Gadgets: Personal app vibe coding that is actually safe — Kenton Varda, Cloudflare

Okay. Hi. All right. I've got a lot to Okay. Hi. All right. I've got a lot to talk about, so I'm going to launch right talk about, so I'm going to launch right talk about, so I'm going to launch right into it here. Um, so Swix says that you into it here. Um, so Swix says that you into it here. Um, so Swix says that you only get to make one point at every only get to make one point at every only get to make one point at every talk, uh, one key takeaway. And so I talk, uh, one key takeaway. And so I talk, uh, one key takeaway. And so I figured I'd just lead with that. My, uh, figured I'd just lead with that. My, uh, figured I'd just lead with that. My, uh, key point is personal AI codegen breaks key point is personal AI codegen breaks key point is personal AI codegen breaks traditional cloud infrastructure. And to traditional cloud infrastructure. And to traditional cloud infrastructure. And to clarify what I mean about that, the word clarify what I mean about that, the word clarify what I mean about that, the word personal here is, uh, is is doing a lot personal here is, uh, is is doing a lot personal here is, uh, is is doing a lot of work. It's uh, loadbearing as cloud of work. It's uh, loadbearing as cloud of work. It's uh, loadbearing as cloud would say. Um my point is that um if we would say. Um my point is that um if we would say. Um my point is that um if we want to see this future where um want to see this future where um want to see this future where um everyone has personal apps and like can everyone has personal apps and like can everyone has personal apps and like can personalize uh the apps that they run um personalize uh the apps that they run um personalize uh the apps that they run um the infrastructure we're using today um the infrastructure we're using today um the infrastructure we're using today um for for software in general is is not for for software in general is is not for for software in general is is not the right thing and we need something the right thing and we need something the right thing and we need something completely different. So to explain what completely different. So to explain what completely different. So to explain what I mean um think about the way that uh uh I mean um think about the way that uh uh I mean um think about the way that uh uh software is produced and distributed software is produced and distributed software is produced and distributed today. You have a developer in an ivory today. You have a developer in an ivory today. You have a developer in an ivory tower who builds an app and then sends tower who builds an app and then sends tower who builds an app and then sends it down to the the people the users who it down to the the people the users who it down to the the people the users who use the app and many of them are happy use the app and many of them are happy use the app and many of them are happy with it but some of them are not. Some with it but some of them are not. Some with it but some of them are not. Some of them uh say this app needs uh some of them uh say this app needs uh some of them uh say this app needs uh some additional features for my use case and additional features for my use case and additional features for my use case and so they go to the developer and they say so they go to the developer and they say so they go to the developer and they say oh great developer will you please grant oh great developer will you please grant oh great developer will you please grant my feature request your app is literally my feature request your app is literally my feature request your app is literally unusable without it. And so then the the unusable without it. And so then the the unusable without it. And so then the the developer's representative, the product developer's representative, the product developer's representative, the product manager takes these feature requests and manager takes these feature requests and manager takes these feature requests and files them into Jira where they are files them into Jira where they are files them into Jira where they are never seen again. Um but sometimes

never seen again. Um but sometimes never seen again. Um but sometimes sometimes the product manager sees a sometimes the product manager sees a sometimes the product manager sees a feature request and says ah I you know I feature request and says ah I you know I feature request and says ah I you know I want that too and then that feature want that too and then that feature want that too and then that feature request goes onto the road map and the request goes onto the road map and the request goes onto the road map and the developer um works on it and the developer um works on it and the developer um works on it and the developer is implementing all these developer is implementing all these developer is implementing all these features features that uh you know each features features that uh you know each features features that uh you know each one is only used by a small subset of one is only used by a small subset of one is only used by a small subset of users and each one is adding all these users and each one is adding all these users and each one is adding all these if statements their code and making if statements their code and making if statements their code and making things messy and uh they don't like it things messy and uh they don't like it things messy and uh they don't like it because the codebase is becoming a mess because the codebase is becoming a mess because the codebase is becoming a mess and each of these features which is and each of these features which is and each of these features which is really kind of boring to implement. And really kind of boring to implement. And really kind of boring to implement. And so the developer says, "Ah, I know what so the developer says, "Ah, I know what so the developer says, "Ah, I know what I need to do. We need a rewrite. I need to do. We need a rewrite. I need to do. We need a rewrite. We need to we need a new architecture We need to we need a new architecture We need to we need a new architecture that has a plug-in system." And then that has a plug-in system." And then that has a plug-in system." And then every one of these features can be a every one of these features can be a every one of these features can be a plug-in and it can be nice and clean and plug-in and it can be nice and clean and plug-in and it can be nice and clean and easy to build and the core can stay easy to build and the core can stay easy to build and the core can stay clean. And so the developer goes off and clean. And so the developer goes off and clean. And so the developer goes off and starts working on the the new starts working on the the new starts working on the the new architecture with the plug-in system. architecture with the plug-in system. architecture with the plug-in system. and uh there are still feature requests and uh there are still feature requests and uh there are still feature requests coming in and the developer says,"Well, coming in and the developer says,"Well, coming in and the developer says,"Well, we can't do those features yet because we can't do those features yet because we can't do those features yet because uh we need the plug-in system. This will uh we need the plug-in system. This will uh we need the plug-in system. This will be so much easier once we have the be so much easier once we have the be so much easier once we have the plug-in system. And if we do it now, plug-in system. And if we do it now, plug-in system. And if we do it now, we're just delaying that and we'll just we're just delaying that and we'll just we're just delaying that and we'll just have to redo it later anyway." And so um have to redo it later anyway." And so um have to redo it later anyway." And so um the years go by and uh the new the years go by and uh the new the years go by and uh the new architecture is not ready yet and architecture is not ready yet and architecture is not ready yet and [snorts] none of the features are being [snorts] none of the features are being [snorts] none of the features are being implemented and people are saying, "What implemented and people are saying, "What implemented and people are saying, "What are they doing? this developer has given are they doing? this developer has given are they doing? this developer has given up their product and uh everybody is up their product and uh everybody is up their product and uh everybody is sad.

sad. sad. So So So AI seems to present a new alternative to AI seems to present a new alternative to AI seems to present a new alternative to this. What if this. What if this. What if uh the developer could create their app, uh the developer could create their app, uh the developer could create their app, the first version of their app, give it the first version of their app, give it the first version of their app, give it to the users, and the users if they need to the users, and the users if they need to the users, and the users if they need a new feature could say that could ask a new feature could say that could ask a new feature could say that could ask their AI agent to write that feature their AI agent to write that feature their AI agent to write that feature just for them, add it to the app. Um, just for them, add it to the app. Um, just for them, add it to the app. Um, then everyone gets the features they then everyone gets the features they then everyone gets the features they need. No one is bogged down in everyone need. No one is bogged down in everyone need. No one is bogged down in everyone else's features. Uh, and the developer else's features. Uh, and the developer else's features. Uh, and the developer gets to keep the the core app nice and gets to keep the the core app nice and gets to keep the the core app nice and clean and beautiful. clean and beautiful. clean and beautiful. But there's a there's a problem with But there's a there's a problem with But there's a there's a problem with this, which is that none of the the this, which is that none of the the this, which is that none of the the infrastructure we build software on infrastructure we build software on infrastructure we build software on today is like remotely designed for today is like remotely designed for today is like remotely designed for this. You've got uh Apple and Google for this. You've got uh Apple and Google for this. You've got uh Apple and Google for the past 15 years uh gatekeeping their the past 15 years uh gatekeeping their the past 15 years uh gatekeeping their systems to the point where there's like systems to the point where there's like systems to the point where there's like five companies that can build mobile five companies that can build mobile five companies that can build mobile apps now and uh because everyone else apps now and uh because everyone else apps now and uh because everyone else has been banned. Um and it's almost like has been banned. Um and it's almost like has been banned. Um and it's almost like easier to in the United States to buy a easier to in the United States to buy a easier to in the United States to buy a gun than it is to like get access to gun than it is to like get access to gun than it is to like get access to your own phone to install unsigned your own phone to install unsigned your own phone to install unsigned software. You go to Google and you say, software. You go to Google and you say, software. You go to Google and you say, "I want to install unsigned software."

"I want to install unsigned software." "I want to install unsigned software." And now they're going to say, "Oh, whoa, And now they're going to say, "Oh, whoa, And now they're going to say, "Oh, whoa, hold on, buddy. hold on, buddy. hold on, buddy. uh you seem upset. Uh you should uh go uh you seem upset. Uh you should uh go uh you seem upset. Uh you should uh go home and think about this. Uh if you home and think about this. Uh if you home and think about this. Uh if you still want that unsigned software in 24 still want that unsigned software in 24 still want that unsigned software in 24 hours, then you can come back and talk hours, then you can come back and talk hours, then you can come back and talk to us. Fortunately, we have a workaround for Fortunately, we have a workaround for all of that, which is the web. On the all of that, which is the web. On the all of that, which is the web. On the web, everyone can build whatever they web, everyone can build whatever they web, everyone can build whatever they want. And it turns out it's fine. It's want. And it turns out it's fine. It's want. And it turns out it's fine. It's not the security disaster that Apple and not the security disaster that Apple and not the security disaster that Apple and Google keep telling us would happen. So Google keep telling us would happen. So Google keep telling us would happen. So you can build whatever you want on the you can build whatever you want on the you can build whatever you want on the web but there's a different problem on web but there's a different problem on web but there's a different problem on the web which is that for the past uh 25 the web which is that for the past uh 25 the web which is that for the past uh 25 years of uh cloud architecture we've years of uh cloud architecture we've years of uh cloud architecture we've been running in the wrong direction. been running in the wrong direction. been running in the wrong direction. uh when you distribute a web app, you uh when you distribute a web app, you uh when you distribute a web app, you run it on your own server like put it on run it on your own server like put it on run it on your own server like put it on your server and then users send requests your server and then users send requests your server and then users send requests to your server where the one version of to your server where the one version of to your server where the one version of your app, the one um you know blessed your app, the one um you know blessed your app, the one um you know blessed version runs uh for every single user.

version runs uh for every single user. version runs uh for every single user. And so that's convenient for developers. And so that's convenient for developers. And so that's convenient for developers. That's why we've done it is so the That's why we've done it is so the That's why we've done it is so the developer can make sure things stay developer can make sure things stay developer can make sure things stay updated and everyone's on the same updated and everyone's on the same updated and everyone's on the same version. But um it obviously means that version. But um it obviously means that version. But um it obviously means that users cannot customize their apps. users cannot customize their apps. users cannot customize their apps. So So So you know last year uh vibe coding comes you know last year uh vibe coding comes you know last year uh vibe coding comes along and we have all these vibe coding along and we have all these vibe coding along and we have all these vibe coding um platforms out there and the most of um platforms out there and the most of um platforms out there and the most of them are targeting web apps because them are targeting web apps because them are targeting web apps because that's the easy thing to target but that's the easy thing to target but that's the easy thing to target but they're all targeting this existing they're all targeting this existing they're all targeting this existing infrastructure which is actually like infrastructure which is actually like infrastructure which is actually like not the right way to do it. Um, we need not the right way to do it. Um, we need not the right way to do it. Um, we need something entirely different. And hence something entirely different. And hence something entirely different. And hence my point. Do you uh do you like how the my point. Do you uh do you like how the my point. Do you uh do you like how the word breaks kind of wiggles every now word breaks kind of wiggles every now word breaks kind of wiggles every now and then? That was uh that was something and then? That was uh that was something and then? That was uh that was something Claude put in there and it was so stupid Claude put in there and it was so stupid Claude put in there and it was so stupid I just had to keep it. Um, I want to I just had to keep it. Um, I want to I just had to keep it. Um, I want to know where in Claude's training data it know where in Claude's training data it know where in Claude's training data it uh it learned that you could make words uh it learned that you could make words uh it learned that you could make words wiggle to give them emphasis because wiggle to give them emphasis because wiggle to give them emphasis because like I you know I understand the red I like I you know I understand the red I like I you know I understand the red I understand the underline but uh the understand the underline but uh the understand the underline but uh the wiggle like I don't think that's that's wiggle like I don't think that's that's wiggle like I don't think that's that's from humans. I I think that's an AI from humans. I I think that's an AI from humans. I I think that's an AI original.

original. original. [laughter] [laughter] [laughter] This this is ASI folks. Yeah, it's This this is ASI folks. Yeah, it's This this is ASI folks. Yeah, it's beyond my puny human brain's ability to beyond my puny human brain's ability to beyond my puny human brain's ability to comprehend. Um anyway, comprehend. Um anyway, comprehend. Um anyway, uh so you might be wondering at this uh so you might be wondering at this uh so you might be wondering at this point like who is this this guy who point like who is this this guy who point like who is this this guy who hasn't introduced himself up on stage um hasn't introduced himself up on stage um hasn't introduced himself up on stage um giving a Richard Stallman-esque rant giving a Richard Stallman-esque rant giving a Richard Stallman-esque rant about how we should have the freedom to about how we should have the freedom to about how we should have the freedom to modify our own software and what does he modify our own software and what does he modify our own software and what does he know about cloud infrastructure. So I'm know about cloud infrastructure. So I'm know about cloud infrastructure. So I'm Kenton Varta. I created Cloudflare Kenton Varta. I created Cloudflare Kenton Varta. I created Cloudflare workers. I started the project um back workers. I started the project um back workers. I started the project um back in 2017 when I joined Cloudflare. I am in 2017 when I joined Cloudflare. I am in 2017 when I joined Cloudflare. I am still the lead engineer today. um it now still the lead engineer today. um it now still the lead engineer today. um it now is uh you know it's a serverless is uh you know it's a serverless is uh you know it's a serverless application hosting platform. We have application hosting platform. We have application hosting platform. We have millions of developers. We serve millions of developers. We serve millions of developers. We serve trillions requests per day. But what I'm trillions requests per day. But what I'm trillions requests per day. But what I'm going to talk to you a little bit about going to talk to you a little bit about going to talk to you a little bit about today is uh sort of a side project I've today is uh sort of a side project I've today is uh sort of a side project I've been working on on top of workers which been working on on top of workers which been working on on top of workers which is um is um is um designed to is my exploration in how to designed to is my exploration in how to designed to is my exploration in how to uh uh solve this problem.

uh uh solve this problem. uh uh solve this problem. So, uh, this thing you're looking at So, uh, this thing you're looking at So, uh, this thing you're looking at right now is actually a little app that right now is actually a little app that right now is actually a little app that I created in this platform. But, I created in this platform. But, I created in this platform. But, um, we're going to the the front page um, we're going to the the front page um, we're going to the the front page here. here. here. So, you have your your Vibe Code prompt. So, you have your your Vibe Code prompt. So, you have your your Vibe Code prompt. You know, these things are a diamond You know, these things are a diamond You know, these things are a diamond dozen. Um, we all seen this before, but dozen. Um, we all seen this before, but dozen. Um, we all seen this before, but I'm just going to put in a little prompt I'm just going to put in a little prompt I'm just going to put in a little prompt to make to show that it works. Uh, make to make to show that it works. Uh, make to make to show that it works. Uh, make a silly counter app. Silly Max it a silly counter app. Silly Max it a silly counter app. Silly Max it silly. silly. silly. All right, but I'm not actually gonna All right, but I'm not actually gonna All right, but I'm not actually gonna sit here and watch it. Oh no, it said sit here and watch it. Oh no, it said sit here and watch it. Oh no, it said error. error. error. Yep, the internet doesn't work. That's Yep, the internet doesn't work. That's Yep, the internet doesn't work. That's okay. That's not the most important part okay. That's not the most important part okay. That's not the most important part of my talk. So of my talk. So of my talk. So um so what I what I want you to understand so what I what I want you to understand about this environment about this environment about this environment is uh this is not like your typical vibe is uh this is not like your typical vibe is uh this is not like your typical vibe coding environment where you're coding environment where you're coding environment where you're deploying apps to a web page. This is um deploying apps to a web page. This is um deploying apps to a web page. This is um uh you need to think about more like uh uh you need to think about more like uh uh you need to think about more like uh like an office suite. So think about like an office suite. So think about like an office suite. So think about Google Docs. You open Google Docs, you Google Docs. You open Google Docs, you Google Docs. You open Google Docs, you have a bunch of documents, hundreds, have a bunch of documents, hundreds, have a bunch of documents, hundreds, maybe thousands of documents. You open maybe thousands of documents. You open maybe thousands of documents. You open one, you edit it, you share it with one, you edit it, you share it with one, you edit it, you share it with people. This is the same thing except people. This is the same thing except people. This is the same thing except instead of documents, you have gadgets.

