Hacker Newsnew | past | comments | ask | show | jobs | submit | kentonv's commentslogin

Yes, the Cloudflare Workers Runtime is open source: https://github.com/cloudflare/workerd

You can definitely run workerd in production on your own machines and some people do.

The biggest catch is that workerd's implementation of Durable Objects currently doesn't work across multiple machines, but I'm working on fixing that: https://github.com/cloudflare/workerd/pull/6780


> bcryptjs reaches for crypto.randomBytes and a few other Node primitives that aren't polyfilled in Workers.

crypto.randomBytes is definitely in Workers' node compat layer. Is it possible you didn't enabled the node_compat flag?

https://developers.cloudflare.com/workers/runtime-apis/nodej...

I guess maybe it's time we turned this on by default...


You're right — corrected: https://finterm.xyz/blog/nextjs-on-cloudflare-workers.

Argon2id was my choice eventually for OWASP reasons

On-by-default nodejs_compat would be welcome - Thanks!


archive.is is malicious -- as in, uses your browser to launch DDoS attacks, and other things.

Stop using it.

https://arstechnica.com/tech-policy/2026/02/wikipedia-bans-a...


> archive.is is malicious -- as in, uses your browser to launch DDoS attacks, and other things.

I think the attack was itself a response to a doxxing attempt. Also, archive.is being a free service doesn't quite fit with claiming they are malicious. The overall picture seems still positive.


I don't care what the attack is responding to, nor do I care what services are being provided.

If, when I visit your site, your site causes my browser to participate in a DDoS attack without my knowledge, your site is malicious.


If you didn't care about the service you wouldn't visit their website in the first place, in which case there is no problem.


Is the person behind archive.today the same operator as archive.is?


Yes, they have a number of domain names, archive.is and archive.today are the most well known ones.


Just run in the console window=null and you are good. It is valuable service until the websites get their shit together and finally fix their payments model.


Is there an alternative?


https://removepaywalls.com/https://www.wired.com/story/when-...

Works for me. I use only Tor so it is actually far more accessible. Archive.is uses Google's Recaptcha, which for some reason rejects valid solutions submitted via Tor.


I’m not sure that is always a valid CAPTCHA and not one being proxied to you for solving it on behalf of some bot (presumably a crawler).


I don't know. I think people would notice if Google were being MITM'd on Tor.


You don’t need to MITM it, this was a common pattern for a long time (not sure it still works though). There was no origin verification so you could just use a different site ID and have people respond to captchas you encountered on that site.


Come on, folks. This is not a conspiracy.

LLMs have a knowledge cutoff date. Opus 4.7's documented cutoff date is in January. Older Claude models are earlier than that.

OpenClaw didn't have the name OpenClaw until January 30th. So indeed, even the latest Claude model does not know what OpenClaw is, unless you have it do a web search. If you have it search, it'll happily tell you all about it.


Knowledge cutoff is completely insufficient as an explanation.

These models have access to a web search tool. Gemini and ChatGPT both happily search for give info on OpenClaw. Claude denies all knowledge.

What’s more it’s this part that’s very concerning.. Banned for wrong think..

> I gave it a direct link to openclaw.ai and the chat instantly ended and hit my 5hr usage limit.


Claude is notorious in my experience to lie directly to your face (even if its baffling) instead of using the web tool. I'll never prompt it without saying 'use web tool' Its ridiculous.


Claude does not use the web search tool unless it thinks there's a good reason to. If you nudge it to search, it will, and then it'll tell you all about OpenClaw. You can easily go try this yourself -- I just did. It works fine.

> I gave it a direct link to openclaw.ai and the chat instantly ended and hit my 5hr usage limit.

Again, go to claude.ai yourself and try it. It works fine. It happily tells you about OpenClaw.

Whatever happened to jrflo must have been a coincidence. It frankly doesn't make any sense for Anthropic to be trying to block this.


My guess is that it was an abuse filter over-keyed on OpenClaw pushing Claude to certain responses patterns.

Normally given a web search tool these models will search if they don’t know.


the model has no such magical access to tools.

it's the harness which responds to the models replies that has access to the tools.

I wish people would continue to reiterate this difference.


I said the model has access to a web search tool. Of course it’s the harness that provides that access.

I didn’t spell that out because it’s irrelevant detail, immaterial to the point I was making.


Except GP said they also pointed it to the source website to reference and then had the follow up weirdness.


Is the behavior the same with other unknown words? Certainly doesn't seem so from other comments.


Fair call.

I don't think couching it as conspiracy is the right frame either. This is not a one-off. I think a critical eye is warranted.


None of the three major Cloudflare outages in the past six months had anything to do with LLMs. They were regular old human mistakes.

We did, however, determine that at least one of them (and perhaps all) would have been easily caught by AI code reviewers, had AI code reviewers been in use. So now we mandate that. And honestly, I love it, the AI reviewer spots all sorts of things that humans would probably miss.

(We also fixed a number of problems around configuration that would roll out globally too fast, leaving no time to notice errors and stop a bad rollout, as well as cases where services being down actually made it hard to revert the change... should be in a much better place now. But again, none of that had to do with LLMs.)


> None of the three major Cloudflare outages in the past six months had anything to do with LLMs. They were regular old human mistakes.

Is that true? At least one of them seemed to involve LLM-written code from what I saw. (Not to say that human error wasn't _also_ a contributing factor, but I wouldn't say it had _nothing_ to do with LLMs).

> We did, however, determine that at least one of them (and perhaps all) would have been easily caught by AI code reviewers, had AI code reviewers been in use. So now we mandate that. And honestly, I love it, the AI reviewer spots all sorts of things that humans would probably miss.

The reviewer is decent, but the false positive rate is substantial, and the false negative rate is definitely nonzero. Not that you would know that the way our genius CTO talks about it...


> Not that you would know that the way our genius CTO talks about it...

Honestly I find it bizarre that there are people at Cloudflare who have this attitude. Without Dane, the company wouldn't be half the size it is today.


Something unexpected that LLMs robbed from us is to receive the grace of assuming we failed on our own e.g. good ol' fashioned human/organizational failure.


> about 68 degrees Fahrenheit (20 degrees Celsius)

Pet peeve: When the original source had only one significant figure ("20 degrees", probably the scientist rounded to the nearest 10 because it's approximate), but the reporter translates it to another unit with more ("68 degrees", makes it sound more exact).

This shows up all over the place. Temperatures quoted in Fahrenheit always seem more exact, just because naturally whatever science they originate from was inevitably done in Celsius and then someone else converted the number without understanding significant figures.

68°F in particular shows up all over the place (like, it's the recommended thermostat setting in the winter to save energy), and it sounds like it's some sort of exact thing, but usually "about 70°F" would be a more accurate representation of the original source.

Also we say that human body temperature is 98.6°F, and a fever is 100.4°F or higher. Wow those numbers are so exact! Four significant figures on the second one! But actually these just map to 37°C and 38°C. Americans are constantly unsure if 99.0°F counts as a fever but the rest of the world probably understands 37.2°C is not...


In Celcius, it's less common to round to the nearest 10 degrees (or say things like "in the twenties" as you might with Fahrenheit), because that makes a much larger difference than it does in Fahrenheit. So I wouldn't necessarily assume that "20 degrees" only has one significant digit unless it's explicitly stated. (I haven't checked the original paper, though.)

However, converting something like 21°C to 69.8°F is indeed silly and should just be 70°F.


You should assume that temperatures in scientific articles are accurate to the degree unless explicitly noted otherwise. In the vast majority of cases "routine" measurements are taken in Celsius with digital thermometers that display and are calibrated to one tenth.

Also don't significant figures only work within the same units? I believe for conversions you have to explicitly propagate error. You can skip that when moving between power of 10 units (as is typical when working in metric) using base 10 numbers but if the conversion doesn't match the base then the shortcut breaks.

> 68°F in particular shows up all over the place (like, it's the recommended thermostat setting in the winter to save energy)

I thought the recommended minimum setting to save energy was 55? Because any colder than that and you start risking pipes in enclosed spaces freezing due to temperature gradients.


20/68 is for human comfort/health.


Sure but isn't that less a recommendation and more just what people typically find comfortable? Once I've adjusted to the seasonal change, a bit above 70 in a cold climate in the winter and I start to feel fairly uncomfortable if I'm moving around at all.

If you need to save money you want to lower the thermostat as much as possible and then use blankets or if that won't work for whatever reason then a space heater in a small room.


> Not to mention the atrocious 3MB worker size limit

That's for the free plan.

Limits are documented here:

https://developers.cloudflare.com/workers/platform/limits/#w...


Well it's so far from Vercel that it's not even funny any more.

Good work on workers though, maybe the next generation of sandstorm will be built on CloudFlare in a decade or so after all the bugs have been hammered out.


You can farm out the requests to a bunch of Durable Objects. Each DO will have a separate six-concurrent limit. And you can send unlimited concurrent requests to Durable Objects. (This is not an exploit, this is working as intended. The concurrency limit exists to prevent creating excessive connections from a single machine; farming to DOs means the requests are spread out.)

Also note that as of recently, the concurrent limit applies only up to the point that response headers are received, not during body streaming.


Great tip. I knew about #2 which still doesn't help me but #1 is nowhere in their docs!


Cloudflare's Durable Objects puts your Worker and SQLite DB on the same physical server (and lets you easily spawn millions of these pairs around the world).

D1 is a simplified wrapper around DO, but D1 does not put your DB on the same machine. You need to use DO directly to get local DBs.

https://developers.cloudflare.com/durable-objects/

(I am the lead engineer for Cloudflare Workers.)


Very cool, thanks for the response!


Just a heads up, the naming might be a little confusing vs:

https://github.com/cloudflare/kumo


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: