Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cloudflare claimed they implemented Matrix on Cloudflare workers. They didn't

tech.lgbt

Post reply on HN
Print view View original

151–160 of 231 posts

Re: Cloudflare claimed they implemented Matrix on Cloudflare workers. They didn't

#151

Post by ampersandy »

My charitable read on this is that an individual vibe-coded both the post and repository and was able to publish to the Cloudflare blog without it actually being reviewed or vetted. They also are not an engineer and when the agent hallucinated “I have built and tested this and it is production grade,” they took it at face value.

You can tell since the code is in a public repository and not Cloudflare’s, which IMO is the big giveaway that this is a lesson for Cloudflare in having appropriate review processes for public comms and for the individual to avoid making claims they cannot substantiate or verify independently.

Re: Cloudflare claimed they implemented Matrix on Cloudflare workers. They didn't

#152

Post by CharlesW »

etchalon wrote: post #3

I've never thought someone should be fired based on a blog post but man, this comes real close.

This appears to be the author's first blog post for Cloudflare, Cloudflare being the author's first post-military employer. For his sake and Cloudflare's, this deserves an AAR that I hope becomes a teachable moment for both.

Re: Cloudflare claimed they implemented Matrix on Cloudflare workers. They didn't

#153

Post by sally_glance »

parliament32 wrote: post #119
PUSH_AX wrote: post #110

Earlier quoted context omitted.

Wait, we think they’re lying because an advisory was eventually found? We think that should be impossible with people involved?

If you're asking in good faith, > Every line was thoroughly reviewed and cross-referenced with relevant RFCs The issue in the CVE comes from direct contradiction of the RFC. The RFC says you MUST check redirect uris (and, as anyone who's ever worked with oauth knows, all the functionality around redirect uris is a staple of how oauth works in the first place -- this isn't some obscure edge case). They didn't make a m…

I mean, you can't review or cross reference something that isn't there... So interpreting in good faith, technically, maybe they just forgot to also check for completeness? /s

Re: Cloudflare claimed they implemented Matrix on Cloudflare workers. They didn't

#154

Post by [deleted] »

renyicircle wrote: post #150

I'd love to see a root cause analysis post by Cloudflare for this one. The ones they do after outages are always interesting to read. How did this make it into the blog? What is the review process for these posts and what failed this time? What measures will be taken to restore Cloudflare blog's reputation?

[deleted]

Re: Cloudflare claimed they implemented Matrix on Cloudflare workers. They didn't

#155

Post by dingnuts »

strange_quark wrote: post #124
blibble wrote: post #29

Earlier quoted context omitted.

it seems as if literally everyone associated with "AI" is a grifter, shill (sorry, "Independent Researcher"), temporarily embarrassed billionaire, or just a flat out scammer I have yet to see a counter-example

I have a feeling that AI psychosis is more prevalent than we realize, especially in software.

[dead]

Re: Cloudflare claimed they implemented Matrix on Cloudflare workers. They didn't

#156

Post by ethin »

augusteo wrote: post #26

Technical blogs from infrastructure companies used to serve two purposes: demonstrate expertise and build trust. When the posts start overpromising, you lose both. I don't know enough about this specific implementation to say whether "implemented Matrix" is accurate or marketing stretch. But the pattern of "we did X" blog posts that turn out to be "we did a demo of part of X" is getting tiresome across the industry.…

They can't do that though. If they did, it would make the shareholders and CEOs mad because it would demonstrate that LLMs cannot (yet) deliver on all the promises these CEOs have been claiming for this entire time.

Re: Cloudflare claimed they implemented Matrix on Cloudflare workers. They didn't

#158

Post by ncruces »

So the original post had this added to the top:

> This post was updated at 11:15 a.m. Pacific time to clarify that the use case described here is a proof of concept. Some sections have been updated for clarity.

But then the bottom still says:

> Our team is using Matrix on Workers, handling real encrypted communications. It is fast, it is cheap, and it is arguably one of the most secure ways to deploy a homeserver today.

Which one is it?

Re: Cloudflare claimed they implemented Matrix on Cloudflare workers. They didn't

#160

Post by philipwhiuk »

ncruces wrote: post #158

So the original post had this added to the top: > This post was updated at 11:15 a.m. Pacific time to clarify that the use case described here is a proof of concept. Some sections have been updated for clarity. But then the bottom still says: > Our team is using Matrix on Workers, handling real encrypted communications. It is fast, it is cheap, and it is arguably one of the most secure ways to deploy a homeserver tod…

I guess they're dogfooding something that's wildly insecure and incomplete internally. Kind of surprising that's allowed on CloudFlare's internal network if true, but I guess shadow-IT is everywhere.
Post reply on HN