Kenton Varda Profile
Kenton Varda

@KentonVarda

8,201
Followers
224
Following
233
Media
4,856
Statuses

Tech lead for @Cloudflare Workers, former Protobuf guy, author of and Cap'n Proto, builds LAN-party optimized houses ()

Austin, TX
Joined November 2008
Don't wanna be here? Send us removal request.
Pinned Tweet
@KentonVarda
Kenton Varda
5 months
Folks, I did it again. I made another RPC system. I know, it's a problem. But bear with me! I think this is the best possible JavaScript RPC. It has all the power of Cap'n Proto with no need to write schemas. There is almost no boilerplate at all.
39
78
630
@KentonVarda
Kenton Varda
9 months
Europe: We are banning egress fees. Google:
Tweet media one
38
723
10K
@KentonVarda
Kenton Varda
4 years
Jesus Christ @zoom_us , you've apparently let a whole school in Chile sign up for a paid account using my e-mail address, because you never verified it. I went to create my own account, it said I had one, so I "forgot password", and now I own this school's admin account.
110
1K
5K
@KentonVarda
Kenton Varda
4 years
Reminder that Judge William Haskell Alsup, who first heard Oracle v. Google, actually LEARNED JAVA in order to make an informed ruling, while these higher-court jokers are relying on analogies to Harry Potter and grocery stores.
27
417
2K
@KentonVarda
Kenton Varda
2 years
Wow. This SanDisk SSD model fails at 40,000 hours exactly. Primary and backup servers each had RAID-1 and they all failed at the same time. When setting up a RAID-1 mirror, always try to pair two SSDs from entirely different chipset makers.
@girlhacker
Lilly Tao
2 years
My husband correctly guessed what caused today's Hacker News failure. He'd experienced it before.
32
359
3K
21
250
1K
@KentonVarda
Kenton Varda
9 months
@joseph_h_garvin Yeah I don't actually think they were trying to get around the ban, I just think the timing is funny.
3
4
1K
@KentonVarda
Kenton Varda
3 months
TIL Swedish time format is exactly the ideal time format, that is, "YYYY-MM-DD HH:MM:SS". In JavaScript, you can do `date.toLocaleString("sv")` to format this way. I wonder if it's safe to assume this will never change...
41
31
936
@KentonVarda
Kenton Varda
4 years
The problem is that my e-mail address is temporal at gmail. It was my teenage gamer tag. I need to change it. But it turns out "temporal" means "temporary" in Spanish. So Spanish-speaking people all over use it as a placeholder address!
13
57
607
@KentonVarda
Kenton Varda
4 years
Apparently, 44 of 50 Republican senators would vote that the sky is red of they thought it would benefit them politically.
13
74
520
@KentonVarda
Kenton Varda
4 years
@zoom_us 89 users, 19 licensed, 44 active. 190 meetings since the account was created a little over a month ago. I have all their names, e-mail addresses, activity logs...
2
32
456
@KentonVarda
Kenton Varda
3 years
Back in the mid-2000's I was working on a core internal protocol used in Google search back-end for transmitting search results, and we had a place in the protocol where any team could add their own extra data about a result. I named this place "stuff".
9
42
423
@KentonVarda
Kenton Varda
1 year
We are approaching the Google UI design solstice. All the corners are approaching peak roundness. Then over several years they will become more square again, until the cycle starts anew. Watch for the buttons that achieve full pill shape, they won't be here long.
11
65
415
@KentonVarda
Kenton Varda
5 months
This is a big deal: possibly the first true edge-optimized Python runtime. It's based on the CPython interpreter (the one most people use), but multiple applications can share the same copy of the interpreter securely. How? The key is Wasm dynamic linking.
@irvinebroque
Brendan Irvine-Broque
5 months
Introducing Python Workers
10
101
603
14
64
409
@KentonVarda
Kenton Varda
2 years
This is a product I'm really excited about! I like to call it Functions as a Service as a Service. It allows any SaaS service to make itself programmable. It's a bit tricky to understand so let me explain with some examples.
