Entering Public Beta - <AUTHOR> https://letsencrypt.org/2015/12/03/entering-public-beta.html <comment><USER3> You may also want to try alternative client from [https://github.com/kuba/simp_le](https://github.com/kuba/simp_le). It can be easily dropped into crontab and renew certificates when necessary.

Disclaimer: I'm the author of simp_le and developer of the official client :)

<comment><USER4> Ehhhh, so I get why you made this, but at the same time, LetsEncrypt intentionally chose 90 days for the duration of the certs. Presumably because renewing a cert is a positive confirmation that you still retain ownership. You _actively_ performed an action that declared: hey I still retain control of this and it hasn't been compromised. (as opposed to other states your cert could be in -- abandoned, compromised, password forgotten and you were too lazy to get the cert revoked-- trust me, engineers made cron because we were lazy especially when it comes to mundane things).

This is around-about way of saying that 90 days was a well-thought out duration to issue a cert and the process of renewing it _manually_ is there as a positive (rather than passive) confirmation you retain control. These guys are doing a public service, on par with archive.org and the EFF. I'm not sure, but even though I've been using cron since before I was a teenager, I'm not throwing that entry in.

Edit: Whoops, so I was half-wrong, mea culpa. [https://letsencrypt.org/2015/11/09/why-90-days.html](https://letsencrypt.org/2015/11/09/why-90-days.html) Part 1 addresses the security issue I brought up, and part 2 endorses automation. My mistake.

<comment><USER5> Let's Encrypt gives encouraging automation as a reason why they choose 90 days:

 _They encourage automation, which is absolutely essential for ease-of-use. If we're going to move the entire Web to HTTPS, we can't continue to expect system administrators to manually handle renewals. Once issuance and renewal are automated, shorter lifetimes won't be any less convenience than longer ones._

[https://letsencrypt.org/2015/11/09/why-90-days.html](https://letsencrypt.org/2015/11/09/why-90-days.html)

<comment><USER6> That philosophy is perplexing because system admins already have to manually handle things like software upgrades. Unlike SSL renewals, upgrades usually occur to an arbitrary frequency yet admins seem to be able to cope.

I'd also contend that 90 day expiry makes end-users less sensitive to certificate change notifications; at present if a website renews its cert after a year I receive a pop-up and I pay attention. Receiving one every 60 days will just condition people to start ignoring cert changes, whether valid or not.

<comment><USER7> What? No browser displays a notification when a website changes its cert. It doesn't even show you a notification if it changes its _key,_ that's the whole point of key pinning: [https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinn...](https://wiki.mozilla.org/SecurityEngineering/Public_Key_Pinning) (A pin failure results in a _non-bypassable_ HTTPS error: [https://projects.dm.id.lv/Public-Key- Pins_test](https://projects.dm.id.lv/Public-Key-Pins_test) )

<comment><USER8> The most popular way to get that is: [https://addons.mozilla.org/en- US/firefox/addon/certificate-p...](https://addons.mozilla.org/en- US/firefox/addon/certificate-patrol/)

I personally no longer use it because of all the noise, even before lets encrypt.

</comment></comment></comment></comment></comment></comment><comment><USER9> FYI, if you don't want to install anything to try it out, you can use [https://gethttpsforfree.com](https://gethttpsforfree.com) which is a browser- based ACME client. It doesn't ask for private keys, so you don't need to trust it.

<comment><USER10> I'm a layman when it comes to secure websites and certificates. I remember reading that the "free https" provided by Cloudflare meant Cloudflare owned the private keys to something and was able to see all traffic. Is that the case with Let's Encrypt? Because if it is I don't see as an improvement at all.

<comment><USER11> No, you never send your private key to anyone, with any HTTPS certificate generating scheme.

All they do is sign your public key.

<comment><USER12> At least you should not. StartSSL (and probably other CAs) has a prominent feature to create your key pair for you, which you need to skip to use a signing request. Always use the latter!

</comment></comment></comment></comment><comment><USER13> Happy to see this project hit public beta! I've deployed Let's Encrypt on a couple of side projects during the last month or so, and my experience has been mostly positive.

The official client still needs some work, especially in terms of auto- configuration on apache, nginx and others, but it's getting there. Some say it's become a bit bloated, which is true to a certain degree, but probably necessary to achieve the goals they have set for it.

Luckily, Let's Encrypt is based on an open specification (ACME) and it's really easy to implement a custom client. There are already more than 10 client implementations out there[1], all created with different goals in mind - anything from a Ruby gem to a simple scripts to get your own CSR signed. If you're not running your typical LAMP or LEMP stack, and don't want to run the official client which is more of a certificate manager requiring root access, that's definitely something to look into.

Note that if Windows XP support is relevant for your use-case, you might want to hold off. There's currently a problem with how XP deals with name constraints, which means any application using Windows XP's SSL API (I believe it's called schannel?) won't work - for example Internet Explorer and Chrome. This might get fixed in the future[2]. Hopefully, that's not relevant to you. :)

[1]: [https://community.letsencrypt.org/t/list-of-client- implement...](https://community.letsencrypt.org/t/list-of-client- implementations/2103?u=pfg) [2]: [https://github.com/letsencrypt/letsencrypt/issues/1660](https://github.com/letsencrypt/letsencrypt/issues/1660)

<comment><USER14> I love this one in particular:

[https://github.com/diafygi/acme-tiny/](https://github.com/diafygi/acme-tiny/)

<comment><USER15> Very good indeed!

</comment></comment></comment><comment><USER16> Here's a Go client that has no dependencies and runs everywhere: [https://github.com/xenolf/lego](https://github.com/xenolf/lego)

<comment><USER17> I just used it, and it works beautifully. Much easier and less impact than the official client.

Thanks,

</comment></comment><comment><USER18> They keep trying to push the idea that letsencrypt should be ran as root. If you disagree with that, I ran it as a normal user using:

        letsencrypt -t --work-dir /tmp --logs-dir /tmp \
        certonly --webroot /www/public -d example.com

Except on my system the letsencrypt command did not work. It failed with an "Operation not permitted". So I edited the webroot.py file, and commented out line 108 that said:

        # Remove execution bit (not needed for this file)
        os.chmod(path, filemode & ~stat.S_IEXEC)

It ran fine without root, sudo, or su.

Then I added this to nginx.conf:

        listen 443 ssl http2;
        ssl_certificate /usr/local/etc/letsencrypt/live/example.com/fullchain.pem
        ssl_certificate_key /usr/local/etc/letsencrypt/live/example.com/privkey.pem

It gets an A+ on ssllabs.com, and it works fine in the browser. When I click the lock it says "Let's Encrypt".

<comment><USER19> > They keep trying to push the idea that letsencrypt should be ran as root.

When you say it that way, it sounds like there's something untoward going on. ;)

From what I understand, the official client _can_ bind to port 80 to do Basic HTTP verification. This requires root privs. The official client can also update many HTTP server config files. I guess you don't need to be root to do this, but it does remove a command line flag. LE is designed to be stupidly simple, but -as you've discovered- it does let more technical users run it in safer modes of operation.

