kentonv
V8 isolates seem "worse" on their face (e.g. mostly incompatible with non-JS apps, more difficult to secure), while aiming down-market. The hyperscalers' biggest existing customers aren't asking for them; they are asking for more and better micro VMs to run their existing codebases. It's only the little guys looking to deploy greenfield apps with low ops overhead and on a tight budget that really appreciate the Workers model, and to AWS these seem like small potatoes. Meanwhile there's a huge amount of investment needed to build out this entirely new and different way of doing things (we've been working on it almost a decade now!). In the worst case, this investment is wasted, and in the best case, cannibalizes the existing product line.
There likely many people at AWS who recognize the dilemma, but still cannot push the organization in the right direction. Too much inertia, too many stakeholders who don't get it, because it's unintuitive. When orgs get big they just cannot take disruptive steps, even when they were built on disruption in the past. They only finally come around after the new disruptor is eating their lunch, but by then it's too late.
Obviously it was a blog post about business strategy and not technical architecture.
But I sort of thought the direct argument for open source and against lock-in as a business strategy would please the technical audience.
My role hasn't changed. I have always been simultaneously writing code, designing technical architecture, and also influencing product/business strategy. This particular piece of strategy is one I advocated and won support for, which is why I wrote the post.
(But I admittedly have not actually asked Ryan if he had long-term plans to add a multi-tenant scheduler so maybe I'm wrong.)
My best guess is that you are suggesting that we should open source our multi-tenant hosting technology, along with workerd.
But this doesn't make sense. No popular JavaScript runtime includes multi-tenant hosting technology. Multi-tenant hosting is the responsibility of the hosting provider. workerd is compatible with other providers' multi-tenant hosting approaches. You do not need our specific technology in order to run Workers apps on other hosting providers, and in fact would not even be particularly useful for that purpose.
My best guess is you're talking about sandboxing, specifically how we defend ourselves against malicious tenants. Indeed, a lot of how we defend against that is not in workerd, and fundamentally can't be, because it's more than just some code, it's a process requiring active management.
However, you only need that if you have untrusted tenants.
If you are using workerd to self-host your own applications on non-Cloudflare infrastructure, then this isn't a concern for you. You don't have untrusted tenants.
If you are hosting untrusted tenants, then you can put workerd in a micro VM, the same as you'd do with any other popular runtime.
Details remain to be worked out, but part of the goal of the project is to make all these interfaces plugable with reference implementations that can sit on common infrastructure.
In fact, celld has already done a lot of this.
> Ok, this peaked my curiosity. Would be great if you could share it!
You'll have to find me in person over drinks somehow. ;)
No, workerd and its semantics are not exclusive to Cloudflare infrastructure. People really do run it in production without using Cloudflare at all (I really wish I was allowed to say who because one of the users is hilariously ironic...).
Ryan's and Bert's core focus at Cloudflare is going to be making the self-hosting story better.
This was emphasized in the blog post: https://blog.cloudflare.com/deno-joins-cloudflare/
I understand why it looks that way, and we knew it would be hard to combat this perception.
But it's simply not true.
The actual story is simply this: The Deno team made a strategic decision to refocus on celld, and we (Cloudflare) are excited to support this work, for the reasons I explained in the blog post: https://blog.cloudflare.com/deno-joins-cloudflare/
See Ryan's own comment here: https://news.ycombinator.com/item?id=50023277
Also another blog post from when the feature became generally available: https://blog.cloudflare.com/dynamic-workers/
I agree it would be an awkward choice for an agent that runs as a local application, but the trend I think is towards agents running more and more on servers.
https://blog.cloudflare.com/deno-joins-cloudflare/
TL;DR: Ryan and co. will be merging celld with workerd to create one first-class open source self-hostable runtime for Workers and Durable Objects. In the post I explain in the post why, contrary to what you might think, this is good business for Cloudflare and we're very excited about it.
At some point you have to decide where along the spectrum you want to put the boundary of "acceptable" for your workload.
Some people argue that isolates are below the necessary threshold and micro VMs are above it. But this isn't really based on any rigorous mathematical analysis, it's mostly vibes. It used to be that people said VMs weren't secure enough for critical workloads, but few people say that these days.
I would argue that we (Cloudflare) have demonstrated that the isolate model can work fine if done carefully: we've been doing it this way for nearly a decade with no breaches.
* Not "strictly riskier", though. There are some risks micro VMs have that V8 isolates do not. Micro VMs that allow tenants to run arbitrary x86 code place a huge amount of trust in the hardware to be exactly correct; a trusted JIT makes it much easier to work around hardware bugs when they are found.
It dates back to when Workers only supported 50ms CPU time limits. Back then 100k iterations was enough to exceed the 50ms budget.
Now that the limit is 5 minutes this is pretty silly, but since PBKDF2 is considered obsolete and not often used in new code, I guess fixing it never really came up.
I would accept a PR to increase the constant to 1M, or higher with a good argument (but most recommendations I see for iteration count are <1M). Constant defined here:
https://github.com/cloudflare/workerd/blob/main/src/workerd/...
That said, sure, I have certainly entertained the idea of retiring and working on open source, particularly on days when work is frustrating or overwhelming.
But if the goal is "recreate Sandstorm", I do believe my current work on Cloudflare OS[0] is much more likely to succeed at that than anything I could reasonably accomplish independently.
More broadly, at the moment it feels like my position at Cloudflare puts me in the middle of something really important. There isn't anywhere else where I would have more influence over the AI revolution.
It's a perfectly valid opinion but not any kind of secret.
I forwarded this to the right person, and it sounds like it's being worked on. Thanks!
And they, apparently, won't do anything about it.
A couple months ago I went searching for the book "Regime Change" by Maggie Haberman and Jonathan Swan, an NYT bestseller. The top search result at the time used the exact official cover art and author names, and was otherwise in every way indistinguishable from the real book.
I foolishly bought it and started reading. I quickly noticed that the text seemed like more of a mediocre college paper than a bestselling book. After a few pages I was like... wtf is this. Jumped to the end of the book and found an "Abort the author" section naming a fellow named Marcus Whitfield as the author.
I dutifully opened a ticket with Google suggesting that they should really remove this book. They refunded me, but told me they couldn't remove the book because their policy states that only the true copyright holder could request a take down, and I am not that.
WTF? I wasn't even claiming a copyright issue. I was claiming false advertising and fraud. I was claiming that Google Play's store was listing an obviously, maliciously fake book, selling it for real money, and that they should stop doing that. They take a 30% cut! How are they not doing even the most basic vetting of these listings? A human could trivially identify it as fake in 30 seconds and an AI even faster.
It appears that since then, the actual real book has risen to #1 in the search results (I think; it's hard to tell), and the exact listing that got me is gone, but there are still a whole lot of obvious fakes after it:
https://play.google.com/store/search?q=%22regime%20change%22...
And if you search for any other popular book, you get the same thing.
(Of course, no real publisher actually cares about Google Play Books, because nobody uses it, so nobody files takedown requests, presumably. Also presumably no engineers work on it, and that's why it's a wasteland. What I don't get is why haven't they shut it down?)
"Pacing the frontier" sounds like something that was carefully wordsmithed in committee, to avoid terms like "slow-down" or "pause" that sound much more negative. They probably did ask an LLM to generate a list of options, because why wouldn't you? But the rest of the writing is almost certainly just Dario.