Today we are releasing Cloudflare OS, a chatbot with connectors, just like every other tech company is doing.
Except actually, it's different. This is a remake of Sandstorm[.]io, my startup from 10 years ago, except this time built on Cloudflare Workers (the platform I've spent the last 9 years building) and deeply leveraging AI. This is more or less the culmination of my secret 10-year master plan.
This is a full-on personal app vibe coding platform, in which the sandbox is so secure that you can pretty much go wild -- the AI cannot introduce a significant security bug. We believe a company's security team can feel comfortable giving non-technical users permission to vibe code and then sleep soundly at night.
How is that possible? It's the Sandstorm security model, revisited. A "Gadget" is the same thing as a Sandstorm "Grain": a fine-grained app instance. For example, if you have a document editor app, each document runs as a separate instance of the app, in a separate sandbox (one "Gadget").
This means two things, both of which I think are Big Deals:
1. The platform can manage all access control, by controlling who can access the Gadget at all. There is no way the Gadget can accidentally leak itself to an attacker -- even an attacker who has access to other Gadgets based on the same app.
2. Since everyone is running their own copy of the code, everyone can freely modify their copy of the code.
Think about #2 a bit more.
What if, when you wanted a new feature in the software you are using, you could just prompt your agent to add it?
This doesn't work in the cloud Software-as-a-Service model, because you are not running your own copy of the app.
Sandstorm tried to change that 10 years ago, but the world wasn't ready, because not enough people had the skills or patience to actually modify their software. AI has changed that. Now you just ask the agent -- the same agent that you are using to help you interact with the Gadget can also modify the code of the Gadget.
And it is so fun.
rozenmd
Everytime I read about new things from Cloudflare they look really cool but I cannot shake the feeling of not wanting to use them for fear of lock-in, am I too paranoid?
yomismoaqui
"OS for work" - like, what does it mean? OS is operating system, it runs on a hardware and provides you to operate the system. I hate when companies destroy the English language with vibe invented terms.
fnoef
Why are companies slapping "OS" in their product naming? it's stupid
thehamkercat
I'm mostly going off the tweet, it could be I just don't understand, but how do you managed shared data if everyone has their own copy of the code and they can add whatever features they want? I mean, I'm assuming that any sort of significant feature requires some sort of change to the data model, and even with a schema-less database you could have conflicts if two things use the same field name, for instance? Also what happens with updates? Like, part of IT is keeping people up to date, but if everyone has their own bespoke customizations how do you not clobber those?
Also the security story doesn't completely add up to me. Like, if I'm a user and I can just add features that I want, what's to stop me from placing data in there that's maybe covered under HIPPA or some other sensitive data (protected class, or even just stuff like authentication information)? Right now a small number of people need to think about data security, but this seems like it'd extend it to anyone? That kind of data, it's not just about "keeping it internal by default", there are a lot of rules around storing it at all.
I dunno, it kind of makes me think of when people suggest forking an open source project if the maintainers won't accept a suggestion. Sure, you can do that, and it does happen, but you're also basically signing up to maintain it for decades. I'm not sure if anyone wants to maintain Alice in accounting's very weird spreadsheet app 10 years after she's left the company?
(Again I'm not throwing shade, just trying to understand better)
overgard
This represents a small part of what IT is worried about. Offer a beer and say the word "SharePoint" if you want the long version of where this could wind up.
The issue isn't letting end-users add features. The issue is twelve end-users customizing something that produces output, saving it, and now nobody can read it.
This can get solved. If it even gets a chance to gain traction (it should, though IT will of course push back). But let's not pretend we're there yet.
badlibrarian
Why do people add "OS" to their product/project name when it is not an OS at all?
q8zd3
So, a security-oriented cloud agent framework? Better call it an OS.
alansaber
This is effectively a Codex/Claude app competitor. Good move from Cloudflare since it helps them sell their core infra offerings. I like the direction they’re going with access control.
wxw
I know the CloudFlare CEO reads HN.
Every day I see so much cool shit from that org, that as a one man band I just can't trust because there's no billing cap/prepaid billing.
comments (10)
Text from tweet:
Today we are releasing Cloudflare OS, a chatbot with connectors, just like every other tech company is doing.
Except actually, it's different. This is a remake of Sandstorm[.]io, my startup from 10 years ago, except this time built on Cloudflare Workers (the platform I've spent the last 9 years building) and deeply leveraging AI. This is more or less the culmination of my secret 10-year master plan.
This is a full-on personal app vibe coding platform, in which the sandbox is so secure that you can pretty much go wild -- the AI cannot introduce a significant security bug. We believe a company's security team can feel comfortable giving non-technical users permission to vibe code and then sleep soundly at night.
How is that possible? It's the Sandstorm security model, revisited. A "Gadget" is the same thing as a Sandstorm "Grain": a fine-grained app instance. For example, if you have a document editor app, each document runs as a separate instance of the app, in a separate sandbox (one "Gadget").
This means two things, both of which I think are Big Deals: 1. The platform can manage all access control, by controlling who can access the Gadget at all. There is no way the Gadget can accidentally leak itself to an attacker -- even an attacker who has access to other Gadgets based on the same app. 2. Since everyone is running their own copy of the code, everyone can freely modify their copy of the code.
Think about #2 a bit more.
What if, when you wanted a new feature in the software you are using, you could just prompt your agent to add it?
This doesn't work in the cloud Software-as-a-Service model, because you are not running your own copy of the app.
Sandstorm tried to change that 10 years ago, but the world wasn't ready, because not enough people had the skills or patience to actually modify their software. AI has changed that. Now you just ask the agent -- the same agent that you are using to help you interact with the Gadget can also modify the code of the Gadget.
And it is so fun.
rozenmd
yomismoaqui
fnoef
thehamkercat
Also the security story doesn't completely add up to me. Like, if I'm a user and I can just add features that I want, what's to stop me from placing data in there that's maybe covered under HIPPA or some other sensitive data (protected class, or even just stuff like authentication information)? Right now a small number of people need to think about data security, but this seems like it'd extend it to anyone? That kind of data, it's not just about "keeping it internal by default", there are a lot of rules around storing it at all.
I dunno, it kind of makes me think of when people suggest forking an open source project if the maintainers won't accept a suggestion. Sure, you can do that, and it does happen, but you're also basically signing up to maintain it for decades. I'm not sure if anyone wants to maintain Alice in accounting's very weird spreadsheet app 10 years after she's left the company?
(Again I'm not throwing shade, just trying to understand better)
overgard
The issue isn't letting end-users add features. The issue is twelve end-users customizing something that produces output, saving it, and now nobody can read it.
This can get solved. If it even gets a chance to gain traction (it should, though IT will of course push back). But let's not pretend we're there yet.
badlibrarian
q8zd3
alansaber
wxw
Every day I see so much cool shit from that org, that as a one man band I just can't trust because there's no billing cap/prepaid billing.
AussieWog93