I Tested the Saving Technique That Promises Retirement at 40 - <AUTHOR> https://www.vice.com/en_us/article/gya8bx/i-tested-the-saving-technique-that-promises-retirement-at-40 <comment><USER3> This article isn't very good. The author tried being frugal and saving 50% of his salary for a month, got bored (no drinks with friends or dates with girlfriend). The first half-year of FIRE living isn't even representative, because you can still live off the largesse of your past life. It's certainly true that your friend group changes, though, from meeting up over weekly drinks/dinners to meeting up to do a sport with low marginal costs like backpacking or rock climbing or basketball.

I've been more or less on the FIRE train for three years now. It's very easy when you have a software engineer's salary in Seattle. In my best year I only spent $21,000, but was fairly unhappy - saving money is a lot of work! All chores take longer and require more mental effort to figure out the least- expensive way of accomplishing your goal.

At this point I've actually found areas of technical interest I can expect to get paid for in the future, so I'm not as laser-focused on the goal. If you manage to bring in even a bit of cash in retirement, the safe withdrawal rate calculus tilts considerably in your favor.

To head off people saying "but you won't really be retired!" you should know the in-group has a term for you: the retirement police. The real goal is freedom, and not the type where you're lying to yourself that this is what you want to be doing.

<comment><USER4> Came here to agree with you and also add that while I've never heard of this movement over here in Europe I do know of a certain type of loosely based community of blogs, forums and people who invest hundreds of dollars each month into stock.

Special stock (I'm at a loss of english financial terms here) that give off a certain percentage of value back to you each year or month.

So the goal is the same, once you own enough of these stock you're supposed to live off the accumulated winnings from them. And of course these stock can be sold off too if you want to free some money. Or if the company announces that they're going to lower their percentage of value that they give out.

I've been doing this for a couple of years now, started late compared to my peers. I'm a slacker and so far haven't calculated much of anything. Simply jumped on a bandwagon, read some blog posts and got started.

But a co-worker who tipped me off to this "movement" claims he's calculated that he will be able to live off his return in 10 years.

This all depends on how much you're putting into your stock each month of course. Personally I buffer money and only buy stock every 3-4 months.

The trick is to find old well established businesses whose stock has been stable for many years, many of them fluctuate up and down over decades.

New companies do not tend to give off this return. I don't know the details but only certain companies give a return on their stock just by owning them. My stock trading app shows this info when you click on a stock.

Once you've bought into some company you might get a letter home saying that they're going to lower or raise the return depending on how well they're doing.

<comment><USER5> I believe you are referring to dividend investing? Investing in a portfolio of stocks that pay higher than average dividends. I'm not an expert in this, but dividend stocks don't normally have as high of a growth potential so the math may be different. Usually when the FIRE community refers to investing, they usually refer to an index fund that includes either the S&P500 or global stock index so you can track the movement of the broader economy and count on the economy growing year over year.

With dividend investing, it's not really the same thing and the math likely won't work out the same.

<comment><USER6> Also, depending on your jurisdiction, you pay taxes on dividends. So, it makes sense (while you earn) to invest in shares or funds that don't give you income (they pay dividends that you have to pay tax on), but capital gains (they increase in value, but you don't have to pay tax on that until you realise the gain, ie sell).

Once you're retired, you can switch from a capital growth portfolio to an income providing portfolio.

</comment></comment></comment></comment><comment><USER7> There is truth in the notion that the saving mindset only heightens financial anxiety. And this, in my experience, can lead to poor financial decisions (the old "penny wise pound foolish" behaviour).

I have also experienced an involuted perspective to money itself when on the saving mindset. Instead of seeking expansive [sic] opportunities, with an always-on savings mindset I often stop taking risks altogether. The FIRE movement, it seems, is only for those who have a reliable and predictable monthly income, or for those who can assume somewhat 100% employment till 40. If you're an entrepreneur, this arbitrary 50% saving of income won't work. You're more likely already forced to save for the next 3 months's just for wages and electric bills.

<comment><USER8> Not sure why you're being downvoted.

What isn't addressed in this 20-year plan is the _risk_ of the many things outside of your control: health, local economy, unexpected family members, etc.

This isn't a risk-free option, it's an attempt to minimize risk in exchange for minimal financial independence. The margin for error is very low.

If you want to achieve financial independence in a more robust manner:

1\. Save up 1-3 years of living expenses. This quickly gives you the financial independence of a _practically_ unlimited runway. It's much more useful to have financial independence _early_ in your career.

2\. Use that independence to find the best possible way to make money for you -- retrain, start a business, etc.

3\. Invest. Take as much (calculated) risk as possible while you're young and become more conservative over time.

People who front-load this in their careers often (in my experience) not only retire early but do so with significant wealth.

<comment><USER9> I'm trying hard to save enough for my son so he can be FI when he enters college (If he chooses to). I want him to have the choices I never had - <USER2> to spoil but pursue any path he desires without the mounting pressure of having to earn an income. I know this could go wrong if not done right so I hope to do it right by planning far in advance.

<comment><AUTHOR> That's very interesting. I feel like being handed FI at a very young age could go either way. Either he realizes what a gift he's been given, or he squanders it because he doesn't. I don't think that I would have appreciated it at that age myself.

Of course, it's your choice to make (and I definitely don't know your situation or your son's situation), but it seems to me that a big part of FI is the mindset, not the money, and I'm not sure you can acquire the mindset without going through the frugal living.

<comment><USER9> Sure. My goal is to instill the mindset far in advance of handing down any sums of money. Basically, if I don't observe the type of behavior I'm looking for such as managing your own finances in an intelligent manner, I'll probably do something else with that money or just let it accrue interest until he is ready.

</comment></comment></comment></comment></comment><comment><USER10> That was a pretty poor article. If all your free time activities involve spending money, mostly socialising in the pub from the sound of it, then maybe you should start by addressing that first. I don't follow the FIRE method but most of my free time is spent, without spending much or any money.

He also claims he got bored of eating the same chicken sandwich for lunch each day. Then prepare your own lunch before you go to work! It's not hard. Max 5 minutes

<comment><USER11> Just visit London once and see what people do at 6 p.m. Then you know how important pubs are in this society.

<comment><USER5> How much is a pint of beer? Pubs here in Singapore is not affordable at all. Going to one everyday after work will really land you in the poor house.

<comment><USER12> In London? Really expensive these days. Over £5 in some places.

</comment></comment></comment></comment><comment><USER13> If you fancy for retirement at 40, why not first save money so much that you can do what you think you would do when retired for one year? It is quite likely that after this experiment:

1\. You realize that actually having a work is quite nice and being retired for extended time periods is boring

2\. If you one day find something you really want to do instead of your day job, the treshold to quit your job and give a try is much lower because you already have faced the anxiety and uncertainty that means.

Obviously, this is easier to do if you do not have massive mortgage, student loan, car loan and four kids. Also it helps if your retirement plans do not include flying around with a private jet.

<comment><USER14> > You realize that actually having a work is quite nice and being retired for > extended time periods is boring

Have you actually done this? I have and that was not my experience. I took a year off and it was great, I was never bored and the only reason I returned to work is because I need more saved before I could afford to make it permanent.

<comment><USER15> I have, and it was absolutely my experience. I "retired" at 28. Before that, I loathed my job and couldn't wait to quit. After? I realized that satisfying work is one of the main ingredients of happiness. If I had figured that out sooner, I could have found a job I enjoyed more, rather than quitting, bumbling around for years trying to figure out what to _do_ with my life.

I do think a significant hazard of a real job is not nearly enough time off (precluding extended travel and so on), but again, if that's the sticking point, negotiate _that_.

<comment><USER14> I've heard this type of thing before but it seems to set up something of a false dichotomy to me. Not having to work a full time job doesn't mean doing nothing, it means financial independence to pursue whatever projects are meaningful to you. I don't really resonate with the approach described in the article because for me those projects tend to require a bit more than a subsistence level of income. There are endless interesting projects to pursue that aren't the most viable options when you have to worry about paying the bills however.

<comment><USER16> Sometimes all it means is continuing in the same job, but saying what you're really thinking more often!

</comment></comment></comment></comment></comment><comment><USER17> FIRE requires gamification:

1\. Dave-Ramsey-style "list your debts smallest to largest, knock them out till you reach the last level!"

2\. Mr-Money-Mustache-style "dial down your spending, try to beat my high score!"

etc, what-have-you.

Beneficial advice, yet follow all the steps and you achieve a vacuum. You've arrived, there's no more debts to pay, spending is under control: now what? It's up to you, but perhaps your identity has been consumed by the journey. What were you living for all along?

What indeed? You can answer that today!

<comment><AUTHOR> > What indeed? You can answer that today!

That is true, but sometimes in the grind of the every day it can be hard to look up and take the time to really think about what you want. And it can be scary to think about upending everything to get what you think you might want.

That's why gamification is easier--concrete goals that don't take a lot of deep thinking about your purpose on earth are easier to achieve when you're in the daily grind.

Not saying it's better--as a sibling comment says, you should aim to build the life you want as soon as you can, rather than save save save and then arrive someplace you weren't aiming for. But the gamification is easier to grasp and less scary to aim for, in my opinion.

</comment></comment><comment><USER18> I really enjoy working and see myself doing that all my life but then I have a certain anxiety that the good times will be over rather sooner than later because (1) maybe we're living through the peak SWE salary times and (2) I'll become unemployed due to ageism. This anxiety forces me to contemplate FIRE tactics.

</comment><comment><USER19> With all due respect to all opinions expressed and to the (still IMHO "poor") article it is not like "FIRE" is a "revolution" of "any kind" it is more or less what "normal" people using "common sense" (an extremely uncommon thing BTW) have always used.

Though retiring by 40 is pure _bullshit_ unless you have exceptionally high earnings/income.

The good ol' advice was:

[https://news.ycombinator.com/item?id=14594858](https://news.ycombinator.com/item?id=14594858)

</comment><comment><USER20> Possibly a stupid question: what happens if the American economy (or whatever the index fund you invest in reflects) doesn't grow for a sustained period of time? The article kind of addresses this, but doesn't clarify if FIRE advocates have a proper rebuttal (I get the feeling that there isn't one).