> Except on my system the letsencrypt command did not work. It failed with an > "Operation not permitted".

Odd. If I'm reading the code correctly, it looks like you have to have write and create privs to 'path', so it's odd that you wouldn't also be able to remove the execute bit.

Regardless, would you file a bug about this or -at least- bring it up on the mailing list? It's possible that this is user error, but if it's not, I expect that it's something the LE guys would like to hear about.

<comment><USER20> Actually... its chown that is failing, which is very logical: only root can do chown.

</comment></comment></comment><comment><USER21> I'm the nth author of an ACME (Let's Encrypt) client. It's a single-binary Go client which you can build and upload to your server. It's designed to work like "make"; you tell it what hostnames you want certificates for, and it tries to satisfy those requirements. It can install a cronjob automatically for autorenewal, and the authorization process doesn't require downtime.

[https://github.com/hlandau/acme.t](https://github.com/hlandau/acme.t)

<comment><USER22> Out of all the clients I tried yesterday, this one seemed the most thought out in terms of usability and operations with automation.

</comment></comment><comment><USER23> The official lets-encrypt client has an extremely large dependency graph, and using the client requires server downtime since it takes over port 80. Can either of these things be improved?

<comment><USER24> Yes, this greatly annoyed me too especially given the 3 month expiry time. [https://github.com/diafygi/acme-tiny](https://github.com/diafygi/acme-tiny) is a tiny alternative client without any dependencies (except python itself), and you can use any web server including your usual running one to serve the challenge responses up.

<comment><USER25> It also requires the openssl executable in your path.

<comment><USER9> Luckily, it's less than 200 lines and open source! Please feel free to fork it and modify for your needs :)

<comment><USER25> I was just clarifying for other readers. I looked through it because I've been working on some Python crypto stuff for a while, so I was curious what it used since the statement above was that it only required Python.

</comment></comment></comment></comment></comment><comment><USER26> For those concerned with the official client requiring `sudo`: there are already many alternative clients that are compatible with the Let's Encrypt server, mine included.[1]

I made my own client because I wanted to know what's exactly going on during the certificate issue process. I tried to make the code as simple as possible, so take a look if you have time![2] It's a simple single file script.

[1] [https://github.com/barosl/letsencrypt- simple](https://github.com/barosl/letsencrypt-simple)

[2] [https://github.com/barosl/letsencrypt- simple/blob/master/let...](https://github.com/barosl/letsencrypt- simple/blob/master/letsencrypt-simple.py)

</comment><comment><USER27> In case anyone is looking for an actual cronjob example. This works wonderfully:

      #!/bin/bash
      cd /srv/cert/domain.xyz
      simp_le -d domain.xyz:/srv/www/domain.xyz/html \
         -f key.pem -f cert.pem -f fullchain.pem \
         && service apache2 reload

And in the crontab:

      43 1 * * * /srv/bin/cert-renew || true

EDIT: This is using the simp_le client ([https://github.com/kuba/simp_le](https://github.com/kuba/simp_le)), not the official client. But this one is wayy easier to use.

EDIT 2: Guide here: [https://blog.philippheckel.com/2015/12/04/lets- encrypt-5-min...](https://blog.philippheckel.com/2015/12/04/lets- encrypt-5-min-guide-to-set-up-cronjob-based-certificate-renewal/)

<comment><USER28> It should be noted that this isn't using LetsEncrypt's client.

<comment><USER27> Yes, correct. This is using the simp_le client (as mentioned in [https://news.ycombinator.com/item?id=10672006](https://news.ycombinator.com/item?id=10672006)). The client is easier to use and developed by the same author as the official client. Works wonderfully.

</comment></comment></comment><comment><AUTHOR> EFF's post on the beta, including details on the roadmap: [https://www.eff.org/deeplinks/2015/12/lets-encrypt-enters- pu...](https://www.eff.org/deeplinks/2015/12/lets-encrypt-enters-public-beta)

<comment><USER29> Looks like Certificate Transparency isn't on the roadmap? What's the holdup on that? Seems like a perfect match for something automated like Let's Encrypt.

<comment><USER13> Certificates are already being pushed to CT log servers.

<comment><USER30> SSL Labs claims there's no CT support, but I must admit I'm at a loss if this is a server configuration issue or not.

</comment></comment></comment></comment><comment><USER31> I have seen many howtos recommending to add a monthly cronjob for the certificate renewal on the first day of the month at 12am (0 0 1 * * or @monthly). It is probably better to renew the certificate on a random day/time (30 4 5 * *) to prevent excessive load on their servers.

<comment><USER32> A RANDOM_DELAY is actually built into @monthly, at least on RHEL/CentOS 6+.

</comment></comment><comment><USER33> If you're using FreeBSD and NGINX you may like the guide I wrote the other day. :) [http://savagedlight.me/2015/11/24/lets-encrypt-on-a- freebsd-...](http://savagedlight.me/2015/11/24/lets-encrypt-on-a-freebsd- nginx-reverse-proxy/)

PS: I also made a cron-callable script which checks the expirity time of the cert before telling letsencrypt to renew. It checks if the cert was renewed afterwards, and echos to stderr if renewal didn't take.

</comment><comment><USER18> Now that it's public, and I verified it works...

[https://letsencrypt.org/donate/](https://letsencrypt.org/donate/)

</comment><comment><USER34> This is among the most exciting things going on in the web world, for me. It's a pretty dramatic change that now every website can be encrypted, by default, and in a secure(ish) fashion (it doesn't really do much for proving identity, but SSL has been broken for that for years anyway).

I suspect integrating this has been the most requested feature for Virtualmin for the past several months (and we're about to roll it out, probably next week). For whatever reason, SSL is just always intimidating for people...even when it's been almost entirely automated, the back and forth between the CA and the server and dealing with private keys is a deal-breaker for a lot of non-technical users, so many of our users who are new to web server management have problems with SSL. It follows close behind DNS in terms of how much confusion it causes.

Anyway, I love that Mozilla and others took the initiative to pull this together, and used their not insignificant clout to push it to completion.

<comment><USER18> What else is exciting? This is the most exciting thing for me, which is actually pretty sad. It's 2015, and HTTPS still isn't widespread, and something like this wasn't done before? It's a good little new thing, but it doesn't really push anything forward. It feels like we're still where we were a decade ago.

<comment><USER34> PHP 7 is a pretty big deal for our users, though not particularly to me (though our websites run on Drupal, WordPress, and Mediawiki so we will get some performance benefit from the change).

It does seem ridiculous that something like Let's Encrypt didn't happen sooner. But, now that it's finally here, I'm excited about it. I like that we can also expect mail to get more widespread encryption because of this, as well.

</comment></comment></comment><comment><USER35> Java: I made a cron friendly script to convert the letsencrypt keys to JKS format. [https://github.com/ericbets/letsconvert](https://github.com/ericbets/letsconvert)

</comment><comment><USER36> Any word on *.mydomain.tld certs from letsencrypt? That's the only thing stopping me from installing it today.

<comment><USER19> Is the ability to get any number of subdomain certs at no charge an adequate substitute for wildcard certs?

<comment><USER5> It still might get annoying (for both sides) if you request thousands of them, + you might not want to publish a list of all valid ones. Example: The issue came up in relation to sandstorm.io, which uses (for security reasons) a subdomain for every document that exists on a server.

<comment><USER19> Perhaps I'm ignorant, but I don't see how the _LE_ guys would be annoyed about thousands of requests for TLS certs from a single user. The system _is_ automated, after all. :)

> \+ you might not want to publish a list of all valid ones.

I assume that you mention this to illustrate a scenario where certs with a bunch of SANs is not a solution to the problem? If you weren't, does LE do something like publishing a list of all of the domains for which they have issued certs?

<comment><USER37> > but I don't see how the _LE_ guys would be annoyed about thousands of > requests for TLS certs from a single user. The system is automated, after > all. :)

We have to actually run a complicated server that does things with an external Hardware Security Module. CPU time, disk space, and bandwidth all cost money, and there's a finite amount of money we can spend on resources :)

Thus, rate-limits. That also helps keeps latency low for most users, and prevents DDOSing.

</comment></comment></comment></comment></comment><comment><USER38> Anyway to get a wildcard SSL certificate from Let's Encrypt? Mine is coming up for renewal soon.

<comment><USER39> No, the whole point of LE is that you wouldn't need one because you'd automatically get a named certificate for each one of your sites.

<comment><USER40> Ah you can get any number of certificates for each subdomain you wish?

Aside from dynamic subdomains, that would indeed solve the need for wildcard certificates.

<comment><USER13> Yep, or one certificate for multiple subdomains (SAN certs).

</comment></comment></comment></comment><comment><USER41> How does lets encrypt handle possible phising domains?

Even if there's zero mitigation I think the benefits will outweigh the downsides, but I wonder if there's anything that stops a criminal from registering a domain that is very similar to, say, that of a bank?

I know from experience (ethical hack) that the traditional authorities won't easily let you register 'suspicious' names like: <bank>-<name>.com where the original domain is <bankname>.com. Or something like that.

<comment><USER42> I'd like to know more about this. When you buy domain validated SSL certificate (that costs $5-10) for which the process is completely automated, does the issuing authority really check or care about which domain it is being used on? Does a human (or a program) check the "suspicious factor" of the domain?

<comment><USER43> No. It's easy to currently register an SSL certificate for any domain, even if that domain is similar to the name of another. The main reason this was a "deterrent" to phishers is that generating tons of these was expensive.

The phishers still have to front the cost for the domain itself, so this really isn't going to increase the number of phishing domains. It may increase the number of phishing domains with SSL, but the purpose of Lets Encrypt is to encrypt everything -- not just "official domains"

<comment><USER41> No you are wrong. Perhaps it's not the case everywhere. But like I said, from personal experience I know that certain types of domains are checked. I tried and failed to register a certificate for a phising domain that masqueraded as a banking website.

whether or not this was originaly the point of ssl or not, this is how many non-technical people decide to trust a page or not: by looking at the lock in their browser.

<comment><USER43> > No you are wrong. Perhaps it's not the case everywhere. But like I said, > from personal experience I know that certain types of domains are checked. I > tried and failed to register a certificate for a phising domain that > masqueraded as a banking website.

I never said it's the case everywhere. I said it's easy to register an SSL certificate for basically any domain you actually own, which is true. Basic SSL certificates are not designed to provide extended validation (there is EV certificates for that), they are designed to identify that domain.

</comment></comment></comment></comment></comment><comment><USER44> everyone interested in conspiracy, please read the comments over here: [https://www.schneier.com/blog/archives/2014/11/a_new_free_ca...](https://www.schneier.com/blog/archives/2014/11/a_new_free_ca.html#comments) when bruce schneier wrote about let's encrypt.

<comment><USER45> That's very overblown. Any CA in any place on the globe is in danger of being taking on their balls by some shady state agency. That's the CA problem.

Doing this at huge scale is not possible though without people noticing. Also one can pin certificates in some situations. Let's Encrypt makes it easy for us people to put an end to mass surveillance.

<comment><USER46> Unless I'm mistaken they're also fundamentally misunderstanding SSL/TLS.

As far as I can tell, LE never sees your private keys. A Certificate Authority signs your _public_ key, so no, the NSA can't coerce LE to give up your private key because LE never sees it to begin with. Could the NSA coerce LE into signing one of the NSA's public keys under your Common Name (that is, coerce them into issuing rogue certificates for "national security" use)? Certainly, but they could do this before, with any already existing CA.

</comment></comment></comment><comment><USER47> What I would really like is wildcard certs for internal only use. For now, as I understand it, the only way to do so would be to temporarily port forward the internal server so it can reach out and close it later... Certs are not just for the internet websites, they are important for Intranets too.

</comment><comment><USER48> Problems with a reverse proxy?

"There were too many requests of a given type :: Error creating new registration :: Too many registrations from this IP"

First time trying to sign up and only for a single domain.

<comment><USER49> I got this too. No idea why.

</comment></comment><comment><USER50> Dumb question time: Why would idenTrust, part of whose business is selling SSL certificates, cross-sign for Lets Encrypt, whose business is giving them away for free?

<comment><USER51> Probably for the publicity, because a lot of Let's Encrypt users will want to upgrade to EV certificates at some point.

</comment></comment><comment><USER52> Does anyone know if their server supports DNS validation yet?

<comment><USER13> Not yet, but soon[1]!

[1]: [https://community.letsencrypt.org/t/on-the-state-of-the- dns-...](https://community.letsencrypt.org/t/on-the-state-of-the- dns-01-challenge/4805/2?u=pfg)

<comment><USER53> Is there a GitHub issue to track?

</comment></comment></comment><comment><USER54> I know this late, but FYI: it seems that certificates issued by Lets Encrypt are not as widely accepted as other commercial providers.

For example, my trial and error I found that the webhook api for both Mandrill and SendGrid did not recognise the Let's Enrypt certificate (although Google Chrome did recognise it). When I switched to a certificate issued by Name Cheap both Mandrill and SendGrid worked.

<comment><USER13> Make sure you're serving the full chain to the root CA, that might be the issue.

LE certs might have that issue with Java apps, since the cross-signed CA isn't currently included in the Oracle root store (they're working on that).

</comment></comment><comment><USER55> Can we use the certificate for dovecot and postfix as well ? Would it be safe ? From the documentation it applies only to web servers.

<comment><USER56> I do, it works. Exim and dovecot.

<comment><USER55> What about this 90 days validity limit ? Do you update it with a script ?

