[HN Gopher] Cloudflare claimed they implemented Matrix on Cloudf...
___________________________________________________________________
Cloudflare claimed they implemented Matrix on Cloudflare workers.
They didn't
Author : JadedBlueEyes
Score : 454 points
Date : 2026-01-27 15:45 UTC (7 hours ago)
(HTM) web link (tech.lgbt)
(TXT) w3m dump (tech.lgbt)
| rideontime wrote:
| Days after the fake story about Cursor building a web browser
| from scratch with GPT-5.2 was debunked. Disbelief should be the
| default reaction to stories like this.
| ronsor wrote:
| They did build a browser; it may not be a very compliant or
| complete browser, or even a useful one, but neither was IE6!
| nerdsniper wrote:
| I believe it was basically a broken, non-functioning wrapper
| around Servo internals. That's what I'd expect from a high
| schooler who says "i wrote a web browser", but not what I'd
| expect from a multi-billion dollar corporation.
| corvad wrote:
| They aren't really a multi-billion dollar corporation. A
| lot of it is them just pumping up their valuation. Stuff
| like this proves that in a lot of ways.
| NicoJuicy wrote:
| They are running > 300 DC's...
| corvad wrote:
| Talking about Cursor not Cloudflare.
| ptman wrote:
| They have equipment in > 300 locations. How much per
| location? More than a rack cabinet?
| unfunco wrote:
| They didn't build a browser from scratch.
| rideontime wrote:
| My understanding is that it doesn't even compile if you clone
| the repo.
| corvad wrote:
| It didn't and it had some pretty weird commit history and
| emails. Overall not a super great sign...
| simonw wrote:
| It does now. It didn't on initial announcement day.
| s1mplicissimus wrote:
| It didn't even compile, which makes me consider wether your
| comment is just ignorant or outright maliciously misleading
| simonw wrote:
| The version that was live on GitHub the day they published
| their blog post was missing compilation instructions,
| didn't cleanly compile and didn't pass GitHub Actions CI.
|
| The project itself _did_ compile most of the time it was
| being developed - the coding agents had been compiling it
| the whole time they were running on it.
|
| Shortly after the blog post they updated the GitHub repo
| with compilation instructions and it worked. I took this
| screenshot with it:
| https://static.simonwillison.net/static/2026/cursor-
| simonwil...
|
| The "it didn't even compile" criticism is valid in pointing
| out that they messed up the initial release, but if you
| think "it never compiled" you have an incorrect mental
| model.
| orwin wrote:
| Also, didn't it use Servo crates? I don't think you can
| say 'from scratch' if 60% of the actual work is from an
| external lib.
|
| If I install an Arch Linux, I don't say I 'installed
| Linux from scratch'.
| simonw wrote:
| It used cssparser and html5ever from the Servo project,
| and it used the Taffy library for flexbox and CSS grid
| layout algorithms which isn't officially part of Servo
| but is used by Servo.
|
| I'd estimate that's a lot less than 60% of the "actual
| work" though.
| orwin wrote:
| My bad, I was misinformed, thanks for correcting me, I
| thought it used the renderer, not just the parser. Thats
| honestly way better than what I thought.
| Vinnl wrote:
| I think it was mostly a joke about IE being horrible.
| embedding-shape wrote:
| Btw, after I wrote that initial article ("Cursor's latest
| "browser experiment" implied success without evidence"), I gave
| it my own try to write a browser from scratch with just one
| agent, using no 3rd party crates, only commonly available
| system libraries, and just made a Show HN about it:
| https://news.ycombinator.com/item?id=46779522
|
| The end result: Me and one agent (codex) managed to build
| something more or less the same as Cursor's "hundreds of
| agents" running for weeks and producing millions of lines of
| code, in just 20K LOC (this includes X11, macOS and Windows
| support). Has --headless, --screenshot, handles scaling, link
| clicking and scrolling, and can render basic websites mostly
| fine (like HN) and most others not so fine. Also included CI
| builds and automatic releases because why not.
|
| The repository itself is here and should run out of the box on
| most modern OSes, downloads can be found at the Releases page:
| https://github.com/embedding-shapes/one-agent-one-browser
| simonw wrote:
| This project is awesome - it really does render HTML+CSS
| effectively using 20,000 lines of dependency-free Rust
| (albeit using system libraries for image rendering and
| fonts).
|
| Here's a screenshot I took with it: https://bsky.app/profile/
| simonwillison.net/post/3mdg2oo6bms2...
| SOLAR_FIELDS wrote:
| 1 MB binary? That IS very impressive
| embedding-shape wrote:
| Releases are here: https://github.com/embedding-
| shapes/one-agent-one-browser/re... one-
| agent-one-browser-Linux-X64 1.14 MB one-agent-
| one-browser-macOS-ARM64 1.02 MB one-agent-one-
| browser-Windows-X64.exe 847 KB
|
| I wonder if I did a Wayland version it'd be bigger or
| smaller, right now only x11 (so via xWayland on Wayland).
| jacquesm wrote:
| That's fairly impressive.
| dwroberts wrote:
| Would be interested to know what people think of the locking
| implementation for the net worker pool.
|
| I'm no expert but it seems like a strange choice to me -
| using a mutex around an MPSC receiver, so whoever locks first
| gets to block until they get a message.
|
| Is that not introducing unnecessary contention? It wouldn't
| be that hard to just retain a sender for each worker and just
| round robin them
| comex wrote:
| I haven't looked at the code, but what you're describing
| doesn't sound that bad. If the queue is empty then it
| doesn't matter whether a worker is waiting on the lock or
| waiting on the receiver itself. If the queue is non-empty
| then whoever has the lock will soon complete the receive
| and release the lock. It would be better to just use an
| actual MPMC channel, but if the traffic on the queue isn't
| too high then it probably doesn't make a significant
| difference. With round robin in contrast, the sender would
| risk sending a job to a worker that was already busy,
| unless it took additional measures to avoid that.
| storystarling wrote:
| I suspect this is just an LLM hallucinating generic thread-
| safety boilerplate. In an async serverless runtime like
| Workers this pattern creates blocking risks and doesn't
| actually solve the distributed consistency problem.
| noosphr wrote:
| Yes, this is what Ai assisted coding is good at.
|
| A poc that would usually take a team of engineers weeks to
| make because of lack of cross disciplinary skills can now be
| done by one at the cost of long term tech debt because of
| lack of cross disciplinary knowledge.
| embedding-shape wrote:
| > Yes, this is what Ai assisted coding is good at.
|
| This is where I wish we spent more energy, figuring out
| better ways to work with the AI, rather than trying replace
| some parts wholesale with AI. Wrote a bunch more
| specifically about that, while I was watching the agent
| work on the browser itself, here: https://emsh.cat/good-
| taste/ (it's like a companion-piece I guess)
| tucnak wrote:
| Congratulations: you've single-handedly managed to humiliate
| a $29 bil. poster child for code-slop!
| embedding-shape wrote:
| Put out bad and sloppy stuff > receive humiliation, a trade
| I'm happy to help facilitate :)
| oefrha wrote:
| The outrageous part of this is nowhere in the blog post or the
| repository indicates it's vibe coded garbage (hopefully I
| didn't miss it?). You expect some level of bullshit in AI
| company's latest AI vibe coding announcements. This can be
| mistaken for a classical blog post.
|
| Although the tell is obvious if you spent one second looking at
| https://github.com/nkuntz1934/matrix-workers. That misaligned
| ASCII diagram, damn.
|
| Why is Cloudflare paying this guy again, just to vibe a bunch
| of garbage without even checking above the fold content in the
| README?
| embedding-shape wrote:
| > A production-grade Matrix homeserver implementation
|
| It's getting outright frustrating to deal with this.
|
| Fine, random hype-men gets hyped about stuff and tweets about
| it, doesn't mind me too much.
|
| Huge companies who used to have a lot of good will putting
| out stuff like this, seemingly with absolutely zero reviews
| before hitting publish? What are they doing? Have everyone
| decided to just give up and give in to the slop? We need
| "engineering" to make a comeback.
| Arathorn wrote:
| https://github.com/matrix-org/matrix-rust-
| sdk/blob/main/CONT... is an example of engineering trying
| to make a comeback, on the Matrix side at least :)
| embedding-shape wrote:
| As long as you take ownership, test your stuff and ensure
| it actually does what you claim it does, I don't mind if
| you use LLMs, a book or your dog.
|
| I'm mostly concerned that something we used to see as a
| part of basic "software engineering" (verify that what
| you build is actually doing what you think it is) has
| suddenly made a very quick exit from the scene, in chase
| of outputting more LOC which is completely backwards.
| oefrha wrote:
| I review every line of code I generate, and make sure I
| know enough that I can manually reproduce everything I
| commit if you take away the LLM assistant tomorrow.
|
| This is also what I ask our engineers to do, but it's
| getting hard to enforce.
| orwin wrote:
| That's the only way, but I even doing that I fear I loose
| some competency.
| heliumtera wrote:
| If you take ownership of the code you submit, them it
| does not matter if it was inspired by AI, you are
| responsible from now on and you will be criticized,
| possibly you will be expected to maintain as well.
|
| Vibing is incompatible with engineering and this practice
| is disgusting and NOT acceptable.
| PunchyHamster wrote:
| We found that reviewing AI code is bottleneck for
| performance so we stopped reviewing it
| rconti wrote:
| > Why is Cloudflare paying this guy again
|
| Perhaps usage of AI is a performance target he's being judged
| against, like at many tech companies today.
| bentcorner wrote:
| I get vibe coding a feature or news story or whatnot but how do
| you go about not even checking if the thing actually works, or
| fact checking the blog post?
| heliumtera wrote:
| Optics is the only thing that matters, there are people
| genuinely pushing for vibe coding on production systems.
| Actually, all of the big companies are doing this and
| claiming it is MORE safe because reduces human error.
|
| I'm starting to believe they are all right, actually. Maybe
| frontier models surpassed most humans, but the bar we should
| have for humans is really really low. I genuinely believe
| most people cannot distinguish llms capabilities from their
| own capabilities, and their are not wrong from the
| perspective they have.
|
| How could you perceive, out in the wild, an essence that
| scapes you?
| blks wrote:
| Army brain.
| blibble wrote:
| it seems as if literally everyone associated with "AI" is a
| grifter, shill (sorry, "Independent Researcher"), temporarily
| embarrassed billionaire, or just a flat out scammer
|
| I have yet to see a counter-example
| heliumtera wrote:
| Everyone (not really, but basically yes) associated with
| $current_thing is a rent seeking scammer.
|
| Even if Blockchain has tremendous impact, even if
| transformers are incredible (really) technology, even if NFTs
| could solve real world problems...you could basically say the
| same thing and be right, rounding up, 100% of the time, about
| anything technology related (and everything else as well).
| This truly is a clown world, but it is illegal to challenge
| it (or considered bad faith around here)
| PurpleRamen wrote:
| I would not rule out that sometimes they are just incompetent
| and believe their own story, because they just don't know it
| better. Seems this is called a "bad apple"?
| strange_quark wrote:
| I have a feeling that AI psychosis is more prevalent than we
| realize, especially in software.
| themafia wrote:
| It's clear that on Hacker News many people have made absurdly
| deep investments into this "technology." There's going to be a
| long period of pearl clutching we have to dig out of until we
| get back to the standard hacker ethic of not believing anything
| published by corporations.
| etchalon wrote:
| I've never thought someone should be fired based on a blog post
| but man, this comes real close.
| CharlesW wrote:
| This appears to be the author's first blog post for Cloudflare,
| Cloudflare being the author's first post-military employer. For
| his sake and Cloudflare's, this deserves an AAR that I hope
| becomes a teachable moment for both.
| corvad wrote:
| Honestly I like Cloudflare's CDN and DNS but beyond that I don't
| really trust much else from them. In the past though their blog
| has been one of the best in the space and the information has
| been pretty useful, almost being a gold standard for postmortems,
| but this seems especially bad. Definitely out of line compared to
| the rest of their posts. And with the recent Cursor debacle this
| doesn't help. I also don't really get their current obsession
| with porting every piece of software on Earth to Workers
| recently...
| hoppp wrote:
| Yeah, I like that I can just upload a static html and host it
| there for free, but anything more I dunno. Its all about vendor
| lock-in with their products.
| corvad wrote:
| I essentially just use them for this and domain DNS/Registrar
| as their pricing is pretty good for that.
| stackskipton wrote:
| >I also don't really get their current obsession with porting
| every piece of software on Earth to Workers recently...
|
| Because their CDN/DNS is excellent software but it's not
| massive moat. Workers on other hand is.
|
| It's like difference between running something on Kubernetes vs
| Lambdas. One you can somewhat pivot with between vendors vs
| other one requires massive rewrites to software that means most
| executives won't transition away from it due to high potential
| for failure.
| palata wrote:
| I guess it depends on the author. Seems like it is the first
| post for this author, and given the reception, maybe the last
| one...
| TehShrike wrote:
| I found the source code Jade was referring to, and it looks like
| the author just noticed this thread:
| https://github.com/nkuntz1934/matrix-workers/commit/0823b47c...
| corvad wrote:
| That honestly makes everything so much worse.
| rideontime wrote:
| Your commit is orphaned now; it seems he amended the log to a
| vague "Clean up code comments" to try to make the purpose less
| obvious: https://github.com/nkuntz1934/matrix-
| workers/commit/2d3969dd...
| etyhhgfff wrote:
| I wouldnt judge if he were to come clean and admit his AI
| slop. Instead he just makes it worse.
| whizzter wrote:
| UUUGH, so basically authentication is missing AND the
| comments that actually marked what needed fixing.
|
| Covering tracks stinks badly enough, trying to hide that
| insecure code is insecure without even leaving notices of it
| is just so bad.
