Folks, I did it again. I made another RPC system. I know, it's a problem. But bear with me!
I think this is the best possible JavaScript RPC.
It has all the power of Cap'n Proto with no need to write schemas. There is almost no boilerplate at all.
Jesus Christ
@zoom_us
, you've apparently let a whole school in Chile sign up for a paid account using my e-mail address, because you never verified it. I went to create my own account, it said I had one, so I "forgot password", and now I own this school's admin account.
Reminder that Judge William Haskell Alsup, who first heard Oracle v. Google, actually LEARNED JAVA in order to make an informed ruling, while these higher-court jokers are relying on analogies to Harry Potter and grocery stores.
Wow. This SanDisk SSD model fails at 40,000 hours exactly. Primary and backup servers each had RAID-1 and they all failed at the same time.
When setting up a RAID-1 mirror, always try to pair two SSDs from entirely different chipset makers.
TIL Swedish time format is exactly the ideal time format, that is, "YYYY-MM-DD HH:MM:SS". In JavaScript, you can do `date.toLocaleString("sv")` to format this way.
I wonder if it's safe to assume this will never change...
The problem is that my e-mail address is temporal at gmail. It was my teenage gamer tag. I need to change it. But it turns out "temporal" means "temporary" in Spanish. So Spanish-speaking people all over use it as a placeholder address!
@zoom_us
89 users, 19 licensed, 44 active. 190 meetings since the account was created a little over a month ago. I have all their names, e-mail addresses, activity logs...
Back in the mid-2000's I was working on a core internal protocol used in Google search back-end for transmitting search results, and we had a place in the protocol where any team could add their own extra data about a result. I named this place "stuff".
We are approaching the Google UI design solstice. All the corners are approaching peak roundness. Then over several years they will become more square again, until the cycle starts anew. Watch for the buttons that achieve full pill shape, they won't be here long.
This is a big deal: possibly the first true edge-optimized Python runtime. It's based on the CPython interpreter (the one most people use), but multiple applications can share the same copy of the interpreter securely. How? The key is Wasm dynamic linking.
This is a product I'm really excited about! I like to call it Functions as a Service as a Service. It allows any SaaS service to make itself programmable. It's a bit tricky to understand so let me explain with some examples.
Why? Probably because "it hurts conversions" and "it's the user's fault if they signed up with someone else's address; no one else is harmed." This needs to change, so I take every opportunity to complain loudly.
I'm apparently not even allowed to delete my account because I "belong" to this organization! I'm apparently not the owner, just an admin, but I cannot remove myself!
After I open sourced Protocol Buffers, the promo committee denied me for promotion (from Senior to Staff) because my packet contained no peer reviews from more-senior engineers who worked closely with me. (There were no such engineers.)
On engineering career progression at Google:
This is the best public description of an important process at Big Daddy G that I've seen. It tracks with what I've heard in less public conversations.
Tried to create a
@discordapp
account only to find that they had already let someone else create an account with my e-mail address, which I had to hijack and delete first. Remember folks, you need to verify e-mail addresses BEFORE you let people use your service!
I usually don't get as much attention when I complain about this stuff. I guess Zoom is a popular target, so this thread is more popular than others. But it's a widespread problem. Many, many online services just do not verify e-mail addresses.
To the Security Dunning-Krugers chastising me for not following responsible disclosure: Responsible disclosure is for protecting vulnerabilities that other people could maliciously exploit, which this isn't. You are not as smart as you think you are.
Cloudflare's new Austin office opened today. I worked a regular day from the office for the first time in three years and, I know this is not a popular opinion on Twitter but, actually, it was really nice and I want to go back.
I actually kind of love admitting when I screwed up. It actually feels good! I mean, not the screwing up part, but the admitting it part. Highly recommend it.
In fact, "stuff" was a better name. If I said "put it in the context", there were like 15 things in the codebase called "context", but "put it in stuff", well, there's only one thing called "stuff". Because no one else was brave/silly enough to use that name.
Once I was e-mailed 300 phone bills all at once from a Spanish telecom. I also get lots of Spanish-speaking people sending me resumes. Students in Latin America register for classes under my address all the time.
@ademrudin
@whitequark
EPA: Noooooo you can't just pump plutonium through leaky pipes and dump it on the floor, you can't just seal contaminated rooms and store waste barrels in the corridors nooooooo
DOE: Hahaha geiger counter go brrrrrrrr
Ugh, it looks like
@CoxCalifornia
let "Juan" from Santa Barbara sign up using my e-mail address (temporal at gmail dot com) and now I'm getting all his damned cable bills.
@CoxComm
provides me no way to remove my e-mail address from this account. You need to verify addresses!
My unpopular opinion for today: Reverting the entire history of contributions by UMN to the Linux kernel means reverting a lot of genuine security *fixes*, which will now be exploitable. This is not the right way to prove a point. This hurts Linux.
Tried to create a
@discordapp
account only to find that they had already let someone else create an account with my e-mail address, which I had to hijack and delete first. Remember folks, you need to verify e-mail addresses BEFORE you let people use your service!
And for those confused why the EU would do this... I'm not an expert, but I think the point is that some cloud providers use artificially high egress fees to prevent people from migrating their data out, which is anti-competitive. The policy is meant to promote fair competition.
And done.
After 1.5 years of work (and even longer thinking about it and arguing for it), my favorite Workers feature is ready to launch.
(We're actually launching TWO huge features...)
I don't have a soundcloud but I do work for
@Cloudflare
which has had free egress all along. If you hate egress fees check us out.
(FWIW I don't actually think Google is trying to avoid the regulation here, I think it was just an amusingly-timed change.)
Today I replaced the nginx instance on the / origin server with the soon-to-be-open-source Cloudflare Workers runtime. Converting an old, crusty nginx config to JavaScript felt pretty good TBH.
That moment when an internal team drops 12.5M requests per second on your service without telling you and nobody notices for 3 hours because it just worksโฆ
@magpiekilljoy
It's OK, there's a guy you can pay to figure out the bill for you. Though he makes you copy all the numbers from the menu yourself, all he does is add them for you. He'll use some of the money you pay him to bribe the restaurant owner into continuing to not give people bills.
My project, Cloudflare Workers, launches today, exactly one year after I joined
@Cloudflare
! Run JavaScript server code directly on Cloudflare's edge network (127 locations and growing rapidly).
I'd like to apologize to
@zoom_us
,
@alexstamos
, etc. for the fact that people are misinterpreting this as a security vulnerability, when it's actually totally common practice across the whole industry and not exploitable. Also apologies that it happened on a Friday night. :/
Me: dd, please write this ISO to this USB stick and *give me progress updates*.
dd: On it!
dd: Update! All 2.7GB copied in 1 second! Now waiting for close()...
* dd waits silently for half an hour while the kernel flushes the page cache.
Me: Great. Thanks, dd. Good show.
A very wonky blog post. We noticed many Durable Objects apps had classic storage bugs (race conditions, unconfirmed writes, long waits, etc.). Instead of telling people to fix their code, we fixed the system, so intuitively-written code is now correct.
Sad to hear about all the amazing engineers laid off from Mozilla today. The Cloudflare Workers team is building a new kind of compute platform on top of web tech, and we need systems engineers and JavaScript/Wasm wonks. DM me or email kenton at cloudflare.
#MozillaLifeboat
I made a little optimization to the Workers Runtime that means Workers don't have to stay in memory if they're just proxying bytes verbatim. We decided to pass on the savings to you.
Here it is. 5000+ words about Workers security architecture, including discussion of V8 bugs and Spectre. I feel like it's still only scratching the surface, though.
TIL `git diff a..b` and `git diff a...b` do completely different things. The former (2 dots) shows you the diff between a and b. The latter (3 dots) finds the last common commit of a and b, then shows the diff from *that* to b.
I'm a big fan of the Linux kernel philosophy that changes should never ever break userspace. Workers takes the same philosophy. But what if we need to fix a bug that people inadvertently depend on? Here's how we're dealing with that...
On the
#CloudflareWorkers
team, we have a policy: A change to the Workers Runtime must never break an application that is live in production. By
@KentonVarda
PSA: In the gmail compose window, if you hold shift, the "full screen" button becomes a "pop out" button, which is like 1000x better but almost no one knows about it.
I suppose most systems use a word like "context", "environment", "data", "info", "headers", "metadata"... but those words really aren't any more descriptive, now are they! They are just stuff!
This tech is really cool. With the absurd amount of data web sites want to download these days, it turns out rendering the site on the edge and streaming down vector graphics draw commands instead is faster. Yeah I didn't believe it either -- until I tried it.
A minute after creating my own account
@discordapp
apparently decided my activity was suspicious and forced me to go through extra security checks including verifying my e-mail. Wish it had done that to the other guy.
The year is 2022. Turning off my TV also automatically turns off my stereo receiver. Turning on my TV turns on the PS5 but *not* the stereo. Turning on my PS5 turns on the TV (not stereo), but turning it off does not turn off the TV (nor stereo). I still need three remotes.
I paid off a loan and, as a result, my FICO credit score *dropped* 70 points. Credit scores are a protection racket, they punish you for not using credit.
So tired of seeing people compare gzipped JSON to uncompressed binary formats (e.g. protobuf, capnp, msgpack, etc.).
You can gzip binary formats too, you know! Serialization and compression are different things.
Workers' `env` contains live objects, not just strings. People kept asking why, so I wrote a blog post!
This design isn't just some weird artistic choice, it actually has profound benefits in terms of developer experience and -- surprise! -- security.
Today we are announcing five updates that put more power in your hands โ Gradual Deployments, Source mapped stack traces in Tail Workers, a new Rate Limiting API, brand-new API SDKs, and updates to Durable Objects. Let's dive in!
#DeveloperWeek
Workers now has a streaming HTML modification API. Previously you had to parse the whole DOM (using a pure-JS library), modify, and serialize again. Our streaming API only invokes JavaScript for the elements you want to change and streams the rest through.
@fasterthanlime
Me: *Designs a compute platform that is legitimately an order of magnitude more cost-efficient than competition. Sets price accordingly.*
Twitter: Those prices are impossible, it must be a conspiracy! Evil! Eeeevvviiiiillll!
Sigh...
PSA: You should enable three-way diffs for merge conflicts in git. It makes merge conflicts massively easier to understand, because the conflict marker will show you the original code in addition to the changed versions. `git config --global merge.conflictstyle diff3`
My 1-year-old, who doesn't speak yet, demanded to go out by bringing me my shoes (to my desk), lifting my feet up and putting them into the shoes, then bringing me my mask and shoving it in my hands.
Hey guys so apparently (by no action of my own) I just opened a new bank account at this cutting edge new bank, it's called the Deposit Insurance National Bank of Santa Clara, just created today.
Rant: If you can't implement infinite scroll in a way that doesn't cause me to lose my scroll position every time you add new items, then DO NOT IMPLEMENT INFINITE SCROLL.
It's been a long time coming, but wrangler (the Cloudflare Workers CLI tool) now automatically uses workerd (the open source Workers runtime) for local development and debugging. Realistic simulation (it's the same code!) without using a remote service.
Weโre proud to announce the release of Wrangler v3 โ the first version of Wrangler with local-by-default development, powered by Miniflare v3 and the open-source Workers workerd runtime.
#DeveloperWeek
I know this is heresy for some, but: We (Cloudflare) actually recommend that you do *not* probe for features in server-side code. It's actually better to check `navigator.userAgent`, as James says!
Did you know that when your code is running in
@Cloudflare
Workers, you can check the value of `navigator.userAgent` to *know* that it's running in Workers? The value is fixed as `Cloudflare-Workers` ...
"Hmm I need to do some heap profiling. Let's link in tcmalloc for that."
*Cloudflare Workers runtime gets 10% faster*
"Oh geez, clearly I should have done that earlier."
@ocdtrekkie
Google's specific behavior is beside the point here. If creating a product interoperable with a competitor's product requires a license from them, that only entrenches monopolies. I don't want WINE and NES emulators to be ruled to be copyright violations.
OMG this page not only explicitly refuses to let me paste (showing the red error message when I try), but also rejects values set via the devtools console. Whyyyyyyy do people do this? If you don't want me to typo, then don't make me type!
"The site went from 1B requests per day to 30-35B requests per day... Through all of this, Cloudflareโs workers kept chugging along and my response times barely moved."
That's over 400,000 requests per second, FWIW.
I ended up leaving Google altogether about 2-3 years later. There was no hope of being promoted or even being a tech lead again in my foreseeable future. So I started
@SandstormIO
instead. Ultimately it did not succeed as a business, but my career is in a much better place now.