Text from tweet:

Today we are releasing Cloudflare OS, a chatbot with connectors, just like every other tech company is doing.

Except actually, it's different. This is a remake of Sandstorm[.]io, my startup from 10 years ago, except this time built on Cloudflare Workers (the platform I've spent the last 9 years building) and deeply leveraging AI. This is more or less the culmination of my secret 10-year master plan.

This is a full-on personal app vibe coding platform, in which the sandbox is so secure that you can pretty much go wild -- the AI cannot introduce a significant security bug. We believe a company's security team can feel comfortable giving non-technical users permission to vibe code and then sleep soundly at night.

How is that possible? It's the Sandstorm security model, revisited. A "Gadget" is the same thing as a Sandstorm "Grain": a fine-grained app instance. For example, if you have a document editor app, each document runs as a separate instance of the app, in a separate sandbox (one "Gadget").

This means two things, both of which I think are Big Deals: 1. The platform can manage all access control, by controlling who can access the Gadget at all. There is no way the Gadget can accidentally leak itself to an attacker -- even an attacker who has access to other Gadgets based on the same app. 2. Since everyone is running their own copy of the code, everyone can freely modify their copy of the code.

Think about #2 a bit more.

What if, when you wanted a new feature in the software you are using, you could just prompt your agent to add it?

This doesn't work in the cloud Software-as-a-Service model, because you are not running your own copy of the app.

Sandstorm tried to change that 10 years ago, but the world wasn't ready, because not enough people had the skills or patience to actually modify their software. AI has changed that. Now you just ask the agent -- the same agent that you are using to help you interact with the Gadget can also modify the code of the Gadget.

And it is so fun.

Also the security story doesn't completely add up to me. Like, if I'm a user and I can just add features that I want, what's to stop me from placing data in there that's maybe covered under HIPPA or some other sensitive data (protected class, or even just stuff like authentication information)? Right now a small number of people need to think about data security, but this seems like it'd extend it to anyone? That kind of data, it's not just about "keeping it internal by default", there are a lot of rules around storing it at all.

I dunno, it kind of makes me think of when people suggest forking an open source project if the maintainers won't accept a suggestion. Sure, you can do that, and it does happen, but you're also basically signing up to maintain it for decades. I'm not sure if anyone wants to maintain Alice in accounting's very weird spreadsheet app 10 years after she's left the company?

(Again I'm not throwing shade, just trying to understand better)

I am no different, but my approach is a dedicated powerful computer on your desk rather than something in the cloud. I am calling it Tarvis AI (derived from TARS from Interstellar and Jarvis from Iron Man), more details here: https://tarvisai.com

I have tried many of the VM/cloud-based agent setups, and they either tend to be only novelties since you can’t do much with 2-4 vCPUs + limited RAM or they start racking up expensive cloud bills.

I realized that the underlying operating systems for AI have to be built from the ground up for agents instead of taking current OSes and taming them for agents. Not sure how much of that philosophy is followed by Cloudflare. Excited to see growth in this area.

The issue isn't letting end-users add features. The issue is twelve end-users customizing something that produces output, saving it, and now nobody can read it.

This can get solved. If it even gets a chance to gain traction (it should, though IT will of course push back). But let's not pretend we're there yet.

We're starting to see indifferently architected AI creep into every engineering tool, from requirements management to coding, MATLAB, EDA and Solidworks. At the same time we see LLMs orchestrating long running hacking campaigns that will leverage other agents and automation to propagate. We really need an architecture that can handle that complexity.

Kenton Varda hitting the ball out of the park again.

"Your Cloudflare account is on the Free plan, but the Cloudflare OS backend needs Dynamic Workers, which requires the Workers Paid plan."

In case anybody missed it.

https://github.com/cloudflare/cloudflare-os

It runs on top of our open source runtime.

https://github.com/cloudflare/workerd

If you're generally opposed to any vendor lock-in, then Cloudflare is definitely a hard sell. Many of their services are pretty specific to their ecosystem and I imagine trying to keep things portable would be infeasible any many scenarios. Granted, this is true in a provider like AWS, too, if you were depending heavily on their proprietary, managed services. But there's definitely value in knowing that you can stick to "generic" services as much as possible in AWS and be able to move away relatively easily.

Cloudflare is definitely becoming a "real" cloud provider (I'd say their release of R2, for me, pushed them into the "serious contender" category), but they focus on pretty specific features that aren't very portable. This Cloudflare OS service is a good example of that. If it is exactly what you need, then it is worth checking out and taking on the risk of vendor lock-in. But if you're doing something where long-term planning and portability is important, then you'll have a hard time warranting even considering them.

Developing abstractions to let you switch technologies has 2 costs: The actual development, and not fully utilizing a specific technology. Lots of people prefer pain in small doses because it can be rationalized as eventual payoff.

There are degrees of this decision, of course, but I would say most folks worry too much about this particular champagne problem.

Also check out Bunny.net.

Not remotely paranoid.

They move pretty quick so they tend to ship a lot of product very quickly that have a lot of potentials. But they are very much MVPs, and you'll hit a lot of limitations that aren't always obvious at first blush. And then it can take years before they mature, at which point they'll pour a ton of resources and they'll go from useless to top tier in like 2 months.

It's really hard to tell.

The Vite plugin for Cloudflare Worker was one of those. It was really rough at first and I wasted hundreds of hours getting stuff working as advertised. And then in a week they fixed all the bugs.

AI Gateway is another. We used it at first because it seemed to check all the boxes, and turns out it had tons of limitations and almost none of the features of other offerings, with very few updates months+. And then recently they basically added all the features it was missing in a few weeks/months and now its good.

Agent SDK too, it was always behind with outdated dependencies and missing features all other agent frameworks had. And then one day they started iterating super fast and now its legitimately good.

You can never tell reading the docs, so you have to try it, curse because you only find the limitations once you're running the thing for real in production, abandon it, then a few months later its everything you could ever want.

I have a love hate relationship with Cloudflare. Mostly love, but still.

And I think they suffer a little a little bit from their infrastructure being _comparatively_ unique. As providers go, they're on the harder end to replace with something else if you were to ever want to retarget your workloads.

If you run an unindexed D1 query, then you get dinged for every row read. If you didn't properly perform scalability testing in non-production, then you'll never know this until you get a bill that you dissect to find out 5 million rows read for a 5 row result, if you even dig that far in the billing.

If you do not use the WebSocket Hibernation API with Durable Objects, then when you spin up a DO and hold open thousands of client WebSockets, you are being billed continuously for the entire time those connections are open—even if zero messages are being sent.

If you keep optimizing for payload size like many do by default but not event frequency (like poll a Worker every second instead of keeping a single stream open), it will show up unpleasantly in the billing.

If you treat KV like a transactional database keeping state, then be aware writes are expensive compared to reads. Pumping high-frequency write traffic into KV will result in exorbitant write operation costs and eventual consistency headaches. High-frequency state mutations belong in Durable Objects, not KV.

Batch your data to minimize request count, aggressively index your SQL queries to minimize row scans, and hibernate your idle persistent connections whenever you can. Doing all this will make your solutions cost efficient, but very locked into their ecosystem.

This is an extra wall in walled garden land; another one you will need to jump if you want to break free. Another stab at gatekeeping the upcoming Ai era of the internet. It's no different to the playbook of Google, Apple, and Facebook of the 00's. So, no, you're not paranoid.

In the terms of security: My firefox on FreeBSD instantly triggers endless loops of "prove your human" on their turnstile. I can't use old handhelds of android and a single VPN triggers all. Anything that they don't see as "secure" you're denied from.

What is stopping Cloudflare from deeming your LLM as unsafe?

Scenario: You're ready to launch, you come up with the next best innovation for the next generation of Ai internet. Revolutionary and you're about to launch, blast off; wait. You're denied your launch because it threatens their service. The former: they like your idea more-so and clone it to become theirs.

Stories of above have all been posted on HN before. Startups have been sabotaged by rug-pulling of cloud providers. It is early-vendor lock-in and at it's best. Google & Co would be jealous; if they were not in bed with.

This will turn in to a netting of: Your Ai isn't using our service, so your Ai isn't allowed to interact with ours.

What does Cloudflare offer as a service? A turnstile to the Internet of Things and the difference this time is that you get to self-host your own corner on their patch of land with their ticket prices and access policy of.

Remember folks, no corporation gives a rat's ass about you. Internally, or externally, you're just another sheep to extract wool from.

    This is not a traditional computer operating system. We use the term "operating system" in two senses:

    - An operating system for the company to be productive with AI, in a way that is safe, so that the security team can sleep at night.
    - An operating system for AI workloads, analogous to the sense in which a traditional operating system manages compute workloads.

Isn’t there even a bug tracker that some company calls an ‘issue OS’ or something absurd?

  - Pull information from external sources
  - Transform and/or augment that information
  - Publish information