"Posting on Reddit requires running nonfree JavaScript code."
I have much respect for him but this is at the level of old-man-shouting-at. Criticism should be more targeted and not just rehashing the same arguments, even if true.
Even with a perfectly free client you still need to perform computation on a remote machine that's outside of your control to post on (or read) reddit. Which is the same violation he moans about in this article,
> Doing your own computing via software running on someone else's server inherently trashes your computing freedom.
As always with Stallman he is dogmatic well past the point of reasonableness.
Stallman is stalwart. The dogma is the point and his obstinate, steady nature is what I love best about him. Free software continues to be incredibly important. For me, he is fresh air in the breathlessly optimistic, grasping, and negligent climate currently dominating the field.
reddit was also open source at one point, so at least in theory anybody could run their own copy. I agree Stallman is far from reasonable but AFAIK he's consistent with his unreasonable standards.
One thing to keep in mind when judging what's 'appropriate' is that Cloudflare was effectively responding to an ongoing security incident outside of their control (the React Server RCE vulnerability). Part of Cloudlfare's value proposition is being quick to react to such threats. That changes the equation a bit: any hour you wait longer to deploy, your customers are actively getting hacked through a known high-severity vulnerability.
In this case it's not just a matter of 'hold back for another day to make sure it's done right', like when adding a new feature to a normal SaaS application. In Cloudflare's case moving slower also comes with a real cost.
That isn't to say it didn't work out badly this time, just that the calculation is a bit different.
To clarify, I'm not trying to imply that I definitely wouldn't have made the same decision, or that cowboy decisions aren't ever the right call.
However, this preliminary report doesn't really justify the decision to use the same deployment system responsible for the 11/18 outage. Deployment safety should have been the focus of this report, not the technical details. My question that I want answered isn't "are there bugs in Cloudflare's systems" it's "has Cloudflare learned from it's recent mistakes to respond appropriately to events"
> doesn't really justify the decision to use the same deployment system responsible for the 11/18 outage
There’s no other deployment system available. There’s a single system for config deployment and it’s all that was available as they haven’t yet done the progressive roll out implementation yet.
Hindsight is always 20/20, but I don't know how that sort of oversight could happen in an organization whose business model rides on reliability. Small shops understand the importance of safeguards such as progressive deployments or one-box-style deployments with a baking period, so why not the likes of Cloudflare? Don't they have anyone on their payroll who warns about the risks of global deployments without safeguards?
Config changes are distinctly more difficult to have that set up for and as the blog says they’re working on it. They just don’t have it ready yet and are pausing any more config changes until it’s set up. They just did this one in response to try to mitigate an ongoing security vulnerability and missed the mark.
I’m happy to see they’re changing their systems to fail open which is one of the things I mentioned in the conversation about their last outage.
Then even in the worst case scenario, they were addressing this issue two days after it was publicly disclosed. So this wasn't a "rush to fix the zero day ASAP" scenario, which makes it harder to justify ignoring errors that started occuring in a small scale rollout.
Cloudflare did have early access, and had mitigation in place from the start. The changes that were being rolled out were in response to ongoing attempts to bypass those.
Disclosure: I work at Cloudflare, but not on the WAF
Cloudflare had already decided this was a rule that could be rolled out using their gradual deployment system. They did not view it as being so urgent that it required immediate global roll out.
Indeed, but it is what it is. Cloudflare comes out of my budget, and even with downtime, its better than not paying them. Do I want to deal with what Cloudflare offers? I do not, I have higher value work to focus on. I want to pay someone else to deal with this, and just like when cloud providers are down, it'll be back up eventually. Grab a coffee or beer and hang; we aren't savings lives, we're just building websites. This is not laziness or nihilism, but simply being rational and pragmatic.
> Do I want to deal with what Cloudflare offers? I do not, I have higher value work to focus on. I want to pay someone else to deal with this, and just like when cloud providers are down, it'll be back up eventually.