instead of documents, you have gadgets. instead of documents, you have gadgets. And each gadget is an application with And each gadget is an application with And each gadget is an application with code. They can all be different code. I code. They can all be different code. I code. They can all be different code. I have um I have an app here which is like have um I have an app here which is like have um I have an app here which is like a collaborative whiteboard app. Like a collaborative whiteboard app. Like a collaborative whiteboard app. Like this is a oneshot prompt. Um, I have a this is a oneshot prompt. Um, I have a this is a oneshot prompt. Um, I have a uh an app here which So, I get a lot of uh an app here which So, I get a lot of uh an app here which So, I get a lot of email in Spanish. It's a long story. I email in Spanish. It's a long story. I email in Spanish. It's a long story. I don't know Spanish, but I need help like don't know Spanish, but I need help like don't know Spanish, but I need help like filtering all the Spanish email. So, I filtering all the Spanish email. So, I filtering all the Spanish email. So, I made a little app to help me do that. made a little app to help me do that. made a little app to help me do that. Uh, a gadget. Um, I have a gadget to Uh, a gadget. Um, I have a gadget to Uh, a gadget. Um, I have a gadget to help me sort uh pull requests that I help me sort uh pull requests that I help me sort uh pull requests that I need to uh review on GitHub. need to uh review on GitHub. need to uh review on GitHub. And uh but those are, you know, things And uh but those are, you know, things And uh but those are, you know, things that I just like vibe coded from that I just like vibe coded from that I just like vibe coded from scratch. But we also have this concept scratch. But we also have this concept scratch. But we also have this concept over here of blueprints. And um a over here of blueprints. And um a over here of blueprints. And um a blueprint is someone made a gadget and blueprint is someone made a gadget and blueprint is someone made a gadget and they decided that it was useful and they they decided that it was useful and they they decided that it was useful and they took a a blueprint of it which is just took a a blueprint of it which is just took a a blueprint of it which is just taking the code exporting the code taking the code exporting the code taking the code exporting the code without the data which they can then without the data which they can then without the data which they can then share with someone else and then other share with someone else and then other share with someone else and then other people can uh instantiate gadgets from people can uh instantiate gadgets from people can uh instantiate gadgets from these blueprints.

these blueprints. these blueprints. So um we have like a you know document So um we have like a you know document So um we have like a you know document editor app here, a combon board and um a editor app here, a combon board and um a editor app here, a combon board and um a slide builder. So like you know typical slide builder. So like you know typical slide builder. So like you know typical office apps uh I'm going to s so this office apps uh I'm going to s so this office apps uh I'm going to s so this this slide builder um was built by my this slide builder um was built by my this slide builder um was built by my colleague Philip here um who's a product colleague Philip here um who's a product colleague Philip here um who's a product manager at Cloudflare and of course manager at Cloudflare and of course manager at Cloudflare and of course these days all product managers are also these days all product managers are also these days all product managers are also prolific engineers prolific engineers prolific engineers um so he you know he vibed this in an um so he you know he vibed this in an um so he you know he vibed this in an afternoon I believe but uh if I afternoon I believe but uh if I afternoon I believe but uh if I instantiate this gadget I get this nice instantiate this gadget I get this nice instantiate this gadget I get this nice little slide deck um you know it has little slide deck um you know it has little slide deck um you know it has things I can edit it and so on. Yay. And things I can edit it and so on. Yay. And things I can edit it and so on. Yay. And if I shared it, it would well. if I shared it, it would well. if I shared it, it would well. So an important point here is that when So an important point here is that when So an important point here is that when I instantiate this app, it is only for I instantiate this app, it is only for I instantiate this app, it is only for one slide deck. If I want multiple slide one slide deck. If I want multiple slide one slide deck. If I want multiple slide decks, I make multiple instances of the decks, I make multiple instances of the decks, I make multiple instances of the gadget uh one for each. And the reason gadget uh one for each. And the reason gadget uh one for each. And the reason for that is that all gadgets are um for that is that all gadgets are um for that is that all gadgets are um sharable and uh you know you can sharable and uh you know you can sharable and uh you know you can collaborate with other people on them collaborate with other people on them collaborate with other people on them and the sharing model is implemented by and the sharing model is implemented by and the sharing model is implemented by the platform instead of by the app the platform instead of by the app the platform instead of by the app itself. So if I click up here, I get itself. So if I click up here, I get itself. So if I click up here, I get sort of a a share dialogue kind of like sort of a a share dialogue kind of like sort of a a share dialogue kind of like a Google Docs share dialogue. I can a Google Docs share dialogue. I can a Google Docs share dialogue. I can create a share link and send it to create a share link and send it to create a share link and send it to people. And uh because each gadget is people. And uh because each gadget is people. And uh because each gadget is just the one thing that you want to just the one thing that you want to just the one thing that you want to share, that means that the platform can share, that means that the platform can share, that means that the platform can implement the sharing model and the implement the sharing model and the implement the sharing model and the access control such that the gadget access control such that the gadget access control such that the gadget itself can't possibly get that wrong.

