Hacker News Reader

Hacker News

Comment by 7ewis | Hacker News Reader

Full thread

7ewis

I'm confused as to what this is. From what I can tell, it's a Lambda competitor?

I 'reserved' a domain, but haven't received an email yet.

View on HN

Yep, it's a Lambda competitor.

Basically it lets you run JS code on every request, much like Lambda. Differences:

1. It's JS but not Node.JS - You write against the service worker API and they run it in a vanilla V8. You'll want to webpack your stuff together or something like that.

2. Because it's V8 and not Node, they can run many customers in the same process (as safely as multiple sites can coexist in Chrome tabs), and therefore it's cheaper than Lambda.

3. It runs on the cloudflare edge nodes, i.e. close to the user, instead of some AWS region on the other side of the world, so latency can be lower. Can be, because for many (most?) use cases you'll still need to call some API somewhere else, eating up most latency wins you might make. They do also have a distributed KV store that might help you address this, however.

To add on to that last point, you don't need to pick in advance which region or regions your code will run in. You push your code once, and it will run in whichever edge locations receive requests, potentially all 165+ locations if you have users sufficiently spread around the world.

They also let you run WebAssembly in addition to JavaScript. It’s something I’m very excited about.

Why would you need to run wasm in a serviceworker? I thought wasm was most practical as bytecode in a client for things like games and such.

You can write non-JavaScript languages to do all the same tasks. It gives you more choice. That’s a good thing.

> as safely as multiple sites can coexist in Chrome tabs

Chrome tabs usually run in different processes. It sounds like Cloudflare is using JS isolates within the same process to run many customers.

This sounds scary to me. For security, the Chrome team assumes that any code running in the same process has access to the whole address space of that process due to all of the recent speculative execution issues (Spectre/Meltdown).

I've seen comments on HN say that this isn't a problem for cloudflare because they do special things with all of JS timing APIs and a few others to mitigate.

Will be interesting if they are able to make this secure. Millisecond cold startup times will be amazing for development.

> This sounds scary to me.

Well, maybe I'm wrong :-) my relationship with CloudFlare ends at me being a customer, there is a significant chance that my impression of how Workers (or its security setup) works is wrong. If you want to be sure, ask CF.

In the conclusion of a recent Spectre paper published by a number of Google security researchers they write:

"The community has assumed for decades that programming language security enforced with static and dynamic checks could guarantee confidentiality between computations in the same address space. Our work has discovered there are numerous vulnerabilities in today’s languages that when run on today’s CPUs allow construction of the universal read gadget, which completely destroys language-enforced confidentiality"

CloudFlare believes this doesn't apply to them and that they have created defences which allow them to run multiple customers' code in the same address space without leaking memory. I think the burden of proof is on CloudFlare, and I'm yet to see them actually publish any information about this.

Regarding point 3, you can run Lambda on edge nodes too — Lambda@Edge, which uses CloudFront.

Although as you say, whether that ends up reducing latency in particle depends very much on your use case.

Lambda@Edge is very limited, you, for example, cannot make requests to arbitrary hosts from an @Edge.

That’s not quite true. They do have different limits than regular Lambda functions, but you can certainly make requests to arbitrary hosts. The documentation puts it like this:

> Functions triggered by origin request and response events as well as functions triggered by viewer request and response events can make network calls to resources on the internet, and to AWS services such as Amazon S3 buckets, DynamoDB tables, or Amazon EC2 instances.

Looks like a cloud based JavaScript V8 runtime (NodeJs-like?). $5 minimum/month ($0.50/million requests after the first 10 million). Here's an article[0].

Seems like an interesting service for someone, to do something...

[0] https://blog.cloudflare.com/cloudflare-workers-unleashed/

One way to think about it is: why not do everything on top of a network like Workers? Does it actually make sense to deploy services to a single location when they can be trivially started up near every user?

Since the workers are stateless, you may want to have your services closer to the data store, instead of the user.

More and more distributed data stores are becoming available. We (Cloudflare) have a KV [1] which can be read quickly everywhere.

[1] - https://blog.cloudflare.com/building-with-workers-kv/

Reply on news.ycombinator.com