This is specious reasoning. How come I had to endure a total outage due to the rollout of a mitigation of a Nextjs vulnerability when my organization doesn't even own any React app, let alone a Nextjs one?
Also specious reasoning #2, not wanting to maintain a service does not justify blindly rolling out config changes globally without any safeguards.
If you are a customer of Cloudflare, and not happy, I encourage you to evaluate other providers more to your liking. Perhaps you'll find someone more fitting to your use case and operational preferences, but perhaps not. My day job org pays Cloudflare hundreds of thousands of dollars a year, and am satisfied with how they operate. Everyone has choice, exercise it if you choose. I'm sure your account exec would be happy to take the feedback. Feedback, including yours, is valuable and important to attempt to improve the product and customer experience (imho; i of course do not speak for Cloudflare, only myself).
As a recovering devops/infra person from a lifetime ago (who has, much to my heartbreak, broken prod more than once), perhaps that is where my grace in this regard comes from. Systems and their components break, systems and processes are imperfect, and urgency can lead to unexpected failure. Sometimes its Cloudflare, other times it's Azure, GCP, Github, etc. You can always use something else, but most of us continue to pick the happy path of "it works most of the time, and sometimes it does not." Hopefully the post mortem has action items to improve the safeguards you mention. If there are no process and technical improvements from the outage, certainly, that is where the failure lies (imho).
> you are a customer of Cloudflare, and not happy, I encourage you to evaluate other providers more to your liking.
I think your take is terribly simplistic. In a professional setting, virtually all engineers have no say on whether the company switches platforms or providers. Their responsibility is to maintain and develop services that support business. The call to switch a provider is ultimately a business and strategic call, and is a subject that has extremely high inertia. You hired people specialized in technologies, and now you're just dumping all that investment? Not to mention contracts. Think about the problem this creates.
Some of you sound like amateurs toying with pet projects, where today it's framework A on cloud provider X whereas tomorrow it's framework B on cloud provider Y. Come the next day, rinse and repeat. This is unthinkable in any remotely professional setting.
> Some of you sound like amateurs toying with pet projects, where today it's framework A on cloud provider X whereas tomorrow it's framework B on cloud provider Y. Come the next day, rinse and repeat. This is unthinkable in any remotely professional setting.
Vendor contracts have 1-3 year terms. We (a financial services firm) re-evaluate tech vendors every year for potential replacement and technologists have direct input into these processes. I understand others may operate under a different vendor strategy. As a vendor customer, your choices are to remain a customer or to leave and find another vendor. These are not feelings, these are facts. If you are unhappy but choose not to leave a vendor, that is a choice, but it is your choice to make, and unless you are a large enough customer that you have leverage over the vendor, these are your only options.
These engineering insights were not worth the 16 seconds load time this website took.
It's extremely easy, and correspondingly valueless, to ask all kinds of "hard questions" about a system 24h after it had a huge incident. The hard part is doing this appropriately for every part of the system before something happens, while maintaining the other equally rightful goals of the organizations (such as cost-efficiency, product experience, performance, etc.). There's little evidence that suggests Cloudflare isn't doing that, and their track record is definitely good for their scale.
Every engineer has this phase when you're capable enough to do something at small scale, so you look at the incumbents, who are doing the similar thing but at 1000x scale, and wonder how they are so bad at it.
...yes, that's what a polyfill is: a javascript implementation of a new spec that's only applied when the current browser doesn't yet support the new spec. This lets devs start using it right away, then when it has enough support across browsers the polyfill can be removed without changing their code.
It's not even clear that the premise is true. There's lots of 'research' done in the big tech companies.
The biggest reason why companies don't seek to emulate "Dupont, Bell Labs, IBM, AT&T, Xerox, Kodak, GE", is probably that it reads like a list of textbox examples of "companies that failed to execute on their research findings", so clearly there was something wrong with this approach.
GE (under Jack Welch specifically) is a textbook example of how financialization and focusing on numbers at the expense of products destroys companies.
Kodak is a textbook example of disruption. Yes they failed to capitalize on digital cameras specifically, but their research in all other areas was very much acted upon.
My mental model as an outsider, is the vibe out of Google is that they push the most talented folks out via process / politics. Not intentionally, just the reality of squeezing the creative type employee / work. Replacing creative smarts which is difficult or impossible to measure, with operational smarts, more easily measured. Those creative smart people mostly go on to start up other companies.
Its worked out ok for Google and others, because there's little teeth to anti monopoly, so all the big tech players can just buy the successes, which is safer than trying to grow them (esp. once the talent left). I really have no idea if this is an accurate take as its mostly vibes, sans for a few of said smart Google folks I've met in startup land(s). Yet Google is so big, they could bleed all kinds of employees telling all kinds of stories and it could all be simply random. Yet at the same time I can't help but think about every aging tech companies biggest / best products being via acquisition.
While I think monopoly is bad, I don't know if ^ otherwise is so bad. Maybe its just creative type folks _should_ avoid big tech, and build their own labs. Capital and compute are readily available to people who can demonstrate success, and its easier than ever to build and experiment in some fields. i.e. if we had stricter capital accumulation associated taxes, maybe the ills of this process wouldn't be so bad.
Bureaucrat-ification isn't a phenomenon unique to Google - it happens at every company eventually.
It's really hard to describe why it's inevitable (there are a lot of factors).
But it's self-evident really. All of the major tech players started with a single innovation that afforded them enough revenue to acquire almost everything else in their portfolio.
Aside from search, the only major product Alphabet built-in house that meaningfully moves the needle revenue-wise is their cloud segment. Youtube was acquired - and it's effectively an extension of search.
Meta had to acquire Instagram and WhatsApp. Without those acquisitions, I have strong doubts they'd still be a major player today.
You can run through this exercise with Microsoft, Apple, Amazon, NVDA etc.
The common theme is they did 1 or 2 things really well, and got big enough to acquire/copy/bully smaller players out of the market.
What's crazy is most of them still rely on that one original thing they did well for >50% of revenue.
> It's really hard to describe why it's inevitable (there are a lot of factors).
I think there's a lot of small factors, but of those the biggest on (IMO) is the fallacy that throwing people at a problem gets it done faster. For some situations: yes, for all situations: no. And you need experience or some kind of sharp intuition to know when to expand and when not to expand.
Add more and more people to a job and they'll find ways to justify their value at the expense of efficiency. And there's a snowball effect from there as an org adds people who believe adding people is always good.
Then the corpo runs into layoffs and everyone throws their hands up and says "How could we have avoided this?" By not overhiring in the first place.
The story with 3M and PostIt Notes is that the idea was originally rejected my management. The inventors created a batch and distributed them to all the executive admin assistants. When they went back a second time, they had the assistants speak up otherwise there would not be any more.
I didn't bring up 3M because of the Post-it story, but because they're being a "general research" company. From open reel tapes to sticky tapes and everything in between.
Würth is also similar. They make seemingly everything in a segment (lubrication, fuel additives, cleaning, restoration, protection, etc. etc.).
The bigger problem today is that there is simply nothing more left to research. Everything that is being worked on are at most optimizations, which allways have a dollar spent vs dollar returned amount on them.
“While it is never safe to affirm that the future of Physical Science has no marvels in store even more astonishing than those of the past, it seems probable that most of the grand underlying principles have been firmly established and that further advances are to be sought chiefly in the rigorous application of these principles to all the phenomena which come under our notice.” Albert A. Michelson (yes, that Michelson, one half of Michelson-Morley), 1894
If it feels like there’s nothing for us engineers to research, that’s probably a sign we need more basic research from the scientists!
LLMs are just better google. In the past, you used to google shit, and copy paste from stack overflow, now you just skip the middle man and go directly to Chat GPT. Anyone that has been programming for a while can attest to that the answers aren't any better, its just more efficient to iterate on them now.
AI hasn't even begun to be solved yet. Everyone is focused on feedforward transformer architecture that is never going to replace the imperative processing of actual intelligence.
Smartphones are pretty much solved, as they have replaced a lot of the need for in person interaction (which by extension means transportation). The last decade has been all about monetizing smartphones.
Wearables aren't transforming society at all.
3d printing and home fab is still too niche and expensive for most people, and you can't really make it cheaper and more accessible.
Electric vehicles largely suck. Self driving is mediocre.
We literally went through a pandemic and people got richer because they had to stay at home and not spend money on things like daycare or gas or car maintenance, without losing any productivity.
Hell, the state the US is in currently is largely explained by the fact that most all the problems in society have been solved to the extent that people have to invent bogeymen and elect a demented felon into office on the promise of solving those problems.
This is a very surface level analysis like saying that the automobile was just an iterative improvement over a horse. Or a computer is just a better abacus. Fundamental research is all about diving into the weeds and finding new problems to solve. It's true that some of the "low hanging fruit" no longer exists (you won't see someone like Euler or Newton who's names pop up all over the place), but I can promise you that real gains are being made on a lower level. These small gains in fundamental research snowball into bigger advancements. As an example, the transformer architecture used by LLMs was first published in 2017.
Automobile was improvement over the horse because things needed to get places. To improve on current automobile will require either massive government investment and regulation in the sense of flying cars, or full electrification with paradigm shifts in transportation, like induction charging roads or battery hot swaps or whatever else. The modern Corolla Hybrid is pretry much the peak optimal point of transportation.
What do humans need right now to improve their lives substantially?
high temperature superconducting would cause a big leap. cheap energy would also help. cheap compute-in-the-walls. machines doing all the dangerous jobs.
Cheap energy is possible now with solar. There is a reason why it hasn't been done yet. Nobody has a need for it. Remember, you may think it would be nice to have an electric car you can charge for microcents a mile, but most people dgaf about putting gas in their car.
Machines doing dangerous jobs also is a thing these days.
High temperature superconducting can potentially be useful in a few applications that involve high current, which mostly deal with transportation. The only real advantage of this is drone delivery service becoming cheaper, but that has big hurdles to cross.
There is a reason why being a streamer is the top choice of "what I wanna be" when you ask kids. Everything is about the internet now in terms of motivation. And unfortunately there, we already hit a hard limit of the speed of light.
oh, I was thinking about science. material science is doing some pretty cool things. quantum is getting interesting. we're just starting to really get a handle on reverse engineering the cell. battery chemistry. whether or not we're going to see practical fusion it seems likely that we'll see knockoffs. I just saw an ad yesterday that Avalanche is planning on selling waste (I mean useful quasi-stable elements). not just that but the non-sexy science (I met a guy yesterday and we talked about how a lot of his colleagues got the axe. he's working on characterizing the response of skin tissue to uv damage. that doesn't sound that sexy, but wouldn't it be nice to know?)
yeah, mostly forget about computers, we're still just coming to grips with the fact that we stopped doing largely innovative work decades ago. my bet is its going to go back to being interesting pretty soon. we are having a lot of interesting discussion about cognition though :)
All of this is research from the 90s, with a few decades of polish.
Now maybe we could start looking at what research labs have come up with since then.
> Hell, the state the US is in currently is largely explained by the fact that most all the problems in society have been solved to the extent that people have to invent bogeymen and elect a demented felon into office on the promise of solving those problems.
That's... an interesting point. I don't really buy it, though. The same could have been said of the fascist movement in Italy, or the royalists in France in 1905.
From "framework fatigue" to "new framework" in five paragraphs.
Personally, I find all these minimalist, back-to-the-basics frameworks a bit misguided. It's always reeks a bit of "well my farts don't smell" – other developers' frameworks are bloated, dependency-overloaded and too complex. My new framework is simple, based on a powerful idea, and just right.
Imo, the best way to build a truly good web app in 2025 is to embrace both server-side rendering and client-side rendering, by sharing the same rendering logic between client and server, like e.g. SvelteKit, Next.js and others do.
We had a nontechnical person choose Next, against my recommendation but I didn't have the authority to override that choice, and it's been a total nightmare.
It's extremely messy. Hostile to debugging. Hostile to testing. Bad HMR. All this to offer us RPC and filesystem based routing (neither of which I even want in a framework).
No, fameworks are relatively opinionated towards the goal the creator had, which is usually in a README.
They're all tools that need more context to decide on when you use them.
For example, in my use case (SaaS) I focus on something that makes refactoring a breeze. Type-safe end-to-end is important there, so I use orpc+react for most projects. If you don't like contract-first APIs you're going to hate this, but it makes me think out what I actually want in my frontend before I write the database. This kind of [mocking -> real data] way of coding makes you proactive when designing the app
- no company generates revenue in its first second. Even if you start a lemonade stand tomorrow, you'll have to buy some lemons first. The time-to-revenue might be very short, but it's never zero. Therefore, making no revenue for 1 day or for 10 years is not a step change, but simply a point on a curve.
- Capitalism is basically a long history of creating vehicles with increasing sophistication to bridge that gap: provide funding for ventures that have returns in the future. This is intrinsically difficult, and it's easy to waste money, but it can work immensely. This started with the Dutch inventing limited liability corporations to fund ship expeditions, and today's VC is essentially an extension of that.
- It has worked well in the past to bet on companies that don't optimize for time-to-revenue, but something else – famous examples being e.g. Amazon, Google, Meta, who all lost lots of money initially.
Hence there can be companies that make no money for quite a while. And it can even turn out that the vast majority of the companies that make no money for a while never make any money. Accepting this risk is a feature, not a bug.
>- no company generates revenue in its first second. Even if you start a lemonade stand tomorrow, you'll have to buy some lemons first. The time-to-revenue might be very short, but it's never zero. Therefore, making no revenue for 1 day or for 10 years is not a step change, but simply a point on a curve.
Yea, it's called investment. If you want to get rich overnight play lottery or start gambling.
I think what changed is that we at least can attempt to limit 'bad' things with technical measures. It was legitimately technically impossible 10 years ago to prevent Photoshop from designing propaganda posters. Of course today's 'LLM safety' features aren't watertight either, but with the combination of 'input is natural language' plus LLM-based safety measures, there are more options today to restrict what the software can do than in the past.
The example you gave about preventing money counterfeiting with technical measures also supports this, since this was an easier thing to detect technically, and so it was done.
Whether that's a good thing or bad thing everyone has to decide for themselves, but objectively I think this is the reason.
Apple has the technology to bias people towards cats instead of dogs but I find it very unlikely they will bother to do that. The missing ingredient is how it helps their bottom line, which, instead of technical feasibility, is the root reason they do things. For whatever reasons some people REALLY love Apple's default restrictions, most don't really give a damn one way or the other, and the smallest group seem to have problems with it. It's not that Apple can do this so they are, it's users want this and now it can be done.
Perhaps a much more bleak take, depending on one's views :).
It's valid to think of this as Microsoft sort of squandering a unique opportunity to become the ubiquitous video conferencing standard by not investing in Skype, back when it had a market-leading position. Another way to look at this is that even though they bungled this, they still managed to become that solution through Teams. Even though they failed to compete with Skype, got leapfrogged by Slack, and then again by Zoom, they still manage to come out on top, at least in corporate America.
You can argue that they could have been Zoom, too, but looking at Zoom's 22bn market capitalization I don't think Microsoft sheds many tears about that thought. It's more a testament to the incredible market power and distribution muscle Microsoft has, that they can afford this many bad decisions and still win in a way.
The way Microsoft “won” with Teams was through monopolistic bundling it into Windows and Office. To this day most people don’t like using Teams for chat, but because it’s there by default there’s not a good reason to go through the hassle of bringing on another product.
>> To this day most people don’t like using Teams for chat
People will say the same thing about Slack, email, and any other messaging system they are forced to use. People love to complain, especially if they're coming to a product after using a different one at a previous job.
They gained it back by basically giving Teams away for free and getting companies to say "we're already paying for this bundle, so let's stop paying for Zoom/Slack." They still missed out on billions which they'll try to claim back over years of slow price raises (until the competition lowers prices and/or becomes more competitive).
This really reads like a parody. Press release, “a consortium of 20 research institutions”, “awarded the STEP (Strategic Technologies for Europe Platform) seal”. Lots of grandiose self-congratulations. All with nothing to run, download or try of course.
It's normal to announce things long before they're actually available to end users. This is not some unique evil of the EU bureaucracy - if anything, it's very corporate of them.
You just don't get it. When it's announced by the EU, it's red tape PDF crunching soulless bureaucracy wasting our time. When it's said by a glorified CPA of an American unicorn startup it's the vision, innovation and triumph of entrepreneurial spirit.
What I am gonna say here is not a political point but I hope someone can point me the pattern (and some something to read about it) I have observed with for example the EU.
Yes it sounds like a parody or an onion piece.
We know the European search engine, cloud, blockchain never got anywhere. I don't even believe that anybody ever really tried.
Now you have to put yourself in their head for 2 minutes and here is what I noticed by knowing a few of them (the "EU type").
In their perception of reality it seems they really believe that if they declare something it is real. This is why they get so deranged if you dare pointing to the facts or just asking questions.
It seems they really believe they succeeded in all those projects. I they say it, it exists.
I am not really satisfied by the explanations we usually hear: they are incompetent, it is corruption or even insanity (some sort of mass hysteria that would take root in some institutions).
What I am wondering is, is there a concept in philosophy or some similar pattern in previous civilisation that could help us understand what is going on with the EU?
Because Gaia-X or OpenEuroLLM is one thing, but it is worrisome they now believe they can raise an army and declare war on everybody.
As a European, the sad reality is that I see parallels with the late-stage Soviet Union and its satellite states.
NOT when it comes to the level of violence and repression or quality of living. Those two things are world-class.
But in the sense that there's a more or less unelected political establishment that's
a) Recursive: It does things only to show them off to itself.
b) Not exposed to real-world consequences.
c) Has a non-falsifiable pretense to validate whatever they do and caution against undoing whatever it is. For the soviets, it was anti-capitalism. For the EU it's some notion of safety or sustainability.
d) Inadvertently benefits itself and other elites and harms the people they pretend to protect.
My hope is that as a democratic institution, the EU is capable of reform.
Yeah you are right there is probably no need to look very far ...
Now what worry me is from I understand of the collapse of the Soviet Union (but I might be very wrong) is they kind let things happen and was less aggressive by the end.
On the contrary the EC is now consolidating power rapidly and are getting very aggressive.
It is not different from any corporate speech, except that this time is for public benefit rather than private, and will proceed much slower. And yes, I don't know why but apparently consortium are named quite often, I'm in compsci in italy and on hpc courses they get named a lot
They also lead in destroying your own country and science and tech industries. And soon they’ll be the number one authoritarian state too! And have biggest bestest king of them all lmao.
Every week new products are released from you guess where: the US. Products used by people all over the world. US is doing pretty great compared to for example Europe. The US is not becoming an authoritarian state. Its a country lead by companies and institutions. Its just a bit clearer now. But its nothing different than 10 years ago
European projects are often long and ponderous, but they do deliver. There's a long history of state-sponsored academic collaborations, like the venerable CERN.
