eastdakota

I wish we (and the rest of the world) were as organized as it’d take to support conspiracy theories. Easier explanation probably is that I just woke up about 90 minutes ago. HN is about #9 on the list of things I check every morning. Saw this post and thought: “Oh not this again!” Pinged our team to get latest status since I hadn’t thought about archive.is in several years. And then jumped into the comments.

But your story is way more fun, makes us look way more organized, and, frankly, would give me hope that there are really smart people out there organizing and planning the chaos. So let’s go with yours.

We’ve tried. The owner of Archive.is actively monitors and then returns bad results. This is true even if we recurse through another recursor. It’s a very odd hill to die on.

In this particular case we truncate EDNS to protect the privacy of users because we believe 1) privacy is a fundamental human right; and 2) the original sin of the Internet is that IP addresses are too closely tied to the identities of individuals and services. Truncating EDNS is trying to honor #1 and overcome #2. So is our work on protocols like Oblivious DNS. This work, frankly, upsets some of our customers or potential customers (like Archive.is). But it’s the right thing to do for the long term health of the Internet.

And today it’s over 250. And the only site I’m aware of that objects to us protecting user privacy by making EDNS more private is this one. ¯\_(ツ)_/¯

Cloudflare has supported a free IPv4 to IPv6 gateway for IPv6-only web servers since 2011: https://blog.cloudflare.com/introducing-cloudflares-automati...

If you need more than web traffic, you can use our Tunnel service.

Think you’re supposed to be on vacation.

The SEC could throw me in jail. And, sure, you could believe that the FBI or whoever could tell the SEC what to do. We have European and Asian investors too, so their financial regulators could also sue me personally for lying. Perhaps the FBI/CIA/NSA control them too? Gets tricky to believe: the bigger the conspiracy the faster it falls apart. It's really, really hard to be part of some grand conspiracy as a public company.

No they don't.

Agree #5 is the riskiest right now with the Quad9 decision in Germany and some of the cases we're facing in Italy, Austria, and elsewhere. The copyright industry has decided that DNS is their new target; never mind that anyone can setup their own local DNS resolver. Good news: those are extremely public cases. And, if we lose, we'll make a lot of news about how dangerous they are. If you're in Europe, it'd be really helpful for more people to be telling the courts and legislatures: DNS is not the right place to try and censor the Internet.

I think we'd consider them "law enforcement agencies." But, for the sake of complete clarity, I'm happy to say that we haven't done any of these for the CiA or NSA or any non-US equivalent.

I'll state right here: all these are still true. We'll get the canary updated. Checking with legal and trust & safety why it hasn't been for so long. Likely just slipped someone's mind. Will make sure that doesn't happen again.

Sorry for the delay. I was writing our Q2 earnings script rather than checking HN. And John (CTO) is in Lisbon where he's probably just waking up. Also: he's on vacation this week.

These threads amuse me.

If adamgamble's speculation were the case, I'd go to jail for things I'd have illegally signed in our SEC disclosures attesting to the sources of our revenue and any government contracts. Suffice it to say, I like not being in jail. It's really, really hard for public companies to be part of some grand conspiracy for so many different reasons. So… once we went public I kind of thought this silly speculation would end. But guess not.

Beyond that, if you think about it, it's a way better business to run Cloudflare and serve the world than serve some US intelligence entity. That's just per se true. So if that's the case why would we ever do anything that would remotely compromise the trust necessary to, you know, be Cloudflare?

Lastly, here's a funny story. Early in our history one of our investors suggested that we talk to In-Q-Tel. Here's how naive Michelle and I were: we had no idea it was the CIA's venture capital arm. So we showed up in their office on Sand Hill Road. It was weirdly austere compared with other VCs we'd visited. And lots of security cameras. The partner at some point came out and greeted us. As he was walking us back he looked back right before we crossed the threshold back to the inner offices, "You're both American citizens, right?"

"No," Michelle said. "I'm Canadian."

"Oh." the VC said. Then you can't come back here.”

"I'm not going back there without her," I said.

"Ok, well, I guess we'll have to do the meeting in the reception area," decided the In-Q-Tel VC.

We had a very cordial meeting and then left. As we were driving away Michelle said, "Those guys were weird." And that was the end of that. Never talked to In-Q-Tel again.

