERE on the list of companies I would have recommended due to the length of their history.)


> trust is somewhat difficult to earn, but easy to lose and nearly IMPOSSIBLE to regain

Eh, I don't agree. Case in point: Microsoft.

Or in other words: a sucker is born every minute.


That's why Microsoft isn't a company that relies on trust and doesn't really care about it. They rely on inertia to continue to exist because they used to be popular and so now we can't just get rid of them all at once.


Nobody who’s actually considered Microsoft trusts Microsoft. It’s just the devil you know and it’s not like there’s reasonable or trustworthy alternatives in most cases.


In my circles at least, people aren't using Microsoft products on their own. At home they either use Macs or Linux.

We grew up compiling Linux kernels when Microsoft was busy spreading FUD about how dangerous it would be to unleash open source and use open source. That using Linux on something critical like servers would lead to absolute chaos because the kernel wasn't written by someone who knew how to move Mt. Fuji.

I imagine Backblaze will soon realize why good PR firms are so expensive.


So you are suggesting that a private communications and messaging system that proports to offer reliable anonymity is a reasonable use case for more-or-less unsupervised development by Claude? Because that is just the sort of use case where I would NOT trust an unsupervised AI.


That is probably the reason they added the /s at the end


How does my attention, the time I spend reading news.ycombinator.com, pay for the site? I DON'T run an ad blocker, but I am not watching any ads here.


HN regularly runs ads for YC companies. https://news.ycombinator.com/jobguide.html


HN is a recruitment tool for Y Combinator. Someone is paying for it with their attention.

Did you think they are running it out of the goodness of their heart?


The significance of the changeover would be much more impactful if the chart showed a longer history.


It's the third sentence of the article:

> the district court ruled that using the books to train LLMs was fair use but left for trial the question of whether downloading them for this purpose was legal.


No, those are separate issues.

The pipeline is something like: download material -> store material -> train models on material -> store models trained on material -> serve output generated from models.

These questions focus on the inputs to the model training, the question I have raised focuses on the outputs of the model. If [certain] outputs are considered derivative works of input material, then we have a cascade of questions which parts of the pipeline are covered by the license requirements. Even if any of the upstream parts of this simplified pipeline are considered legal, it does not imply that that the rest of the pipeline is compliant.


Consider the net effect and the answer is clear. When these models are properly "trained", are people going to look for the book or a derivative of it, with proper attribution?

Or is the LLM going to regurgitate the same content with zero attribution, and shift all the traffic away from the original work?

When viewed in this frame, it is obvious that the work is derivative and then some.


That is your opinion, but the judge disagreed with you. The decision may have been overturned on appeal, but as it stands, in that courtroom, the training was fair use.


I can memorize a song and it will be fair use too, but it won't be anymore once I start performing it publicly. Training itself is quite obviously fair use, what matters is what happens next.


This is also, unfortunately, the only way this can be settled. Making LLM output legally a derivative work would murder the AI golden rush and nobody wants that


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: