What's the Matter with Ebooks? - <AUTHOR> http://www.dancohen.org/2015/03/24/whats-the-matter-with-ebooks/ <comment><USER2> Being a "I can't wait for" enthusiast of eBooks before they existed, when they finally arrived I must sadly report they "aren't ready yet". There are two major issues that prevent eBooks from supplanting paper books.

1\. The design of devices on which to read eBooks are far too bulky, non- ergonomic and expensive. Until 13" tablets are ultra-light weight, malleable, full color, and have extra long battery life, at a reasonable price, the medium will play second-fiddle to the comfort of a real book.

2\. eBook ownership is confusing and tied to particular companies which exert authoritative control over one's library. Having to recollect the particular app to open to find a particular book sucks. But worse, the horror stories of cancelled accounts and subsequent loss of all purchased books will keep any thinking person away from anything more than cursory purchases.

Fix these two problems and the eBook deluge will really begin. Until then I wouldn't even be surprised to see a drop in sales.

<comment><USER3> 13"? E-book readers should be smaller, not larger. A phone size e-book reader would be perfect for fiction. It would be crazy lightweight, you could read all day without having to rest your arm to hold your book.

The size is also perfect for reading: your eye can focus on several entire lines simultaneously without any eye scan.

I have several nice e-readers, but I always read on my phone because the size is much more comfortable. That forces me to sit up so I can rest my arm in my lap.

In the dark an OLED screen will always be superior to e-paper due to the lack of a backlight.

<comment><USER4> I use Kindle Voyage and the reading experience in the dark is superior to that of iPhone 6. The screen is lit but it doesn't shine in your face, so you can read comfortably for a prolonged period of time.

I still read a lot on the phone because it's always available but with 3G enabled Kindle you can freely switch between the two devices and always pick up where you left off no matter what device you're using.

I somewhat still prefer reading paper books but I do majority of my reading on Kindle. It's always available, it can hold thousands of books and if there is a book you want to read chances are you can get it on your device within minutes.

</comment></comment></comment><comment><USER5> Especially for non-fiction, ebooks are lacking the "flippability" (for lack of a better term) that print books have. The slow response time of e-ink, IMHO is a big factor in that. I was trying to read David Graeber's _Debt: The First 5000 Years_ on my Kindle, and I eventually caved in and got the print book because the Kindle version frustrated me when I tried to flip back to review earlier points in the books.

I would posit that this is why e-books are still far behind print when it comes to textbooks. Even Millenials prefer print textbooks, even as they adopt e-books for other purposes.

<comment><USER6> On the other hand, "search" is much more advanced in e-books. Taking notes, bookmarks, etc. It's just that e-paper/e-ink isn't as responsive as tablets. It'll come, though. It's only a matter of time.

</comment></comment><comment><USER7> Some in this thread have already mentioned platform lock-in/DRM, which is a huge issue, the elephant in the room really. But the other huge issue I encounter very often is the absolute garbage typography and formatting of even commercial-grade ebooks.

For example, of the ebooks I've read, 80% of them that were sourced from books that were in print before the ebook era are clearly slap-dash OCR jobs that never even got a proofread from a frazzled intern. Even modern books, those published this year or recently, are subject to this sort of mistreatment, though at a lower rate. King's _Dark Tower_ series is a great example of this: when I bought the ebooks from Amazon a few years ago, they were filled with spelling errors, mis-curled quotation marks, errant or missing hyphens, broken paragraphs, and so on. And I paid nearly the same price as a print version!

Even if an ebook isn't an awful OCR hackjob, publishers seem to insist on dragging our collective decade of experience writing web pages and the HTML5-based epub3 spec through the mud. An ebook is, at its core, nothing more than a handful of HTML pages and some metadata. Ebook readers, at their core, are web browsers. Yet commercial ebook developers insist on using outrageously bad markup that confuses a device's simple mind, awful custom styling that stomps a device's sane defaults, and markup that's only compatible with one or two platforms. (Amazon is partly to blame for this, because their stubborn and idiotic insistence on the god-awful mobi format instead of the open and sane epub format means many producers have to trust automated tools to convert between the two.)

Free ebooks aren't excused from this either; books from Project Gutenberg are also hit-or-miss in quality, mostly miss. (Though that may be because many of their ebooks were produced before ereaders and modern standards were even a thing!)

All of that together makes ereading a distinctly sub-par experience compared to the beauty that centuries of typographical knowledge produces in print books.

I'm working on a public-domain project, standardebooks.org (not online yet), to help nudge the industry in the right direction. The idea is to promote a rigorous typography and coding style guide to public-domain books transcribed at Gutenberg. Anyone can use these guides, our toolchain, and the ebooks produced from them as a sort of "best practice" for creating high-quality epubs that look great on any modern ereader. If you're interested in helping, drop me a line.

<comment><USER8> Otherwise +1, but characterizing EPUB as "sane" is rather charitable of you. EPUB 2 is an incompatible fork of XHTML c. 2001 with crude CSS and proprietary cruft, and EPUB 3 is still largely unusable in practice.

<comment><USER7> I disagree on epub3; Standard Ebooks is using it as a base format. While it certainly is a sometimes-strange mix of XHTML and HTML5, and there are things I'd personally have done differently, as a means of presenting static documents it rivals the power that HTML5 on desktop browsers has. (Because it's basically just HTML5!) Whatever formatting limitations there are are generally are on the client rendering side--for example, Kindles are notoriously bad at rendering tables, but that's because the Kindle renderer sucks, not because any of the competing standards don't have good <table> tag support.

Plus, since it's basically HTML in a zip file, anybody with basic web page production knowledge can jump in to producing an epub book. Sure there's some epub-specific cruft here or there but the core HTML markup has been well- understood for a decade.

Additionally, the power of HTML5 and epub's semantic inflection standard lets us mark books up in fascinating new ways that aren't easily possible in simpler formats. Whether or not that ends up going anywhere we have yet to see; another thing Standard Ebooks is trying to do is add semantic inflection to the books we produce.

Yes, it's not great for more complex stuff like interactive ebooks or javascript and so on, but no format is yet, and ereader technology isn't really there yet either.

<comment><USER8> Sorry, wasn't clear there: EPUB3 as a standard is theoretically OK, but real- world support of it on ebook readers just isn't there yet. And the update cycle is a _lot_ slower than browsers or even mobile phones.

Also, do you know what _is_ a great platform for "javascript and interactive stuff"? The web browser!

</comment></comment></comment></comment><comment><USER9> I don't buy as many Ebooks as I would like to for one reason: for the restrictions which have been put in place, they are too expensive.

I'm renting a (typically lower overall quality) book, but I'm having to pay the price of a new physical book (give or take a few dollars).

OK, there's two reasons: about 1/3 of the books I'd like to purchase are unavailable in Ebook form without pirating.

The value is not worth the price.

<comment><USER10> How are you renting your ebooks?

<comment><USER11> I believe the grandparent is making the point that (s)he does not truly own the ebook, since it is delivered with DRM and subject to the ability of the retailer to delete it.

<comment><USER10> Renting involves making regular payments. This is a false analogy.

<comment><USER9> Renting implies paying for the temporary use of something, there's no regular payments involved. If I rent a movie from RedBox, I'm not making regular payments - just a single payment covering the cost of the item.

If my use of the Ebook was not dependent on the Amazon (or Apple or B&N) ecosystem, then it might be easier to think of as a purchase with conditions; but if my account goes down, so does my ability to freely read the Ebook.

<comment><USER10> That's fair - I'm convinced.

</comment></comment></comment></comment></comment></comment><comment><USER12> When I traveled to eastern Ukraine for work a couple years ago, what surprised me the most about the culture was the ubiquitous use of ebook readers. It seemed like everyone had one.

When I asked a Ukrainian colleague why they were so popular, he said it simple: ebooks are cheap/free and easy to find, and print books are expensive and require effort to obtain.

One of the biggest points of friction to consuming content is discovery and paying for it. I think when it's easier to find ebooks and cheaper to purchase them, adoption will really accelerate. Until then, there isn't much compelling reason to switch.

<comment><USER13> I'd wager most of the books your Ukrainian friends alludes to are the astoningly easy to find pirated epubs. There's zero to none friction if you know how to look for them and don't mind reading in English.

I found odd that the author didn't mention piracy.

<comment><USER14> He did mention Ukraine. Did he need to be redundant?

</comment></comment></comment><comment><USER15> [https://stallman.org/ebooks.pdf](https://stallman.org/ebooks.pdf)

<comment><USER16> The title of that PDF should be changed from "The Danger of Ebooks" to "The Danger of DRM Ebooks".

</comment></comment><comment><USER17> 1\. "Single digit growth" is still growth. Even if you accept their numbers (which have some severe problems, as noted below) compounding will take its toll eventually.

2\. As the author himself notes (although buried way down in the article), these "official" sources fail to capture a _very large portion_ of the ebook market. Specifically, they only reflect books with an ISBN, which is not required by _any_ of the major U.S. ebook vendors (Amazon, Apple, B&N). Most indie authors don't bother, given the insane pricing schedule that Bowker imposes for small quantities of ISBNs.

</comment><comment><USER18> That they come pre-pwned, mostly. I don't really trust digital media.

</comment><comment><USER19> DRM is what's the matter. If I go down to Chapters, I own the book. An ebook from Amazon is just "licensed"

</comment><comment><USER20> Publishers _could_ lower the price of ebooks and still make more than they would on a paperback? Right?

Surely printing costs, distribution costs, and retail costs for a physical book dwarf the listing fee that Amazon et al charge for an ebook?

<comment><USER21> [http://www.antipope.org/charlie/blog- static/2010/05/cmap-9-e...](http://www.antipope.org/charlie/blog- static/2010/05/cmap-9-ebooks.html) (and the rest of his 'Common misconceptions about publishing'[1] series) covers this idea in quite some detail, and ultimately concludes that the majority of the cost is in the pre-production processes, not the physical book printing.

Exactly how ebook pricing relates to any form of sanity is something of another matter. IIRC Amazon, Apple, etc all take something like 30%+ of the sale price, and the retail book industry (after allowing for unsold returns and all the weird accounting jiggery-pokery) operates on quite thin margins.

[1] [http://www.antipope.org/charlie/blog- static/2010/04/common-m...](http://www.antipope.org/charlie/blog- static/2010/04/common-misconceptions-about-pu-1.html)

<comment><USER20> It sounds like the actual pre-production process is cheap ($7-20k for a book).

After reading his blog a fair bit it seems clear that Amazon is the real winner and that they pocket the savings from switching to ebooks (they take up to 70% of the sale price!).

</comment></comment></comment><comment><USER8> Back in 2012, I wrote a blog post that predicts e-books will be obsolete by 2017 (2 years to go!) and outlining a few reasons why. TL;DR:

 _Crippled by territorial license restrictions, digital rights management, and single-purpose devices and file formats that are simultaneously immature and already obsolescent, they are at a hopeless competitive disadvantage compared to full-fledged websites and even the humble PDF. ... But once publishers start breaking ranks (as they are already doing) and major authors start to self-publish (as they are already doing), the illusion of e-books being a necessary simulacrum of printed books will start to dissipate._

[http://gyrovague.com/2012/04/30/why-e-books-will-soon-be- obs...](http://gyrovague.com/2012/04/30/why-e-books-will-soon-be-obsolete-and- no-its-not-just-because-of-drm/)</comment>


Form: interaction and prototyping design tool for iOS apps - <AUTHOR> http://www.relativewave.com/form.html

<comment><USER2> Just watched the demo. Looks similar to Origami. The price is relatively high, will there be a trial version?

Also, I'm a bit confused about Relative Interface. You have a product page dedicated to it, but no links to either the source or information on how to purchase it.

<comment><USER3> RelativeInterface is the framework that powers rendering for compositions made with Form. There's no need to purchase it. We're hoping to open it up for people to use in non-Form projects, but that announcement will be coming later.

</comment></comment><comment><USER4> You might want to have a look at this site in Firefox.

I'm on Firefox 32 on Mac and the videos are grainy and blocky (like trying to watch satellite TV during a rain storm or a badly compressed JPEG). It's so bad I'm having a really hard time telling what they're showing. The header video only loads about every 5th time for me, otherwise I get either a spinner or just a blank white screen.

When it shows up, I also can't click the "Get Mac App" or "Get iOS Viewer" buttons. They doesn't seem to do anything.

Opened it up in Safari and Chrome and looks and work much better.

<comment><USER3> Unfortunately, Firefox only supports Ogg for video. Although it's open, it's far worse than h.264 for quality :(

</comment></comment><comment><USER5> I really expected clicking on the down button to scroll me downwards. I was disappointed.

That said, after watching the tutorial video I noticed that the narrator was able to accomplish quite a bit, with relatively low technical knowledge. It makes me wonder why building real apps isn't this easy.

</comment><comment><USER6> Your site design makes me nauseous, and it's not clear what I'm looking at.</comment>


Sorry, your account is too new to submit this site - <AUTHOR> Can anybody explain about this please? <comment><USER2> First of all, by asking your question here, it seems you missed the following in the HN site guidelines:

[https://news.ycombinator.com/newsguidelines.html](https://news.ycombinator.com/newsguidelines.html)

> _" Please don't post on HN to ask or tell us something (e.g. to ask us > questions about Y Combinator, or to ask or complain about moderation). If > you want to say something to us, please send it to firstname.lastname@example.com."_

To answer your question, some sites have a history poor quality articles (i.e. usually webspam regurgitation articles with a few rare exceptions of good articles mixed in), and some sites are regularly abused but also have worthwhile content (submitting off topic videos from youtube to drive up stats by spamming news aggregation sites like HN is a constant and infamous problem). To prevent abuse, new HN accounts are unable to submit URLs from the lightweight and problematic sites.

</comment><comment><USER3> Sounds like you're trying to submit a link which is from a domain which is either spammy, linkbaity, low quality, or otherwise overly submitted to this site. It's probably an anti-shilling mechanism built into HN.</comment>


US customs dismantled 'impossible to replace' instrument, Mali musician says - <AUTHOR> https://www.theguardian.com/music/2020/feb/06/malian-musician-kora-ballake-sissoko-dismantled-tsa-us-customs <comment><USER2> just a data point: i moved to the USA in the late 90s, H-1B. flew into Nashville because it was the nearest intl entry point to Little Rock, AR, my destination at the time. i flew in with a very large suitcase, a large bag and a pretty expensive mountain bike. among the two bags were wrapped gifts for the family who would be putting me up. Nashville i believe was a fairly new international point of entry back then. the INS (at the time) gave me a hell of a welcome. the H-1B was questioned. i was taken aside and left in a small room for many hours. when they eventually released me, it had been about five fours and my mountain bike was almost completely dismantled. the forks were out of the front tube, all wheels were off. they said they had to check the frame for drugs. all my wrapped gifts were ripped open. i had to repack everything in a drafty arrivals hall after being held for (as i could discern) absolutely no reason, a fresh grad with a valid visa heading off to work and pay taxes in booming late 90s America. that was my welcome to the USA. honestly. each welcome since hasn't been much better. i say this even knowing i am a very lucky white guy. i can't imagine how much worse it is for anyone who isn't white these days. YMMV.

</comment><comment><USER3> Other sources mention that the note had tape on it (which TSA does not use in notes) and was in poor condition. TSA labeled it as screened and cleared, indicating there was no need to open it. It is possible that someone else destroyed it and put an old notice inside. I've heard quite a few stories of broken instruments during air travel, but typically musicians blame the airline (e.g. [https://youtu.be/Th0qY3d6oHA](https://youtu.be/Th0qY3d6oHA))

</comment><comment><USER4> The article talks about US Customs and TSA as if they are the same thing. It also references border officials which TSA agents aren't. I understand the musician not knowing the difference but I would expect a reporter to know the difference. That she isn't competent enough to know the difference makes me highly doubtful regarding the rest of the substance of the article.

<comment><USER5> No one really cares about such a minor distinction. Perhaps you have some experience with these agencies but for the vast majority of people they're basically the same thing - especially for non-Americans (the Grauniad is English).

Deciding that the rest of the story is "highly doubtful" over that is your call but ffs there are pictures. No musician breaks their own utterly unique instrument to craft a fake story. Be real.

That it's apparently so difficult to precisely assign accountability for this damage is it's own issue, not a cause for suspicion of the story. Lol.

<comment><USER4> As I stated in my original post I understand the musician not knowing the difference; however, a professional reporter not knowing the difference or being able to do enough journalistic research to discover the difference is unacceptable.

I didn't say that the musician faked the damage to his instrument. That is something you read into my comments.

It is the reporters job to do actual journalism and discover the complete story as best they can. If a reporter can't even figure out which agencies are involved how can I trust that they have done anything to accurately reflect the whole story.

<comment><USER5> Where does the article say that the TSA are border agents, or that customs and the TSA are the same thing? The pedantry and slating of the journalist here is unwarranted.

The point is, a priceless and unique instrument has been destroyed and there is no accountability. How you got from there to wherever you are is beyond my comprehension.

<comment><USER4> I suggest rereading the article. TSA, border agents and customs are used interchangeably throughout the entire artcile.

<comment><USER5> Are they? And can you admit that absolutely nowhere was the claim made they're the same thing?

</comment></comment></comment></comment></comment></comment><comment><USER6> > 'Would US customs have dared to dismantle a Stradivarius?'

The TSA has repeatedly manhandled and damaged priceless Western string instruments as well. I don't have a source handy, but there was at least one case of them snapping a $600k cello bow.

<comment><USER7> LMGTFY Probably [https://www.wqxr.org/story/269292-cellists-bow- damaged/](https://www.wqxr.org/story/269292-cellists-bow-damaged/) or [https://albangerhardt.com/es/broken-bow-broken- cello/](https://albangerhardt.com/es/broken-bow-broken-cello/) I'm not sure how the incident was resolved.</comment></comment>


SF cracks down on 'Monkey Parking' mobile app - <AUTHOR> http://blog.sfgate.com/cityinsider/2014/06/23/sf-cracks-down-on-street-parking-cash-apps/ <comment><USER2> At least one of these companies is a pure protection racket.

 _" ParkModo was recently offering $13 an hour to drivers who would occupy parking spaces in the Mission District during peak weekend times and then sell the spot through its app, a Craigslist job posting showed.

"'Get paid $13.00 per hour just to park!' the ad read. 'Our company is launching an awesome app that rewards people to sell their on-street parking spots before leaving to people who need a spot.'

"It went on to say that: 'Once you are parked, using the app, you will offer the spot for sale. … Once someone purchases the spot, you will complete the transaction with the buyer and then find another space to park in and start the process all over again!'"_

It's as if AirBnB were paying people to burn down hotels.

<comment><USER3> This is disgusting. Parking in SF is already not easy, and now this cancer is moving in and exacerbating the problem.

<comment><USER4> Heh, I think you mean _exacerbating_

</comment></comment></comment><comment><USER5> _> 'ParkModo was recently offering $13 an hour to drivers who would occupy parking spaces in the Mission District during peak weekend times and then sell the spot through its app, a Craigslist job posting showed.'_

Wow, I remember when parking spot squatting was the province of bold homeless men near nightclubs.

This sort of rent-seeking on the commons is particularly distasteful, but simply 'cracking down' on it seems like a wasted opportunity.

If the demand and divide are such that this is a real issue it seems like time for a progressive congestion tax or similar. Collect and invest in infrastructure.

<comment><USER6> SF already has the nation's most advanced parking space pricing system, called SFPark. However, that is a low bar. The prices change very slowly and some neighborhoods still have not found their equilibrium price (for example, a busy stretch of Valencia has had its price increased in every adjustment round and is now up to $6/hr. Nobody knows the equilibrium price for that area.)

There's also the problem that SFPark isn't very widespread because "local merchants" who are a kind of caveman often oppose it.