itself can't possibly get that wrong. itself can't possibly get that wrong. So I'm going to go over to actually So I'm going to go over to actually So I'm going to go over to actually another instance of the same slides app. another instance of the same slides app. another instance of the same slides app. This is the um the slides I originally This is the um the slides I originally This is the um the slides I originally wrote for this talk, which yesterday I wrote for this talk, which yesterday I wrote for this talk, which yesterday I decided these slides were trash and I decided these slides were trash and I decided these slides were trash and I threw them all away and rewrote it. Um threw them all away and rewrote it. Um threw them all away and rewrote it. Um but the the reason they're bad is is but the the reason they're bad is is but the the reason they're bad is is entirely my fault. It's not Philip's entirely my fault. It's not Philip's entirely my fault. It's not Philip's fault. It's uh not the software's fault. fault. It's uh not the software's fault. fault. It's uh not the software's fault. Um but this this can still serve as an Um but this this can still serve as an Um but this this can still serve as an example uh to to demonstrate some of example uh to to demonstrate some of example uh to to demonstrate some of what you can do on this platform. what you can do on this platform. what you can do on this platform. So if I uh click on here, I can see the So if I uh click on here, I can see the So if I uh click on here, I can see the conversation. And you know, of course, I conversation. And you know, of course, I conversation. And you know, of course, I didn't edit the slides myself by hand. I didn't edit the slides myself by hand. I didn't edit the slides myself by hand. I asked the agent to make them for me, asked the agent to make them for me, asked the agent to make them for me, right? Um, and every app in this right? Um, and every app in this right? Um, and every app in this platform automatically platform automatically platform automatically integrates with agents so that you can integrates with agents so that you can integrates with agents so that you can do that. And so what I did is I gave do that. And so what I did is I gave do that. And so what I did is I gave Claude a link to this document, this Claude a link to this document, this Claude a link to this document, this Google doc where I had described all of Google doc where I had described all of Google doc where I had described all of the gadgets that I wanted or all the the the gadgets that I wanted or all the the the gadgets that I wanted or all the the slides that I wanted in my um in my slides that I wanted in my um in my slides that I wanted in my um in my presentation. And crucially though, this presentation. And crucially though, this presentation. And crucially though, this is the interesting point. I said, if you is the interesting point. I said, if you is the interesting point. I said, if you need uh if you need to add any new need uh if you need to add any new need uh if you need to add any new features to the slides app itself to features to the slides app itself to features to the slides app itself to support some of these slides, feel free support some of these slides, feel free support some of these slides, feel free to do so. And it did. Um Claude read all to do so. And it did. Um Claude read all to do so. And it did. Um Claude read all the code for the app and read my doc and the code for the app and read my doc and the code for the app and read my doc and said, "Yes, actually, let's see. Slide said, "Yes, actually, let's see. Slide said, "Yes, actually, let's see. Slide three needs a uh strikethrough three needs a uh strikethrough three needs a uh strikethrough formatting. That's not implemented." Um formatting. That's not implemented." Um formatting. That's not implemented." Um we can add that. Um, some of the slides we can add that. Um, some of the slides we can add that. Um, some of the slides require things to be centered. And you

require things to be centered. And you require things to be centered. And you know, I guess Philip's design taste is know, I guess Philip's design taste is know, I guess Philip's design taste is too good for centering text. Uh, but my too good for centering text. Uh, but my too good for centering text. Uh, but my more pedestrian taste called for some more pedestrian taste called for some more pedestrian taste called for some centering. And that's okay. Cloud can centering. And that's okay. Cloud can centering. And that's okay. Cloud can add that. Um, more interestingly, slides add that. Um, more interestingly, slides add that. Um, more interestingly, slides uh five and six here. So, I asked for uh five and six here. So, I asked for uh five and six here. So, I asked for this like really crappy diagram of the this like really crappy diagram of the this like really crappy diagram of the cloud, right? And the the app um didn't cloud, right? And the the app um didn't cloud, right? And the the app um didn't support sort of like arbitrary diagrams. support sort of like arbitrary diagrams. support sort of like arbitrary diagrams. It supported, you know, uh box diagrams It supported, you know, uh box diagrams It supported, you know, uh box diagrams and arrows and such, but not an and arrows and such, but not an and arrows and such, but not an arbitrary drawing like this. And so arbitrary drawing like this. And so arbitrary drawing like this. And so Claude said, "Okay, that's okay. We can Claude said, "Okay, that's okay. We can Claude said, "Okay, that's okay. We can add a feature. We'll add a feature that add a feature. We'll add a feature that add a feature. We'll add a feature that allows uh you to insert a bunch of SVG. allows uh you to insert a bunch of SVG. allows uh you to insert a bunch of SVG. Just paste it into this box here. And Just paste it into this box here. And Just paste it into this box here. And now it becomes uh part of the slide." now it becomes uh part of the slide." now it becomes uh part of the slide." And now that's not very useful for any And now that's not very useful for any And now that's not very useful for any human, but it was perfectly useful for human, but it was perfectly useful for human, but it was perfectly useful for Claude who then generated the SVG. Claude who then generated the SVG. Claude who then generated the SVG. Now, at this point, you might be looking Now, at this point, you might be looking Now, at this point, you might be looking at this and saying, "That's a little at this and saying, "That's a little at this and saying, "That's a little scary. SVG can contain JavaScript. Uh, scary. SVG can contain JavaScript. Uh, scary. SVG can contain JavaScript. Uh, are there XSS bugs here?" And the answer are there XSS bugs here?" And the answer are there XSS bugs here?" And the answer to that is, uh, it doesn't really matter to that is, uh, it doesn't really matter to that is, uh, it doesn't really matter because of the way this environment is because of the way this environment is because of the way this environment is set up. So the UI that you see for the set up. So the UI that you see for the set up. So the UI that you see for the app here is running inside a null origin app here is running inside a null origin app here is running inside a null origin iframe sandbox iframe sandbox iframe sandbox um with content security policy set so um with content security policy set so um with content security policy set so that it basically cannot talk to that it basically cannot talk to that it basically cannot talk to anything any of the rest of the world anything any of the rest of the world anything any of the rest of the world can't access any cookies so on um the can't access any cookies so on um the can't access any cookies so on um the only thing it can do is post message to only thing it can do is post message to only thing it can do is post message to the parent frame and through that post the parent frame and through that post the parent frame and through that post message channel we set up a a captain

