Kenton Varda
Engineer at Cloudflare who designed Workers, Durable Objects and Cap’n Proto; earlier the primary author of Protocol Buffers v2 at Google, and co-founder of Sandstorm.io.
Everything they publish, on ppll ↗ Who they are, on wiqqi ↗
Kenton Varda did not write this page.
We collected these quotes from things they published elsewhere, and every quote links to where it was said. They have no account here and have not endorsed this site. Quotes are word for word; the short line under each one is our own restatement, not their wording. Their own site. Is this you? Claim it or ask us to remove it. Or tell us what is wrong here.
The line under a date shows how recently it was said: empty within a month, full after three years.
-
Their wordsEven the best benchmarks have bias and tradeoffs. It's difficult to create a benchmark that is truly representative of real-world performance, and all too easy to misinterpret the results of benchmarks that are not.
↗Unpacking Cloudflare Workers CPU Performance Benchmarksblog.cloudflare.com
- 13 months earlier
-
Their wordsEven if it does have to go to disk, it's a local SSD. You might as well consider the local disk as just another layer in the memory cache hierarchy: L5 cache, if you will.
↗Zero-latency SQLite storage in every Durable Objectblog.cloudflare.com
-
Their wordsMore importantly, though, synchronous queries help you avoid subtle bugs. Any time your application awaits a promise, it's possible that some other code executes while you wait. The state of the world may have changed by the time your await completes.
↗Zero-latency SQLite storage in every Durable Objectblog.cloudflare.com
- 6 months earlier
-
Their wordsRPC is often accused of committing many of the fallacies of distributed computing. But this reputation is outdated. When RPC was first invented some 40 years ago, async programming barely existed. We did not have Promises, much less async and await. Early RPC was synchronous: calls would block the calling thread waiting for a reply. At best, latency made the program slow. At worst, network failures would hang or crash the program. No wonder it was deemed "broken".
↗We've added JavaScript-native RPC to Cloudflare Workersblog.cloudflare.com
-
Their wordsThe fact is, RPC fits the programming model we're used to. Every programmer is trained to think in terms of APIs composed of function calls, not in terms of byte stream protocols nor even REST. Using RPC frees you from the need to constantly translate between mental models, allowing you to move faster.
↗We've added JavaScript-native RPC to Cloudflare Workersblog.cloudflare.com
- 4 days earlier
-
Their wordsEven if you have systems in place to deliver auth keys to services securely (like Workers Secrets), if the key is just a string, the service itself can easily leak it. For instance, a developer might carelessly insert a log statement for debugging which logs the service's configuration – including keys. Now anyone who can access your logs can discover the secret, and there's probably no practical way to tell if such a leak has occurred.
↗Why Workers environment variables contain live objectsblog.cloudflare.com
-
Their wordsMuch of this pain comes about because connecting a server to a resource today involves two steps that should really be one step: Configure the server to point at the resource. Configure the resource to accept requests from the server.
↗Why Workers environment variables contain live objectsblog.cloudflare.com
-
Their wordsDesigning code to be DI-friendly sometimes seems tedious, but every time I've done it, I've been incredibly happy that I did.
↗Why Workers environment variables contain live objectsblog.cloudflare.com
- 8 months earlier
-
Their wordsFrankly, I should have declared 1.0 a long time ago – probably around version 0.6 (in 2017) or maybe even 0.5 (in 2014).
-
Their wordsAs discussed above, this is opt-in today, but in practice I find it’s almost always desirable, and disallowing it can lead to subtle problems.
- 10 months earlier
-
Their wordsSome in the industry prefer to call nanoservices "functions", implying that each individual function making up an application could be its own service. I feel, however, that this puts too much emphasis on syntax rather than logical functionality.
↗Introducing workerd: the Open Source Workers runtimeblog.cloudflare.com
-
Their wordsFirst, we can now restrict the global fetch() function to accept only publicly-routable URLs. This makes applications totally immune to SSRF attacks! You cannot trick an application into accessing an internal service unintentionally if the code to access internal services is explicitly different.
↗Introducing workerd: the Open Source Workers runtimeblog.cloudflare.com
- 11 months earlier
-
Their wordsIn the old world, if the Node.js maintainers decide to make a breaking change to an obscure API between releases, it's OK. Downstream developers are expected to test their code before upgrading, and address any breakages. But in the serverless world, it's not OK: developers have no control over when upgrades happen, therefore upgrades must never break anything.