<comment><USER56> Haven't been on the limit yet, but i have a small bash-script which will revalidate them. I have a TODO to revalidate once manually when it is near expiration. If the script works, i will probably throw it in a cronjob.

</comment></comment></comment></comment><comment><USER57> PSA: don't use ReadTheDocs for your documentation. Turns good projects sour with a nasty UI, poor features, and horrible SEO.

<comment><USER37> Eh, it works and we care way more about that.

Anyhow, we can always switch the Sphinx theme, and your comment sounds more like a complaint about Sphinx in general (which I don't happen to agree with, but whatever).

</comment></comment><comment><USER58> For those already using Let's Encrypt since the closed beta: Do not forget to remove the `agree-dev-preview` flags, as newer client version do seem to throw up if it's still set. I had `agree-dev-preview = True` in a config file and got an error about True being an invalid value.

</comment><comment><USER59> Ignorant question: If they are making getting a certificate easy for everyone, what is to stop "bad guys" from getting certificates for their sketchy sites? I usually look to the green "https" in my uri bar for reassurance when I'm on an unusual site.

<comment><USER60> Nothing will. Checking for https for validation whether author of a website has malicious intents is wrong, SSL is not intended for that purpose. That's the purpose of an EV cert, because it requires a company to prove its identity, so the very least you can do is to look for green bar / company name in the address bar.

<comment><USER59> So then why is it important? What is the argument for encrypting all web traffic? Does it act as a sort of camouflage for the actually important encrypted traffic?

</comment></comment></comment><comment><USER61> Hoping for automation for Nginx...

<comment><USER62> git clone [https://github.com/letsencrypt/letsencrypt](https://github.com/letsencrypt/letsencrypt) cd letsencrypt/ ./letsencrypt-auto (ignore the 'error'. It's because you don't run apache)

/root/.local/share/letsencrypt/bin/letsencrypt certonly --webroot -w /var/www/example.com/public -d www.example.com -d example.com (uses the public directory for ownership check, and creates a cert for www.example.com + example.com)

Then in your /etc/nginx/sites-enabled/example.com:

/etc/letsencrypt/live/www.example.com/fullchain.pem; /etc/letsencrypt/live/www.example.com/privkey.pem;

Sorry.. you're asking for automation

</comment></comment><comment><USER63> Can you use this on a shared host and avoid the certificate installation fee?

</comment><comment><USER64> I'm having trouble finding where it specifies what permissions I need to use Let's Encrypt. Can I get a certificate for my subdomain even if I don't control the full domain?

<comment><USER13> Yes, as long as you're able to host content at subdomain.example.com/.well- known/acme-challenge/{random_token}, you're good to go!

</comment></comment><comment><USER65> Does it work without port 80? Many home ISPs block port 80 which would prevent homes from being able to use the service.

</comment><comment><USER66> Can't wait to start using this on nginx.

<comment><USER67> why don't you give caddy a try which has let's encrypt baked in.

[https://caddyserver.com/](https://caddyserver.com/)

<comment><USER68> This looks pretty cool, it doesn't explain how to use Let's Encrypt as far as I can find in the docs, have an example?

EDIT: Looks like it's available in the latest prerelease. [https://github.com/mholt/caddy/releases](https://github.com/mholt/caddy/releases)

<comment><USER16> Yep, check back tomorrow. Meanwhile here's a 28-second teaser video of it working: [https://www.youtube.com/watch?v=nk4EWHvvZtI](https://www.youtube.com/watch?v=nk4EWHvvZtI)

</comment></comment></comment></comment><comment><USER69> Does renewing a certificate require completing a challenge, or is that only for the initial certificate?

<comment><USER70> Also for renewing. Otherwise they can't be sure you still actually control the domain.

</comment></comment><comment><USER71> From what I can tell, this does not support generating an SSL cert for use with AWS ELB correct?

</comment><comment><USER72> Works flawlessly on my site. SSLLabs recognises the cert. Super easy to setup.

<comment><USER24> > Super easy to setup.

Yes, thank god I don't have to manually contact anyone like StartSSL or even provide real contact information for this. It's just what it says - <USER2> validation, nothing more.

Interestingly, StartSSL did far more verification for their free certificates than other providers I used for paid certificates, Comodo, GlobalSign, AlphaSSL, etc.

</comment></comment><comment><USER73> How do I use it with Google Cloud HTTP Load Balancer?

</comment><comment><USER74> "We want to see HTTPS become the default."

Sounds fine for shopping, online banking, user authorizations. But for every website? If I'm a blogger/publisher or have a brochure type of website, I don't see point of the extra overhead.

Update: Thanks to those who answered my question. You pointed out some things I hadn't considered. Blocking the injection of invisible trackers and javascripts and ads, if that's what this is about for websites without user logins, then it would help to explicitly spell that out in marketing communications to promote adoption of this technology. The free speech angle argument is not as compelling to me though, but that's just my opinion.

<comment><USER13> Without HTTPS, any MitM could inject ads, malware, or simply manipulate any content on your blog. TLS isn't just useful to encrypt private data, it also makes sure what you see is what the site owner wanted you to see. With http/2, the overhead is minimal and with TLS 1.3 it might soon be gone completely (since it's probably going to add a mode that avoids multiple round trips for the initial TLS handshake; encryption itself isn't really an issue nowadays with AES-NI, etc.)

<comment><USER75> And this isn't a theoretical threat either, actual ISPs have been injecting adverts, trackers, and other content into third party websites. Even in the US.

See:

[http://arstechnica.com/tech-policy/2013/04/how-a-banner- ad-f...](http://arstechnica.com/tech-policy/2013/04/how-a-banner-ad-for-hs- ok/)

[http://www.infoworld.com/article/2925839/net- neutrality/code...](http://www.infoworld.com/article/2925839/net- neutrality/code-injection-new-low-isps.html)

[http://www.makeuseof.com/tag/two-ways-your-isp-is-spying- on-...](http://www.makeuseof.com/tag/two-ways-your-isp-is-spying-on-you-and- how-to-be-safe/)

<comment><USER74> Yes I'm aware of that. But guess what, ISPs no longer do that because they were sued and lost.

<comment><USER74> OK Someone1234, I was not aware of that. So what ISPs should we avoid now?

<comment><USER19> Pro tip: If the "reply" thingie on a comment is missing, click on the comment's timestamp to load the comment itself and a reply thingie will appear.

<comment><USER74> Good to know, thanks.</comment></comment></comment></comment></comment></comment></comment>


Chronix: A fast and efficient time series storage - <AUTHOR> http://chronix.io/#features <comment><USER2> A couple of us from Prometheus met with Josef from Chronix last week. I haven't tried Chronix yet, but it sounds great for what they're doing. It's currently used for industrial manufacturing monitoring (think car production lines), with a focus on offline anomaly detection. However, there are no live queries yet - it's more about offline number crunching and storing all data points forever. They are also Prometheus users, so they're interested in having Prometheus as a live monitoring system and feeding long-term data into Chronix once the interfaces for that in Prometheus become available.