message channel we set up a a captain message channel we set up a a captain web RPC uh session which forwards onto web RPC uh session which forwards onto web RPC uh session which forwards onto the server and all the way back to the the server and all the way back to the the server and all the way back to the server code for this gadget which is uh server code for this gadget which is uh server code for this gadget which is uh this code here which is written as a a this code here which is written as a a this code here which is written as a a durable object on Cloudflare workers durable object on Cloudflare workers durable object on Cloudflare workers and uh basically that means so so this and uh basically that means so so this and uh basically that means so so this this server code runs in a dynamic this server code runs in a dynamic this server code runs in a dynamic worker sandbox worker sandbox worker sandbox uh on the server side where it too is uh on the server side where it too is uh on the server side where it too is prevented from talking to any of the prevented from talking to any of the prevented from talking to any of the rest of the world. So now we've set up rest of the world. So now we've set up rest of the world. So now we've set up this environment where there's a this environment where there's a this environment where there's a vibecoded client and a vibecoded server. vibecoded client and a vibecoded server. vibecoded client and a vibecoded server. They can only talk to each other and They can only talk to each other and They can only talk to each other and produce the UI uh for the user. produce the UI uh for the user. produce the UI uh for the user. And so if you have an XSS bug, it And so if you have an XSS bug, it And so if you have an XSS bug, it actually doesn't end up mattering actually doesn't end up mattering actually doesn't end up mattering because these can't leak anything. Um because these can't leak anything. Um because these can't leak anything. Um they're prevented from doing so. And it they're prevented from doing so. And it they're prevented from doing so. And it basically there is no security bug you basically there is no security bug you basically there is no security bug you can have in this code that matters. Um, can have in this code that matters. Um, can have in this code that matters. Um, and that makes it safe to, you know, go and that makes it safe to, you know, go and that makes it safe to, you know, go and do things.

