5 ms·
Looking at the docs for their JS SDK, they have this warning: > The client provider requires an API token to fetch flag values. This token is not scoped to a s
by crabmusket 5mo ago
Looking at the docs for their JS SDK, they have this warning:
> The client provider requires an API token to fetch flag values. This token is not scoped to a single app, so anyone with the token can evaluate flags across all apps in your account. Use the client provider with caution in public-facing applications.
https://developers.cloudflare.com/flagship/sdk/client-provider/ https://developers.cloudflare.com/flagship/sdk/client-provid...
Can anyone clarify... why the client SDK, designed to be deployed to browsers, requires caution? Does this mean that any client could send requests with a new targetingKey and observe other users' flags?
While flags probably shouldn't be critical information, this seems like an interesting design choice.
- OptionOfT 5mo agoLet's think about it. This is probably something used internally at CloudFlare and someone thought I'd be interesting to make it public. There is no way 6 months ago someone at CloudFlare thought it was a good idea to build a competitor to say LaunchDarkly.
- wahnfrieden 5mo agoCare to share why
- jasonjmcghee 5mo agoHmm not sure I necessarily agree. Cloudflare's strategy has been looking like "the only platform you need" for a while now. Their recent features / announcements have been equivalent to: (LaunchDarkly) Resend, Firecrawl, CrewAI, Helicone, Replicate, Pinecone - Which like… many companies have a painful procurement process. If all you need is Cloudflare, and prices are within reason- why not use them
- stingraycharles 5mo agoDon’t forget they now also have an OpenRouter alternative.
- sedimannapoleon 5mo ago[dead]
- gowthamgts12 5mo agoTheir quality of the products they ship have already became shitty for quite a while now.
- risyachka 5mo agothey are quickly turning into a slop shop instead of polishing their existing products (and most of them do require a lot of work) they jump into any other niche someone thought was a good idea. My guess is that with ai being able to prototype things quickly they just started doing everything that is even a bit relevant. which won't end well
- nijave 5mo agoI think they were doing that before AI got big the last couple years. Their core network stuff always seemed pretty robust but all the newer stuff was much more thrown together. Thinking specifically of Zero Trust/Argo Tunnels which has been around a few years (and I do like) but has some rough edges.
- bg24 5mo agoBoth Cloudflare and Vercel have feature parity. Flags is a feature already in Vercel. While customer-first is a thing, it is also a no-brainer to start with: we use it, Vercel has it, let us build it.
- pjmlp 5mo agoNow waiting for Cloudflare to allow me to use Rust for serverless, real native code, not WebAssembly. https://vercel.com/docs/functions/runtimes/rust https://vercel.com/docs/functions/runtimes/rust
- iainmerrick 5mo agoThey have containers, does that count? If you’re specifically thinking of native ephemeral workers with very fast startup, it seems like those would have to be sandboxed somehow, and WebAssembly seems like a decent solution. Is there really a significant native code gap between WebAssembly workers and native containers?
- pjmlp 5mo agoContainers seem to only be "Available on Workers Paid plan", whereas Vercel supports it on the hobby account as well. Kind of relevant on those cheapskate projects that only start paying licenses after the SOW is signed, but already expect some kind of prototyping in place. WebAssembly is a solution looking for a problem outside the browser, with worse development experience. If I want bytecode based runtimes, I already have them with first class development experience, and decades of deployment experience, between Erlang, JVM and CLR.
- nijave 5mo agoHaven't used Vercel but back in the Heroku/CloudFoundry days it was pretty easy to jam arbitrary binaries into the runtime containers and some of the build packs were flexible enough you could override most of the functionality. Not sure if that's possible/how easy it is on Vercel
- roerohan 5mo agohttps://blog.cloudflare.com/flagship https://blog.cloudflare.com/flagship Here's why we built it!
- Hamuko 5mo ago>Agentic coding tools like OpenCode and Claude Code are shipping entire features in minutes. How many minutes do I need to wait until app-scoped tokens are live?
- deleted 5mo ago[deleted]
- philipwhiuk 5mo agoAh, no-look coding. How can we possibly trust the AI to disable the 'CODE_IS_SKYNET' flag.
- jjcm 5mo agoJane Wong salivating reading this
- roerohan 5mo agoHi! One of the engineers from the Flagship team here, app-scoped tokens are WIP.
- stingraycharles 5mo agoThat sounds like the product is not finished and should not be released?
- ai_fry_ur_brain 5mo agoThis has been the Cloudflare standard operating procedure for the last year or so. Non stop shipping alpha/beta products.
- rustystump 5mo agoOtherwise known as vibe code snacking. Vibe out the easy 80% and say the hard 20% is “coming soon tm”
- nine_k 5mo ago"If you are not ashamed by what you are shipping, you are not shipping early enough" (Quoting from memory)
- crabmusket 5mo agoThat's a terrible attitude for an infrastructure company. This is what private betas / close iteration with customers is for.
- stingraycharles 5mo agoThat’s really about creating an MVP for a startup, because too many founders stay in a cave trying to make it “perfect” before collecting valuable user feedback. This does not apply to Cloudflare, especially not for an auth token that needs to be published on your website that cannot be restricted.
- 5mo ago