</comment></comment><comment><USER7> Here's a better idea: charge market rate for parking on the street, citywide. There's no reason that space should be given away for free.

Use the revenue to build some much needed trains.

<comment><USER8> Roads are public goods and more importantly they are built with tax money. They are also specifically built for cars to use and without a place to stop they are a bit meaningless in a city.

They might just change this and start charging but that's a pretty stupid idea. Free market is not an answer to everything.

<comment><USER9> "Free market is not an answer to everything."

The problem here is one of rationing. There are a limited number of spots; who gets them?

In the current situation, the spaces are free/subsidized, but you pay instead by driving in circles. That's a big waste of time and adds to traffic congestion. Maybe that's more "fair" in some sense, but that doesn't make it good.

The app in question does either nothing or very little to help ration. It allows people who really need to park, and have the money to pay for it, to be more certain that they will get a space, which I guess is something. But it creates so many bad incentives that it's making the problem worse, not better.

The city is in a better position to create market incentives, because they can charge for the entire duration that you're in the space, not just the moment you happen to park. That means people would have no reason to camp out in a space waiting for the price to go up, which means more spaces will be available for useful purposes. It saves time and congestion, but perhaps loses out on some definitions of "fairness".

Any other ideas?

<comment><USER10> _' Maybe that's more "fair" in some sense, but that doesn't make it good.'_

I'm not even sure it's more "fair" \- as you said, you're still paying. I suppose a part of the cost (time wasted) _is_ sort of indexed by income...

</comment></comment></comment></comment><comment><USER11> While I think some of what the city says makes sense, how can a city in the US force a company in Rome to cease and desist? Even Apple might be loath to follow this order since you can't follow every city and country on earth's laws and stay in business.

<comment><USER12> Because the company is operating in the US city, of course. Would it be OK to sit in San Francisco and remotely run a service that was illegal in Rome? Of course not, Italian prosecutors would issue demands and then seek a court ruling that they would then ask US courts to enforce. This is the sort of thing that international treaties are for.

EDI for clarity, of course there are no treaties about parking spaces. But treaties usually include general provisions about courts recognizing each others' judgments in criminal and civil matters, not least to prevent cross- border financial fraud, tax evasion and so on. It's not foolproof because not all territories have treaties, eg someone based in Somalia could run an illegal internet business with relative impunity because the US has no treaties with Somalia (as far as I know). On the other hand, countries that have no criminal or commercial treaty relations with other countries tend to be hellholes.

<comment><USER13> Of course it's OK to run a service in the US that might be illegal abroad. Twitter, Youtube, Facebook, etc. have all been banned, blocked, and threatened by various foreign governments, even in nominally democratic countries.

US-based Internet companies have flourished due to the relatively hands-off regulations concerning websites. To suddenly apply every foreign law that's ever been written would be a significant chilling effect on business.

<comment><USER12> Those services are not inherently illegal in other jurisdictions* for one thing, and where specific activities have been deemed illegal the operators either abide by the judgment of the courts or exit the market. Case in point: Google allowing EU citizens to apply for delisting of privacy-infringing search results in accordance with EU data protection laws.

* I'm not sure about places like North Korea, but trying to offer services there would be embargoed by domestic sanctions in any case.

<comment><USER13> Google is a huge multinational company with sufficient nexus in the EU (specifically France) to fall under the jurisdiction of that ruling. This sounds like an app developed by a small team, physically and legally located far outside of San Francisco. If the city tried to enforce a judgment against them, it should be laughed out of court.

I'm not sure why so many here are so quick to throw the hackers under the bus as soon as they agree with the government's demands. This kind of thing could happen to anyone, and ruin any controversial startup.

<comment><USER12> If you're doing business somewhere, as ParkingMonkey is in SF, then there's sufficient nexus for them to come under the jurisdiction of that place.

So what if it's a small team offering this service remotely? What stops them deploying this in their home town of Rome? And what makes you so sure that claims against them would be laughed out of court? True, any judgment against them would take a long time to enforce, hence the city exploring the more practical route of asking Apple to cease enabling their activity. But cross- border litigation happens all the time.

</comment></comment></comment></comment></comment></comment><comment><USER14> They're not selling the spots, they're selling prior knowledge of their departure. They have no right or means to block or make exclusive the spots, so what's the problem?

<comment><USER12> The law prohibits selling or contracting around public parking spaces, ie contracts formed for the purpose of exploiting a public resource are automatically void.

The app itself invites users to 'request a parking spot' and asks 'how much would you pay?' The knowledge of imminent departure is just an instrumentality for gaining occupancy of the parking spot, to claim otherwise is disingenuous. There's a mentality among some hackers that 'the means justify the ends,' ie if you can find some definitional wiggle room on what you're doing it automatically validates the outcome. That works OK on computers, but the law is not a big computer system and does not operate on the same sort of binary logic as computers do.

</comment></comment><comment><USER15> "MonkeyParking and any motorists using the app face fines of $300 per violation of the city's law prohibiting selling or contracting for parts of a public street, according to the city attorney."

I was going to ask what the actual law was, but it seems I've found some version of the gist of it here. Where I live (not San Fransisco) we have privatized parking in plots of land that aren't on the public street. Would using this app on places like that in SF be legal?

<comment><USER16> I can park nearly all day at moscone center with little time investment for $20-$30, why the hell would I use this then?

<comment><USER15> You wouldn't :) but, it can be hard to find a parking spot in, for example, Seattle on a Friday night.

</comment></comment></comment><comment><AUTHOR> Previous discussion at: [https://news.ycombinator.com/item?id=7702659](https://news.ycombinator.com/item?id=7702659)

</comment><comment><USER17> Good. The idea of a couple guys in Italy making money on trades of public parking spaces in SF baffles me. I assume they're not paying any taxes back to the city that maintains the spaces. How does one possibly defend this?

<comment><USER18> They are proving value by solving a market inneficiency (a good, parking spaces, being available at sub-market rates, free). As such, they have a right to some of the profits.

By increasing the cost of parking spaces, they improve the efficiency of allocation by making sure they go to people who value them at $20 before people who value them at 0.003$

Or, more likely, they live outside of US juristiction, so they have plenty of time to make a profit, and when the law does catch up to them, they are likely not looking at anything worse then needing to shut down the service.

</comment></comment><comment><USER19> Here's the letter (PDF): [http://www.sfcityattorney.org/modules/showdocument.aspx?docu...](http://www.sfcityattorney.org/modules/showdocument.aspx?documentid=1669)

</comment><comment><USER20> San Francisco's attorney further stated that they believe it's illegal for anyone outside northern California to create an iPhone application or any web- based property. When asked for additional insight he responded "We've studied the situation and believe we have world-wide jurisdiction to applications running on mobile devices and computers used in our city".

</comment><comment><USER21> I can't really see any moral difference between this and , say, ticket scalping.</comment>


Has a Speeding Neutrino Really Overturned Einstein?-Science is ruthless - <AUTHOR> http://online.wsj.com/article/SB10001424053111903703604576588662498620624.html?mod=googlenews_wsj

<comment><USER2> Giving a link to an article behind a paywall is not very useful.

<comment><USER3> Just put the title in google "Has a Speeding Neutrino Really Overturned Einstein?" and say you're feeling lucky.</comment></comment>


When Random Numbers Are Too Random: Low Discrepancy Sequences - <AUTHOR> https://blog.demofox.org/2017/05/29/when-random-numbers-are-too-random-low-discrepancy-sequences/ <comment><USER2> Particularly useful for [https://en.wikipedia.org/wiki/Quasi- Monte_Carlo_method](https://en.wikipedia.org/wiki/Quasi-Monte_Carlo_method) \- O(1/n) convergence rather than O(n^-0.5).</comment>


Bitcoin Bubble Makes Dot-Com Look Rational - <AUTHOR> https://www.bloomberg.com/gadfly/articles/2017-11-27/bitcoin-crash-may-take-a-while-longer <comment><USER2> The idea that you can value bitcoin via P/E, utilizing mining fees as the "E" is incorrect. It's akin to valuing gold through P/E, by utilising the cost of extraction as the "E".

This is obviously wrong because holding gold doesn't entitle the bearer to a portion of those mining costs, same with Bitcoin.

The reality is that gold cannot be objectively valued because it doesn't have an objective value (beyond its industrial use, which accounts for less than 10% of its actual current price).

As a society, we collectively agree that gold is worth something because we agree that it is worth something.

With Bitcoin, we are doing the same. But if we had centuries to consolidate our appreciation of gold, we are compressing price discovery for Bitcoin in just a few years.

Interestingly, Bitcoin offers several improvements over gold (being digital, lightweight, cheap to move, proven limited supply). It also has drawbacks.

Lastly: the author's contention that you can take value away from Bitcoin by just copying its code is misguided. It would be akin to saying that you can replicate Facebook's valuation by copying its codebase. Facebook's value comes from its network. The same happens with Bitcoin, since its fundamental properties (censorship-resistance, security) are functions of network size and node-dispersion.

<comment><USER3> You remember that there were other social networks before facebook dominated everything, right? Network effect _now_ is no guarantor of the future.

<comment><USER4> That doesn't mean Facebook is overvalued though. Just because it's value could disappear doesn't mean it has no value.

<comment><USER3> It doesn't mean BTC is overvalued either. But BTC could well prove to be cyrptocurrency's Friends Reunited or Bebo.

</comment></comment></comment></comment><comment><USER5> The idea is great, but in reality these stupid crypto coins are practically useless and wasting HUGE amounts of resources.

Bitcoin is said to be consuming as much power a some countries, and still rising fast, while the amount of transactions is comically low compared to the power consumption.

Bitcoin in its current state can never be a thing to actually buy something with. I don't see any other long-term use for bitcoin than just making a couple of bucks before it eventually crashes down like the Hindenburg.

I'm not saying that all cryptocoins will suffer that fate, but I truly believe bitcoin specifically will.

<comment><USER6> It's (looking like it's turning out to become) digital gold. When is the last time you bought a family dinner with gold?