But maybe it's the Canadian equivalent of the CIA/FBI/NSA we're beholden to??! ;-)

Hmm. Don't think that's intentional. Will ping legal and policy team and make sure they get a heartbeat published ASAP.

I was 34 when I started Cloudflare and had had every random job from bartender to LSAT test prep instructor to adjunct law professor. Eric, incidentally, is one of the kindest, most curious people I’ve had a pleasure to get to know on this journey. Feel lucky to call him a friend. Truly great guy.

We give domain registration away at cost. The only reason that makes sense for us is if some of the people who register use our services. Key to using our services is using our name servers. So someone who uses our registrar but not our name servers is a complete loss to us — we literally lose money on the payment processing and anticipated support fees. There are lots of other registrars and we make it easy to transfer away if you need to use other name servers for some reason. But if our registrar business weren’t lead generation for our other services then it wouldn’t make sense for us to have a registrar business at all.

Agree that’s the right analysis for many people. Wasn’t arguing whether you should start a startup or not. Just that if you do bootstrapping isn’t inherently better than raising venture capital.

Your broader point is important too: startups are unfortunately too often a luxury of the upper class. It is extremely scary to take a risk when you don’t have a safety net. I was personally broke when we started Cloudflare and had to borrow money from my mom to pay my rent. But I could borrow money from my mom. And I had a mom and a family that if I failed would make sure I didn’t go hungry. My family wasn’t anything close to what I now see really rich looks like, but we weren’t scraping by. Had I not had that safety net I don’t think I’d have had the confidence to start Cloudflare. And I think that’s a real issue with entrepreneurship we don’t talk enough about.

I don’t think IPO was success. It was just another fundraising event. Another step in the journey. And, per this discussion, the end of our VC journey and beginning of our public company journey.

“Profitability” is a funny term on Hacker News. Think most people here aren’t accountants so they think of profitability as: do you have more cash in the bank at the end of the period than you did at the beginning. That’s “free cash flow profitable.” By that measure, we’ve been profitable the last ~12 months and have said we expect to be so every year going forward. We’ve had non-GAAP operating profits even longer. So next up is GAAP profitability, which I am confident we’re on a path to. We want to emulate Microsoft’s accounting financials, not Salesforce’s.

Even that won’t be “success.” Just another step in the journey. Success to me is living up to our mission of helping build a better Internet. Don’t get me wrong, financing and accounting milestones are all critical to us doing that. If we were burning through cash it would be hard for us to fulfill our mission. But I show up to work every day because I see the positive impact our team is making toward a more secure, more reliable, faster, more private, and more efficient Internet for everyone. Only steps toward that represent success to me.

It’s fine if that’s your expectation. It’s fine if you’re bootstrapping and comfortable with your level of success. It’s hard if you thought you were building a rocket ship, raised money selling the vision of the rocket ship, and benchmark your success versus others who built rocket ships.

What a depressingly nihilistic world view. Certainly if you believe you are beholden to some entity’s rules you must follow then all you can ever learn is what the entity you follow is willing to teach. We took a different path.

We talked to our investors generally four times a year at Board meetings. We had a rule that no sentence we said in those meetings could end with a question mark. We recognized that we were the experts in our business. We used those checkins as opportunities to confirm ourselves that we were making progress. We focused on building great products for our customers and chose the KPIs to report based on measuring that. And we leveraged our success to meet thousands of people we’d never have had access to and try and learn from them all.

One thing that I think is natural if you have professional investors but is important to find way to create even if you’re bootstrapped: the regularly scheduled check-in. The most valuable part of a Board meeting isn’t the meeting itself. It’s the preparation for that meeting which forces you to assess how things are going.

Our trick was to pick 5 KPIs that indicated the true health of the business and track them relentlessly. The first 12 pages of our Board meeting presentation was exactly the same every time other than the numbers being updated. We picked the the metrics. We didn’t ask for our VCs input. But then we relentlessly stuck with them, quarter after quarter. It made preparing for Board meetings easy: just update the stats and prepare to talk about whatever is anomalous (good or bad). And the consistency built confidence from our investors. I remember one saying: “Cloudflare Board meetings are great: I know exactly how things are going by slide 4 of the presentation.”