<comment><USER3> I didn't even have to go to IRC and ask you guys about this, now that's service! ;-).

Exciting!

</comment></comment><comment><USER4> A comparison to InfluxDB would be interesting.

<comment><USER5> There are some publications including a comparison of the storage efficiency, memory footprint, and query runtimes. For example:

[https://speakerdeck.com/florian_lautenschlager/the-new- time-...](https://speakerdeck.com/florian_lautenschlager/the-new-time-series- kid-on-the-block?slide=24)

Database versions: InfluxDB (v. 0.10.3-1) Graphite (v.0.9.15) OpenTSDB (v. 2.2.0) KairosDB (v. 1.1.1)

</comment></comment><comment><USER6> If you are interested in time series storage, I'm keeping a list of interesting ones [http://ronnieroller.com/metrics](http://ronnieroller.com/metrics)

Would be happy to hear of ones I might be missing.

</comment><comment><USER7> I'd be interested to know what drove the technology choices for Java and Apache Solr.

<comment><USER8> For one, Lucene[1] is quite amazing. With a slight stretch of imagination, you can think of it as a document oriented database, with _all_ fields indexed by default. Imagine loading 100M rows with 100 columns into an RDBMS and then index _each_ column[2]. You don't necessary do that. With Lucene - and SOLR and elasticsearch for that matter - it's not even a thought. Additionally, you get to tweak your indexing with dozens of field-tested analyzers.

[1] [http://lucene.apache.org/core/](http://lucene.apache.org/core/)

[2] we do this (over 300G of complex data) with a tool called solrbulk and on a single server in less than four hours, [https://github.com/miku/solrbulk](https://github.com/miku/solrbulk)

<comment><USER7> I agree that Lucene is a mature solution with many excellent use-cases.

For this portion of the stack why would it be preferable to start with Lucene rather than Elasticsearch? (for all of the distributed scaling benefits)

<comment><USER8> I would probably start with elasticsearch and establish a business case first. Only once that's proven and some need for lower level customizations arises, I would descend the stack.

</comment></comment></comment></comment><comment><USER9> What's a "time series storage"?

<comment><USER10> Time-series data is chronological and immutable and which has time as a primary dimension; think about the outputs of a weather-monitoring station for example which streams air pressure, wind speed and direction and temperature at ( say ) one-second intervals.

You can stuff all that into a standard RDBMS with appropriate schema design but there's a lot of wasted overhead; you're not going to execute updates, for example, and there can probably be a lot of smart compression achievable for long series of unchanging data, such as air pressure which might remain constant for hours and then change gradually.

~~

A slightly more obscure example is ADS-B data streamed from aircraft. I did a logging system and schema a few years back and in order to handle the input volume it held the raw data on ramdisk and ran summarisation logic before inserting into an RDBMS. So it persisted the minimum and maximum altitudes of a particular aircraft in a particular period, for example, but in doing so we lost data on the intermediate vertical flightpath and rates of change. And each aircraft had multiple time periods for each encounter. It rapidly became quite complicated compared to the use a time-series store where the data would be stored in sequence and the complicated logic is moved to the offline query stage rather than the up-front storage pre-processing stage.</comment></comment>


Startup Postatic lets you create your own clone of Hacker News - <AUTHOR> http://www.startupdaily.com.au/2014/08/startup-postatic-lets-create-clone-hacker-news/

<comment><USER2> Building a community is hard, discussion website software is easy. Cloning HN is really hard.

It looks like the submitter is also "in it for yourself", looking at noyalizor's submission history. If you stick around, and learn the rules of the community, you can get a lot more out of it.</comment>


Confusion reigns as UK scientists face government 'gagging' clause - <AUTHOR> http://www.nature.com/news/confusion-reigns-as-uk-scientists-face-government-gagging-clause-1.19454 <comment><USER2> Conservatives in the UK are not alone; they're taking a page from the Tories in Canada where Harper did the same thing.

[http://www.cbc.ca/news/technology/faq-the-issues-around- muzz...](http://www.cbc.ca/news/technology/faq-the-issues-around-muzzling- government-scientists-1.3079537)

<comment><USER3> We can only hope there is a backlash resulting in the election of a liberal party after this one.

</comment></comment><comment><USER4> >"But unless an exception is given to researchers, Ward adds, they will face having to use their own funds to do anything that could be considered lobbying or influencing policy."

What is the problem? It makes no sense for the government to give money to someone who uses it to lobby the government. It doesn't make sense if a charity does it, a church does it, or a researcher does it. What am I missing? Grant money should be spent on research, not lobbying...

<comment><USER5> I guess it depends on what "influencing policy" means. Say a scientist using public funds happens to find results that contradict current government policy. Publishing the results could be considered as influencing policy, particularly if the opposition party picks it up and runs with it.

<comment><USER4> I think we need to know what _doesn 't_ count as influencing policy, since it seems like that could cover just about everything.

<comment><USER6> Isn't that what the 'Confusion reigns' in the title referring to?

FTA:

"On 6 February, the government announced that any groups in receipt of public money will be banned from using those funds to attempt to influence either the government or Parliament."

"In theory, this could mean that scientists at UK universities are not allowed to tell ministers what the policy implications of their work are, or respond to consultations that touch on their area of interest — potentially removing their ability to comment on everything from climate change to medical regulation."

I'm not 100% sure on how the UK works, but in the US, if there is some new research that is done, and I'm invited to White House (or even to meet with a local senator, or give a talk as a conference with government personnel present), it's likely that the money to travel, speaker fees, etc are paid with grant money. This is generally 'normal'. What's the point of doing any research when I can't actually talk about the results with the people who are most likely going to be able to use it (since they paid for it)

<comment><USER4> Not that I know anything specific about this law, but I don't believe this would cover discussing your work in the presence of government personnel.

The same would have to apply to any charity that happened to discuss it's success or needs. What if they use the money to put up a webpage and government personnel happen to click on it?

It sounds like a very poorly written law in general if that is the case.

<comment><USER6> I was specifically envisioning something like a government sponsored, or affiliated conference like speaking at an NOAA, DOD, etc workshop (which could fall under "attempt to influence ... government... parties"), which again is where the confusion comes from, and why the associated organizations are trying to bring clarity.

And for clarity, it's not a law, but new wording being put into all grant contracts. In it's entirety reads:

"The following costs are not Eligible Expenditure: Payments that support activity intended to influence or attempt to influence Parliament, government or political parties, or attempting to influence the awarding or renewal of contracts and grants, or attempting to influence legislative or regulatory action."[0]

[0] - [https://www.gov.uk/government/news/government-announces- new-...](https://www.gov.uk/government/news/government-announces-new-clause- to-be-inserted-into-grant-agreements)

</comment></comment></comment></comment></comment></comment><comment><USER3> It's amusing that UK political parties are also "groups in receipt of public money".