<comment><USER21> In an economic downturn having a few hundred thousand pounds / dollars sitting in the bank they will have more options than your average person.

The economy would have to be completely screwy for there not to be a way of making money from capital. Even if the currency goes into hyper inflation you are much more likely to be able to get it out into a safer currency when you have enough of it lying around.

<comment><USER12> Brexit says hi! Fortunately I can invest in overseas stocks and bonds to defray some of the problems, but don't count on "having a few hundred thousand" in the bank as being worth much if your country decides to leap off a cliff.

<comment><USER22> But surely Brexit is an argument for building a nest egg.

The Boris Johnsons and Jacob Reece-Moggs of the world aren't worried about the financial aspects of Brexit, because they have a 'nest egg'.

</comment></comment></comment></comment><comment><USER23> The author doesn't make enough money to do this well. £34k seems like a low salary for an educated 28 year old in London.

<comment><USER24> What do you mean by educated?

This is a person who is only able to entertain themselves by spending money. That doesn't sound educated to me.

"Entertainment", in the sense that it's commonly used, should really be called "paid entertainment". There's plenty of free entertainment. Read a book, good for a walk, or my favourite: learn something new that is complementary to your current skills and that might make you more econmically valuable. But he doesn't like these things, he just likes being with friends in the pub and playing FIFA. I promise you that I know a lot of educated people and their lives look nothing like that.

<comment><USER23> I mean it as in its definition, which has nothing to do with how someone entertains themself.

<comment><USER24> You haven't answered the question. What is your definition?

</comment></comment></comment></comment><comment><USER25> > and eating a Tesco meal deal for lunch (£3) [$4]. I know I should be > preparing my own lunches to save an extra bit of cash, but the effort > required to save an extra dollar a day doesn't quite cut it for me

This for me is a wonderful little example of how costs build up.

If you're not familiar with a "meal deal" in the UK, they're a sandwich/snack/drink combo. They are almost universally pretty poor.

The author talks of the effort to prepare lunch, when compared to a _basic sandwich_ and thinks this would still cost about £2 per day.

If they could cut the lunch cost in half it'd be equivalent to them getting a £500/year payrise.

Edit - oh, the meal deal was them trying to save money. Then making at home you can have something a lot better _and_ cheaper and if they were spending 5-6 per day before (easy to do) it may be worth £2k/year in salary, up to 2500 of they have a student loan too.

> As I spend my lunch break stolidly working my way through a seventh straight > chicken sandwich,

But you weren't limited to that sandwich, and the sandwich wasn't part of your savings!

As usual, it's a fairly lazy look at the concept. Take a moderate salary in a high cost of living place and try vaguely to cut it drastically, then sum up by saying you might die anyway so why bother.

Here's a quick simpler rundown:

Keep track of what you're spending, it's a simple habit that can pay off well.

Spend less on things that don't improve your life.

Spend more on the things that do.

If one of the things that would improve your life is more financial safety or being able to not have to work, spend some of your money on that.

Other than "earn more money if it's worth the change in job satisfaction" that's a recipe for making your life better whether you want to retire early or not.

</comment><comment><USER26> Real economic freedom varies by the area you live in, but if you live in major metro areas, where you want to take advantage of all the cultural and entertainment offerings they have and also raise children, real economic freedom starts kicking in at around $700,000/year +/\- $200k.

To make that much without a job, you need roughly $10M in the bank (yielding ~7% growth). That's a lot. A $500k/yr job w/o taxes or spending anything would take 20 years. The only way to get there is to have family money or hit the startup lotto (or actual lotto).

These articles are not about true economic freedom at 40, they're about limiting your consumption and being happy about it.

<comment><USER27> Not quite. For one thing, that +/\- 200k matters a lot. Start out making $100k out of college. Get a 10% raise per year. Save half of everything you make over that initial $100k—like pretending you only got a 5% raise. You'll be able to retire with $10M in the bank in your early 50s. At 40, you'll have a couple million in the bank, kids in school, and be able to take modest family vacations without worrying about it. You can absorb health problems, needs for therapy of various sorts—give your kids a great launch.

The trick is finding ways to keep that compensation number moving up 10%/year. The first decade is easy. The second... can be done. Past that, I dunno.

<comment><USER26> > Start out making $100k out of college. Get a 10% raise per year. Save half > of everything you make over that initial $100k—like pretending you only got > a 5% raise.

Do the math, it doesn't work. Starting with $100k at 20, with 5% raises every year gets you to $430k/yr at 50. You're still nowhere near $10M.

<comment><USER27> Get a 10% raise. At 50 you're at $1.7M/yr. You save 0.8M that year, spend 900k—including paying off your kids' education. Assuming 5% returns, your savings tick over to $11118263.51.

But you're right that it's not pretending you only got 5% raises.

</comment></comment></comment></comment><comment><USER12> "monthly subscriptions like Netflix and Spotify" ... I can see a problem right there. Somehow I have managed to live my life without either of those things, and I still manage to watch series, films and listen to tons of music.

<comment><USER22> That's not necessarily a problem. Its the next paragraph where they complain they're bored despite the subscriptions that's the problem.

</comment></comment><comment><USER28> I'm new to HK - just read the guidelines. I clicked this post because the title screamed _scam( to me and I was curious. I was happily surprised to see a post that makes sense.

I've never heard of FIRE. I'm always skeptical of things with names like that - and some of the rules may or may not be ideal - but the conc3ept behind it is fantastic. I'm old and tried living this way way back in my 20's - then i got a family. Without a wife with the same ideals - forget it.

_But* - if it could be gamified ... I always want to design something :-)

</comment><comment><USER29> Waste of time to waste your youth like that, as a frugal shut-in. Plus, this strategy of earning a living thru speculating and miserly living aint so fun when bull-market dead and percentages drop. Best to not worry bout money in your twenties and build your career and make your mistakes and make lots of friends and enjoy drinking as much as you want while not getting fat.

</comment><comment><USER30> It's always good to live beneath your means. Not just for financial reasons, but because you'll be happier if you do.

</comment><comment><USER31> FIRE doesn't have to be miserable. Read Mr. Money Mustache and see how saving can be fun, fulfilling, and even luxurious. Spending >90% of your paycheck is a good way to have to work a long time with not much to show for it.

</comment><comment><USER32> I think there are two unethical aspects to this: Firstly, less money spent will harm the economy, and, secondly, if lots of people do it, the system will adjust to lower salaries until it is not feasible anymore, i.e. this cheatcode depends on most other people still working their entire lives and constantly spending lots of their incomes.

<comment><USER33> Honestly I found none of that unethical.

If you're able to live with a lower consumption you should not increase it just to "not harm the economy". On the contrary I would find it unethical to increase your consumption beyond your need.

To your second point, I don't find it compelling either. First off, the FIRE way requires some amount of restraint and discipline - in many ways it's like dieting. It's good for you, but that doesn't mean people will do it - it will continue to be only a subset of people. Secondly, how would the system would adjust? What would be the driver for lower wages? The method is basically to save and invest half your income - that doesn't depend on your income. The people are still equally skilled, working equally hard during their working years. The output at their work while they work remains unchanged.

If anything it might drive wages _up_, as people would require increasingly higher compensation to stay at work, if the alternative is to live happily and safely without working.</comment></comment>


LEDs may cause retinal toxicity at occupational domestic illuminance - <AUTHOR> https://www.ncbi.nlm.nih.gov/labs/articles/27751961/ <comment><USER2> Some immediate thoughts:

1\. 6000 lux is a _lot_ of light.

2\. The LEDs tested are not the "warm white" (1500-2500K) commonly used as replacements for incandescent bulbs in the US. They're the "blue white" (>4000K) ones, or pure blue or pure green at specific wavelengths.

With those constraints, it's an interesting result. It does not mean you need to run home and rip all the lights out, though.

<comment><USER3> One group of people who could potentially be affected: people who use anti-SAD lighting (especially people building souped-up DIY rigs: [https://meaningness.com/metablog/sad-light-led- lux](https://meaningness.com/metablog/sad-light-led-lux)). Those use LEDs and are specifically meant to be very bright and very blue.

Hopefully this turns out not to be a big deal. Having to choose between depression and retina damage would sure suck :/

<comment><USER4> Also, those lights are suggested for skin exposure, not for staring directly into or for illuminating your space... still though, proximity would encourage more harmful interactions.

<comment><USER5> They are not intended strictly for skin exposure. They are marketed and used as a way to expose your eye (brain) to the high light levels that (may be) needed to regulate diurnal activity.

<comment><USER6> The Phillips light specifically has warnings about not looking directly at it, but rather having it in your peripheral vision. It calls out that eye damage can happen if staring directly at the light for prolonged periods.

<comment><USER7> The lights that I've looked at (look up liberty vt20 for example) have all suggested that eye contact with the light, peripheral or otherwise, is essential for results.

</comment></comment></comment></comment></comment></comment><comment><USER8> Wow, guess you can get LED poisoning :-). The question that I've heard being bandied about is that people use brighter (higher luminous flux) LED lights and displays for better visibility and the question was whether or not the pupil dilation reflex was appropriately triggered (sort of like going blind by looking directly at a total eclipse of the Sun). If a cause could be identified and reproduced it seems the "fix" would be simply adjusting the spectrum of the output to clue your eye into the fact that it was really bright.

Anyway, I wonder if these guys got a follow up grant, does anyone know?

</comment><comment><USER9> I'm curious why LEDs used in light bulbs could cause eye damage, but not for backlights in computer monitors or other common uses? I kindof get the impression that the blue-tinted led's are being considered 'evil' and studies are 'showing' that they are 'harmful'. Certainly these blue led's have far far far less of any wavelength at all of output than say the sun at noon...

I wouldn't be surprised to see that this study is never reproduced.

<comment><USER10> Turn the lights off in a room, and see how much of it your monitors can illuminate. Our eye's logarithmic response to light can end up confusing us about the mile-wide canyon between a glow and a light.

<comment><USER11> Sure but at the same time we are not staring directly at light bulbs for 8 hours a day.

<comment><USER12> Sure but a mile-wide canyon is a mile-wide canyon. They're just not in the same ballpark.

