JadeJan 27

Cloudflare just published a vibe coded blog post claiming they implemented Matrix on cloudflare workers. They didn't, their post and README is AI generated and the code doesn't do any of the core parts of matrix that make it secure and interoperable. Instead it's littered with 'TODO: Check authorisation' and similar

https://blog.cloudflare.com/serverless-matrix-homeserver-workers/

Building a serverless, post-quantum Matrix homeserver

As a proof of concept, we built a Matrix homeserver to Cloudflare Workers — delivering encrypted messaging at the edge with automatic post-quantum cryptography.

The Cloudflare Blog
Show threadJadeJan 27
Let me just pick a few examples from the code, because this is so bad
Show threadJadeJan 27

This is a core part of the protocol, that's not exactly simple (https://spec.matrix.org/v1.17/server-server-api/#authorization-rules)

They just have TODO comments, and happily accept anything, even if it's blatantly forged

Show threadJadeJan 27
Rather than implementing the critical state resolution algorithm that's the core of Matrix, they just directly insert the latest state into the database. That'll instantly lead to diverging views of the room and incompatibility with every other implementation - and it's also a massive security hole.
Show threadJadeJan 27
Oh and to top things off, they make trivially false claims in their post. Tuwunel and its predecessors do not and have never used Postgres or Redis.
Show threadJadeJan 27
Honestly this is almost insulting to me, as someone who has spent a nontrivial amount of effort developing a Matrix homeserver, with how low effort it is. And what’s the point? Marketing? I’m not gonna be trusting anything Cloudflare after this.
Show threadJadeJan 27
The pricing comparisons are stupid, by the way, too - a bunch of us in the matrix chatrooms got out how many HTTP requests per day we were serving and the per-request cost of Workers would be more expensive than dedicated VPSs - not even counting CPU time or storage costs!
Show threadJadeJan 27
For those of you that don't know, I develop https://continuwuity.org - a Rust based Matrix homeserver that actually works, and that you can run on a Raspberry Pi, rather than someone else's centralized cloud infrastructure
Continuwuity

A community-driven Matrix homeserver

Show threadJadeJan 27

I'm also giving a talk about some of the actual work that goes into building this software in a few days at FOSDEM, if you want to learn more:

https://tech.lgbt/@JadedBlueEyes/115956965835059690

Show threadJadeJan 27

Oh look, they’re trying to cover up what they did too

https://github.com/nkuntz1934/matrix-workers/commit/2d3969dd5e795caa3641d0e237e2b52ca0502463

Archive link for posterity:

https://web.archive.org/web/*/https://github.com/nkuntz1934/matrix-workers/commit/2d3969dd5e795caa3641d0e237e2b52ca0502463

Show threadAlexJan 27

@JadedBlueEyes more cover up - now making changes removing the claims of Production Ready and adding It is meant to serve as an example prototype and not endorsed as ready for production at this point.

https://github.com/nkuntz1934/matrix-workers/commit/fd412f41f98c0f3f360f5c4034443ef80680de49

I was assisted by Claude Code Opus 4.5 for this implementation 🤮

Show threadbuherator
@alex @JadedBlueEyes Archive link: https://archive.ph/AbxU5
Jan 27 at 7:25pmWeb