↗Backwards-compatibility in Cloudflare Workersblog.cloudflare.com
-
Their wordsBut what if the test only worked because of a bug in the underlying platform that caused it to do the right thing by accident? Well, that's the platform's fault. The developer did everything they could: they tested their code thoroughly, and it worked.
↗Backwards-compatibility in Cloudflare Workersblog.cloudflare.com
-
Their wordsSecond, part of the promise of serverless is that developers shouldn't have to worry about updating their stack. If we start letting people pin old versions, then we have to start telling people how long they are allowed to do so, alerting people about security updates, giving people documentation that differentiates versions, and so on. We don't want developers to have to think about any of that.
↗Backwards-compatibility in Cloudflare Workersblog.cloudflare.com
- 3 months earlier
-
Our reading
The worst thing an application can do is tell a user their action succeeded when it did not.
Their wordsThe worst thing an application can do is tell the user that their action was successful when it wasn't. If, for some reason, a write cannot be completed, then it's imperative that the application presents an error to the user, so that the user knows that something is wrong and they'll have to try again or look for a fix.
↗Durable Objects: Easy, Fast, Correct — Choose threeblog.cloudflare.com
-
Their wordsConcurrency is hard. It doesn't matter if you're a novice or an expert: even experts regularly get it wrong. It's difficult to think about all the ways that concurrent operations might overlap to corrupt your application state.
↗Durable Objects: Easy, Fast, Correct — Choose threeblog.cloudflare.com
- 12 months earlier
-
Their wordsOn one hand, V8 is an extraordinarily complicated piece of technology, creating a wider "attack surface" than virtual machines. More complexity means more opportunities for something to go wrong. On the bright side, though, an extraordinary amount of effort goes into finding and fixing V8 bugs, owing to its position as arguably the most popular sandboxing technology in the world.
-
Our reading
No one has fixed Spectre, not even with heavyweight virtual machines; everyone is still vulnerable.
Their wordsA dirty secret that the industry doesn't like to admit: no one has "fixed" Spectre. Not even when using heavyweight virtual machines. Everyone is still vulnerable.
-
Their wordsIt is abundantly clear that many more vulnerabilities exist, but haven't yet been publicized. Who might know about those vulnerabilities? Most of the bugs being published are being found by (very smart) graduate students on a shoestring budget. Imagine, for a minute, how many more bugs a well-funded government agency, able to buy the very best talent in the world, could be uncovering.
-
Their wordsPopular security culture often dwells on clever hacks and clean fixes. But for the difficult real-world problems, often there is no right answer or simple fix, only the hard work of building defenses thicker and thicker.
- 2 years earlier
-
Their wordsWe believe the true dream of cloud computing is that your code lives in the network itself. Your code doesn't run in "us-west-4" or "South Central Asia (Mumbai)", it runs everywhere.
- 19 months earlier
-
Their wordsPrivacy, security, ownership, and mobility are all important, but I feel there is a much more important goal that is often poorly understood: The most important reason to decentralize is software—and developer—diversity.
-
Their wordsThe only way to solve these problems is by decentralizing the software (not just the storage). Software must be provided as a package – not as a service – with each user running their own private copy.
- 2 years earlier
-
Their wordsIn today’s popular software-as-a-service model, indie development simply is not viable. People do it anyway, but their software is not accessible to the masses. In order for low-budget software to succeed, and in order for open source to make any sense at all, users must be able to run their own instances of the software, at no cost to the developer.
↗Open Source Web Apps Aren't Viable; Let's Fix Thatsandstorm.io
-
Their wordsSoftware-as-a-Service and open source just don’t make sense together. It’s not really open source if you can’t run modified code, and the high barrier to entry shuts out hobby projects or anything unwilling to be monetized.
↗Open Source Web Apps Aren't Viable; Let's Fix Thatsandstorm.io
The line under a date fills as the words age, a quarter at a time: past a month, six months, a year, and three years. Empty means said within the last month; full, more than three years ago. It says when, not whether it still holds — a change of mind is marked on the claim itself.
Dashed means we only know the words existed by that date; they may be older.