</comment></comment></comment></comment><comment><USER13> Having now skimmed through the paper, there's one very reassuring thing that no-one's pointed out yet:

 _Long-term exposure to LED at 500 lux, in cyclic (light /dark) conditions induced retinal damage only in albino rats but not in pigmented rats_

So, at household levels WITHOUT artificially dilated eyes, only the albino rats (who one would assume are more sensitive to light) suffered any damage.

Given that, as another commenter mentions, rats are likely to be more sensitive to light than humans anyway, this looks like it's a reassuring rather than concerning result. Just don't artificially dilate your eyes then stare at a super-bright LED bank for 24 hours!

<comment><USER14> "Just don't artificially dilate your eyes then stare at a super-bright LED bank for 24 hours!"

Looks like my weekend plans are shot

</comment></comment><comment><USER15> One area where this can matter more than standard lighting is light therapy devices. I have a circadian sleep disorder and for those light therapy is one of the few medically recommended treatments (it is also recommended in the winter for seasonal affective disorder). There are two basic types of light therapy devices, a bright light that you set on the table nearby and a less bright light in a visor that you put near your eyes. I think LEDs are universal in the visor style ones and quite common in the table ones. The blue spectrum is more effective than other wavelengths so they are frequently focused on the blue spectrum although some of the table ones are white light. They are only supposed to be used for a half hour or hour at most.

I just tried for a couple of weeks a visor style light that is just over 500 lux at 500nm dominant wavelength (blue-green; it looks green and is a longer wavelength than most such devices). While it didn't seem super bright, it did seem fairly bright and actually caused me mild pain, similar to what bright light occasionally causes. The lower 315 lux level did the same at first. I started with that a few days and it seemed like my eyes adapted quite a bit so I moved to the higher level. I got spooked after noticing the pain later in the day one day after using the visor on high in the morning, so I haven't tried the lower level again to see if that still causes pain. The manufacturer said that in studies about 3% of people report that problem.

Anyway, it seems to me that my use of the visor might be similar to the lighting in this study. I haven't noticed this issue with other artificial lighting, although I haven't been around LEDs that much that I know of, mostly compact flourescents. The closest is a led light alarm clock that I have stared at at close range for a while and is listed at 300 lux, although I'm not sure if that is what I am getting even a few inches away. The visor light does have a 50-166 hz pulse so that could be related; I'm not sure about the light alarm, but I never noticed that flicker the way the visor does.

Anway, 500 lux at eye level at least can be quite a bit different than normal lighting.

<comment><USER16> Is the light therapy having an effect on your circadian rhythms?

<comment><USER15> The visor did actually seem to help more than any other bright light in the morning method I've tried (including getting natural light in the morning). So I wish it didn't hurt my eyes :(.

</comment></comment></comment><comment><USER17> I don't like the light given off by LEDs. It looks unreal/surreal to me, and makes me uneasy if it's the only light source. Especially the blueish ones. Before installing them I was very enthusiastic about all the benefits of low power lighting, but now I want to switch back to halogen bulbs, or at least very warmly colored LEDs.

I'm oversensitive though. E.g. slightly flickering energy saving lamps make me dizzy, exacerbated by ACs making my eyes dry (hello, Ikea).

I hope those nano-coated regular light bulbs will become a thing.

<comment><USER18> I'd recommend you look for high-CRI LED bulbs – I've had similar reactions to yours but I'm satisfied with some of the better/higher CRI bulbs(color rendering index [https://en.wikipedia.org/wiki/Color_rendering_index](https://en.wikipedia.org/wiki/Color_rendering_index)). They tend to be harder to find, but they're out there. GE Reveal bulbs are higher CRI, for example and I've found other brands through some specialty LED dealers that almost match halogen bulbs.

<comment><USER19> Be careful, though. Soraa, for example, makes fancy LEDs with CRI 95, and they use violet LEDs behind the phosphor. The problem is that the phosphor lets a decent fraction of the source light through. Soraa even has a nice graph on their spec sheet, and it has a violet peak.

Also, a neat fact: _all_ CEC qualified LEDs are high CRI.

(P.S. I bought a GE Reveal once and it had the worst color fidelity I've ever seen. Some normally bluish surfaces were distinctly green. I don't understand how it has a high CRI.)

<comment><USER20> GE has been busted by myself falsely advertising their UV LED bulbs. In fact, I'm currently looking for more people that bought these A19-style UV Black Light bulbs from GE so we can start a class-action suit for false advertising and unfair competition.

In short, I wouldn't trust GE for LEDs. In fact, I'm so disillusioned with almost every company out there (Cree, Philips, GE, Sylvania) that I've simply gone back to building my own lights for my specific purposes. I can't trust any of these companies to be accurate or truthful in their marketing.

<comment><USER21> > that I've simply gone back to building my own lights for my specific > purposes.

Is this what your username references?

<comment><USER20> Yup. I design my own LED units, have a company called SinkPAD (I think it's Adura, now) make the boards, then I populate the boards myself.

<comment><USER22> Maybe you could point me in the right direction. I'm looking to construct a panel that can make it look like day, but has infinite dimming.

Making daylight is easy enough. The Nichia 219B LED in 5000K R9050 (CRI 90+, R9 50+) is beautiful. 12-18 of them will comfortably make over 5000 lumens without having to be driven especially hard. It's not terribly hard to come up with options to wire them up and heatsink them properly either.

What I haven't been able to find is a suitable power supply and driver. I want to plug it in to 100-240V and have a dimmer knob giving me 5-5000+ lumens via current regulation, not PWM, though very fast (> 10kHz) PWM might be acceptable. Yes, I'm aware the tint will shift a bit through the brightness range without PWM. I'm OK with that.

<comment><USER20> "I'm looking to construct a panel that can make it look like day, but has infinite dimming."

Infinite? Not happening, but if you want to get CLOSE, your best bet is in a simple benchtop voltage and current regulator. I use four Nichia 219B LEDs to light my 55-gallon aquarium, are you SURE you really need 5,000 lumens? You could probably get away with just four of those, a fixed 12V power supply with adjustable current, and be done with it, they're ungodly bright and a quad of those can match up with the Cree MK-R.

<comment><USER22> It need not be truly infinite or stepless as long as it has hundreds of steps. I want to dial in the ideal level, rather than pick from say... 10 options.

I'm sure I want over 5000 lumens. When I want my room well-lit to promote a sense of alertness and compensate for shorter days in winter, my best current option is a flashlight that produces about 4200 lumens bounced off the ceiling. No, that's not one of those BS marketing numbers: the light is a Jetbeam T6, which in stock form uses four Cree XP-Ls powered from four 18650 Li-ion batteries. Independent tests, including my own have found its claimed performance to be accurate. I swapped the XP-Ls for Nichia 219Cs (5000K, CRI 80+, R9 unspecified) and measured about a 2% loss of output, but increased intensity. This works as a room light, but requires an external cooling fan to run on high for longer than about 10 minutes (it has a thermal sensor and stepdown), and the batteries can only keep up with that output for a bit over an hour. 219Cs are more efficient than 219Bs and can be driven much harder, but aren't as pretty. Even the recently-released R9050 (CRI: 90+, R9: 50+) version just doesn't look as nice to me.

Four 219Bs definitely can't produce 5000 lumens. The 90+ CRI versions peak at about 600[0], but I don't want to run them at peak output; the harder they're driven, the stronger the spectral peak of the underlying blue LED. I want to run them at about 300lm/ea. 12 of them will get me that, but I'd actually rather have more than 5000 lumens.

Thanks for responding. I was hoping for an off the shelf driver, but it looks like I'm going to be improvising a bit more.

[0] [http://budgetlightforum.com/node/27652](http://budgetlightforum.com/node/27652)

<comment><USER20> Here's an idea. Get a single 50w COB LED that can match or get close to the Nichia (they exist, I'm sure of it.) Actually, Nichia has some of their own that do match - [http://www.nichia.co.jp/en/product/led_product_data.html?typ...](http://www.nichia.co.jp/en/product/led_product_data.html?type=%27NVEWJ048Z%27) and [http://www.nichia.co.jp/en/product/led_product_data.html?typ...](http://www.nichia.co.jp/en/product/led_product_data.html?type=%27NVELJ048Z%27). Then you just need a simple heat sink, and fixed voltage power supply with adjustable current. Those aren't too expensive, but you're still looking at roughly ~$80 in total BOM.

<comment><USER22> I thought about getting one of those bigger arrays, but I'm concerned that the light they produce may not be as pretty as the 219B even if they have the same color temperature and CRI on paper. The 219C, for example is not, though it's still very nice and capable of quite a bit more output. Output per emitter and overall efficiency aren't major concerns for me: we're talking about around 90W for 6300lm driving 18 219Bs at 1500mA each.

It's also difficult to find the 048Z available in single quantities. I didn't find the R9050 version on Octopart, Other versions cost $50-60, while 219Bs in several tints are readily available from suppliers of DIY flashlight parts for $3/pc. Getting 219Bs and triple or quad copper MCPCBs is easy, and they can be configured for any multiple of about 3 volts, while the 048Z requires a 50 volt power supply.

I was expecting to spend over $100 when all is said and done.

<comment><USER20> "It's also difficult to find the 048Z available in single quantities"

Just ask Nichia for an engineering sample. :) Boom, free sample if they've got one for you to utilize. I don't know how many Cree, KingBright, Nichia, Osram, and Epistar LEDs I've got just because I ask to test them.

As for the 50V power supply, it'll run on a 48V 1.25A driver. You'll be fine and those are about $20 each.

<comment><USER22> I have hundreds of dollars worth of flashlights I got by offering to write reviews, but asking for an engineering sample never crossed my mind. I may have to try that.

<comment><USER20> If you point out to them reviews you've written (some of them mentioning their LEDs favorably) you'll get the engineering sample no problem, I imagine. They like people that promote their products and bend over backwards to get them tiny things that cost them far less than what they're going to get in potential advertising.

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER23> Link to full paper via sci-hub: [http://twin.sci- hub.cc/ac1a63745360991b7b9a42390ab3faa8/krig...](http://twin.sci- hub.cc/ac1a63745360991b7b9a42390ab3faa8/krigel2016.pdf)

(Sorry if this is a dupe and hope this link is persistent, I scanned the thread and saw some people lacking access and didn't see any sci-hub post)

</comment><comment><USER24> > using different LEDs (Cold-white, blue and green)

I wonder what the results would look like for warm LEDs ~ 2700K. I used to be a Cold-white aficionado but moved to warms for everything. If I experiment by suddenly switching between my cold and warm lights its pretty jarring (warm seems more relaxing).