</comment><comment><USER7> Great law should have exemption for certain things.

<comment><USER8> Yet, oddly enough, it does not prohibit government contractors, or recipients of tax breaks/subsidies from lobbying...</comment></comment>


What Happened When Facebook Hired Some Journalists - <AUTHOR> http://gizmodo.com/want-to-know-what-facebook-really-thinks-of-journalists-1773916117 <comment><USER2> Having worked with journalists, these sound like typical entitlement complaints. Frankly, a lot of writers have an attitude that they're "artists" who shouldn't be rushed and don't have performance requirements.

Frankly, it does not sound very hard at all. They have to write 20 posts a day, but each post is only a headline and a brief summary. A focused writer can finish that in 15 minutes.

> We had to write in the most passive tense possible. That's why you'd see > headlines that appear in an alien-esque, passive language.

Oh no! How dare Facebook strive to be neutral and passive.

> After doing a tour in Facebook's news trenches, almost all of them came to > believe that they were there not to work, but to serve as training modules > for Facebook's algorithm

Of course they were. Facebook is quite explicitly trying to apply ML throughout their site. Why should they permanently be in the business of employing writers to do something which computers could do reliably and effectively?

<comment><USER3> > We had to write in the most passive tense possible. That's why you'd see > headlines that appear in an alien-esque, passive language.

I was just thinking that the Facebook summary headlines are surprisingly journalistic compared to Buzzfeed, Upworthy, etc. Seeing somebody complain about that explains why their title is "news curator" and not "journalist."

<comment><USER4> Oh, I would say it's a very "journalistic" complaint, unfortunately. Apparently, there is a fair market for that (given the popularity of sites like newyorker.com on HN), but in general what some journalist wants to write is almost opposite to what I want to read. I want to know news, meaning as short and pointed messages as possible, and "no news today" would be actually a good thing. A journalist who thinks he is "good" (note the "graduated from Ivy League" part) wants presence, wants to be someone, a (or, preferably, "the") trendmaker, the Lord of opinions, like that Spider Jerusalem guy. His ego gets in his way. Which is pretty natural, actually — not only for journalists, but for everyone who wants to be a Person, an Individual, not just a smaller part of the system. Which is actually good, I think, for a human.

It might be somewhat working with printed media and specialized news agencies — after all, agency wants something close to what the journalist wants: to have presence, for public to pay attention to them, not to some other agency. "No news today" would be a disaster for them.

I mean, it's all pretty natural, if we admit that typical news agency's goal is not to "give information". And Facebook's "trending news" section's goal, on the contrary, is quite close to that.

<comment><USER5> I think that's an unfair dig at Spider Jerusalem. He's a decent (fictional) journalist in my opinion. Trying to uncover truth and stuff, old school.

More on topic though, the comments section of the article is also full of "booohoo they have it sooo tough" comments but I think work conditions are relative. It's the typical job agency treatment only a couple of levels higher. If everyone around you is living the Facebook life and you're curating news in a basement/conference room...sure that's not horrible but it's still fairly indecent treatment.

Disclaimer: Huge Transmetropolitan fan, programmer not journalist :)

</comment></comment></comment></comment><comment><USER6> "After doing a tour in Facebook's news trenches, almost all of them came to believe that they were there not to work, but to serve as training modules for Facebook's algorithm." ha! aren't we all.

<comment><USER7> So.... They finally know what it feels like to be a blue collar worker whose job gets outsourced and sometimes are offered benefits contingent on training their offshore trainees.

Everyone was happy to have $30 jeans which could last one year over their $70 jeans made stateside which could last five years or more... But now that it affects them, oh my, this is bad now...

<comment><USER8> >Everyone was happy to have $30 jeans which could last one year over their $70 jeans made stateside which could last five years or more...

I'm not sure this analogy works. Surely the people selling jeans would prefer to sell new $30 pairs every year rather than $70 pairs every five.

<comment><USER9> I see this as a fundamental problem of the unsustainability of our economy. The incentive of every corporation is to earn an increasing amount of money, and thus to move more things from resources to garbage as quickly as possible. "But all those jobs!!" is a stupid argument. Jobs aren't the goal. The goal should be getting resources to the right people, and sustainability for the long term.

<comment><USER10> I don't buy this planned obsolescence bs. I get that most markets aren't very free, but they're free enough to ensure that superior products generally win out. Companies are trying to make money _today_. They aren't thinking: "hey, let's put out a crappy product that will be worse than our competitors' so that people will have to buy more of our stuff in the future!"

Any company that did that wouldn't make it to tomorrow.

<comment><USER11> The problem is that the consumer usually has no way to compare quality easily, and so all they have to go on is sticker price. As a result the incentive is for companies to reduce sticker price at the expense of quality.

If you ask a consumer whether they want a $500 product that lasts 10 years or a $200 product that lasts 2 years, they'll happily pay extra for the higher quality product. But that's not usually the choice they're presented with.

I think a solution to planned obsolescence would be to mandate prominent labelling of lifetime guarantees.

<comment><USER12> >The problem is that the consumer usually has no way to compare quality easily

That used to be true and is an example of information asymmetry in markets - classic example being the used car market [0]. It is much less so now, when was the last time you bought anything substantial without reading a review of it or checking the customer ratings?

>If you ask a consumer whether they want a $500 product that lasts 10 years or a $200 product that lasts 2 years, they'll happily pay extra for the higher quality product.

That's not necessarily true - value decisions are more complex than that. Depending on the market, those two price points may be in different segments based on (e.g.) disposable income. Sure, for Alice, who has $500 disposable income available for a particular purchase, this might be a no brainer, but for Bob with only $200, not so much. See also Vimes' boots theory of socioeconomic unfairness [1], hyperbolic discounting [2]

[0] [https://en.wikipedia.org/wiki/The_Market_for_Lemons](https://en.wikipedia.org/wiki/The_Market_for_Lemons)

[1] [http://www.goodreads.com/quotes/72745-the-reason-that-the- ri...](http://www.goodreads.com/quotes/72745-the-reason-that-the-rich-were-so- rich-vimes-reasoned)

[2] [https://en.wikipedia.org/wiki/Hyperbolic_discounting](https://en.wikipedia.org/wiki/Hyperbolic_discounting)

<comment><USER13> aninhumer pointed out the main flaw in this line of reasoning but it's not just the lack of long term data. Many companies change models frequently or make quiet design changes – e.g. the blender given a good reliability review changes a couple of years in to replace metal gears with plastic, which requires a teardown to see. If you go to Costco, Sam's Club, etc. count how many things have slightly different specs and model numbers than the ones you can find reviews for, etc. The last time we bought a washing machine, only one of the models which Consumer Reports had recommended a little over a year before was still offered for sale in our region – everything else had changed and most online reviews were just "we got it last week and it's great" comments which don't tell you anything about long-term experience.

In some cases, you can simply conclude that an entire brand is either unreliable or trustworthy (e.g. Apple doesn't sell Walmart edition devices which break within 18 months) but in most cases you have to do a lot more research to know what level you're getting.