No VC taught us that. We learned it by being curious, talking to other entrepreneurs, and experimenting ourselves. You can do the same if you’re bootstrapped, you just have to be more self-directed to create some cadence to check in with your business and keep yourself honest.

PS - sadly, there’s no Illuminati running the world either. “Sadly” because it’d certainly be comforting to think someone was in control and it’s scary to meet the people who supposedly are and realize they’re just making it up as they go along too.

Yup, that’s one big reason people keep up The Slog. It’s even an honorable one. But, knowing people who are 10+ years into that journey, it can be extremely painful.

Thank you for posting. We could never have built Cloudflare without Lee. His disease is incredibly tragic and in many ways literally unimaginable. Today he is still alive but has continued to cognitively decline. I am happy that Cloudflare’s success has ensured he has the support he needs. I miss having him as a cofounder and friend every day.

Agree.

Indeed! And an honorable failure — where you learned a ton, tried your best to succeed, but it just didn’t work — is a terrific outcome. We acquihire “failed” startups quite regularly. The founders of those companies have often turned into some of our best senior engineering and product leaders. And some of them go on to then leave after learning from us to give a startup a go again.

Success or failure aren’t the bad startup outcomes. The worst startup outcome is The Slog. The Slog sucks. I have several friends stuck in The Slog. Symptoms: you’re growing just barely enough to hold things together (call it 10–20% YoY on <$200k in revenue per employee). You keep thinking the next big thing is just over the horizon. You have a handful of customers who say they love you but won’t buy any more from you. Every once in a while you get some press or show up on HN saying you’re cool.

THAT is the recipe for disaster. You can wake up and realize 10 years have passed and you have nothing (economically, educationally, or emotionally) to show for it. It’s possible both with bootstrapped and VC-backed startups. The Slog is the worst startup outcome.

Bad VCs can definitely make The Slog worse. There’s so much money in the system there’s almost always someone who will put more in, even if on worse and worse terms. Good VCs, on the other hand, can help get you out of The Slog. They can counsel you when it’s time to give up. They can introduce you to potential acquirers. And while it may not be a huge financial win for you or them, it’s a much better outcome than slogging on indefinitely.

You still eventually need to return money to your private market investors at some point. So that just pushes the outcomes out later. Or, again, in the super rare case that you’re generating so much case that you can pay investors back at a rate of return they’re happy with with dividended cash flows.

The lottery is not a very good analogy. Let’s look at worst cases. In the lottery you put in cash and usually get nothing back. You literally learn nothing because every draw is random. At a VC-backed startup someone else gives you money. With that money you’re expected to pay yourself a salary. You get to learn at an incredibly fast rate on someone else’s dime. And you get that salary and learning even if your investors are awful and push you to do terrible things and you agree to do those terrible things and they tank the company. In the worst case, it’s a free education with room and board included. And, if it works, there’s a helluva upside.

So, lottery expected worst case: you lose all your money. VC-backed startup expected worst case: you learn a ton and end up no worse financially than you started.

As an aside, whether venture-backed or bootstrapped, having gotten to know a lot of successful founders the characteristic that seems to set them apart is their rate of learning. The best are relentlessly curious, always assume there’s something they don’t know, and seek to learn from as many people as possible.

You’re so right! It was an absolute disaster for us. Never do it!!!!!

Kidding aside, it is true that raising money from VCs puts you on a very defined path with really only three potential outcomes: 1) failure, 2) sell to acquirer, or 3) go public. There are a small handful of exceptions, mostly for companies that throw off massive amounts of cash, but, realistically, those are the outcomes.

If you don’t like any of those end states and what it realistically will take to get to them, don’t raise money from VCs.

But, having done so and been successful and taken a company public, I can say: it’s pretty great and I have zero regrets about anyone we raised money from. And I’m proud that everyone who invested in us prior to going public made at least a 10x return.

While there are plenty of VC horror stories, there are fairytales as well.

The stories we can tell about getting 1.1.1.1 and 1.0.0.1 to be reliably routable…

The solution, of course, is to ban private tutoring. Just like they did here: https://www.sixthtone.com/news/1008838

Proud to have bought a bunch of his original paintings and drawings of my home mountains when he put them up for sale a year ago. The artistry and practicality I find really beautiful.