</comment><comment><USER25> In a study done on rats... evidence is low, i would wait for large scale studies before concluding on LED health effects

<comment><USER26> Aren't rats nocturnal? Seems like a very poor study.

<comment><USER27> Lab rats are brown rats, which aren't nocturnal, but active day and night. I'm not sure that's important for a test of damage to the eye, but there you go.

<comment><USER28> Their vision is still really different to that of humans.

<comment><USER29> Sounds like you have some background on this. Would you elaborate? In particular, how the differences make the research unlikely to be meaningful with respect to humans?

<comment><USER28> I have no background in eyes but I have on rats. I can't affirm that the differences would make that study invalid.

I can however tell you a few facts about rat eyes.

\- Their eyes are sensitive to ultraviolet.

\- They have a dichromatic vision, two sets of cones instead of three. (some short wavelengths of ultraviolet/blue and a lot of greens)

\- They cannot reshape their lenses.

\- They have a lot more photo-receptors on their retina than us.

\- They are something between farsighted and nearsighted.

\- Poor binocular vision but big field of view.

Albino rats have more differences but I doubt they would have used any of those in a study on eyes.

Rats do get the same kind of eyes disease humans do (cataracts, etc.) however their sensitivity to light is really different. I don't think that it is ideal to use such different eyes to test LEDs sensitivity.

</comment></comment></comment></comment></comment></comment><comment><USER30> I think it's important to recognize that this is _far_ from the only study pointing to this, and that similar problems are associated with CFL's.

For example, here is a 2014 study, "White Light–Emitting Diodes (LEDs) at Domestic Lighting Levels and Retinal Injury in a Rat Model" [http://ehp.niehs.nih.gov/1307294/](http://ehp.niehs.nih.gov/1307294/)

This article cites numerous studies in the quotes section ( scroll down) [http://lowvision.preventblindness.org/daily- living-2/artific...](http://lowvision.preventblindness.org/daily- living-2/artificial-lighting-and-the-blue-light-hazard/)

Links to eye toxicity, macular degeneration, and blindness are not the only problems associated with new lighting either, which tends to be very heavy in the blue components. Lots of research links usage of blue-heavy white lighting to damaging circadian rhythms, which can lead to significant health effects. [https://www.sciencedaily.com/releases/2011/09/110912092554.h...](https://www.sciencedaily.com/releases/2011/09/110912092554.htm)

This year the AMA issued a public safety warning regarding LED street lights because of the association with circardian rhythm disruption and related health effects. [http://www.cnn.com/2016/06/21/health/led-streetlights- ama/in...](http://www.cnn.com/2016/06/21/health/led-streetlights- ama/index.html)

Paul Jaminet has stated that circadian rhythm disruption has been more strongly linked to cancer than any food study, ever.

I use the GE Align PM LED bulbs, available on Amazon, which cut out most of the blue frequencies and largely address both sets of problems. Highly recommended. [https://www.amazon.com/GE-Lighting-93842-350-Lumen- Dimmable/...](https://www.amazon.com/GE-Lighting-93842-350-Lumen- Dimmable/dp/B00PLR3M0M/ref=cm_cr_pr_product_top?ie=UTF8)

EDITED to correct summary of AMA announcement.

</comment><comment><USER31> Does anyone else use something like flux or redshift _permanently_? These programs change the color temperature of your monitor based on the time of day, but I use them all day.

Otherwise my eyes start watering after awhile and get itchy and irritated. I think I must be sensitive to blue light. I used to set it around 4500 color temperature but now I lowered it to 4000.

<comment><USER32> I use f.lux on a rather high setting 24/7 at work, most of the day at home (where I have better lighting), and at night on my phone. Using it all day at work with the 20/20/20* rule has greatly reduced my eye stress.

* I made a simple website using the Notifications API which reminds you every 20 minutes to take an eye break.

[https://johnbartos.github.io/eyebreak/](https://johnbartos.github.io/eyebreak/)

<comment><USER33> Workrave[1] is good for this too. Just set short breaks to 20sec every 20min.

[1] [http://www.workrave.org/](http://www.workrave.org/)

</comment></comment></comment><comment><USER34> If blue light exposure causes Macular Degeneration I wouldn't be suprised if environmental and genetic effects would cause some people to be affected by it and others not.

This is the case for noise related hearing loss. Everybody loses hearing acuity a bit as they get older, but exposure to noise accelerates this process. Exposure to ambient sounds in the high 60s (decibels) is harmful to a small segment of the population. That's not very loud, but fortunately most people are not hurt at that level. Occupational exposure levels are set considerably above that point.

</comment><comment><USER35> Just a word of caution not to draw precipitated conclusions since this is a study in preclinical phase tested on rats. Of course it means something and requires further study but just wanted to emphasise the fact that it wasn't applied on humans.

</comment><comment><USER36> A related study on human retinal pigment epithelial cells

[https://www.researchgate.net/profile/Eva_Chamorro/publicatio...](https://www.researchgate.net/profile/Eva_Chamorro/publication/230878318_Effects_of_Light- emitting_Diode_Radiations_on_Human_Retinal_Pigment_Epithelial_Cells_In_Vitro/links/0a85e535162107674c000000.pdf)

</comment><comment><USER37> So the blue SAD lamps like this would be especially dangerous. [https://www.amazon.co.uk/Klarstein-Therapy-Generous- Display-...](https://www.amazon.co.uk/Klarstein-Therapy-Generous-Display- Application/dp/B00PLSWOVO)

I have this exact same model and it has been working great, too bad if carrying a significant risk.

</comment><comment><USER38> Two more situations where this spectrum and intensity is in use: on stages (music,TV) the old PAR lights are nowadays nearly fully replaced by strong led spots shining directly on the actors. Still you don't spend 22h on stage of course.

The other situation would be artificial gardening system where a heavy bended light spectrum is used to grow lettuce etc.

</comment><comment><USER39> Oh great, no doubt this will picked up as a sensationalist news item that'll inevitable lead to a futile debate with my elderly inlaws about how _dangerous_ LED lights are, because this is proof, no matter how much my inlaws are NOT nocturnal albino lab rats.

Sigh...

</comment><comment><USER40> It was a Q-Switched, Xenon pumped, Neodymium Garnet laser intended for Photo- retinal Welding.

This pulse laser was so powerful that at discharge through the microscope it could create a white spark in mid-air; the

so-called waist area.

I Hired on to CooperVision as a Developmental Tech, I inadvertantly grounded a flash-circuit while the laser exit face

aligned to my eyes.

The Fluke Meter actually bounced a centimeter into the air at discharge, and I saw a moderate orange glow for a bare

instant.

Immediately after, and today, when I gaze into a clear blue sky, I see a "small dounut shadow" of two to three degrees

in my mid to lower right field.

The contrast of the Donut image has decreased over the years but decades later, I see it. What do you Know? I got shot with a surgical welder.

-No worries though, No worries at all.

</comment><comment><USER41> How does this relate to staring at OLED at LED screens? Are they potentially dangerous as well? Could you prevent harm by running a tool like F.lux and lower the brightness?

<comment><USER42> Everything is potentially dangerous. The article reported an experiment done on albino rats; that's not much indication of a serious risk to people; it only means that someone should look into it further.

</comment></comment><comment><USER43> Thanks HN and NIH. Just in time too -- I have been mulling the purchase of an LED garage light.

[https://www.haikuhome.com/garage-light](https://www.haikuhome.com/garage- light)

Color temp = 5000K. Output is 13000 lumens. The sales page assumes 10 ft x 15 ft illuminated area (install height not specified but probably 8 ft) = 250 ft^2 or ~23 m^2.

Doing the math yields 565 lumens / m^2. Should be a little more at standing (eyes ~5ft off the floor) height.

<comment><USER44> It sounds like you wouldn't be anywhere near the lux levels that present a danger based on this post.

<comment><USER42> Especially since the GP's author probably is not an albino rat (though I don't want to presume).

</comment></comment></comment><comment><USER45> Should I worry that I've been using this daily for a year, per my sleep doctor, for delayed sleep phase syndrome?

Philips GoLITE BLU - [https://www.amazon.com/Philips-GoLITE-BLU-Energy- Light/dp/B0...](https://www.amazon.com/Philips-GoLITE-BLU-Energy- Light/dp/B00M3SGCUE/)

30 minutes a day at the highest setting...

</comment><comment><USER46> Is it possible that this is just a problem with LEDs that flicker[1] because they don't rectify the AC? The blurb didn't mention this problem, but presumably that's not what's going on here.

[1][https://www.youtube.com/watch?v=zcbk4H2iGYU](https://www.youtube.com/watch?v=zcbk4H2iGYU)

<comment> m-p-3 Now I'm wondering if my dog see my LEDs as a stroboscope.. :/

</comment></comment><comment><USER47> Normally, I would not have thought much about this kind of an article. But, I happen to be wandering around CES today and there was a booth somewhere that was promoting some glasses to protect your eyes from LED lights.

If I happen across that booth again, I'll stop and look.

</comment><comment><USER48> Car headlights seem to have gotten much brighter in recent years. I know this is about domestic lighting, but... any concerns about car headlights and streetlights? Those tend to be much much brighter than indoor LEDs.

</comment><comment><USER49> Whew, I thought it said "LCDs". Are those safe?

</comment><comment><USER50> Reminds me of recent results using 40Hz blinking LEDs to treat Alzheimer's:

[http://news.mit.edu/2016/visual-stimulation-treatment- alzhei...](http://news.mit.edu/2016/visual-stimulation-treatment- alzheimer-1207)

I often fall into the trap of thinking that light at normally encountered levels has essentially no effect. That's obviously not the case though.

</comment><comment><USER51> Looking through the literature it looks like it might be Dry AMD (macular degeneration) which is bad because it's currently untreatable. Wet AMD has some treatments available.