<comment><USER7> I wonder how the environmental impact of mining gold compares to mining bitcoin?

<comment><USER8> Pollution from Gold mining: [https://sciencing.com/types-pollution-generated- gold-mining-...](https://sciencing.com/types-pollution-generated-gold- mining-22598.html)

A very rough estimate: World wide Bitcoin mining operation spends per year around 60% as much electricity as all of USA's bank offices: [https://news.ycombinator.com/item?id=15615601](https://news.ycombinator.com/item?id=15615601)

With Bitcoin mining there is a high incentive to actually use renewable energy sources and could be physically outsourced to places where building green power plants is otherwise not practical due to the limits of creating a power grid to make such a power plant profitable.

<comment><USER9> [https://www.hydrominer.org/](https://www.hydrominer.org/)

</comment></comment></comment></comment></comment><comment><USER6> I don't get this. The dot-com bubble ran up to $6.7tn in market cap, in 2000, before crashing down to $1.7tn.

The crypto space, which seems to be shaping into an entirely new asset class, has a $300bn valuation. That's less than the value of Facebook.

The only reason why people are shouting bubble is because people were able to get in from the start, when these coins were 10 cents on the dollar. But when Facebook IPOed after 10ish years, it had a valuation of $50bn. But early angel investors also got in at 10 cents on the dollar.

It could eventually become a bubble, but I don't think think we're even nearly there yet.

<comment><USER10> also the fact that 99% of bitcoin's value is tied up in financial speculation rather than real world use cases, and the remaining 1% is drug dealing.

<comment><USER6> Gold has close to no use cases (80%+ is store of wealth) and seems to be doing fine at an $8tn global market cap.

Of the potential 21m Bitcoin in existence, 4m are assumed to have been permanently lose. 16m have been mined. That leaves 1m coins left to be acquired in the future.

<comment><USER11> Is there a timeframe for how long it will take for those 1m coins to be mined? Is it equally likely that the price craters or skyrockets once that happens?

<comment><USER6> I think the price will skyrocket anyway, because there is a limited supply. In a way, I believe it could be like an epic short squeeze. You have people wanting to buy in (retail + institutional money is coming in) over the next few years.

If you take the example of oil -- once the price of a barrel goes over a certain threshold price, you'll go and explore new wells that were previously not profitable. And you will eventually get more supply after a while. That's just not the case with Bitcoin (and probably Ethereum after next year).

</comment></comment></comment></comment></comment><comment><USER12> Old saying: "What's common in every bubble is the belief that this time, it will be different." -> if you invest in cryptocurrencies, make sure not to invest more than you can comfortably lose (probably a few percent of your overall funds).

<comment><USER13> Oh, but the naysayers in the media who have predicted bitcoin's collapse every month for years and have been wrong every time are of course given a free pass and are allowed to say "this time it's different" once again.

<comment><USER14> I think this is clearly not equivalent

At the moment it feels like a parent warning a child - at some point you have to decide to step back and let them learn the painful lesson for themselves

</comment></comment></comment><comment><USER15> Calculating a P/E on transaction fees seems silly because frees on a crypto currency aren't related to the amount of value moved they are related to the number of bytes of space your transaction takes which in a simple transaction is most effected by the number of source and destination addresses used in the transaction.

A better way to calculate this fake P/E ratio would be to look at the total USD volume of Bitcoin transactions and take 2% of that as the "earnings" logic being that if a coin were a credit card like company their earnings would be 2% of thier transaction volume. Still a bit of a contrived metric but at least related to the economic activity taking place.

</comment><comment><USER16> > Take dot-com stocks, which were the biggest bubble of the past few decades, > and likely the largest in stock market history. At the height of the dot-com > stock bubble, the technology-heavy Nasdaq stock index had a price-to- > earnings ratio of 175. In the past year, bitcoins have generated transaction > fees of nearly $219 million. And at $9,600 a piece, the total value of all > bitcoins -- their market cap -- now tops $155 billion. That gives bitcoins > the equivalent of a trailing P/E ratio of 708.

What kind of logic is that? Holding bitcoin doesn't give you any earnings. In fact, you need to spend electricity and equipment if you want to collect those fees.

Apples and Oranges.

<comment><USER17> > What kind of logic is that? Holding bitcoin doesn't give you any earnings.

Well, holding USD gives you inflation (i.e., negative interest).

Holding BTC doesn't (assuming the 21 mn are already priced in).

<comment><USER16> Eh, nope. That's not how it works.

Holding 1 USD will give you 1 USD after 1 year.

Holding 1 Bitcoin will give you 1 Bitcoin after 1 year.

You are confusing the unit you are holding with the value "vs" another unit. That depends on the market and the external factors (like inflation, interest rates, etc...)

But holding 1 Unit will always give you 1 Unit of whatever you are holding.

<comment><USER17> You are deflecting to a problem of definition ;)

Yes, you have the same amount but no it doesn't purchase as much as it did one year ago. Units of accounting only make sense within a context of other units of account.

A dollar by itself is just a piece of paper if you cannot buy an amount of wheat, water or square meters with it.

And by that measure the dollar is losing value vs a bitcoin.

<comment><USER16> So? You just repeated what I said. My original comment was debunking the Bloomberg article.

When you hold 1 Stock, at the end of the year you get a dividend. You divide the dividend by the stock to get the P/E ratio.

That's not the same with USD or BTC. Its value fluctuates but it generates no income on its own.

<comment><USER17> I think I misunderstood the intention for your first comment, probably by interpreting it in the context of another comment that was nearby but not related at all. Sorry

</comment></comment></comment></comment></comment></comment><comment><USER13> The news media have posted stories predicting Bitcoin's collapse pretty much every month since 2012... but I'm glad that once again they're sharing some morsels of their expert insight with us peons on why Bitcoin is overvalued.

</comment><comment><USER18> Attempting price/earnings analysis here is not sensible, because bitcoin is not a stock: simply owning some doesn't earn you any "dividends" (mining rewards).

A better parallel is gold, which is a store of value that produces nothing of value for its owners, but is valuable because the supply is limited and there's a collective belief that this shiny metal is worth much more than its practical uses.

Bitcoin is going up because of those same properties. If supply ever becomes unlimited (say, there's a critical bug found), or its investors lose faith, it will crash.

<comment><USER19> For the Casper update of Ethereum with proof of stake, this may turn into a useful metric. You can use your ETH to participate in the PoS lottery and thus earn ETH (a kind of dividend).

</comment></comment><comment> cup-of-tea Ultimately this will come down to what value Bitcoin really has to society.

An investment is when you work to receive something you don't want, but that you think other people will want in the future so that you can exchange it for things you do want. If you work for money then you do investment. By working for money you are betting that when you need food at the end of the week the shopkeeper will take your money.

Investing in other things is no different. You make a bet that people in the future will want to trade the thing you buy for things that you want at that point. For example, you could buy a small amount of gold every month and when you are ready to retire buy an annuity with the gold. That's if anyone actually wants the gold in 30 year's time. If they don't then you'll have to eat the gold.

People often say that cash is a bad investment, but actually it's really great as long as you plan to spend it soon. What they mean is it's not a good long term investment, of course. But cash stays valuable because unlike other things you can exchange it for things you want almost immediately. Bitcoin is now not like cash because of the high transaction fees. So it now competes with things like gold. So you have to ask yourself: what do you think will still be valuable in 10, 20, 30 years time? Gold? Bitcoin? If Bitcoin isn't a yes for enough people, then it's a bubble.

</comment><comment><USER20> I think you are making a mistake by only looking at cryptos as "coins".

There are businesses being run on and around public blockchains and the cryptoeconomic incentives will ensure the perpetuation of the network. As long as there is value in maintaining public blockchains, their tokens (BTC, BCH, ETH, etc) will hold monetary value.

[https://i.imgur.com/AfGNEA5.jpg](https://i.imgur.com/AfGNEA5.jpg)

</comment><comment><USER21> Was the collapse of the German Deutsche Mark, the Zimbabwean Dollar, the Venezuelan Bollivar a bubble too? Good money drives bad money out, so I'd argue that no, Bitcoin's price is not a bubble. Clearly there's no price that bitcoin holders will sell at so they're clearly exiting the USD ecosystem.

I think the logical fallacy that's occuring right now with critics of bitcoin's price rise is that all bubbles has dramatic price rises (Pets.com, endless bullshit dot com IPOs, housing bubble) but not all dramatic price rises are bubbles (currency collapses)

Because bitcoin is measurable scarcity one can provable show it's a good store of wealth.

OTOH, the ICO binge is an apt analogy for the IPO craze of the 90s. Investors are buying up securities with no viable business model expecting returns which isn't going to happen on software that anyone can copy and run themselves. It doesn't take a $200 million raise for a few engineers to build an MVP. It does take $200 million to run a successful Ponzi scheme (ICOs are probably not scarce and are therefore improper stores of wealth)

<comment><USER22> Bitcoin has scarcity, but so does Litecoin or Bitcoin Cash

What makes Bitcoin special?

<comment><USER23> Network effect - same thing for Facebook. The more valuable bitcoin is the more secure and more resilient. Thus purely by price appreciation bitcoin is doing hiperbitcoinization - once people realize that fundamental value of fiat currency is a myth, more fiat currencies will collapse

<comment><USER2> This is exactly right.

If you create a company and copy Facebook's code, the resulting company will not be worth as much as Facebook.

Why? Because much of Facebooks' valuation derives from its network.

Bitcoin is the same.

<comment><USER24> The problem with being _by design_ a fungible commodity is that your network lock-in isn't anywhere near as strong as Facebook's. Or AOL's...

</comment></comment></comment></comment></comment><comment><USER25> I just went out after a long time. Banks are coming in and i don't trust them. They are smarter then me. I took out my profits and i'm doing stocks since a 1/2th year, i'm focusing on that now.

Here my reasoning:

1) BTC takes too long to make a transaction ( 2,5 hours) which make me kinda doubt the use case.

2) the enterprise is adopting the blockchain, which is irrelevant to bitcoin. If they would do crypto, they will create their own coin.

3) the guy further in the street is also buying crypto ( not in IT). Which for me, is a sign of a bubble. He knows nothing about the tech. It won't ever be used for the original porpose at this valuation.

4) First time adopters are going out now @ 10 k., check out reddit: [https://www.reddit.com/r/Bitcoin/](https://www.reddit.com/r/Bitcoin/)

5) The HODL meme is currently blocking the bubble to burst. Some people are willing to HODL even when 75% fades away. PS. Banks won't adopt the HODL meme :)

I have second doubts though, it truelly is an amazing tech.

</comment><comment><USER26> P/E is a nonsensical measure for currency and assets. No one holding BTC expects to earn transaction fees. The miners get those fees. If we're talking about market cap of the miners themselves then this would be useful. Otherwise, the value of BTC should go up the smaller the transaction fees become. Why? Because less value is lost in transmission.

</comment><comment><USER27> My only resentment toward Bitcoin is that if I had gotten in early enough there could have been some easy money to be made, but only because I believe in the Greater Fools theory, not because I actually believe in Bitcoin as a currency.

<comment><USER28> I never believed bitcoin as a currency same way I don't believe gold or art as a currency.

But bitcoin for me is something like art or gold (scarce, durable) easily, securely transferable to anyone on the planet within less than a day without the need for any third party.

That's bound to be worth something.

</comment></comment><comment><USER29> How do you quantify what p/e of a US dollar is? Doesn't make much sense to me

</comment><comment><USER30> Is price compared to transaction fees really a good measure?

Holding them doesn't mean you get the transaction fees, and increasing transaction fees would lower the 'P/E' but make bitcoins obviously worse to have or use.

</comment><comment><USER31> AFAICT transaction fees aren't the reason someone "invests" or buys bitcoin, if you buy bitcoin you don't get a fraction of those fees. If you want that you should invest in mining, so I think the initial part of the analysis is flawled.

The second part looks like nothing to say, backed by a lot of non sensical numbers, but I'm not a native english speaker and also generally don't read nor like economic "analysis", so I may be wrong

<comment><USER19> The high transaction fees and long transaction delays are turning into a reason why people are starting to question bitcoin.

</comment></comment><comment><USER32> This article seems to be making the assumption that price-to-rent, price-to- earnings and price-to-transaction-fees ratios should all naturally converge to the same amount.

I don't see any plausible justification for this assumption, in fact it seems like it is trivially disproved. The US dollar has no transaction fees, so it's price-to-transaction-fee ratio is infinite. This whole article is based on a false premise.

</comment><comment><USER33> > bitcoins have generated transaction fees of nearly $219 million. And at > $9,600 a piece, the total value of all bitcoins -- their market cap -- now > tops $155 billion. That gives bitcoins the equivalent of a trailing P/E > ratio of 708.

Absurdly idiotic analogy, as holding the underlying is in no way related to the revenues that miners earn.

</comment><comment><USER34> Finally an article that gives some numbers to quantify Bitcoin market. Transaction fees as P/E analogy seems wrong.

</comment><comment><USER15> Here is a chart of transaction volume on several of the major crypto currencies...

[https://bitinfocharts.com/comparison/transactions-btc-eth- bc...](https://bitinfocharts.com/comparison/transactions-btc-eth-bch-xmr.html)

Anyone see a trend...

<comment><USER19> Yup. Bitcoin transactions have stagnated for the last year or so.

[https://bitinfocharts.com/comparison/transactions-btc-eth- bc...](https://bitinfocharts.com/comparison/transactions-btc-eth-bch- xmr.html#1y)

<comment><USER35> Might be due to the fact that the amount of transactions is capped.

<comment><USER15> Thought experiment; Would Apple be as valuable as it is today if it decided that it should cap iPhone production at 1,000 units a month?

</comment></comment></comment></comment><comment><USER36> Bitcoin could hit $10.000 any moment now. Who is buying and why?

<comment><USER37> If you go to bitcoinity and check the price of bitcoin, the first exchange they list is bitfinex. The price they list is in USD. That's actually wrong. There are no dollars on bitfinex. They use a currency called tethers which they claim is backed 1-1 by dollars but almost certainly isn't. They've created close to a billion dollars worth of that token during this run up.

Rumor has it that they're using those tethers to buy btc on their own exchange and manipulate the price.

Once people realize those tethers are worthless and they can't withdraw dollars, they'll start using them to buy btc at any price and withdraw them on the exchange causing a massive run up in btc price as they make a run on the bank. It's not really an increase in btc price but hyperinflation of tethers.

<comment><USER11> > _They use a currency called tethers which they claim is backed 1-1 by > dollars_

Didn't they just recently say they're not backed 1-1 by USD?

</comment></comment></comment><comment><USER38> Dot-com bubble lost $1.7 trillion when it popped. All cryptocurrencies combined are like $300 billion, and they will definitely not go to zero if/when it pops.

</comment><comment><USER39> People should not see cryptocrruencies as a stock market, you should not expect any ROI, it's not a placement.

Cryptocrruencies (for me) are meant to be used, exchanged, a good metric to value a cryptocrruencie should be the 'cash flow (? exchange of money per unit of time)'.

Bitcoin is actually inefficient with its high transaction fees.

<comment><USER40> Transaction fees are about $5-7 USD right now, which for transactions over $200 makes it cheaper than using a credit card, and definitely cheaper than a wire.

</comment></comment><comment><USER41> 41 points 109 comments as of writing one hour after publishing. Look like bitcoin advocates have specifically vetoed this publication.

This is probably one of the only the downside of crowd moderation. This would be an interesting phenomenon to investigate if someone have access to HN logs.

</comment><comment><USER42> its going to crash big time, opportunity to buy more

<comment><USER43> Tulips are on their way back. Let's get in on the ground floor!

<comment><USER42> you do not understand bitcoin, and thats ok :)

<comment><USER43> Not so much. I spent a chunk of 2009-2010 hanging around with British bitcoin enthusiasts. It was predicated on greater fools then and it still is.</comment></comment></comment></comment>


The CEO Paying Everyone $70,000 Salaries Has Something to Hide - <AUTHOR> http://www.bloomberg.com/features/2015-gravity-ceo-dan-price/ <comment><USER2> This article slings a lot of mud but little of it sticks. The main thrust of their issue is (paraphrasing) "He should have been paid about 470K, not 1.1mil" (before he cut his pay and gave it to his staff).

But in a private business the owners can pay themselves whatever they want as long as all owners agree to it. The lawsuit is likely related to how not all owners agreeing with his 1.1 mil pay packet, and the article is arguing that his decision to cut it and give it away was because he knew the lawsuit was incoming (to head it off, essentially).

They try to raise a lot of other issues (e.g. that he claimed client turnover was 30%, when they claim it is 16% and up, but definitely less than 30%), but much of it comes across as almost petty, like they had one big interesting claim and tried to pad it out with a bunch of minor mis-speaking or other miscellaneous issues.

Ultimately it reads like a hit piece. Really they're just re-hashing the lawsuit and have nothing else to add of value.

<comment><USER3> > the article is arguing that his decision to cut it and give it away was > because he knew the lawsuit was incoming (to head it off, essentially).

That is not what the article is saying at all. It says that he initiated this pay raise __after __being sued because he payed himself too much.

<comment><USER4> There is literally no difference between gp and what you are saying.

</comment></comment></comment><comment><USER5> This piece is pretty long for the little bit of new information it provides, so here's what I believe is the nut of the piece:

Dan Price co-owned Gravity with his brother Lucas. Dan Price became famous for raising his employees salaries so that none made under $70,000. Shortly he did that, a story broke that Dan was being sued by his brother Lucas, who was demanding that Dan buy his stake out. Dan and his spokespeople represented to the media that the suit was a reaction to the pay raise, which reduced profits for owners to pay employees.

But it turns out that Dan was served for the lawsuit before the pay raise, and that Dan's legal response to the suit also precedes the raise. It does not seem likely that the lawsuit had anything to do with the raise. It is now plausible (but unproven) that the raise was a tactical reaction to the suit.

Furthermore, Dan Price's ex-wife alleges that Dan was physically violent to her. And, Dan Price's own salary is anomalously high given the details of the company.

That's pretty much it.

<comment><AUTHOR> Thank you for writing what I was too lazy to do.

</comment></comment><comment><USER6> I went to high school with this guy, and used his company as a payment processor when I was running a small retail shop. That was about 4 years ago. really did a good job nailing down the small merchant niche by removing dumb fees like 'drop fee' and 'statement fee'

It's been really weird to see everyone's reaction to this thing. Surreal almost. Didn't see Notch get this kind of hate when he shared his bonus with all employees. Perhaps it's because he works in the financial industry?

<comment><USER2> It is because he is promoting "evil" socialist ideas that go against the very grain of capitalism (essentially sharing the wealth, and sharing the profits).

He's upset a lot of rich and powerful people who don't want their poor underlings to start asking why they aren't benefiting from the company's growth or profit margins.

Essentially he upset the status quo.

<comment><USER3> This guy is not the first person in history to pay his employees well. You're sadly mistaken if you think this guy is some socialist hero to the working class.

<comment><USER2> He isn't. But he is seen that way by others, and that's why upset THEM. This is more about them and how they perceive it (and the associated media) than about him directly.

</comment></comment></comment></comment><comment><USER7> Man, with the way the sharks have been in the water around this guy, you'd think he was running Theranos or something. So what if he was initially overpaid, and so what if the lawsuit predated the decision? The domestic violence allegations are another matter, but still, if he's guilty of that does that mean that his employees have to give half their salaries back to him just to appease the Ayn Rand acolytes?

<comment><USER8> He might have had selfish motivations, and he might be a bad guy. But neither of those things changes the fact that he did an experiment with giving employees equal salaries, and that experiment had positive results on the company.

I think sharks are circling because people have a zeal for debunking the idea that someone is selfless. If you Google it, you can even find people who criticize Mother Theresa for having secret, selfish ulterior motives.