| renyicircle wrote:
| New damage control commit just came in, removing "production
| grade" from README, mentioning AI assistance, and fixing the
| misaligned ASCII diagram. https://github.com/nkuntz1934/matrix-
| workers/commit/fd412f41...
|
| Should have just nuked the whole thing to be honest, the blog
| post and the repo.
| usefulposter wrote:
| Agreed. And the diagrams still lack substance, IMO.
|
| Previously someone might sketch out a purposeful one in
| Monodraw or something (https://monodraw.helftone.com). But
| only when it adds value.
|
| Now Claude shits out this vacuous nonsense by the bucketload
| ------but it's some interconnected boxes in a code block in a
| readme, so it must be good.
| augusteo wrote:
| Technical blogs from infrastructure companies used to serve two
| purposes: demonstrate expertise and build trust. When the posts
| start overpromising, you lose both.
|
| I don't know enough about this specific implementation to say
| whether "implemented Matrix" is accurate or marketing stretch.
| But the pattern of "we did X" blog posts that turn out to be "we
| did a demo of part of X" is getting tiresome across the industry.
|
| The fix is boring: just be precise about what you built. "We
| prototyped a Matrix homeserver on Workers with these limitations"
| is less exciting but doesn't erode trust.
| palata wrote:
| To be fair, the technical posts from Cloudflare are usually
| _very insightful_.
| direwolf20 wrote:
| That's demonstrating expertise
| Spunkie wrote:
| Yeah normally the CF blog ranks as one of the best in the
| world in my book, so a post of lower quality and potentially
| AI slop really stands out here.
|
| That said I think the concept of a full matrix server running
| all on CF infrastructure/services is an awesome blog post
| from CF.
|
| Honestly I wish CF would simply unpublish/retract this blog
| post, put another engineer on it to help the PM, and spend
| another couple of weeks polishing the post/code to republish
| the same blog post.
| Signez wrote:
| Even acknowledging that blunder and the lost of trust that
| could have followed for such sloppy work would be a
| minimum.
|
| I am quite shocked by such lack of care, and it does
| tarnish the reputation of Cloudflare in my eyes :/
| oasisbob wrote:
| Usually. Previously.
|
| I raised this point on a previous Cloudflare blog post -
| they've turned quite vapid these days. If you pay attention,
| they're stuffed to the brim with generated text which is
| sloppy and under-opinionated on the audience for the writing
| in the first place.
| ethin wrote:
| They can't do that though. If they did, it would make the
| shareholders and CEOs mad because it would demonstrate that
| LLMs cannot (yet) deliver on all the promises these CEOs have
| been claiming for this entire time.
| biohazard2 wrote:
| The developer just "cleaned up the code comments", i.e. they
| removed all TODOs from the code:
| https://github.com/nkuntz1934/matrix-workers/commit/2d3969dd...
|
| Professionalism at its finest!
| esnard wrote:
| No more vulnerabilities then I guess!
| bob1029 wrote:
| I also use this as a simple heuristic:
|
| https://github.com/nkuntz1934/matrix-workers/commits/main/
|
| There exist only two commits. I've never seen a "real" project
| that looks like this.
| biohazard2 wrote:
| The repository is less than one week old though; having only
| the initial commit wouldn't shock me right away.
| jstanley wrote:
| But if the initial commit contains the finished project
| then that suggests that either it was developed without
| version control, or that the history has deliberately been
| hidden.
| btown wrote:
| It was/is quite common for corporate projects that become
| open-source to be born as part of an internal
| repository/monorepo, and when the decision is made to
| make them open-source, the initial open source commit is
| just a dump of the files in a snapshotted public-ready
| state, rather than tracking the internal-repo history
| (which, even with tooling to rebase partial history,
| would be immensely harder to audit that internal
| information wasn't improperly released).
|
| So I wouldn't use the single-commit as a signal
| indicating AI-generated code. In this case, there are
| plenty of other signals that this was AI-generated code
| :)
| cortesoft wrote:
| That is totally fine... as long as you don't call it
| 'production grade'. I wouldn't call anything production
| grade that hasn't actually spent time (more than a week!)
| in actual production.
| victorbjorklund wrote:
| To be honest sometimes on my hobby project I don't commit
| anything in the beginning (I know not great strategy) and
| then just dump everything in one large commit.
| masklinn wrote:
| I've also been guilty of plugging at something, and
| squashing it all before publishing for the first time
| because I look at the log and I go "no way I can release
| this, or untangle it into any sort of usefulness".
| InsideOutSanta wrote:
| I think that's a reasonable heuristic, but I have projects
| where I primarily commit to an internal Gitea instance, and
| then sometimes commit to a public GitHub repo. I don't want
| people to see me stumbling around in my own code until I
| think it's somewhat clean.
| ectospheno wrote:
| I have a similar process. Internal repo where work gets
| done. External repo that only gets each release.
| Hamuko wrote:
| I might just make dummy commits ("asdadasdassadas") in the
| prototyping phase and then just squash everything to an
| "Initial commit" afterwards.
| oefrha wrote:
| Oh wow I'm at a loss for words.
|
| To the author: see my comment at
| https://news.ycombinator.com/item?id=46782174, please also
| clean up that misaligned ASCII diagram at the top of the
| README, it's a dead tell.
| corvad wrote:
| Yeah deleting the TODOs like that is honestly a worse look.
| jtbaker wrote:
| Incoming force push to rewrite the history . Git doesn't lie!
| corvad wrote:
| I wouldn't put it past them...
| fermuch wrote:
| I wouldn't put it in past tense...
| rideontime wrote:
| Hilarious. Judging by the username, it's the same person who
| wrote the slop blog post, too.
| corvad wrote:
| Wow this is definitely not a software engineer. Hmm I wonder if
| Git stores history...
| usefulposter wrote:
| Reminds me of Cloudflare's OAuth library for Workers.
|
| >Claude's output was thoroughly reviewed by Cloudflare
| engineers with careful attention paid to security
|
| >To emphasize, this is not "vibe coded".
|
| >Every line was thoroughly reviewed and cross-referenced with
| relevant RFCs, by security experts with previous experience
| with those RFCs.
|
| ...Some time later...
|
| https://github.com/advisories/GHSA-4pc9-x2fx-p7vj
| PUSH_AX wrote:
| What is the learning here? There were humans involved in
| every step.
|
| Things built with security in mind are not invulnerable,
| human written or otherwise.
| kvdveer wrote:
| This is especially true if the marketing team claims that
| humans were validating every step, but the actual humans
| did not exist or did no such thing.
|
| If a marketer claims something, it is safe to assume the
| claim is at best 'technically true'. Only if an actual
| engineer backs the claim it can start to mean something.
| btown wrote:
| Taking a best-faith approach here, I think it's indicative
| of a broader issue, which is that code reviewers can easily
| get "tunnel vision" where the focus shifts to reviewing
| each line of code, rather than necessarily cross-
| referencing against both small details and highly-salient
| "gotchas" of the specification/story/RFC, and ensuring that
| those details are not _missing_ from the code.
|
| This applies whether the code is written is by a human or
| AI, and also whether the code is reviewed by a human or AI.
|
| Is a Github Copilot auto-reviewer going to click two levels
| deep into the Slack links that are provided as a motivating
| reference in the user story that led to the PR that's being
| reviewed? Or read relevant RFCs? (And does it even have
| permission to do all this?)
|
| And would you even do this, as the code reviewer? Or will
| you just make sure the code makes sense, is maintainable,
| and doesn't break the architecture?
|
| This all leads to a conclusion that software engineering
| isn't getting replaced by AI any time soon. Someone needs
| to be there to figure out what context is relevant when
| things go wrong, because they inevitably will.
| parliament32 wrote:
| The learning is "they lied". After all, apart from
| marketing materials making a claim, where is the evidence?
| PUSH_AX wrote:
| Wait, we think they're lying because an advisory was
| eventually found? We think that should be impossible with
| people involved?
| huimang wrote:
| To me it's likely, given the extremely rudimentary nature
| of that issue.
| parliament32 wrote:
| If you're asking in good faith,
|
| > Every line was thoroughly reviewed and cross-referenced
| with relevant RFCs
|
| The issue in the CVE comes from direct contradiction of
| the RFC. The RFC says you MUST check redirect uris (and,
| as anyone who's ever worked with oauth knows, all the
| functionality around redirect uris is a staple of how
| oauth works in the first place -- this isn't some obscure
| edge case). They didn't make a mistake, they simply did
| not implement this part of the spec.
|
| When they said every line was "thoroughly reviewed" and
| "cross referenced", yes, they lied.
| sally_glance wrote:
| I mean, you can't review or cross reference something
| that isn't there... So interpreting in good faith,
| technically, maybe they just forgot to also check for
| completeness? /s
| usefulposter wrote:
| Reading the necessary RFC is table stakes. Instead we got
| this:
|
| >"NOOOOOOOO!!!! You can't just use an LLM to write an
| auth library!"
|
| >"haha gpus go brrr"
|
| (Those lines remain in the readme, even now:
| https://github.com/cloudflare/workers-oauth-
| provider?tab=rea...)
| blibble wrote:
| the problem with "AI" is that by the very way it was
| trained: it produces plausible looking code
|
| so the "reviewing" process will be looking for the needles
| in the haystack
|
| when you have no understanding, or mental model of how it
| works, because there isn't one
|
| it's a recipe for disaster for anything other than trivial
| projects
| godelski wrote:
| Here's the post on LinkedIn
|
| https://www.linkedin.com/posts/nick-kuntz-61551869_building-...
| tamnd wrote:
| https://www.linkedin.com/in/nick-kuntz-61551869/
|
| DevSecOps Engineer United States Army Special Operations
| Command * Full-time
|
| Jun 2022 - Jul 2025 * 3 yrs 2 mos
|
| Honestly, it is a little scary to see someone with a serious
| DevSecOps background ship an AI project that looks this
| sloppy and unreviewed. It makes you question how much rigor
| and code quality made it into their earlier "mission
| critical" engineering work.
| alex_sf wrote:
| Tbf, there is no one with a 'serious DevSecOps background'.
| It's an incredibly strong hint that the person is largely a
| goof.
| esseph wrote:
| Maybe, but the group of people they are/were working with
| are Extremely Serious, and Not Goofs.
|
| This person was in communications of the 160th Special
| Operations Aviation Regiment, the group that just flew
| helicopters into Venezuela. ... And it looks like a very
| unusual connection to Delta Force.
| BoredPositron wrote:
| I don't know what's more embarrassing the deed itself, not
| recognizing the bullshit produced or the hastly attempt of a
| cover up. Not a good look for Cloudflare does nobody read the
| content they put out? You can just pretend to have done
| something and they will release it on their blog, yikes.
| guluarte wrote:
| they should have at least rebased it and removed from git
| history
| InsideOutSanta wrote:
| LLMs made them twice as efficient: with just one release,
| they're burning tokens _and_ their reputation.
|
| It's kinda mindblowing. What even is the purpose of this? It's
| not like this is some post on the vibecoding subreddit, this is
| fricken Cloudflare. Like... What the hell is going on in there?
| armchairhacker wrote:
| It's not a _working_ or _complete_ implementation, but...
| palata wrote:
| Well that is an interesting idea and proof of concept. I agree
| that the post is not the best I have seen from Cloudflare, and
| it shouldn't suggest that the code is production ready, but it
| is an interesting use-case.
| drrotmos wrote:
| But according to the README, it _is_ production grade!
| Presumably "production" in this case is an isolated proof of
| concept?
| dfajgljsldkjag wrote:
| It is worrying to see a major vendor release code that does not
| actually work just to sell a new product. When companies pretend
| that complex engineering is easy it makes it very hard for the
| rest of us to explain why building safe software takes time. This
| kind of behavior erodes the trust that we place in their
| platform.
| godelski wrote:
| The real concern is that we've been doing this race to the
| bottom for so long that it's becoming almost trivial to explain
| why they are wrong. This over simplification has existed before
| AI coding and it's the dream AI coding took advantage of. But
| this market of lemons got too greedy
| Fokamul wrote:
| nkuntz1934 Senior Engineering TPM @ Cloudflare
|
| Of course, this is done by a manager. Classic corporate mindset,
| I can do what these smelly nerds do every day, hold my bear.
|
| He doesn't even know how git works, huh?
|
| What a clown.
| OsrsNeedsf2P wrote:
| TPM isn't manager. It's basically a PM, but they're (supposed)
| to be technical
| SahAssar wrote:
| Does TPM not mean Technical Program Manager or Technical
| Product Manager?
| luckylion wrote:
| Probably, but that isn't a management role, they're not a
| manager, even if the job title includes the word manager.
| asadotzler wrote:
| Product Managers are generally not "Senior Engineering,"
| though I suppose it is possible. IMO, it's a whole lot more
| likely a _program_ manager than a _product_ manager.
| asadotzler wrote:
| My guess, a program manager high up in the engineering org
| and not a people manager. But suggesting a high up program
| manager doesn't direct people is also wrong. TPMs "make the
| wheels go 'round" in engineering. They very much control the
| fate of other individual, and often whole teams so their
| integrity and capability both matter considerably which means
| they should not be passing themselves off as a coder or their
| individual code projects as production ready.
| selfawareMammal wrote:
| Embarrassing, coming from a company like Cloudfare
| guluarte wrote:
| everybody is vibing everything now, code, messages, reviews,
| everything
| Imustaskforhelp wrote:
| Um what's up with companies trying to recreate really big
| projects using vibe coding.
|
| Like okay, I am an indie-dev if I create a vibe coded project, I
| create it for fun (I burn VC money of other people doing so tho
| but I would consider it actually positive)
|
| But what's up with large companies who can actually freaking
| sponsor a human to do work make use of AI agents vibe code.
|
| First it was cursor who spent almost 3-5 million$ (Just came here
| after watching a good yt video about it) and now Cloudflare.