23
78
407
@KentonVarda
Kenton Varda
4 years
Why? Probably because "it hurts conversions" and "it's the user's fault if they signed up with someone else's address; no one else is harmed." This needs to change, so I take every opportunity to complain loudly.
7
29
364
@KentonVarda
Kenton Varda
4 years
I'm apparently not even allowed to delete my account because I "belong" to this organization! I'm apparently not the owner, just an admin, but I cannot remove myself!
3
15
357
@KentonVarda
Kenton Varda
4 years
Meanwhile because I used Google login, Zoom has merged my personal details from my Google account into this account.
2
21
352
@KentonVarda
Kenton Varda
6 years
After I open sourced Protocol Buffers, the promo committee denied me for promotion (from Senior to Staff) because my packet contained no peer reviews from more-senior engineers who worked closely with me. (There were no such engineers.)
@patio11
Patrick McKenzie
6 years
On engineering career progression at Google: This is the best public description of an important process at Big Daddy G that I've seen. It tracks with what I've heard in less public conversations.
22
289
1K
5
49
325
@KentonVarda
Kenton Varda
4 years
For the record, this stuff happens to me all the time. Here's Discord:
@KentonVarda
Kenton Varda
4 years
Tried to create a @discordapp account only to find that they had already let someone else create an account with my e-mail address, which I had to hijack and delete first. Remember folks, you need to verify e-mail addresses BEFORE you let people use your service!
6
16
174
13
15
298
@KentonVarda
Kenton Varda
4 years
I usually don't get as much attention when I complain about this stuff. I guess Zoom is a popular target, so this thread is more popular than others. But it's a widespread problem. Many, many online services just do not verify e-mail addresses.
4
23
286
@KentonVarda
Kenton Varda
3 years
This was a fun one.
2
16
237
@KentonVarda
Kenton Varda
4 years
To the Security Dunning-Krugers chastising me for not following responsible disclosure: Responsible disclosure is for protecting vulnerabilities that other people could maliciously exploit, which this isn't. You are not as smart as you think you are.
1
11
232
@KentonVarda
Kenton Varda
2 years
Cloudflare's new Austin office opened today. I worked a regular day from the office for the first time in three years and, I know this is not a popular opinion on Twitter but, actually, it was really nice and I want to go back.
13
6
238
@KentonVarda
Kenton Varda
3 years
This story was brought to you by the function `fetch(req, env, ctx)`. Sigh.
2
0
224
@KentonVarda
Kenton Varda
3 years
I actually kind of love admitting when I screwed up. It actually feels good! I mean, not the screwing up part, but the admitting it part. Highly recommend it.
@singhns
Narinder Singh
3 years
@kennethn +1000 for @Cloudflare hiring people that admit mistakes and take ownership even when no one is watching.
1
6
281
5
8
211
@KentonVarda
Kenton Varda
3 years
In fact, "stuff" was a better name. If I said "put it in the context", there were like 15 things in the codebase called "context", but "put it in stuff", well, there's only one thing called "stuff". Because no one else was brave/silly enough to use that name.
1
5
209
@KentonVarda
Kenton Varda
2 years
me: These language models are just plagiarism engines, they don't produce original content. [plays with ChatGPT for a while] me: fuck. what the fuck
6
8
203
@KentonVarda
Kenton Varda
4 years
Once I was e-mailed 300 phone bills all at once from a Spanish telecom. I also get lots of Spanish-speaking people sending me resumes. Students in Latin America register for classes under my address all the time.
3
7
196
@KentonVarda
Kenton Varda
4 years
@ademrudin @whitequark EPA: Noooooo you can't just pump plutonium through leaky pipes and dump it on the floor, you can't just seal contaminated rooms and store waste barrels in the corridors nooooooo DOE: Hahaha geiger counter go brrrrrrrr
2
19
198
@KentonVarda
Kenton Varda
4 years
Wow, what an amazingly clear demonstration of the limitations of machine learning.
@Chicken3gg
Chicken3gg ๐Ÿ‹
4 years
@tg_bomze ๐Ÿค”๐Ÿค”๐Ÿค”
Tweet media one
232
3K
21K
3
52
190
@KentonVarda
Kenton Varda
4 years
Here's Cox cable:
@KentonVarda
Kenton Varda
4 years
Ugh, it looks like @CoxCalifornia let "Juan" from Santa Barbara sign up using my e-mail address (temporal at gmail dot com) and now I'm getting all his damned cable bills. @CoxComm provides me no way to remove my e-mail address from this account. You need to verify addresses!
3
3
43
5
6
180
@KentonVarda
Kenton Varda
3 years
My unpopular opinion for today: Reverting the entire history of contributions by UMN to the Linux kernel means reverting a lot of genuine security *fixes*, which will now be exploitable. This is not the right way to prove a point. This hurts Linux.
7
23
181
@KentonVarda
Kenton Varda
4 years
Tried to create a @discordapp account only to find that they had already let someone else create an account with my e-mail address, which I had to hijack and delete first. Remember folks, you need to verify e-mail addresses BEFORE you let people use your service!
6
16
174
@KentonVarda
Kenton Varda
9 months
And for those confused why the EU would do this... I'm not an expert, but I think the point is that some cloud providers use artificially high egress fees to prevent people from migrating their data out, which is anti-competitive. The policy is meant to promote fair competition.
2
1
176
@KentonVarda
Kenton Varda
4 years
@TProphet @munin @zoom_us This isn't an exploitable security bug. Responsible disclosure wouldn't accomplish anything here.
2
0
159
@KentonVarda
Kenton Varda
4 years
And done. After 1.5 years of work (and even longer thinking about it and arguing for it), my favorite Workers feature is ready to launch. (We're actually launching TWO huge features...)
14
4
160
@KentonVarda
Kenton Varda
9 months
I don't have a soundcloud but I do work for @Cloudflare which has had free egress all along. If you hate egress fees check us out. (FWIW I don't actually think Google is trying to avoid the regulation here, I think it was just an amusingly-timed change.)
2
0
162
@KentonVarda
Kenton Varda
2 years
Today I replaced the nginx instance on the / origin server with the soon-to-be-open-source Cloudflare Workers runtime. Converting an old, crusty nginx config to JavaScript felt pretty good TBH.
6
9
152
@KentonVarda
Kenton Varda
4 months
In case you were still wondering whether Cloudflare Workers can scale to your traffic...
@bjyule
Benjamin Yule
4 months
That moment when an internal team drops 12.5M requests per second on your service without telling you and nobody notices for 3 hours because it just worksโ€ฆ
20
19
743
5
20
154
@KentonVarda
Kenton Varda
1 year
@magpiekilljoy It's OK, there's a guy you can pay to figure out the bill for you. Though he makes you copy all the numbers from the menu yourself, all he does is add them for you. He'll use some of the money you pay him to bribe the restaurant owner into continuing to not give people bills.
0
5
148
@KentonVarda
Kenton Varda
6 years
My project, Cloudflare Workers, launches today, exactly one year after I joined @Cloudflare ! Run JavaScript server code directly on Cloudflare's edge network (127 locations and growing rapidly).
7
38
141
@KentonVarda
Kenton Varda
4 years
I'd like to apologize to @zoom_us , @alexstamos , etc. for the fact that people are misinterpreting this as a security vulnerability, when it's actually totally common practice across the whole industry and not exploitable. Also apologies that it happened on a Friday night. :/
8
8
134
@KentonVarda
Kenton Varda
4 years
Me: dd, please write this ISO to this USB stick and *give me progress updates*. dd: On it! dd: Update! All 2.7GB copied in 1 second! Now waiting for close()... * dd waits silently for half an hour while the kernel flushes the page cache. Me: Great. Thanks, dd. Good show.
9
7
140
@KentonVarda
Kenton Varda
3 years
A very wonky blog post. We noticed many Durable Objects apps had classic storage bugs (race conditions, unconfirmed writes, long waits, etc.). Instead of telling people to fix their code, we fixed the system, so intuitively-written code is now correct.
2
29
137
@KentonVarda
Kenton Varda
3 years
7
1
135
@KentonVarda
Kenton Varda
4 years
Sad to hear about all the amazing engineers laid off from Mozilla today. The Cloudflare Workers team is building a new kind of compute platform on top of web tech, and we need systems engineers and JavaScript/Wasm wonks. DM me or email kenton at cloudflare. #MozillaLifeboat
1
38
132
@KentonVarda
Kenton Varda
3 months
Tweet media one
1
0
135
@KentonVarda
Kenton Varda
3 years
Source (yep, it's me):
3
3
131
@KentonVarda
Kenton Varda
3 years
I made a little optimization to the Workers Runtime that means Workers don't have to stay in memory if they're just proxying bytes verbatim. We decided to pass on the savings to you.
8
16
129
@KentonVarda
Kenton Varda
3 years
So @bufbuild sent me this trophy for... arguing on the internet, lol.
Tweet media one
Tweet media two
3
6
121
@KentonVarda
Kenton Varda
3 years
My first academic paper! It's about Spectre and Cloudflare Workers, co-authored with @tugraz folks and friends including @marv0x90 , @borrello_pietro , @0xhilbert , @lavados , @misc0110 , and Thomas Schuster.
@Cloudflare
Cloudflare
3 years
Dynamic Process Isolation: Research by Cloudflare and @tugraz . #CloudflareResearch ๐Ÿ”ฌ
0
21
50
6
16
116
@KentonVarda
Kenton Varda
4 years
Here it is. 5000+ words about Workers security architecture, including discussion of V8 bugs and Spectre. I feel like it's still only scratching the surface, though.
6
21
109
@KentonVarda
Kenton Varda
3 years
TIL `git diff a..b` and `git diff a...b` do completely different things. The former (2 dots) shows you the diff between a and b. The latter (3 dots) finds the last common commit of a and b, then shows the diff from *that* to b.
6
10
107
@KentonVarda
Kenton Varda
3 years
I'm a big fan of the Linux kernel philosophy that changes should never ever break userspace. Workers takes the same philosophy. But what if we need to fix a bug that people inadvertently depend on? Here's how we're dealing with that...
@Cloudflare
Cloudflare
3 years
On the #CloudflareWorkers team, we have a policy: A change to the Workers Runtime must never break an application that is live in production. By @KentonVarda
0
24
87
7
16
101
@KentonVarda
Kenton Varda
2 years
I would say the point is crucial *and* samsung!
@njnrn
Niranjan Patil
2 years
This point is so crucial. once you face this problem it seems so obvious. But vendors are reluctant to comply.
0
1
4
1
4
100
@KentonVarda
Kenton Varda
4 years
Witness my Slow Descent into Madness debugging a GitHub Action.
Tweet media one
17
5
100
@KentonVarda
Kenton Varda
3 years
PSA: In the gmail compose window, if you hold shift, the "full screen" button becomes a "pop out" button, which is like 1000x better but almost no one knows about it.
Tweet media one
3
25
99
@KentonVarda
Kenton Varda
4 years
Really didn't expect this rant would go viral when my previous similar rants about other companies doing the same thing never did.
9
5
97
@KentonVarda
Kenton Varda
2 years
Overheard: "The error is happening on line 58. However, line 58 is 100KB long."
5
5
97
@KentonVarda
Kenton Varda
3 years
I suppose most systems use a word like "context", "environment", "data", "info", "headers", "metadata"... but those words really aren't any more descriptive, now are they! They are just stuff!
3
2
98
@KentonVarda
Kenton Varda
4 years
This tech is really cool. With the absurd amount of data web sites want to download these days, it turns out rendering the site on the edge and streaming down vector graphics draw commands instead is faster. Yeah I didn't believe it either -- until I tried it.
@Cloudflare
Cloudflare
4 years
Introducing Cloudflare Browser Isolation beta. #ZeroTrustWeek ๐ŸŒ
6
46
166
7
25
98
@KentonVarda
Kenton Varda
4 years
A minute after creating my own account @discordapp apparently decided my activity was suspicious and forced me to go through extra security checks including verifying my e-mail. Wish it had done that to the other guy.
1
1
95
@KentonVarda
Kenton Varda
5 years
@whitequark Oh and this! This is my favorite! Oh man, memories...
Tweet media one
9
12
94
@KentonVarda
Kenton Varda
2 years
The year is 2022. Turning off my TV also automatically turns off my stereo receiver. Turning on my TV turns on the PS5 but *not* the stereo. Turning on my PS5 turns on the TV (not stereo), but turning it off does not turn off the TV (nor stereo). I still need three remotes.
3
0
97
@KentonVarda
Kenton Varda
3 years
I paid off a loan and, as a result, my FICO credit score *dropped* 70 points. Credit scores are a protection racket, they punish you for not using credit.
4
7
96
@KentonVarda
Kenton Varda
4 years
So tired of seeing people compare gzipped JSON to uncompressed binary formats (e.g. protobuf, capnp, msgpack, etc.). You can gzip binary formats too, you know! Serialization and compression are different things.
6
6
92
@KentonVarda
Kenton Varda
5 months
Workers' `env` contains live objects, not just strings. People kept asking why, so I wrote a blog post! This design isn't just some weird artistic choice, it actually has profound benefits in terms of developer experience and -- surprise! -- security.
4
16
94
@KentonVarda
Kenton Varda
5 months
Honestly these announcements would have been worth five separate blog posts but you don't have time for that so we made it one blog post.
@Cloudflare
Cloudflare
5 months
Today we are announcing five updates that put more power in your hands โ€“ Gradual Deployments, Source mapped stack traces in Tail Workers, a new Rate Limiting API, brand-new API SDKs, and updates to Durable Objects. Let's dive in! #DeveloperWeek
8
22
156
2
13
94
@KentonVarda
Kenton Varda
4 years
Launch days are the best days. Nothing makes me happier than a well-received product launch that I worked hard on... ๐Ÿฅฐ
6
0
91
@KentonVarda
Kenton Varda
5 years
Workers now has a streaming HTML modification API. Previously you had to parse the whole DOM (using a pure-JS library), modify, and serialize again. Our streaming API only invokes JavaScript for the elements you want to change and streams the rest through.
3
27
91
@KentonVarda
Kenton Varda
8 months
@fasterthanlime Me: *Designs a compute platform that is legitimately an order of magnitude more cost-efficient than competition. Sets price accordingly.* Twitter: Those prices are impossible, it must be a conspiracy! Evil! Eeeevvviiiiillll! Sigh...
3
5
85
@KentonVarda
Kenton Varda
3 years
PSA: You should enable three-way diffs for merge conflicts in git. It makes merge conflicts massively easier to understand, because the conflict marker will show you the original code in addition to the changed versions. `git config --global merge.conflictstyle diff3`
1
14
87
@KentonVarda
Kenton Varda
3 years
My 1-year-old, who doesn't speak yet, demanded to go out by bringing me my shoes (to my desk), lifting my feet up and putting them into the shoes, then bringing me my mask and shoving it in my hands.
0
1
77
@KentonVarda
Kenton Varda
6 years
Narrator: It happened.
Tweet media one
3
12
75
@KentonVarda
Kenton Varda
1 year
Hey guys so apparently (by no action of my own) I just opened a new bank account at this cutting edge new bank, it's called the Deposit Insurance National Bank of Santa Clara, just created today.
4
4
73
@KentonVarda
Kenton Varda
4 years
Rant: If you can't implement infinite scroll in a way that doesn't cause me to lose my scroll position every time you add new items, then DO NOT IMPLEMENT INFINITE SCROLL.
3
7
74
@KentonVarda
Kenton Varda
1 year
It's been a long time coming, but wrangler (the Cloudflare Workers CLI tool) now automatically uses workerd (the open source Workers runtime) for local development and debugging. Realistic simulation (it's the same code!) without using a remote service.
@Cloudflare
Cloudflare
1 year
Weโ€™re proud to announce the release of Wrangler v3 โ€“ the first version of Wrangler with local-by-default development, powered by Miniflare v3 and the open-source Workers workerd runtime. #DeveloperWeek
5
41
196
5
7
73
@KentonVarda
Kenton Varda
2 years
My 3-year-old loaded the dishwasher.
Tweet media one
7
0
71
@KentonVarda
Kenton Varda
3 years
I'm building a house and I tell my contractor I don't want any smart shit in it and he's like "but you're a tech guy?" and I say "yes exactly".
8
4
70
@KentonVarda
Kenton Varda
2 years
The latest on my internet situation.
Tweet media one
Tweet media two
Tweet media three
6
1
70
@KentonVarda
Kenton Varda
3 months
I know this is heresy for some, but: We (Cloudflare) actually recommend that you do *not* probe for features in server-side code. It's actually better to check `navigator.userAgent`, as James says!
@jasnell
James M Snell
3 months
Did you know that when your code is running in @Cloudflare Workers, you can check the value of `navigator.userAgent` to *know* that it's running in Workers? The value is fixed as `Cloudflare-Workers` ...
5
9
71
4
8
69
@KentonVarda
Kenton Varda
4 years
Aww yeah it's time to build a new workstation.
Tweet media one
5
0
69
@KentonVarda
Kenton Varda
6 years
Landed my first (and @Cloudflare 's second) @v8js patch. Drastically improves performance with lots of threads and/or lots of isolates.
1
16
68
@KentonVarda
Kenton Varda
6 years
"Hmm I need to do some heap profiling. Let's link in tcmalloc for that." *Cloudflare Workers runtime gets 10% faster* "Oh geez, clearly I should have done that earlier."
2
4
66
@KentonVarda
Kenton Varda
4 years
@ocdtrekkie Google's specific behavior is beside the point here. If creating a product interoperable with a competitor's product requires a license from them, that only entrenches monopolies. I don't want WINE and NES emulators to be ruled to be copyright violations.
1
0
67
@KentonVarda
Kenton Varda
3 years
OMG this page not only explicitly refuses to let me paste (showing the red error message when I try), but also rejects values set via the devtools console. Whyyyyyyy do people do this? If you don't want me to typo, then don't make me type!
Tweet media one
5
3
67
@KentonVarda
Kenton Varda
3 years
"The site went from 1B requests per day to 30-35B requests per day... Through all of this, Cloudflareโ€™s workers kept chugging along and my response times barely moved." That's over 400,000 requests per second, FWIW.
3
13
66
@KentonVarda
Kenton Varda
5 years
@whitequark You should see how libprotobuf stringifies floats without losing precision... (this is... my code...)
5
7
62
@KentonVarda
Kenton Varda
6 years
I ended up leaving Google altogether about 2-3 years later. There was no hope of being promoted or even being a tech lead again in my foreseeable future. So I started @SandstormIO instead. Ultimately it did not succeed as a business, but my career is in a much better place now.
1
0
66
@KentonVarda
Kenton Varda
4 years
Well, it finally happened. I had to write some Go code.
6
1
61
@KentonVarda
Kenton Varda
4 years
@Shadow0pz @zoom_us @k8em0 It's not a vulnerability.
0
0
62