I personally believe people who help others always get something out of it (even if it's just private satisfaction), and that's OK. A good act is a good act, regardless of the internal thoughts that triggered it.

<comment><USER9> People criticise mother theresa because she believed that suffering was a gift from god and because of that she didn't allow pain medication to be used in her "hospices". And her hospices didn't separate the curable from the untreatable, so a bunch of people died needlessly.

<comment><USER8> That's very interesting! I haven't seen that specific (and horrifying) criticism.

What I've seen was from Christopher Hitchens, who said that she wasn't a "good" person because her primary motivation was to proselytize, as she believed Jesus instructed her to do.

My comment was creating an analogy between those two: Dan Price doing something awesome for his employees because of a lawsuit is something like Mother Theresa serving the poor because she believed it was how she would have a good afterlife.

I don't know if either of those motivations are true. It's impossible to know someone's motivations with certainty. That's why I think an action and its consequences are the thing to focus on.

If it's true, as the article says, that Dan Price is creating the cult of Dan Price (a do-gooder-CEO kind of thing), great! Even if he's just some narcissist who wants people to love him, I'm happy that another wealthy person is pursuing some form of humanitarianism. All the really "good" people might be narcissists, for all we know!

<comment><USER10> Did you see the Christopher Hitchens documentary? There seems to be quite a lot of detail in it beyond just her motivation being to proselytize..

</comment></comment></comment></comment></comment><comment><USER11> TL;DR: he raised the salaries _after_ he was sued for overpaying himself.

<comment><USER12> Thank you :)

I don't know how to write this comment in a short time span without coming across as a snarky a-hole but seriously, why are such piss-poor writers allowed to write for such serious publications? where the hell are editors and what are they doing? when did it become acceptable to hit 'publish' on such a shoddy amateurish article?

sigh

<comment> shawn-furyan This is a bit off topic, but I see this bafflement over the general decline in editing quality a lot. It's really not so surprising given the way the news landscape has changed in the last couple decades.

Editing is expensive[1]. The internet ripped the heart out of the print news business. Accordingly, editing has been cut back drastically pretty much across the board in response to increasingly tight budgets.

[1] Much more expensive than one might assume without having experienced the process. Coordinating among multiple people plus the back and forth iterative process that editing generates adds a lot of overhead to the writing process. Self editing is much faster (and therefore cheaper), but you get blind to errors that would jump out at someone else, and so errors slip through much more readily. Plus, other people are capable of challenging your assumptions in a way that you just aren't capable of since you aren't even always aware of your own assumptions.

Source: I've written informally at the margins for a reasonably, but not tremendously, high trafficked niche blog, and have participated a little in both edited and self-edited articles from both the writing and editing side. This was never industrial strength editing, so I imagine the cost to actual news outlets with higher standards is a lot higher than I have experienced.

</comment></comment></comment><comment><USER13> The CEO just sounds desperate for attention, as if he's a cult leader. Seriously, planks during meetings? I'd quit right then and there. Just sounds like an immature person that just wants to start a business because he'll get to implement all these quirky, utopic policies.

Also, just very low emotional intelligence for not thinking about the people who got paid highly and deserved it. You didn't hire robots - you hired human beings with real emotions.

<comment><USER14> Maybe I suck at emotional intelligence, but why would a highly paid employee be upset that lower paid employees are getting a raise?

<comment><AUTHOR> Let's say I'm a college graduate (with accompanying student loan debt) and you're a high school grad. We both get jobs at the same company and you're paid 40k while I'm paid 60k. If we both get raises to 70k, I am still stuck with my student loan debt while getting paid the same as someone who did not need to spend years in school or take on student debt.

<comment><USER15> But why would the other person's salary affect you?

<comment><AUTHOR> Because of the reasons listed in my original post. If I had to sacrifice time and money to graduate from college to qualify for a job and an arbitrary raise provides the same compensation to someone who does not have a college degree, it devalues my degree. On top of that, besides the degree getting devalued, I still have the original student debt amount.

<comment><USER16> But you had 60k before and now you have 70k... I'm sorry but your line of thought makes no sense at all to me. I'd be fine with it.

<comment><USER13> As another posted said it makes complete sense. Psychology 101: [https://en.m.wikipedia.org/wiki/Relative_income_hypothesis](https://en.m.wikipedia.org/wiki/Relative_income_hypothesis)

</comment></comment></comment></comment></comment></comment></comment><comment><USER3> > Gravity's 2014 profit was $2.2 million, Price adds.

> At private companies with sales like Gravity's total revenue, salary and > bonus for the top quartile of CEOs is $710,000, according to Chief Executive > magazine's annual compensation survey. At companies with sales like > Gravity's net revenue, the top quartile pay falls to about $373,000. At > companies with a similar number of employees as Gravity, the top quartile of > CEOs makes $470,000 in salary and bonus. The CEO of JetPay, a publicly > traded competitor that processes a similar volume as Gravity, received > $355,000 in 2014.

$1.1 million on CEO salary sounds ridiculous given a $2.2m profit.

<comment><USER17> Not if he were the managing partner (and majoritary owner).

But agreed. If this were a public company, stockholders would probably be very unhappy that half of their earnings are being poached by some profesional executive with no skin in the game.

<comment><USER18> But since he is the majority stockholder it makes perfect sense. It's his money one way or the other.

</comment></comment></comment><comment><USER19> I read about 60% of that article and had to stop. It felt like I was reading some sort of pseudo-soap opera script.

<comment><USER20> I read the whole thing, but I agree, this style of journalistic writing can't end soon enough.

<comment><USER21> Yep, it seems to me that it's only an ad (hidden in the last paragraph) for the book about that salary thing.

Basically, this guy want to use the Paris Hilton Syndrom to growth. _I 'll be famous coz I'm rich coz I'm famous coz..._

</comment></comment></comment><comment><USER18> Well that was a waste of words. The tl;dr seems to be he used to pay himself a lot (which he has told everyone), now he pays a lot of people more than before (which he has told everyone), is stressed out that his brother is suing him (which he told everyone) and likes publicity (which is obvious).

</comment><comment><USER22> I'd be skeptical of this piece. There's been one hit piece after another against this guy from the conservative/business media. It is possibly that he's a shady character, but it is also possible that some people are Really upset at him establishing a pay floor of $70k a year.

We should suspend judgment until we have further evidence.

</comment><comment><USER23> I can't imagine being forced to 'plank' during an office meeting.

</comment><comment><USER24> The stuff about him overpaying himself is bad enough, but why isn't anyone talking about his ex-wife's allegations at the end of this piece? (Charitable interpretation: people didn't make it that far bc this thing is so poorly written.) Anyway, she's about to go on the record in a very public way (TED talk) claiming he hit her and "waterboarded" her. It's despicable in its own right if true, and it points to a larger pattern of dishonesty.

<comment><USER25> Probably because they are allegations. If they are found true he should and will be punished. But until then, he is innocent until proven guilty. I don't see the point in a witch hunt.

<comment><USER24> I don't see the rest of the article being treated with this level of skepticism.

</comment></comment></comment><comment><USER26> Why do we always have to tear people down for doing something good? Who cares their motivations, reasons, or response? I give the guy credit for doing something radical that improves peoples lives. I don't care about what Dan Price may or may not be getting out of this. I'm more interested in the experiment itself, and the employees. To me this is nothing more than a hit piece.

</comment><comment><USER27> TL;DR: This is a run of the mill hit piece. Save yourself the trouble and don't waste your time reading this drivel.

</comment><comment><USER28> I stopped at the plank during meetings bit...

</comment><comment><USER29> The plank meeting idea seems good.

</comment><comment><USER30> Well this is a hit piece.

</comment><comment><USER31> tl;dr anyone?

<comment><USER32> It's a hit piece. Basically the lawsuit from his brother seems to have come about before the pay hike for employees. Also put a smattering of he beat his ex-wife in at the end, but we have no real evidence.

</comment></comment><comment><USER33> Its incredible how hard the sharks are trying to discredit this guy. I recall reading about Gravity on marketwatch several months ago, comments were full of expletives and certainty that the company would go bankrupt. Dumbasses.

The benefits are obvious to anyone with half a brain - significantly better retention, a large pool of motivated applicants to choose from, and more companies doing business with them (mostly based on the ethics "brand"). The guy got first mover advantage here. Good for him.

</comment><comment><USER34> Was anyone else caught off guard by the sexy yoga ball pose?

Edit: Someone else says it's a hit piece, makes sense that the picture seems off if it is some filthy animal squandering the internet's time on savagery.

<comment><USER35> I'd say the pictures are kinda creepy.

</comment></comment><comment><USER36> The Twentieth century motor company</comment>


U.S. Charges 3 Chinese Hackers for Hacking Trimble, Siemens and Moody's Analytics - <AUTHOR> https://www.justice.gov/opa/pr/us-charges-three-chinese-hackers-who-work-internet-security-firm-hacking-three-corporations <comment><USER2> "An indictment was unsealed today against Wu Yingzhuo, Dong Hao and Xia Lei, all of whom are Chinese nationals and residents of China, for computer hacking, theft of trade secrets, conspiracy and identity theft directed at U.S. and foreign employees and computers of three corporate victims in the financial, engineering and technology industries between 2011 and May 2017...."</comment>


Azure Search Is Now Generally Available - <AUTHOR> http://azure.microsoft.com/blog/2015/03/05/azure-search-is-now-generally-available/

<comment><USER2> Honest question: how is this different from using the Bing search and spelling APIs that have been available for years on the Microsoft Marketplace? I use the Bing search APIs in a few of my apps, and have been doing so for years.

<comment><USER3> Can you index your own data with the Bing search API? This looks like it lets you run the same software that runs Bing with your own data as opposed to only what Bing has crawled. From the link:

> You can now more easily load data from Azure DocumentDB, SQL Server running > in Azure VMs, and Azure SQL Database to Azure Search using new indexers. The > indexer infrastructure provides a no-code solution that allows you to point > Azure Search to your data store where it will ingest data as well as data > changes on a scheduled basis.

<comment><USER4> tkmcc is correct, the other big area that people typically want is the ability to easily tune their search results. For example, you might want to give more weighting (or boost it higher in the search results) to an item if the search text is found product name then if you find it is in the product description. Or perhaps boost a result based on the proximity (geo-location) of the item in relation to the user.

Full disclosure, I am a Program Manager on the Azure Search team.</comment></comment></comment>


Let's Encrypt is down - <AUTHOR> https://letsencrypt.status.io/?170519 <comment><USER2> Josh from Let's Encrypt here. First, my apologies for the trouble this has caused.

I want to offer people here an early root cause analysis. I say early because we have not entirely completed our investigation or a post-mortem.

OCSP requests that use the GET method use standard base64 encoding, which can contain two slashes one after another. While debugging why a small number of OCSP requests consistently failed our engineers observed a rather odd, but standard, web server behavior. When a server receives a request with multiple slashes one after another they will collapse them into a single slash. This caused our OCSP responder to consider requests that had this unusual encoding quirk invalid and would respond to with a '400 Bad Request' response. The fix seemed quite simple: disable the slash collapsing behavior.

Unfortunately, stopping this behavior surfaced a more serious issue. The AIA extension that we include in certificates we issue contains a URI for our OCSP server. This URI contains a trailing slash. According to RFC 6960 Appendix 1 an OCSP request using the GET method is constructed as follows 'GET {url}/{url-encoding of base-64 encoding of the DER encoding of the OCSPRequest}' where the url 'may be derived from the value of the authority information access extension in the certificate being checked for revocation'. A number of user agents take this quite literally and will construct the URL without inspecting the contents of the AIA extension meaning that they ended up with a double slash between the host name and the base64 encoded OCSP request. Before we disabled slash collapsing this was fine as the web server was silently fixing this problem. Once we stopped collapsing slashes we started seeing problems.

From our OCSP server's perspective a majority of the OCSP requests we were receiving were prepended with a slash and we were unable to decode them so we'd respond with a '400 Bad Request' response and move on. This coincided with a large number of previously cached responses on our CDN expiring, causing us to start getting hit with a large number of requests. Because we were responding with '400 Bad Request' responses we were setting explicit no- cache headers which meant we had a near 0% cache (CDN) offload rate and were hit with the full brunt of our OCSP request load at our origin servers. This caused our whole infrastructure to get bogged down.

<comment><USER3> Just a quick question. Does this mean that if your OCSP servers were to go down, a lot of SSL enabled websites and applications will stop working? Seems like a serious single point of failure for modern day internet. I was always under the assumption that clients do not have to contact the CA (every time?) before a TLS handshake takes place.

OCSP Stapling seems to be the way to mitigate this problem, but not all web servers implement it (for instance lighttpd does not). Any recommendation from Let's Encrypt on this issue?

<comment><USER4> I'm pretty sure revocation checks like CRL and OCSP all fail-open (they still allow the connection if contacting the revocation server fails).

<comment><USER5> Some have argued that this is why CRL and (especially) OCSP are useless pieces of security theater: they don't actually protect against a crafted attack because they fail-open in the very situations that a determined adversary can trigger, so they only "protect" in situations where no real threat exists. It's simply feel-good bookkeeping.

Adam Langley, working on Google Chrome [1][2][3], has been very vocal about OCSP's faults, and Chrome began using its own auto-update to ship an aggregate of revocations of high-value certs directly to browsers out-of-band. Despite this being another famous instance of Chrome going against the grain of other browser vendors, I believe this was the correct solution: offering better protection for a curated subset of sites vs. pretending to -- but not actually -- protecting all sites.

[1] [https://www.imperialviolet.org/2012/02/05/crlsets.html](https://www.imperialviolet.org/2012/02/05/crlsets.html) [2] [https://www.imperialviolet.org/2014/04/19/revchecking.html](https://www.imperialviolet.org/2014/04/19/revchecking.html) [3] [http://www.zdnet.com/article/chrome-does-certificate- revocat...](http://www.zdnet.com/article/chrome-does-certificate-revocation- better/)

<comment><USER6> > I believe this was the correct solution: offering better protection for a > curated subset of sites vs. pretending to -- but not actually -- protecting > all sites.

I concur, but note that it _is_ possible to do better and offer better revocation protection for all sites, with low bandwidth/storage costs: [http://www.ccs.neu.edu/home/cbw/static/pdf/larisch- oakland17...](http://www.ccs.neu.edu/home/cbw/static/pdf/larisch- oakland17.pdf)

<comment><USER5> This paper -- the CRLite proposal -- is wonderfully well thought-out, experimentally tested, and meets the design goals much better and more elegantly than any other attempt to solve the certificate revocation problem.

Looks like it was posted here and got very little traction [1]; a shame. But it will be presented in a few days at the IEEE Symposium on Security and Privacy [2]. I hope it will get the coverage and examination it deserves.

[1] [https://news.ycombinator.com/item?id=13982861](https://news.ycombinator.com/item?id=13982861) [2] [https://www.ieee-security.org/TC/SP2017/program- papers.html](https://www.ieee-security.org/TC/SP2017/program-papers.html)

</comment></comment></comment></comment></comment></comment><comment><USER7> So in case this helps anyone, I had people complaining about strange OCSP errors all over the morning coming from my server (using apache httpd).

It turns out apache does practically everything to behave as dumb as possible in case of OCSP downtimes.

If the OCSP sends an error it will send the error as a stapled OCSP reply (instead of using an old, still valid OCSP reply). You can't make it behave sane here, but you can at least tell it to not return the error with SSLStaplingReturnResponderErrors set to off.

However if the OCSP isn't available at all apache will fake its own OCSP error (sic!) and send it. This is controlled by the option SSLStaplingFakeTryLater, which defaults to on. So if your firefox users get strange OCSP errors, it's most likely this. The doc for SSLStaplingFakeTryLater claims that this option is only effective if SSLStaplingFakeTryLater is set to on, however that's wrong.

tl;dr set both of these options to "off", then at least apache won't staple any garbage in your TLS connection, firefox will try to reach the ocsp on its own and fail and still accept the connection. Yes, that's all pretty fucked up.

<comment><USER8> Thanks for pointing this out!

Going through the documentation, another thing that surprised me was the SSLStaplingStandardCacheTimeout setting.

If I understand this correctly, by default Apache will only cache OCSP responses for 1 hour, even if they are still valid for days. I guess increasing this to 1 day or something would make sense as well.

<comment><USER7> > If I understand this correctly, by default Apache will only cache OCSP > responses for 1 hour, even if they are still valid for days. I guess > increasing this to 1 day or something would make sense as well.

Yeah, that's another major problem. But increasing that doesn't really fix anything in a reasonable way. There shouldn't be any cache timeout, this option doesn't make any sense. It should cache as long as the reply is valid and replace it in time before it expires.

<comment><USER8> By the way, I checked the source and it appears that setting SSLStaplingStandardCacheTimeout to a large value (larger than typical OCSP reply validity) effectively creates this behavior.

Apache checks if cached reply is still valid and if it's not it attempts to renew it.

At least in 2.4.10 shipped in Debian Jessie. Relevant code is in modules/ssl/ssl_util_stapling.c, stapling_cb()

</comment></comment></comment></comment><comment><USER9> Was fun finding this out during a random server cycle. Turns out, Caddy doesn't appreciate the ACME server being down, and refuses to start :)

[https://github.com/mholt/caddy/issues/1680](https://github.com/mholt/caddy/issues/1680)

<comment><USER10> Wow @ that close comment:

> So, this is not a bug and all is working as intended.

Caddy folks had better never restart the caddy service (or server) while LE happens to be down, even if you already have a valid cert!

<comment><USER11> That's going to be a limiter for adoption. Hopefully @mholt reconsiders.

Update: Mholt pushed a change where caddy only refuses to start if the cert is expiring in 7 days or less. [https://github.com/mholt/caddy/commit/410ece831f26c61d392e0e...](https://github.com/mholt/caddy/commit/410ece831f26c61d392e0e8fa41e9b4f90d7fb95)

<comment><USER9> Hm, yeah I hope so too :/ Been using Caddy in prod for a year now, this issue, rare as it may be, could single-handedly get me back on nginx.

Having the server be unable to start through circumstances outside of the system's control is just such a huge no.

<comment><USER12> Why did you switch away from nginx?

<comment><USER9> Not having to deal with certificate renewal is a big deal.

<comment><USER13> I am running nginx reverse-proxying to a python API right now. Dealing with certificate renewal is a matter of running a daily cronjob issuing 'certbot renew'. If it works it replaces the fullchain.pem certificate, and that's it, easy peasy.

Am I missing something?

<comment><USER9> And by running Caddy instead, I have one less piece to monitor and worry about.

The way Let's Encrypt works, it makes a _lot_ of sense to have the functionality be part of the web server.

<comment><USER14> > by running Caddy instead, I have one less piece to monitor and worry about

No, with Caddy you have several vaguely related pieces glued together with superglue.

> The way Let's Encrypt works, it makes a lot of sense to have the > functionality be part of the web server.

I think this thread is pretty much proof that that approach _will_ bite you in the ass.

<comment><USER9> > _I think this thread is pretty much proof that that approach will bite you > in the ass._

What bit me here is the fact that I'm running alpha software instead of a battle-tested web server; I'm doing so willingly, with full awareness of the risks that that entails.

Drawing the conclusion you did from the variables at play is shortsighted. If anything bites people in the ass, it's prejudice and shortsightedness. I wouldn't want you handling my ops/infrastructure.

<comment><USER14> > What bit me here is the fact that I'm running alpha software

This wasn't caused by a bug. This was a _deliberate_ decision to fail to start if the certificates on-disk were <= 30 _days_ away from expiring and the CA can't be contacted.

> Drawing the conclusion you did from the variables at play is shortsighted

Using caddy is the web-server-stack equivalent of "putting all your eggs in one basket". If one thing about it isn't working the way you want, you have to either a) replace it completely or b) work out how to disable the bit that's not working how you want, and replace that part of it.