</comment><comment><USER52> raise your hand if this article prompted you to lower the color temperature of your monitor via f.lux

</comment><comment><USER53> What implications does this have for VR glasses like the Vive and the rift. Those use OLED displays?

</comment><comment><USER54> Can someone please tl;dr this? I seriously couldn't make it through the abstract.

</comment><comment><USER55> Does anyone know if this applies to organic LEDs as well?

</comment><comment><USER56> I always knew blue LEDs was bad for you. But its nice to have confirmation of this.

Blue LEDs can seem almost blinding.

</comment><comment><USER57> When new phones or displays come out, the manufacturer will invariably brag about the increased color gamut. Before I get blinded with science, it's time to adjust my f.lux and night shift settings.

</comment><comment><USER58> Using a yellow whiteboard marker, simply colour in the LED's face. Problem solved.

</comment><comment><USER59> Name me a thing, a biscuit, a light bulb, a gadget, a piece of metal, where there isn't some sort of agency that claimed that it increases the risk of cancer by 0.3% based on a study based on a sample of 8 patients and an opinion from the author's grandma!</comment>


Scrabble for the iPad: the best $1,000 you ever spent on a board game - <AUTHOR> http://www.engadget.com/2010/04/04/scrabble-for-the-ipad-stir-in-some-iphones-and-its-the-best-1/ <comment><USER2> "You can't deny, it's pretty metaphysically silly to be playing a board game your parents bought at a yard sale for $2 on a $500+ iPad, in conjunction with two or more $200+ iPhones. Mix in service plans, accessories, the price of the app ($10), and the bribes you'll have to pay your friends to join in on something so embarrassing, and you're really pushing the limits of common sense with Scrabble for the iPad. "

The title of this is really just linkbait, its misleading. Scrabble is some marginal cost over the price of the device, not the reason why someone buys it.

<comment><USER3> Or it's just, you know, a joke.

</comment></comment><comment><USER4> There are a lot of board games I like, but don't play very much due to the set up time. A version of Puerto Rico for these would be awesome.

<comment><USER5> Agreed. Puerto Rico, Agricola, any game where you have your own board or 'plot' would be very cool. Anyone who's had to stop for a day or two and try to protect a game in progress would appreciate an autosave feature too.

<comment><USER6> Just make a high-resolution photo, works well.

</comment></comment></comment><comment><USER7> One nice potential for this is that people far away could join in over the internet.

Either one person with an iPhone playing remotely, or another couple of people with iPads/iPhones replicating the board and playing the same game.

I wonder if they've done anything like that.

And the board state could exist on a server somewhere and you could join and leave at any time and play a long running game, and then you open up the opportunity for the iPad to be a Google Maps stlye viewport into a single massively multiplayer game of the Red Alert / Populous / Sim City / Gods styles and the key bit being it's a small living room coffee table device with long battery life and App Store enabled low complexity of joining in.

Cross with Dropbox/Flickr and instead of video conferencing you get a virtual object/image store between you and your (parents/family/friends/whoever). Not in an 'email a picture' kind of way, but in a nearest-thing-to-teleportation way.

Open app on iPad, on iPhone, take picture with phone. Other end of the tunnel opens their app and there's a new picture. All you need then is that 'rebuild a few photos into a 3D model' technique that was going around a while ago and you have a great tech demo. Wonder if it would have any real world desirability... ahh, sometimes I wish I was a real programmer.

<comment><USER8> > I wonder if they've done anything like that.

You just described Words with friends for the iPhone. You can also play up to 20 games simultaneously. But the problem with playing scrabble online is that it's way too easy to cheat. (www.scrabulizer.com for example). At least in person you can watch them.

</comment></comment><comment><USER9> Well, shit. I guess thanks to the iPad we aren't deprived of literally 100s and 100s of online scrabble games.

<http://www.google.com/search?q=online+scrabble>

<comment><USER10> I would not be so quick to write the iPad off just because alternatives are free and the iPad is expensive. Humans are weird creatures. Who knows how people justify their purchases. But I can tell you from spending an hour in an Apple Store on Saturday -- the iPad is flying off the shelf, and the buyers are all types. Perhaps a $1,000 game of Scrabble is not as unreasonable as you might think.

<comment><USER11> If you buy an iPad just to play Scabble, it's $1,000 for the game. But a common family may already have an iPhone for each member. They could decide to buy an iPad to replace a netbook, or because they have none and/or no computer.

When they will find Scrabble and decide to buy it, it will be $10 for the game, not $1,000.

</comment></comment></comment><comment><USER12> _> There isn't even a helpful warning like "are you sure you want to end this game you just invested an hour of your life into without even saving or something?"_

Well, yeah. That's not possible. When you hit the menu button, the app gets killed. (I think it gets some sub-1-second time to try to wrap up loose ends, but still.)

Now, it should save your state as you go, but that behavior isn't possible with the iPad SDK, and engadget should know that.

<comment><USER13> not so! i have my own game that also runs across two or more iphones and/or ipads via wifi, and it saves its state just fine, and allows you to pick up where you left off.

true, you don't have a whole lot of time to save state, but you don't need much. in my case, everything i need to know about the game is saved in a roughly 4k blob, which is saved to prefs almost instantly.

<comment><USER12> What I meant is that the message asking if you're sure you want to quit isn't possible. But yes, it definitely should save state automatically.

</comment></comment></comment><comment><USER14> Scrabble should be part of the elementary school curriculum. There are so many opportunities not just with the iPad but with tablets in general.

</comment><comment><USER15> I know it's easy, and even sensible to dimiss this as completely overpriced, but it's concepts like these that really get me excited. I see so much potential in this sort of device communication, it makes me anxious just thinking about it.

</comment><comment><USER16> iPad as digital gameboard... that could be pretty compelling.

I'd love to have a really nice high-resolution digital chessboard.

<comment><USER17> How would this be better than an infinite resolution analog one?

<comment><USER18> Or an 8x8 pixel one?

<comment><USER19> An 8x8 pixel chessboard would require players to memorize which color corresponds to which piece type (for both sides).

You could also have certain flickering colors represent certain pieces, but overall it would require good color vision from all players.

Alternatively, you could have an 8x8 character grid; monochrome if you represent things like:

        rnbqkbnr
        pppppppp
        . . . .
         . . . .
        . . . .
         . . . .
        PPPPPPPP
        RNBQKBNR

or

        ♜♞♝♛♚♝♞♜
        ♟♟♟♟♟♟♟♟
        _█_█_█_█
        █_█_█_█_
        _█_█_█_█
        █_█_█_█_
        ♙♙♙♙♙♙♙♙
        ♖♘♗♕♔♗♘♖

(The second board may not be properly fixed-width in your local "fixed-width" font, but you get the picture).

</comment></comment></comment></comment><comment><USER20> "You can't deny, it's pretty metaphysically silly to be playing a board game your parents bought at a yard sale for $2 on a $500+ iPad, in conjunction with two or more $200+ iPhones."

Yes, if that's _all_ that the iPad+iPhones were capable of...

<comment><USER7> If that's all you bought them for. Extra capabilities don't count as value if you aren't benefiting from them.

</comment></comment><comment><USER6> Playing Scrabble with out the direct face-to-face communication sounds terrible. What about argueing over words, bluffing, celebrating, whining. Does not sound even remotely fun compared to real Scrabble to me.

<comment><USER21> Huh? Isn't the use-case here that you all sit around the iPad, which acts as the common game board, using your personal iPhone to hold your bricks? I didn't watch the video, but that's how I understood it.

<comment><USER6> I don't have Flash so I could not watch the video. If you are right, then it makes it even worse to me. I like the haptic feel of the pieces when playing. Why would you want to remove that. I see no benefit at all making this virtual. ("difficult math", seriously?) D&D on a pad could rock of course.

</comment></comment></comment><comment><USER22> This fits comfortably in the slot between insanely dumb and amazingly cool.</comment>


Show HN: My weekend project - CuteAdoptablePets.com - <AUTHOR>

Just deployed my weekend project. It's a mashup of Petfinder results with Google Maps.<p>Let me know if you have any comments, questions, suggestions, etc. Thanks! <comment><USER2> I could find exactly one pet in there and I ended in Italy when entering a US zipcode (90125).

Other than that _fantastic_ ideal, let me know when you're ready to go live and I'll promote you every chance I get, including on all the websites I run.

<comment><AUTHOR> Update: This should be better now. I added a check for non-US addresses.

That's really interesting. My geocode backstop is Google's geocode service. When I do a Google Map search for "90125" it also displays Palermo, Italy. I'll see what I can do to work around this. Thanks for your help!

</comment></comment><comment><AUTHOR> Clickable: <http://cuteadoptablepets.com>

</comment><comment><USER3> USA only, but I think this is a great idea.</comment>


Mathematics of the ISO 8601 calendar - <AUTHOR> http://www.staff.science.uu.nl/~gent0113/calendar/isocalendar.htm <comment><USER2> An interesting read, although the color scheme of red-on-blue headers combined with green background, red for the quotes, and a green gradient for the site background is a bit too much for me.

<comment><USER3> Poor design choices aside (looking at you, frames), calendar math is absolutely fascinating. This is mostly because of how annoying it is to have the world's schedule dictated by the poor choices of a 512 year old pope.</comment></comment>


The Site Reliability Workbook: Practical Ways to Implement SRE [pdf] - <AUTHOR> https://services.google.com/fh/files/misc/the-site-reliability-workbook-next18.pdf <comment><USER2> Who here would like to contribute their actual organization's practices to a wiki just dedicated to SRE stuff?

Rather than just talk about how we're supposed to do this stuff, we can share how we actually do it. Pick some recipes (procedures, configs, documentation, tooling, workflows, etc), learn from previous teams, and go to town. Contribute back the things you've done/changed/learned to the wiki.

I bought the domain sre.pizza because it was funny and easy to remember. I can set up a wiki there this weekend...

<comment><USER3> There is a story about a motorist stopping in the Irish countryside and asking for directions ... "I would nae start from here if I were you" being the reply.

companies SRE efforts range from world leading to fiscally irresponsible- and revealing the latter to the world will be actionable - against the "whistle blower" and yourself (publisher).

Wikileaks looks like it does to protect against that. (partially)

So you can either look like wikileaks, and have a genuine survey of current state of play, or you can have a "this is how we did awesome SRE at the tiny portion of the big co I was employed by" talks.