and do things. and do things. So, uh, I, uh, there's a whole lot that So, uh, I, uh, there's a whole lot that So, uh, I, uh, there's a whole lot that I would like to talk about that I won't I would like to talk about that I won't I would like to talk about that I won't have time for here, unfortunately. have time for here, unfortunately. have time for here, unfortunately. So the um So the um So the um uh uh uh so there there like for instance the uh so there there like for instance the uh so there there like for instance the uh we created a whole system by which these we created a whole system by which these we created a whole system by which these apps can talk to external services in a apps can talk to external services in a apps can talk to external services in a safe way but I could give you know two safe way but I could give you know two safe way but I could give you know two more talks about that. Um we created um there's a lot of stuff here. the the there's a lot of stuff here. the the points that I want to make in the time points that I want to make in the time points that I want to make in the time that I have left though is that I have left though is that I have left though is so everything you see here is uh is so everything you see here is uh is so everything you see here is uh is built on everything except for the LLM built on everything except for the LLM built on everything except for the LLM is built on Cloudflare workers. Um a lot is built on Cloudflare workers. Um a lot is built on Cloudflare workers. Um a lot of people don't know this but you can of people don't know this but you can of people don't know this but you can actually build complex apps on workers. actually build complex apps on workers. actually build complex apps on workers. There are no containers involved here. There are no containers involved here. There are no containers involved here. There's just dynamic workers. There are There's just dynamic workers. There are There's just dynamic workers. There are no there's no database involved. It just no there's no database involved. It just no there's no database involved. It just uses durable objects. Um, and uses durable objects. Um, and uses durable objects. Um, and furthermore, all of this is actually furthermore, all of this is actually furthermore, all of this is actually running locally on my laptop, which is running locally on my laptop, which is running locally on my laptop, which is why it doesn't matter that uh the why it doesn't matter that uh the why it doesn't matter that uh the internet didn't work because uh so this internet didn't work because uh so this internet didn't work because uh so this is all running on workerd, which is our is all running on workerd, which is our is all running on workerd, which is our open source runtime. A lot of people open source runtime. A lot of people open source runtime. A lot of people don't know this. The Cloudflare workers don't know this. The Cloudflare workers don't know this. The Cloudflare workers runtime is open source. You can runtime is open source. You can runtime is open source. You can self-host it. And I'm excited about that self-host it. And I'm excited about that self-host it. And I'm excited about that because we have in here a uh Home because we have in here a uh Home because we have in here a uh Home Assistant uh connector and a Spotify Assistant uh connector and a Spotify Assistant uh connector and a Spotify connector. And I want to run this in my connector. And I want to run this in my connector. And I want to run this in my basement and uh use it to do home

basement and uh use it to do home basement and uh use it to do home automation tasks. automation tasks. automation tasks. Um so [sighs] Um so [sighs] Um so [sighs] this is where though I have to give a this is where though I have to give a this is where though I have to give a little bit of an apology. Um so a couple little bit of an apology. Um so a couple little bit of an apology. Um so a couple of months ago when I submitted the the of months ago when I submitted the the of months ago when I submitted the the uh the proposal for this talk. This was uh the proposal for this talk. This was uh the proposal for this talk. This was like a side project I was working on and like a side project I was working on and like a side project I was working on and the plan was I was going to come here the plan was I was going to come here the plan was I was going to come here and I was going to present it and then I and I was going to present it and then I and I was going to present it and then I was just at the end of the talk going to was just at the end of the talk going to was just at the end of the talk going to ye it onto GitHub so that everyone could ye it onto GitHub so that everyone could ye it onto GitHub so that everyone could go and download and play with it go and download and play with it go and download and play with it themselves. themselves. themselves. In the last couple of weeks um there's In the last couple of weeks um there's In the last couple of weeks um there's been a lot of excitement inside been a lot of excitement inside been a lot of excitement inside Cloudflare and this has become a more Cloudflare and this has become a more Cloudflare and this has become a more serious project. And so last Thursday serious project. And so last Thursday serious project. And so last Thursday Dne our CTO pulled me uh into a room and Dne our CTO pulled me uh into a room and Dne our CTO pulled me uh into a room and said Kenton said Kenton said Kenton I don't think you should yeet this. I I don't think you should yeet this. I I don't think you should yeet this. I don't think this is yeet material. I don't think this is yeet material. I don't think this is yeet material. I think we need a uh we need to be more think we need a uh we need to be more think we need a uh we need to be more careful and disciplined and intentional careful and disciplined and intentional careful and disciplined and intentional about how we release this. So, let's about how we release this. So, let's about how we release this. So, let's hold it off for a few weeks. And I was hold it off for a few weeks. And I was hold it off for a few weeks. And I was pretty upset about that because I pretty upset about that because I pretty upset about that because I promised in the abstract that I was promised in the abstract that I was promised in the abstract that I was going to open source it, but sorry. Uh going to open source it, but sorry. Uh going to open source it, but sorry. Uh that's not happening today. It will that's not happening today. It will that's not happening today. It will happen soon though.

happen soon though. happen soon though. Um, Um, Um, and I wish the silly counter worked and I wish the silly counter worked and I wish the silly counter worked because GPT makes some silly counters, because GPT makes some silly counters, because GPT makes some silly counters, but um oh well, it's not a big deal. And but um oh well, it's not a big deal. And but um oh well, it's not a big deal. And that's uh that's all I got. that's uh that's all I got. that's uh that's all I got. [applause]