> Drawing the conclusion you did from the variables at play is shortsighted

\- People use a piece of software that serves as both ACME TLS certificate client and web server

\- Said software _by design_ won't start if the CA can't be contacted 30-days out from expiry

The conclusion I drew is that such integration leave the operator with _less_ control than if they followed a separation-of-concerns approach, and left web serving to a web server, and TLS certificate renewal to an ACME client. The former doesn't need to care about how old the certificates are, just use what it's given.

<comment><USER9> You're drawing conclusions from unintended behaviour, which has now changed (and a release has been issued).

<comment><USER14> > unintended behaviour

Ahem. [https://github.com/mholt/caddy/issues/1680#issuecomment-3026...](https://github.com/mholt/caddy/issues/1680#issuecomment-302693543)

Emphasis mine:

> So, this is not a bug and all is _working as intended_.

<comment><USER9> Have you noticed that the bug has been fixed?

<comment><USER14> why do you keep calling it a bug?

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER15> I think LE is a huge boon to the internet. But I would really love for someone like Amazon, Google, Facebook, or Microsoft to set up a separate provider that implements the same thing. Redundancy is super important here and clearly just one organization can't guarantee 100% uptime.

<comment><USER16> Amazon does, though limited to its own services (which is, frankly, to be expected). AWS Certificate Manager

<comment><USER11> ACM is nice, but it does require the manual step of clicking a link in a verification email.

<comment><USER17> Yes but it also issues certs for a year, which helps alleviate that email link issue.

<comment><USER18> If you are running the AWS ACM certificate at the time when the old one is close to expiration it will automatically renew it without user intervention. [http://docs.aws.amazon.com/acm/latest/userguide/configure- do...](http://docs.aws.amazon.com/acm/latest/userguide/configure-domain-for- automatic-validation.html)

</comment></comment></comment></comment></comment><comment><USER19> Not only is it a problem with certificate issuance - but their OCSP servers are also down. This caused an issue on one of my sites where I was using OCSP Stapling: normal browser connections were failing, but not tools like curl (which don't ask for the OCSP response over SSL).

<comment><USER20> What's the typical validity period for OCSP responses with Let's Encrypt? Shouldn't the stapled responses continue working for at least a couple hours even after Let's Encrypt goes down?

<comment><USER21> 1 week, so most servers likely won't be affected unless the outage goes on for a really long time.

<comment><USER8> Not sure how this works.

I have OCSP stapling turned on in Apache and Firefox wouldn't load my page when Let's Encrypt OCSP servers went down.

My monitoring shows that last stapled response had 4 days of validity left. So it seems that Apache immediately threw away cached OCSP responses.

<comment><USER22> For what it's worth, Caddy is the only server that will locally cache the staples (and manage them) automatically. In other words, Caddy sites were not affected by this OCSP downtime.

<comment><USER23> While we're on the topic: [https://github.com/mholt/caddy/issues/1680](https://github.com/mholt/caddy/issues/1680)

</comment></comment></comment></comment></comment></comment><comment><USER24> On the plus side, as a side effect to this event, most of libraries shall start handling this case in better robust ways..

<comment><USER25> Usually takes a serious failure first. Then, they start doing real robustness... on just that one thing. ;)

</comment></comment><comment><USER26> It seems that Let's Encrypt is back up.

I think, in the past, mods have put an extra down-weight on "X is down" stories, once 'X' is back up.

Since this discussion now has interesting stuff related to Let's Encrypt—and products which use Let's Encrypt—I hope the mods are willing to forgo the down weight, and instead just change the post title to something like "Let's Encrypt Was Down".

<comment><USER27> I'm still getting 504s and timeouts from [https://acme-v01.api.letsencrypt.org/acme/new- reg](https://acme-v01.api.letsencrypt.org/acme/new-reg) and [https://acme-v01.api.letsencrypt.org/directory](https://acme-v01.api.letsencrypt.org/directory) (trying from Lisbon, PT)

Edit: Akamai is issuing the 504 when hitting [https://acme-v01.api.letsencrypt.org/acme/new- reg](https://acme-v01.api.letsencrypt.org/acme/new-reg) so I guess the origin servers are still overloaded...?

<comment><USER28> I'm experiencing the same from Kuala Lumpur.

<comment><USER27> FYI, acme-staging.api.letsencrypt.org is working ok for me but the production endpoints are still timing out.

</comment></comment></comment></comment><comment><USER29> Nothing against letsencrypt but dependencies on services to be online is fragile and will break. Their 90 day limit makes it worse. Saying its for security is like saying 1 or 3 year certs are somehow insecure which is not the case. It's one more headache for an admin to think about even if automated.

We really should reexamine the CA system. Self signed certs should have more value than they currently do, and identity can be verified by out of band methods. Surely it's worth exploring.

What we have now effectively disempowers individuals and centralizes essential services which cannot be good in the long run.

<comment><USER30> You can run your own ACME provider, the code is open source.

Nothing stops you from running a CA that offers 1 year certs over ACME. Or just providing one that also offers 90 day certs. If people will trust that CA is another question.

The automation of LE is not the problem either. Properly automated systems would extend/renew the cert well before they are invalid, almost every LE guide I know mentions this on grounds of "what if LE is down".

The only libraries and services affected are those who do not properly code for an external service provider being temporarily offline.

The problem with OOB verification of certs is that it's slow and inefficient for almost all methods this can be done with. And it doesn't scale either.

Imagine if everyone wanted to OOB verify the Google certs on the same day.

<comment><USER31> > Nothing stops you from running a CA that offers 1 year certs over ACME. Or > just providing one that also offers 90 day certs. If people will trust that > CA is another question.

You know that's BS. All of your users would get certificate errors, that's what's preventing you from running your own CA.

<comment><USER30> Read carefully.

"if people wo trust that CA is another question"

Of course you won't get trusted but that's not the issue.

</comment></comment></comment></comment><comment><USER32> We've been using LetsEncrypt on dozens of our servers for several months now and it's worked flawlessly both in set-up and in operation!! Set up was quite easy thanks to A LOT of work by the team there.

To make HTTPS simple and free to set up is a FANTASTIC mission & the team has overall built a SUPERB system. Congratulations & thanks for addressing this issue quickly, looks like it's already solved, good work!

</comment><comment><USER33> This is also why you don't wait until the last day before renewing. (But no- one does that, right?)

<comment><USER15> If you use one of the myriad of automated tools for using LE, you will get your cert renewed as early as 30 days before it expires. So right now the issue should only be with new domains getting certs.

If you renew LE certs manually, first what is wrong with you and don't you like yourself? Second, at that point it's no different than NameCheap going down and you getting your cert from 1and1 instead.

<comment><USER34> > So right now the issue should only be with new domains getting certs.

Certainly should have been, but it looks like a lot of libraries are choking on the outage even if the old cert is 100% valid.

<comment><USER15> I use [https://github.com/lukas2511/dehydrated](https://github.com/lukas2511/dehydrated) which is a bash script for doing this. It doesn't choke because it's just a cron job.

I also use dokku's LE plugin which is... also a shell script corn job. Maybe that's the way to do this. I know Caddy is an exception case for this.

</comment></comment></comment></comment><comment><USER35> Just spent an hour debugging why development scripts work but production doesn't.. Good reminder to configure some kind of notifications from AWS Lambda also when the execution times out, not just on errors.

</comment><comment><USER36> Clearly it is high time for an EncryptWeShall nonprofit with a wholly separate implementation and team and all the tooling adjusted to randomly pick between the two.

</comment><comment><AUTHOR> Traefik is having a problem similar to Caddy, where having letsencrypt down prevents it to boot.

[https://github.com/containous/traefik/issues/791](https://github.com/containous/traefik/issues/791)

</comment><comment><USER37> Holy frijoles, I was pondering exactly this scenario earlier today while messing around with Caddy and LE, as in: do I want to take a (mostly) static and offline process and directly inject it as another moving part into runtime world, for the sake of its cost, convenience, and overall worthwhileness?

Is there a good alternative, without this sort of process? Or back to the sharks?

</comment><comment><USER38> This is unrelated to this outage, however in the past when renewing, I've always had problems resolving acme-v01.api.letsencrypt.org - am I alone with this issue?

I'm running a local dnscache instance (djbdns), perhaps that has something to do with it?

</comment><comment><USER39> Working for me. I just renewed some certs using the DNS method without issue.

</comment><comment><USER40> Well, it's down again

</comment><comment><USER41> Short version - they fixed an issue but the fix had dependencies

</comment><comment><USER42> oh my god, a website in the internet is currently down, let's discuss that.

</comment><comment><USER25> "High assurance datacenter" High assurance my ass. Those don't go down unless there's a DDOS or catastrophic failure (often several). Then, they're right back up. People need to stop misusing this label. Another is "high-assurance" certs from vendors that get compromised or subverted easily. Only one high- assurance CA that I know of. It's not around for business reasons, though.

[http://www.anthonyhall.org/c_by_c_secure_system.pdf](http://www.anthonyhall.org/c_by_c_secure_system.pdf)

<comment><USER31> The issue here doesn't seem that a data center went down, but that there was a bug which caused downtime.

<comment><USER25> The issue I brought up is nothing about it is high-assurance except maybe tamper-resistance on a HSM involved. It's a term abused in the certificate market a lot. An easy hint to tell is if it's a product developed slowly in a safe subset of C, Java, or Ada. Those have the tooling needed for highly- robust implementations. Then look at the OS to see if it's something extremely hardened or unusual (eg separation kernel RTOS). The protocols will be ultra- simple with a lot of high-availability and easy recovery. Almost no modern tooling will be in the TCB for configuration or deployment unless it's simple. Most of it isn't.

I'm not seeing any of this in the reporting that made it here. Definitely not high-assurance. Likely compromised by high-end attackers either for specific targets or in some general way. It will help protect in its intended way against the rest, though. Enormously positive development. Just not high- assurance security at any level.</comment></comment></comment>