I don't have an answer if you are in the irish countryside and want to start from somewhere else.

That would be a question worth answering

<comment><USER4> If I had to make a wild guess, I'd say companies that are seriously willing to engage in real SRE are probably also open enough to have a "How we did it" chapter written. At least in the Fortune 500 world where I live, companies aren't into pretending they don't suck, generally.

And the companies that are likely to be jerks about it are unlikely to be doing interesting SRE work. I'd like stories of hard-won success (or cautionary tales of failure), not just ranting about how much Company X sucks and how broken they are.

<comment><USER2> Exactly. Most companies are willing to advertise their wins and lessons learned because it means they grew. If they don't have wins yet, they can use the wiki to work on their process and eventually contribute back what works. And I'm sure there's lots of existing companies who have gone through all of that (several of which are in the SRE workbook)

</comment></comment></comment></comment><comment><USER5> This is a free download until August 23. It's a sequel to their 2016 book, Site Reliability Engineering, which is free to read online at the same landing page: [https://landing.google.com/sre/book.html](https://landing.google.com/sre/book.html) The previous book was more about principles than practice; this one is more about practice. The foreword noted that while few companies are at Google's current scale, many more are as large as Google was when they started practicing SRE ideas.

</comment><comment> luka-birsa Huge fan of what Google is doing with SRE, we're mandating that everybody that works on production systems reads this book. So many insights that point you in the right direction on how online services/products are properly deployed. Even if you can't implement everything now, go read the book.

We're a small team and we started implementing SLOs for services, we're slowly building our SRE teams, with the purpose of "SRE embeds" in existing engineering teams.

A must read for anybody that wants to do systems engineering / devops / whatever sys admins are called these days. A must read for any technical lead.

</comment><comment><USER6> The big question when something like this comes out of Google, FB or whatever: is it relevant to your company? Sometimes (very often) what's appropriate for a big company that's raking in money hand over fist and has a ton of people is not at all appropriate for your company.

<comment><USER7> I think a better question to ask is not if it is relevant, but what portions of it are relevant. There are certainly many key, important lessons that have been learned in the process of scaling their organization and processes. I'd say it's near impossible that none of those lessons are relevant.

Copying their full process probably won't make you the next Google, but figuring out how to take their learnings and apply them at the right time is a great way to give yourself a leg up.

</comment></comment><comment><AUTHOR> Announcement from Urs: [https://twitter.com/uhoelzle/status/1022320545528864769](https://twitter.com/uhoelzle/status/1022320545528864769)

</comment><comment><USER8> Looking for reviews from SREs who have read this themselves. O'Reilly books are top notch in my experience, I am hoping this one is right up there with the rest that I have read.

<comment><USER9> The fact that Mark Burgess wrote the forward is a good sign to me. His writing is among the best I have encountered in 20 years of practice.

</comment></comment><comment><USER10> Is there a epub version ?

<comment><USER11> What are the advantages of epub over PDF? I've never heard of anyone asking for a conversion in that direction before.

<comment><USER12> Reflow.

</comment></comment></comment><comment><USER13> Apologies for looking a gift horse in the mouth, but it's a bit terrible that most of the URLs in the book are bit.ly links. I guess you can play link roulette...</comment>


Cooking a Project Team - <AUTHOR> http://blog.jaconda.im/cooking-a-project-team

<comment><USER2> Not bad I guess.

<comment><USER3> I don't know, I think it reads like bad advertising copy. Cliche'd metaphor made on a tenuous link but without any of the added wit and je-ne-sais-quois that makes (good) copy fun to read.

I strongly disliked a number of things about it.</comment></comment>


Apple CEO Tim Cook to donate his fortune to charity - <AUTHOR> http://money.cnn.com/2015/03/27/technology/tim-cook-wealth-charity-fortune/ <comment><USER2> The world needs more CEOs like him. The CEOs of the largest companies of the world have the power to really change the world by just donating the money.

Not everyone "can" or "afford" to think of rest of the world because they are to0 helpless to give away the money instead of making ends meet.

It is really difficult to fill the shoes of Steve Jobs and get out of the shadow, and not only he has maintained the dignity of what apple is but Tim Cook has certainly made a name for himself and it is very nice to hear that we have such good people in this world.

It makes me fall in love with Apple more. #Respect

<comment><USER3> > _The world needs more CEOs like him. It makes me fall in love with Apple > more._

Did you read the article, or just the headline? There _are_ more CEOs "like him".

"More than a hundred" have signed up to give away their wealth to charities, including Bill Gates, who started the pledge along with Warren Buffet. Of course, around here Bill Gates eats vitriol, because of some business practices in his history and despite his generosity and charity work. Meanwhile, Apple openly conspired to keep industry wages low and gets "#Respect"?

This is not to take away from what Mr. Cook has decided. It's great for the world. But let's not put him on a pedestal without at least acknowledging there are a slew of wealthy individuals doing this, some of them real pioneers of the idea.

[https://en.wikipedia.org/wiki/The_Giving_Pledge](https://en.wikipedia.org/wiki/The_Giving_Pledge)

<comment><USER4> I have to come to HN's defense here. This is an entirely unfair statement:

"Of course, around here Bill Gates eats vitriol, because of some business practices in his history and despite his generosity and charity work. Meanwhile, Apple openly conspired to keep industry wages low and gets '#Respect'?"

There are absolutely some individuals who engage in this hypocrisy, but I would not paint all of HN with that brush. Quite the opposite. I regularly see posts downvoted in to oblivion for failing to compartmentalize opinions about Bill Gates, Microsoft CEO and Bill Gates, Philanthropist.

<comment><USER3> > _regularly see posts downvoted in to oblivion for failing to > compartmentalize opinions about Bill Gates, Microsoft CEO and Bill Gates, > Philanthropist._

This is probably true, but I can't recall seeing it in many threads _I_ read. On the other hand, I've seen comments (albeit, downvoted), on these very forums, calling for Mr. Gates' _death_. I'm serious. That's unbelievable in what is otherwise a highly intelligent tech community.

My post probably comes off as "Who cares?", and that was not my intention. This is amazing of Mr. Cook. But let's not attach it to "Apple is so great!"

</comment></comment></comment></comment><comment><USER5> On page 263 of my large-print edition of the Isaacson biography of Steve Jobs, Jobs is quoted as saying about Bill Gates, "Bill is basically unimaginative and has never invented anything, which is why I think he's more comfortable now in philanthropy than technology".

I don't know about you, but I'd rather be unimaginative than fabulously, unimaginably rich but also selfish about it.

<comment><USER6> Was Jobs selfish? Or did he just not use his charitable giving as a means of self promotion or legacy building? Fair question. We're assuming facts not in evidence.

<comment><USER5> I don't know what Jobs did with his money. I'm criticising his _values_ , as described in this statement that clearly paints philanthropy as beneath him, to those of Cook. Maybe he gave money away even though he thought it was beneath him, but it's still disgraceful and loathsome to paint philanthropy as a pursuit of the small-minded.

<comment><USER7> >..clearly paints philanthropy as beneath him..

Wow, I did not get that from the quote.

<comment><USER8> "Bill is basically unimaginative and has never invented anything, which is why I think he's more comfortable now in philanthropy than technology"

I certainly got from that that Jobs views philanthropy as the land of retirement for the unimaginative.

</comment></comment></comment></comment></comment><comment><USER9> I like seeing these sorts of actions... I do wish that more corporations simply operated a bit more even handed to begin with though.

As an aside, I really wish there was a tag in the headline when auto-play video is in a link... I tend to open up several articles and the respective comments in tabs in the morning... the chrome indicator helps, but would be nice to know it was going to happen.

</comment><comment><USER6> Interesting that the article mentions his orientation. Seems irrelevant to the premise of the story.

<comment><USER10> I don't feel it's irrelevant. Both anecdotes point to Tim being a progressive, unconventional CEO.

I think it's great, and I didn't personally pick up on CNN trying to pull anything sleazy here.

<comment><USER6> Being gay doesn't make you progressive any more than blue eyes make you progressive. Actions are the key not one's genetic characteristics.

<comment><USER11> Why people believe it is something genetic? People are not animals, we're not controlled by our genes. The difference between a dog and a human just can't be counted. It is just psychiatrists pushing this idea that taking drugs, violence and perversions are natural.

<comment><USER12> > People are not animals

By every scientific definition, yes, we are.

</comment></comment></comment></comment></comment><comment><USER13> Isn't it interesting that it's seemingly only self-made millionaires/billionaires who are pledging the bulk of their self-made fortunes away? That despite them doing this, we're not seeing "old" money following suit?

<comment><USER14> Bill Gates is not a self-made millionaire, if that phrase is to have any meaning.

<comment><USER6> Was he born a millionaire? Define 'self made.'

<comment><USER14> "Self made" defies precise definition. If you start with $999,999 and earn $1 by your own efforts, a strictly precise definition for "self made" would imply you were a "self made" millionaire. However it would also apply to somebody who started with $1 and earned $999,999 by his own efforts. Hence using "self made" in both cases renders the phrase so broad as to be empty of meaning.

<comment><USER15> It doesn't need a precise definition. I think most people will understand what you mean when calling someone a self-made millionaire. That's all that matters: the phrase conveys a meaning.

</comment></comment></comment></comment></comment><comment><USER16> I am surprised that he isn't over a billion already. I guess the extreme wealth of a few founders makes me assume "CEO of largest company in the world worth 600B should be worth over a billion himself"

</comment><comment><USER17> Actually, the world needs more people who think beyond their own family legacy and consider what the world needs. Its interesting how you can look at people today (via the media) and size them up as far as if they feel they are a citizen of the world. Tim Cook clearly sees himself that way. The Koch Brothers...not so much.

<comment><USER18> [http://www.metmuseum.org/visit/plan-your- visit/plaza](http://www.metmuseum.org/visit/plan-your-visit/plaza)

</comment></comment><comment><USER19> This post says Entire which doesn't make any sense unless he means when he dies. But upon reading the actual article it doesn't mention anywhere "entire".

</comment><comment><USER20> The headline here has "entire" in it - on CNN it does not. Makes quite a difference!