|
| Like, large corpos, if you are so much interested in burning
| money, atleast burn it on something new (perhaps its a good
| critique of the browser thing by Cursor but yeah)
|
| I am recently in touch with a person from UK (who sadly got
| disabled due to an accident when he was young) guy who is a VPS
| provider who got really impacted by WHMCS increase in bill and He
| migrated to 1200 euros hostbill. Show him some HN love
| (https://xhosts.uk/)
|
| I had vibe coded a golang alternative. Currently running it in
| background to create it better for his use cases and probably
| gonna open source it.
|
| The thing with WHMCS alternatives are is that I made one using
| gvisor+tmate but most should/have to build on top of KVM/QEMU
| directly. I do feel that WHMCS is definitely one of the most rent
| seeking project and actually writing a golang alternative of it
| feels sense (atleast to me)
|
| Can there not be an AI agent which can freaking detect what
| people are being charged for _(unfairly)_ online & these large
| companies who want to build things can create open source
| alternatives of it.
|
| I mean I am not saying that it stops being slop but it just feels
| a good way of making use of this tech aside from creating
| complete spaggeti slop nobody wants, I mean maybe it was an
| experiment but now it got failed (Cursor and this)
|
| A bit ironic because I contacted the xhosts.uk provider because I
| wanted to create a cloudflare tunnels alternative after seeing
| 12% of internet casually going through cf & I saw myself being
| very heavily reliant on it for my projects & I wasn't really
| happy about my reliance on cf tunnels ig
| tsujamin wrote:
| That the original post to HN linked in the blog was done on a
| throwaway kind of implies a level of awareness (on the part of
| the dev) that the code/claims were rubbish :)
|
| https://news.ycombinator.com/item?id=46780837
| OsrsNeedsf2P wrote:
| Not to mention they commented on their own post, pretending to
| ask a question..
| huckery wrote:
| Bloody hell that's embarrassing, for both Cloudflare and the blog
| author. Did he not have anyone review it before publishing?
|
| So many failures coming out of Cloudflare these days, feels like
| they peaked a while ago and are slowly declining into
| incompetence.
| blibble wrote:
| > So many failures coming out of Cloudflare these days
|
| I wonder if there's a particular new fad that could be causing
| this
| orthecreedence wrote:
| Hubris?
| erichocean wrote:
| In 2026, you should be implementing MLS instead of Matrix.
| soulofmischief wrote:
| "This architecture shifts the paradigm for self-hosting. It turns
| "running a server" from a chore into a utility. You get the
| sovereignty of owning your data without the burden of owning the
| infrastructure"
|
| Yeah, this is just shameful. Obviously written by an LLM with
| zero oversight. If this engineer doesn't get fired I'll lose all
| trust in Cloudflare.
| sva_ wrote:
| Ahh, so that is what "shipping at the speed of inference" means
| arthurcolle wrote:
| Did they really vibe code a partial implementation and blog about
| it?
|
| That's one way to destroy the CF blog credibility!
| renyicircle wrote:
| I'd love to see a root cause analysis post by Cloudflare for this
| one. The ones they do after outages are always interesting to
| read. How did this make it into the blog? What is the review
| process for these posts and what failed this time? What measures
| will be taken to restore Cloudflare blog's reputation?
| ampersandy wrote:
| My charitable read on this is that an individual vibe-coded both
| the post and repository and was able to publish to the Cloudflare
| blog without it actually being reviewed or vetted. They also are
| not an engineer and when the agent hallucinated "I have built and
| tested this and it is production grade," they took it at face
| value.
|
| You can tell since the code is in a public repository and not
| Cloudflare's, which IMO is the big giveaway that this is a lesson
| for Cloudflare in having appropriate review processes for public
| comms and for the individual to avoid making claims they cannot
| substantiate or verify independently.
| jsnell wrote:
| I agree, but it's probably not just about being "able to" do
| it, but about what the incentives and pressures are in that
| organization.
|
| Cloudflare apparently considers blog posts to be a key
| deliverable for many roles. Not just marketing or devrel but
| engineering too. That sets up a lot of incentives for slop. And
| then all you need for a disaster is a high trust environment
| with insufficient controls, which they probably have since the
| process had worked for a decade without an insufficiently
| reviewed article blowing up in their face.
|
| Going forward there will be just a little bit less trust, more
| controls, and more friction that will make it harder to get a
| post out in a timely manner. It's just the way all
| organizations evolve. You can see from the scar tissue where
| problems existed in the past.
|
| What I can't believe is that they haven't retracted the whole
| post by now, but are allowing the author to make an even bigger
| mess trying to fix the initial problems.
| themafia wrote:
| This person works for Cloudflare. What else are they "vibe
| coding?" How long until Cloudflare shuts off half the internet
| due to a "mistake" again? How much longer are we going to
| accept that these are mistakes?
| lazystar wrote:
| > How much longer are we going to accept that these are
| mistakes?
|
| How much longer are shareholders** going to accept that these
| are mistakes?
| themafia wrote:
| The problem is this analysis and the mindset of a
| shareholder are about as far apart as you can get. The
| market likes to pretend it is "sophisticated and
| knowledgeable." It's a slot machine and as long as the
| handle pullers smell money in the machine they're going to
| sit there and pull.
| amalcon wrote:
| I've always found it interesting that these tech infra
| companies' stock tends to rise in the immediate aftermath
| of these outages. My best guess is that people see the
| effect of the outage and say "Hey, this company I've never
| heard of sure seems to have a lot of customers!"
|
| To be fair I've benefited from that in the past; this is an
| observation of my own that doesn't represent the views of
| any of my current or former employers.
| babelfish wrote:
| I have heard that Cloudflare leadership (CEO/CTO) review every
| single blog post personally.
| slekker wrote:
| I doubt they checked the code though
| arctictony wrote:
| Claudflare?
| ares623 wrote:
| Fraudfare
| ncruces wrote:
| So the original post had this added to the top:
|
| > _This post was updated at 11:15 a.m. Pacific time to clarify
| that the use case described here is a proof of concept. Some
| sections have been updated for clarity._
|
| But then the bottom still says:
|
| > _Our team is using Matrix on Workers, handling real encrypted
| communications. It is fast, it is cheap, and it is arguably one
| of the most secure ways to deploy a homeserver today._
|
| Which one is it?
| philipwhiuk wrote:
| I guess they're dogfooding something that's wildly insecure and
| incomplete internally. Kind of surprising that's allowed on
| CloudFlare's internal network if true, but I guess shadow-IT is
| everywhere.
| corvad wrote:
| I don't believe "Our team is using Matrix on Workers." The repo
| is in someone's personal Github and a pretty incomplete and
| insecure implementation.
| ncruces wrote:
| Edited again at 11:45 to remove that as well. Now reads:
|
| > _I have been experimenting with the implementation and am
| excited for any contributions from others interested in this
| kind of service._
|
| A few of the versions of the blog are available at:
| https://archive.ph/https://blog.cloudflare.com/serverless-ma...
| corvad wrote:
| Blog post now says: "* This post was updated at 11:15 a.m.
| Pacific time to clarify that the use case described here is a
| proof of concept. Some sections have been updated for clarity."
| But parts of it are still misleading.
| catskull wrote:
| I hope this isn't in bad taste, but I applied for the editor-in-
| chief position at Cloudflare back in August when they had it
| open. I'm still very interested in the role. If anyone at cf is
| reading this, my email is bro @ website in bio.
| nkalupahana wrote:
| Not the first time Cloudflare has done this. Click around some of
| the docs for Realtime SFU, it's all AI slop. Hard to tell if
| anything is hallucinated or not.
| https://developers.cloudflare.com/realtime/sfu/sessions-trac...
| tamirzb wrote:
| Since cloudflare are busy editing this blog post to say something
| completely different from what it originally said, I feel that
| this archive link is relevant
|
| https://archive.ph/AbxU5
| qqvga wrote:
| Hah. The coward even deleted the telltale "not just X; Y" LLM
| dead-giveaway line from the blog, after someone vomit emoji
| quoted it in the mastodon thread.
| watermelon0 wrote:
| > Traditionally, operating a Matrix homeserver has meant
| accepting a heavy operational burden. You aren't just installing
| software; you are becoming a system administrator. You have to
| provision virtual private servers (VPS), tune PostgreSQL for
| heavy write loads, manage Redis for caching, configure reverse
| proxies, and handle rotation for TLS certificates. It's a
| stateful, heavy beast that demands to be fed time and money,
| whether you are sending one message a day or one million.
|
| I have limited experience with Matrix, but you don't actually
| need Synapse (reference homeserver) which is quite a resource hog
| and not even remotely easy to setup/administer.
|
| You can just use the lightweight Continuwuity homeserver for the
| Matrix part, and Caddy for the reverse proxy/TLS/ACME part,
| installed on a VPS. Both require minimal configuration, and
| provide packages for many Linux distributions, as well as Docker
| images.
|
| _(Continuwuity is a fork of conduwuit which was a fork of
| Conduit. Conduit was abandoned, but is now active again, and
| there are also other active forks as well. However, it seems to
| me that Continuwuity is currently the most active fork.)_
___________________________________________________________________
(page generated 2026-01-27 23:01 UTC)