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER14> 'Mark Zuckerberg has been transparent about his goal to monopolize digital news distribution. "When news is as fast as everything else on Facebook, people will naturally read a lot more news,"'

Oh lord. That's not news. Those are sensationalist, click baity headlines making us all collectively dumber. It's anecdotal, but I'm quite sure the 'news' my girlfriend has gotten from FB has made her less informed.

I actually wrote an FF plugin to hide that right bar, since I would now and then get sucked in by that crap and waste 15 minutes reading about Lindsey Lohan or whatever.

<comment><USER2> Actually, I find that the Facebook headlines are much less clickbaity than the predominant headlines from news organizations.

</comment></comment><comment><USER15> When the employees of Facebook collectively ask "What responsibility do we have to stop the election of Donald Trump" at an internal meeting, it gives me Orwellian chills. Today, it's not governments we need to fear the most, it's data hungry, fascist internet corporations.

<comment><USER7> Sometimes people have a hard time decoupling politics from their jobs. They should try how ridiculous it would sound to say "What can we do to stop Bernie Sanders". That should give them pause. As far as I know all the major candidates are operating within the law and thus we ought not try to Stop Them" just because our politics differ.

Or what if instead of national figures FB or anyone else tried to railroad an SF Supe they didn't particularly like because they shot down their proposed development. Or Menlo Park.

<comment><USER15> Exactly. The problem is, as a private company, should Facebook choose to manipulate it's news feed algorithm to promote one candidate or the other, or for whatever reason, this would be its prerogative under the First Amendment.

I personally choose to not use Facebook specifically for these reasons. Even though I know many Facebook employees personally, I don't trust it's employees to divorce their own interests and their powerful position as Facebook's curators.

<comment><USER10> This isn't a new problem. Old media has been doing this for centuries.

<comment><USER16> Old media usually has had opposition, like there is Fox but there is also MSNBC. Facebook is THE social network, even Twitter is a joke in terms of size against it.

<comment><USER17>
      They were also discouraged from mentioning Twitter by name in headlines and summaries, and instead asked to refer to social media in a broader context.

Hah!

</comment></comment></comment></comment></comment></comment><comment><USER18> > "It was degrading as a human being," said another. "We weren't treated as > individuals. We were treated in this robot way."

Strange that people at Facebook would feel apathetic toward individuals that can't code.

<comment><USER19> Google has this disease _quite_ badly, from multiple sources.

It's pretty common elsewhere in SV as well. And is a cardinal error.

</comment></comment><comment><USER20> _almost all of them came to believe that they were there not to work, but to serve as training modules for Facebook's algorithm_

If Facebook is doing it's job and utilizing their biggest talent acquisition of Yann LeCun, then this is exactly what they should be doing.

A critical part of the path towards AGI is using humans to teach it.

<comment><USER21> Thoughts about the utility of schools to serve this function? We are already teaching humans very simple to very advanced tasks and we do so millions of times a day. Is the fact that tasks/knowledge are being structured for paced human learning irrelevant for this purpose?

<comment><USER22> It's not irrelevant, since there is a minor area of ML called 'curriculum learning' which asks how to order examples to teach a ML algorithm most efficiently, and it comes up in some other contexts (for example, a boosting algorithm which focuses on optimizing performance on hard/misclassified cases can be seen as somewhat like curriculum learning, and there are variants of gradient descent which focus on hard examples rather than wasting time on cases where the NN can already get the right answer; and for 'active learning', you want to pick the example which will teach the algorithm the most), but there's not much you can take from known pedagogy at the moment and apply straight to NNs. Even the non-bullshit parts of education like spaced repetition have no clear analogues for tasks like 'train an RNN to write news headlines based an article text using this corpus of human-written headlines'.

</comment></comment></comment><comment><USER23> So, I got interested in this article's description of horrid working conditions and decided to read about it carefully. But I noticed that it gives emotional descriptions of it long before the actual facts. I wouldn't go as far as calling this a manipulation, but it's certainly a disturbing writing style.

3rd paragraph:

> grueling work conditions, humiliating treatment, and a secretive, imperious > culture in which they were treated as disposable outsiders.

6th paragraph:

> "It was degrading as a human being," said another. "We weren't treated as > individuals. We were treated in this robot way."

And then, finally, on 10th paragraphs, we get a glimpse on the facts:

> they received benefits including limited medical insurance, paid time off > after 6 months and transit reimbursement

(BTW, is it usual for contractors to receive such perks?)

> A company happy hour would happen at 8 p.m., and we'd be working

Horrible, inhumane treatment indeed.

> Over time, the work became increasingly demanding, and Facebook's trending > news team started to look more and more like the worst stereotypes of a > digital media content farm. Managers gave curators aggressive quotas for how > many summaries and headlines to write, and timed how long it took curators > to write a post. The general standard was 20 posts a day.

20 posts during 8 hour work day is almost half an hour on one post. It is considered too little? Seriously?

So — apart from all the pretty words, I didn't really see any especially bad treatment. Hell, I'm pretty sure that your average newspaper employees have more nightmare stories.

</comment><comment><USER6> "It was degrading as a human being," said another. "We weren't treated as individuals." hmmm. Trying hard to feel sympathy/emapthy for these victums but my algorithm is throwing an exception.

</comment><comment><USER24> Reducing the number of journalists implies that supervised learning[0] was effective enough to begin to replace some human effort.

[0] [https://en.wikipedia.org/wiki/Supervised_learning](https://en.wikipedia.org/wiki/Supervised_learning)

</comment><comment><USER25> Maybe Facebook should have advertised this as a temporary "Robot Journalist Training Fellowship"

</comment><comment><USER5> I don't think the assessment that they were part of a future algorithm is too far off. Given enough expert input picking a fitting image/video or headline should be doable. Worst case you reduce the number of humans needed to one quality assurance person. Algorithm says "this headline, this image"...yes/no;fix.

</comment><comment><USER26> why would they hire journalists to do this? It doesn't seem like it takes much skill at all to pick a story and write a short summary of it.

<comment><USER27> I wonder that myself. I think it has more to do with standard corporate over thinking about what's skills are actually required for a job. It certainly make it easier to say, "We want someone to write titles and snippets of news stories. Who does that? Journalists. Cool, let's get some of those."

disclaimer: i worked on that fb product.

</comment></comment><comment><USER28> why am i reading this

this is the most worthless piece of thing i've ever read in my life

<comment><USER29> We've banned this account for repeatedly violating the HN guidelines.

<comment><USER30> bless m8</comment></comment></comment>


The Quants: Formula for a Meltdown  - <AUTHOR> http://online.wsj.com/article/SB10001424052748704509704575019032416477138.html <comment><USER2> The following quote illustrates the article pretty well:

       [..] advances that had earned their discoverers several
       shelves of Nobel Prizes

Hyperbole as a style form is all and well, but this is just misrepresenting the truth. This journalist didn't rethink what he was writing for even a second.

<comment><USER3> The article struck me as anti-intellectualism run amok. I didn't even see a _hint_ of anything indicating that quants were especially to blame.

<comment><USER4> I see this as a scape goating of the quants. Not the mismanagers who hired and profited from the quants. The culpability of the mismanagerial classes are being whitewashed away.

</comment></comment></comment><comment><USER5> Yet another article blaming the poor quants. Anyone with nonzero experience in finance knows that quants have no power and earn no respect. Of course quants know that models have limitations, but if you tell your boss that one should be conservative, the only thing you will attain is to get yourself fired. The ones to be blamed are the ones with decision-making power, and everybody knows that quants have as much decision-making power as the IT guys.

At least they talk about Aaron Brown. In any case, I was expecting more from the WSJ. They used to be better than this...

<comment><USER6> _In any case, I was expecting more from the WSJ._

Amen to that. The article mentions "The secretive trading operations within banks that use large doses of leverage, or borrowed money, to make huge bets on the market". This is just not true -- and the WSJ should know that. You can generate leverage without borrowing a dime. Options contracts can be highly leveraged yet involve no borrowing. Futures contracts can be highly leveraged with no borrowed money. In both cases the exchanges have put in place elaborate mechanisms to ensure a losing side can pay up, and guarantees the winning side will collect even in case of complete counterparty failure. There is no borrowing here but there's plenty of leverage.

Unfortunately a lot of the bad trades behind the meltdown (AIG derivatives, etc.) were basically private contracts, with no exchange mechanisms in place to mitigate counterparty risk. That's also one reason nobody knew what was really going on.

</comment></comment><comment><USER7> Whoa, this really touched a nerve. I think everyone should step back and see that this is an excerpt from a book. I thought it was an interesting snippet but I would have like to see more.</comment>


Make state management simple again: Intro to MobX - <AUTHOR> https://mobxjs.github.io/mobx/getting-started.html <comment><USER2> Thank you for sharing this. I have been doing a lot of digging for an upcoming greenfield rewrite of our client side, and mobx+react is now tied w/ me alongside mercury.js, which shares a similarity in using nested observers as the nervous system of the viewstate. Have you had a chance to look at mercury and the way it achieves unidirectionality?

The documentation for mercury is sadly very poor, but the ideas are sound once you "get it"

here is the repo [https://github.com/Raynos/mercury/](https://github.com/Raynos/mercury/)

here are the rough docs [https://github.com/Raynos/mercury/tree/master/docs](https://github.com/Raynos/mercury/tree/master/docs)

how would you compare the prescribed method of state management of mobx+react to mercury's immutable observer state-tree that sends observed changes up to the app root, then signals re-render w/ a immutable state emission to a cascade of renders below it?

<comment><AUTHOR> I think it is quite different, at least if I read the docs correctly mercury is much closer to Redux / OM then MobX + React. MobX doesn't work with cursors and your tree doesn't have to be a normalized tree (it can be any (mutable) graph). In MobX data is not pushed through the root (which is when working with large collections still slow!) but rather each components observes exactly its own observables (deeply). This means that children can re-render without their parents and vice versa. This is done automatically and you don't have to write any cursors for it.

I'm not sure whether this answers your question completely, so just let me know if that is the case :)

<comment><USER2> This definitely helps, thank you.

I suppose the main similarity is the chain of observables being a nervous system of sorts. In mercury the observers pass the update signal all the way back to root (and then needless re-renders are mitigated by vdom-thunks) , whereas w/ mobx the update signal is not passed up to root, just to the local component in question, and then that re-renders itself, so the rest of the app is not concerned

One cool thing about combining observables AND immutability as in mercury isyou get the equality checking via immutability, but you also get to deal w/ component updates locally. ...no dependence on a global event emitter or global event emitter abstraction like redux.

So 2 questions: w/ mobx + react how do you deal w/ events outside of a component?

And what, if anything, is lost from losing the uni-directionality?

<comment><AUTHOR> In MobX it actually doesn't matter whether the events happen inside or outside the component. Components themselves are part of the nervous system. They react to changing observables that are used in the rendering. Regardless how those observables are changed.

Note that MobX itself also uses reference equality checking (it applies PureRenderMixin), see this issue for an explanation why that is possible: [https://github.com/mobxjs/mobx/issues/101#issuecomment-18987...](https://github.com/mobxjs/mobx/issues/101#issuecomment-189875383)

MobX is still unidirectional data flow: `events / actions => state => view` (although you could create React components that are bidirectional a recommend against that). But if you mean with unidirectional data flow that there is no action dispatcher; that is up to the developer. Having an action dispatcher might still be nice for your app. Or over engineering. MobX is unopiniated about these things.

<comment><USER2> thank you for taking the time to explain all this, its very helpful!

i see what you mean now about equality checking. you are using it, but only in the cases that the observables do not already provide the mutatation check. it looks like you are using a great balance of mutating observables w/ equality checking, though i have to wonder how this marriage doesnt crop up with a large amount of edge cases.

still, exciting idea nonetheless!

one last question... are you saying an ideal mobx implementation has no opinion whatosever about how events / actions are handled as long as they result in updates of mobx observables directly?

<comment><AUTHOR> For your first question: nope, the important edge case is that deep changes on _non_ observable objects won't be observed. But that is no different from the edge that deep changes on (conceptually) immutable objects are not observed.

For the last question: yes exactly. Note that the observables can (should) usually be updated from a 'nice' place, for example from controller or class methods, as directly manipulating data inside event handlers (as done in the tutorial for brevity) will quickly result in your code becoming a mess. But besides that state should be updated in the most straight forward way possible :). So MobX is unopiniated from a technical perspective, but you should have some opinion about it so that code is regularly structured and easy to grasp by others.

</comment></comment></comment></comment></comment></comment><comment><USER3> [https://news.ycombinator.com/item?id=11181980](https://news.ycombinator.com/item?id=11181980)

</comment><comment><USER4> Been using this a lot recently, love it!

<comment><USER5> how do you find it compared to redux?

<comment><USER6> There's a similar wuestion here (with a bullet list answer :)) [https://discuss.reactjs.org/t/redux-or-mobservable-what- to-c...](https://discuss.reactjs.org/t/redux-or-mobservable-what-to- choose/2453)</comment></comment></comment>


You and your research - <AUTHOR> http://www.cs.virginia.edu/~robins/YouAndYourResearch.html <comment><USER2> This has been submitted and discussed many, many times, but even if you seen it before I strongly recommend reading it, and reading it carefully.

And don't read it passively - read it actively. Don't just think "That's interesting" \- think to yourself:

Can I translate this into _my_ context and _my_ situation? Can I use this information, these thoughts, these musing, and this advice to make me better at what I do?

My suspicion is that if you work at this, you can gain a lot from it.

On the other hand, you could just skim it and move on.

What will you do?</comment>