<comment><USER21> Perhaps CNN is actually being pedantic, be will be paying for his nephew's college education first, and then the rest to charity.

<comment><USER22> CNN made a story out of something from Forbes, but what exactly isn't cited. Nor does it appear to be available online. Maybe it's print only.

Suffice to say there's not enough information to say anything definitively. It's not like Tim is paying for his nephew's college next week and then donating everything to charity. One could reasonable expect this to be in reference to his fortune when he dies. Not what happens next week.

But we don't know because all we have is a blog spam re-write of something we can't see.

<comment><USER23> The Forbes text is here: [http://fortune.com/2015/03/26/tim- cook/](http://fortune.com/2015/03/26/tim-cook/)

It's linked from the CNN piece.

</comment></comment></comment></comment><comment><USER24> This should be good for the Apple stocks.

</comment><comment><USER25> Do LGBT orgs count as charity in his definition?

<comment><USER26> There are a variety of non-profits that serve the LGBT community.

<comment><USER27> In my book, LGBT orgs are political and don't get to be classified as charity.

<comment><USER12> The Trevor Project, as an example, aims to reduce suicide in LGBT youth. If "encouraging kids not to kill themselves" is a "political" act to you, I really don't like your politics.

</comment></comment></comment></comment><comment><USER28> Sorry if this is politically incorrect. I say this respectfully and with the hope that it would be useful to someone who reads it:

People typically save money for their kids. The 'mothering' or 'fathering' instincts are so strong that we protect resources for our progenys. It appears that Tim Cook may never have a real progency. So what will he do with all this money? He could give it to his nephew. Maybe. He gets a thank you card from them. But his 'parenting' instincts are not triggered by it. So he has to do something else with it, like donating it to Charity.

<comment><USER29> Are you insinuating that he won't be having kids because of a weak correlator (his sexual orientation)? Why not use a better correlator, that he's the type of person that doesn't want kids?

</comment></comment><comment><USER30> I don't understand the psychology of making billions of the backs of the grotesquely underpaid and over-worked masses (Foxconn suicides [1] and illegally mined tin [2] for example) and then turning around and saying 'oh, this is too much for one person - here, you have it.' If you want to help people or even just preserve the environment, why not start with what you have direct control and responsibility over in the first place.

Fucking billionaires [[https://youtu.be/iko4s3CfBi0?t=44s](https://youtu.be/iko4s3CfBi0?t=44s)]

[1] [https://en.wikipedia.org/wiki/Foxconn_suicides](https://en.wikipedia.org/wiki/Foxconn_suicides) [2] [http://www.bloomberg.com/bw/articles/2014-02-13/apple- supply...](http://www.bloomberg.com/bw/articles/2014-02-13/apple-supply- report-acknowledges-its-smartphones-and-tablets-rely-on-smelters-using- illegally-mined-tin)

<comment><USER11> People will suicide if their families get money for doing that that. Stupid? Sure. There is no slavery on Foxconn plants, anyone can go away and grow some rice peacefully.

<comment><USER31> > There is no slavery on Foxconn plants[..]

While it's not slavery in the traditional way, it sure is when you pay workers virtually nothing for a product that's overpriced.

Think a situtation where you'd be an administrator for Amazon and you're getting $10/day just because you live in <x> country, while your other _only_ option is to - as you said - "go away and grow some rice".

While this is a completely legal action, would you say that it's also ethical?

But no, whenever a f*cked up situation is not near our own precious asses, it doesn't matter. They can go out and grow some rice.

<comment><USER32> The workers who manufacture the iPhones aren't Apple employees. They're Foxconn employees, and Apple doesn't really have much control over how much they get paid. I mean sure, they could say "here's an extra Billion, make sure that the workers who build the iPhones get these"; I'm sure Foxconn would take it, but who knows where it would go from there.</comment></comment></comment></comment>


Let's Encrypt tls-sni-01 disabled due to credible vulnerability report - <AUTHOR> https://letsencrypt.status.io/pages/incident/55957a99e800baa4470002da/5a55777ed9a9c1024c00b241 <comment><USER3> Josh from Let's Encrypt here. I'm not able to give many more details yet, but here's what I can add now:

1) This isn't a relatively simple issue like a bug in our CA code would be. It's an interaction between the protocol and provider services.

2) Disabling TLS-SNI is a complete mitigation for us, meaning it's no longer possible to get an illegitimate certificate from Let's Encrypt by exploiting this issue.

3) We have not yet reached a conclusion as to whether or not the TLS-SNI challenge will need to remain disabled permanently.

4) At this point we have no reason to believe that the vulnerability has been exploited by anyone other than the researcher who figured it out and reported it to us.

Our focus now is on sharing information with relevant parties and looking for less drastic mitigations that might allow us to restore the TLS-SNI challenge option to people who rely on it.

We will, of course, share more information as soon as we can. That might be as soon as the next few hours, things are moving quickly.

<comment><USER4> Do we get points for speculation based on these hints?

My guess would be that some major public CDN (Cloudflare etc) will let the attacker deploy their TLS-SNI challenge certs, and thus validate for other victim domains using the same CDN service.

EDIT: Main reasoning being that I can't think why it wouldn't work - <USER2> from the TLS-SNI challenge certs somehow being considered invalid by the CDN provider and refusing to deploy them, but I find it hard to trust that happening with 100% certainty.

<comment><USER5> I haven't seen anything on our internal security mailing lists about this. If it does somehow involve Cloudflare I'd be happy to receive a report directly via HackerOne ([https://hackerone.com/cloudflare](https://hackerone.com/cloudflare)). Happy to assist.

<comment><USER4> Sorry, I just chose cloudflare as a random example when speculating, I don't have any information about what specific providers this would affect, and I'm not implying that cloudflare would be affected.

Seems like my guess was right, though!

<comment><USER5> No, need to apologize.

When you say "Seems like my guess was right, though!" are you saying that there is some way that Cloudflare is involved?

EDIT: I see ([https://community.letsencrypt.org/t/2018-01-09-issue-with- tl...](https://community.letsencrypt.org/t/2018-01-09-issue-with-tls- sni-01-and-shared-hosting-infrastructure/49996)) now. I don't think LE has been in contact with us so don't think we're affected but happy to be told otherwise.

<comment><USER4> I would indeed like to explicitly apologize, because I regret mentioning "cloudflare etc" as an example. That's exactly the kind of bad speculation that leads to harmful rumors based on misunderstandings.

> When you say "Seems like my guess was right, though!" are you saying that > there is some way that Cloudflare is involved?

No. It seems like I was right about the general nature of the vulnerability. It remains to be seen what providers are affected.

That being said, at this point, I'd personally be happier seeing a list of providers NOT affected, rather than a list of affected providers... It's probably also in "major public CDN provider's" interest to demonstrate that their user cert validation processes would have prevented this attack, and their customers were not at risk before LE pulled the plug...

</comment></comment></comment></comment></comment></comment><comment><USER6> Interesting, definitely looking forward to the details, and great to see Let's Encrypt react this quickly even though this might cause a small amount of disruption to users.

The latest ACME draft - mostly referred to as what will become ACME v2, which Let's Encrypt supports on the staging environment as of a few days ago - has a slightly revamped version of the TLS challenge (tls-sni-02). The TLS-SNI challenge works roughly like this: The validation (CA) server sends a "fake" SNI hostname, generated by the CA server, to the IP behind the domain the CA is trying to validate. Domain control is assumed to be given if the server responds with a certificate that contains the CA-generated hostname in its SAN extension (where certificates store the domains and other identifiers they're valid for).

One of the concerns people had with tls-sni-01 is that it made it possible for a TLS server to "solve" such a challenge by effectively echoing back the requested SNI value blindly. This was changed in tls-sni-02 - just taking the SNI value and putting it in the SAN field is no longer enough to pass such a challenge. Until now, there was no reason to believe anyone was running TLS servers that showed this behaviour, so the was no real rush to deprecate tls- sni-01 right away (as opposed to just rolling out ACME v2, which only has tls- sni-02). I wonder if someone's found a lot of TLS servers that turned out to do this, or if there's some other vulnerability in the design or implementation.

<comment><AUTHOR> > TLS server to "solve" such a challenge by effectively echoing back the > requested SNI value blindly

I would be mildly surprised if they pulled tls-sni because of this, since it is basically a client vulnerability, and both http-01 and dns-01 suffer from similar scenarios (e.g. I tricked a major email provider into serving /.well- known/acme-challenge/ for a domain I shouldn't have been able to, and a friend managed to get a wildcard for a ccTLD).

<comment><USER6> I think we're talking about slightly different scenarios. HTTP-01, for example, cannot be solved by just echoing back the file name the validation server requests because the client is supposed to return "token || '.' || base64(JWK_Thumbprint(accountKey))", but the file name is just "token".

dns-01 is not affected either because the requested label is always just "_acme-challenge.<FQDN>".

<comment><AUTHOR> Any links to discussions on this topic? Sounds suspiciously like SNI proxies.

<comment><USER6> I'm not aware of any public discussion of the ongoing incident. This[1] is the thread on the ACME WG mailing list that lead to tls-sni-02 being introduced.

[1]: [https://mailarchive.ietf.org/arch/msg/acme/s8gaZ6ev- iqoSQjOZ...](https://mailarchive.ietf.org/arch/msg/acme/s8gaZ6ev- iqoSQjOZWUpZ41mA0M)

</comment></comment></comment></comment></comment><comment><USER7> Just wanted to jump on this for Caddy users [1]:

> _Until further notice, when starting Caddy, we recommend using the > '-disable-tls-sni-challenge' flag. This will require either HTTP or DNS > challenges to be functional in order to renew your certificates._

By default, Caddy randomly chooses either the HTTP or TLS-SNI challenge to obtain and renew certificates. Your sites will likely not go offline even if you do not use this flag because Caddy tries up to 2 times per day, 30 days out, to renew an expiring certificate, as long as you keep it running. The chances that it would choose TLS-SNI sixty times in a row is extremely low. (We -- meaning myself and many people who contributed their feedback and code -- thought about these kinds of scenarios and Caddy is prepared to handle them.) However, since the TLS-SNI challenge will fail 100% of the time while it is disabled on the server end, might as well have the client not even try it.

Also note that all certificate maintenance routines are logged to the process log, so be sure you always run Caddy with the '-log' flag in production so you can see what's going on.

Since this outage may be temporary, check back later about re-enabling it. I recommend having more than one way to perform verifications when possible. (For Go programmers, the xenolf/lego library [2] supports all verification methods -- and is being upgraded for ACMEv2 currently; Sebastian is doing an awesome job! It also supports numerous DNS providers for easy setup of the DNS challenge.)

One more thing: wait for a full report from Let's Encrypt rather than speculating. Most questions can't be answered until there's more information. I don't think there's anything you need to do, no alarms to raise... just use another verification method until we get more info.

[1]: [https://twitter.com/caddyserver/status/950926718004428800](https://twitter.com/caddyserver/status/950926718004428800)

[2]: [https://github.com/xenolf/lego](https://github.com/xenolf/lego)

<comment><USER8> Cool. Now's a good time to remind everyone that Caddy became popular as a fully open source web server and now charges for commercial use of its binary. [https://caddyserver.com/products/licenses](https://caddyserver.com/products/licenses) However, there's little technically in place to prevent people from using the free version for commercial products. The result of this is that there's probably a bunch of people who downloaded Caddy when it was free for commercial use, who probably just upgraded it, and are now violating the license. A sticky situation. Better to just use nginx or apache (actually apache compares favorably to nginx when it's used properly) until another thing like caddy comes along that's free.

Ironically it's quite a similar tax to $10 SSL certificates, only it's a higher upfront cost, of $25. If people were willing to pay $25 for every HTTP server, HTTPS everywhere could have started growing quickly without LetsEncrypt.

<comment><USER9> Though not relevant to the bulk of your comment, could you elaborate or provide some relevant links on why apache compares favorably to nginx when used properly?

<comment><USER8> Apache, like nginx, is powerful and well-maintained. It has a longer history than nginx, though, and has to support some features that probably wouldn't have been implemented if the project was created more recently. One such feature is .htaccess, which makes it so an app's directory, belonging to the app's user, can configure the web server. This is a potential attack vector if the app's directory is writable (not an issue for configurations in /etc which are only writable by root). This feature can be turned off by setting AllowOverride None in /etc/apache2 (/etc/httpd on CentOS). There are other defaults that are better in nginx than apache as well. Here's a post that has the AllowOverride None suggestion and two others: [https://www.jeffgeerling.com/blog/3-small-tweaks-make- apache...](https://www.jeffgeerling.com/blog/3-small-tweaks-make-apache-fly)

</comment></comment></comment></comment><comment><USER3> We've now posted more details about the issue and our plans.

[https://community.letsencrypt.org/t/2018-01-09-issue-with- tl...](https://community.letsencrypt.org/t/2018-01-09-issue-with-tls- sni-01-and-shared-hosting-infrastructure/49996)

<comment><USER10> A suggestion: if the solution takes too much to develop (long enough that certificates risk expiring before being renewed), could you at least allow renewals of existing LE certificates if they are from the same LE account (perhaps only if they are still at the same IP address)?

</comment></comment><comment><USER11> For certbot-nginx plugin users, I've had success with --webroot authentication:

For nginx: location ^~ /.well-known/acme-challenge/ { default_type "text/plain"; root /home/www/letsencrypt; }

Then, for SELinux: chcon -Rt httpd_sys_content_t /home/www

Reload nginx and 'certbot renew --webroot -w /home/www/letsencrypt' has a fighting chance.

<comment><USER12> I've been doing this ever since they released certbot, but I can't really vouch for the stability of this method. Changes to your virtual host config can break this very easily, especially if rewrites to https are involved.

</comment></comment><comment><USER13> Background history that might be helpful here:

The http-01 proof of control as originally defined allowed you to use HTTPS instead for the URL. This was never enabled in production because many bulk web hosts had a configuration where if anyone (say Let's Encrypt) asks for [https://not-ssl-enabled.customer1.example/blah](https://not-ssl- enabled.customer1.example/blah) the bulk host's server will send over the answer for [https://aaaa.ssl-enabled.customer2.example/blah](https://aaaa.ssl- enabled.customer2.example/blah) because it just picked the alphabetically first SSL enabled name as default instead of giving an error for no match.

The Ten Blessed Methods don't say not to do this, but Let's Encrypt did not want a service which can be trivially exploited on common bulk hosts so they disabled it as they've now done for tls-sni-01.

I suspect a researcher has found a configuration that similarly causes an attacker to be able to pass tls-sni-01 for names using some shared infrastructure such as the same CDN or same web hosting as the attacker.

[Let's Encrypt posted a follow-up to their Discuss outlining exactly the above scenario but without the historical digression a few minutes after I wrote this]

</comment><comment><USER14> To the badass people who get their LE certificates with Apache mod_md: you have chosen well!

mod_md checks the challenge list from the ACME server and choses one that it supports. So, if your server listens on port 80, everything will continue to work. You do not need to change anything.

If your server is only reachable via port 443, there seems currently no way you can sign up with Let's Encrypt. You will need to open port 80 for certificate renewal/signup to work. Some Advice:

* port 80 needs to be available only during a renewal/signup. Once you have your certificates, you may close it again. You need to mind renewal periods then and should check your server logs more frequently.

* you can safely redirect your port 80 to 443 with the 'MDRequireHttps' configuration directive. This redirection takes automatically care that challenges from an ACME server are still being answered while all other requests are redirected.

In case you find issues or have additional questions, visit the github repository at [https://github.com/icing/mod_md](https://github.com/icing/mod_md) and file an issue.

</comment><comment><USER15> The shutdown of tls-sni-01 doesn't affect the http-01 challenge, so the workaround is to switch your code over to the latter if this is affecting you.

We're using Greenlock ([https://github.com/Daplie/node- greenlock](https://github.com/Daplie/node-greenlock), previously node- letsencrypt via npm) for our app ([https://Clearalias.com](https://Clearalias.com)) and this library supports switching challenges fairly easily. It's even easier if you're just using an Express server, since you can use a Node library like Greenlock-express ([https://github.com/Daplie/greenlock- express](https://github.com/Daplie/greenlock-express), previously known as letsencrypt-express), which makes it dead simple to use http-01.

Best of luck to anyone who's scrambling to fix their cert layer right now. It seems like there's a chance the TLS-SNI challenge stays disabled, so it's best not to hold your breath and instead quickly switch to a different challenge mode if you get a chance.

</comment><comment><USER16> I'm actually glad they openly admit there's an issue when there's an issue. Waiting for the full report.

</comment><comment><USER17> That's a pretty bad blow... A lot of Go software relies on the TLS-SNI-01 challenge, I believe. Will TLS-SNI-02 be a viable replacement? What should be done about servers currently using TLS-SNI-01?

<comment><AUTHOR> In particular, autocert ([https://godoc.org/golang.org/x/crypto/acme/autocert](https://godoc.org/golang.org/x/crypto/acme/autocert)) relies on tls-sni and does not support the other DV methods.

Hopefully it is not fatal flaw in the design of the method, otherwise a lot of software will need to be re-built.

<comment><USER18> I'm not an expert, but the autocert package appears to support both tls-sni-01 and tls-sni-02.

The title of this HN post says "tls-sni-01" is disabled, but on the linked page it says "tls-sni challenge disabled".

So I'm confused. Is tls-sni as a whole disabled? Or just tls-sni-01? If the former, then I don't think package autocert will continue to function. If the latter, then autocert users should be okay.

<comment><USER6> tls-sni-02 is not supported on the production ACME server. It is part of the latest ACME draft (ACME v2), which recently got deployed on Let's Encrypt's staging server, but the certificates signed in that environment aren't publicly trusted.

<comment><USER18> Thanks. So the upshot is that package x/crypto/acme/autocert can no longer obtain production certs. I have bumped this issue, volunteering to do the work to add http-01 support to package autocert: [https://github.com/golang/go/issues/21890](https://github.com/golang/go/issues/21890)

</comment></comment></comment></comment></comment><comment><USER19> Looks like Ted Unangst was right?

[https://archive.is/VZrOS](https://archive.is/VZrOS)

</comment><comment><USER20> I'm pretty annoyed, because when I first started using Let's Encrypt I was hamstrung by their restrictions on the various "automated" methods of deploying and renewing certs. I went with tls-sni because it was the least-bad method for my use case.

I listened with an open mind to their justification of the extremely short 90 day max cert length period in the "automate all the things world". The sysadmin in me was skeptical, even though I have also fought the "crap, we haven't renewed this cert in years and nobody knows how to do it anymore!" emergencies over the years, and understand how renewing frequently could, at least in theory, replace that problem with a lesser problem.

But, turns out my skepticism was justified. Thankfully I'm not using it in production yet, but too often these new projects and paradigms suffer too much from "what could possibly go wrong?" thinking, and you have to follow all the right forums and keep all your configurations in mind to know when a problem like this will bite your infrastructure. I only stumbled across this randomly while checking my Let's Encrypt community account for something else.

Now, granted, this just happened yesterday, but I missed the HN thread on it when it happened, which means I could well have missed it until it's too late and a bunch of certs expire. Then it's a scramble to fix your certs AND fix your automation all at once.

</comment><comment><USER21> Nice, acmi4j v2 (java client) already disabled this - [https://github.com/shred/acme4j/blob/master/README.md#known-...](https://github.com/shred/acme4j/blob/master/README.md#known- issues)

</comment><comment><USER22> Last year I made a letsencrypt client[1] that only supports DNS mode of validation.

It currently only supports cloudflare and AuroraDNS, but it is very easy to use any other DNS provider[2]

1\. [https://github.com/komuw/sewer](https://github.com/komuw/sewer)

2\. [https://github.com/komuw/sewer#how-to-use-a- customunsupporte...](https://github.com/komuw/sewer#how-to-use-a- customunsupported-dns-provider)

</comment><comment><USER23> Unfortunately, this means that Traefik's default Let's Encrypt integration (without setting a DNS provider) does not work anymore. Although the logs now say "could not find solver for: http-01", they actually use tls-sni-01.

</comment><comment><USER24> Are there any servers that automatically generate self signed certs for any SNI they receive? I think servers like that (if they exist) would also be vulnerable.</comment>