there was a nice blog post recently about that: https://blog.cloudflare.com/workers-environment-live

there was a nice blog post recently about that: https://blog.cloudflare.com/workers-environment-live-object-bindings

The Cloudflare Blog

Why Workers environment variables contain live objects

Bindings don't just reduce boilerplate. They are a core design feature of the Workers platform which simultaneously improve developer experience and application security in several ways. Usually these two goals are in opposition to each other, but bindings elegantly solve for both at the same time

ChaikaOP•4/8/24, 5:53 PM

shouldn't be able to reach anything not assigned at all

Somepotato•4/8/24, 5:55 PM

In theory. But it shares an issue workers have in that they use isolates, and a vm escape or another branch prediction exploit and bad news

ChaikaOP•4/8/24, 5:56 PM

and they've got a bunch of protections against that: https://developers.cloudflare.com/workers/reference/security-model/, but yea

CChaika there was a nice blog post recently about that: https://blog.cloudflare.com/work...

Somepotato•4/8/24, 5:56 PM

That also decries giving everything access to everything which is ironic given if you can edit the toml you can also access everythig

ChaikaOP•4/8/24, 5:57 PM

they don't always get put in a shared process either

Sometimes, though, Cloudflare does decide to schedule a Worker in its own private process. Cloudflare does this if the Worker uses certain features that needs an extra layer of isolation. For example, when a developer uses the devtools debugger to inspect their Worker, Cloudflare runs that Worker in a separate process

Somepotato•4/8/24, 5:58 PM

Using dev tools is a pretty manual process though

Somepotato•4/8/24, 5:58 PM

For PCI and HIPAA compliance they'll have to offer isolation as an option

Somepotato•4/8/24, 5:58 PM

Though those measures often a separate process isn't even enough

Somepotato•4/8/24, 5:59 PM

Spectre proved a lowly browser could access kernel memory, spooky stuff

Somepotato•4/8/24, 6:01 PM

It'd be neat if you could bind certain columns or tables in R1 to workers as opposed to the whole DB

ChaikaOP•4/8/24, 6:02 PM

would be interesting, probably require a fair bit of custom sqlite patches though

Somepotato•4/8/24, 6:04 PM

Sqlite already supports authorization hooks

Somepotato•4/8/24, 6:04 PM

So less than you'd think

Somepotato•4/8/24, 6:06 PM

Cloudflares cloudified, distributed sqlite

ChaikaOP•4/8/24, 6:06 PM

it's D1, not R1 lol

Somepotato•4/8/24, 6:06 PM

These names are...less than great lmao

ChaikaOP•4/8/24, 6:06 PM

R2D1, beep boop

Somepotato•4/8/24, 6:06 PM

I can't ever not get them mixed up

ChaikaOP•4/8/24, 6:07 PM

The D is for "not actually Distributed yet"

Somepotato•4/8/24, 6:09 PM

Or Dsqlite

Somepotato•4/8/24, 6:13 PM

Next cursed idea, postgresql durable object running via a wasm runtime

ChaikaOP•4/8/24, 6:14 PM

I think it's just too big too
https://github.com/stackframe-projects/pgmock for example is 41 MB

ChaikaOP•4/8/24, 6:15 PM

D1 cheats because they have their own custom saving/storage stuff, and sqlite is embedded into the runtime

Somepotato•4/8/24, 6:16 PM

You could probably deeply compress the wasm

Somepotato•4/8/24, 6:16 PM

Also that emulates x86 and creates an entire networking stack from scratch

Somepotato•4/8/24, 6:17 PM

The wasm API doesn't work as expected in workers? That's lame, eliminates possibility of jitting

CChaika I think it's just too big too https://github.com/stackframe-projects/pgmock for ...

Somepotato•4/8/24, 6:17 PM

https://github.com/electric-sql/pglite

GitHub

GitHub - electric-sql/pglite: Lightweight Postgres packaged as WASM...

Lightweight Postgres packaged as WASM into a TypeScript library for the browser, Node.js, Bun and Deno - electric-sql/pglite

Somepotato•4/8/24, 6:17 PM

Dynamic wasm is a lot safer than dynamic js

Somepotato•4/8/24, 6:18 PM

Though restricting dynamic js is kinda silly too

Piero512•4/8/24, 6:29 PM

why not wasm?

liam | helius.dev•4/8/24, 8:12 PM

If a customer receives a CF 503 Page from an endpoint that is backed by a worker, is that always an issue with CF connecting to the worker? I don't see any logs in my worker in these cases

Lliam | helius.dev If a customer receives a CF 503 Page from an endpoint that is backed by a worker...

ChaikaOP•4/8/24, 8:16 PM

What do you mean "cf connecting to the worker"? Workers execute on the same machine that gets the request (unless you have smart placement enabled), not like it has to go anywhere. If your worker fetches an external host and returns the result, I would assume the 503 is from that

ChaikaOP•4/8/24, 8:18 PM

Is it cloudflare branded normal error page (https://cloudflare.com/cdn-cgi/error/503), or is it black & white and looks like a nginx error page? Do you get any other error code in the visible error (like a internal 1xxxx/10xxx)?

Somepotato•4/8/24, 9:01 PM

it'd be neat if we could have authorizer workers that used sqlite3_set_authorizer for all db requests

CChaika Is it cloudflare branded normal error page (https://cloudflare.com/cdn-cgi/error...

liam | helius.dev•4/8/24, 9:16 PM

Shows error 1105, the error is kind of vague though

You've requested a page on a website (bar.foo.com) that is on the Cloudflare network. The page could not be rendered due to a temporary fault.

You've requested a page on a website (bar.foo.com) that is on the Cloudflare network. The page could not be rendered due to a temporary fault.

neoney•4/8/24, 9:28 PM

please tell me its possible to fetch() with a client-side ssl certificate?

neoney•4/8/24, 9:29 PM

im trying to implement apple pay

neoney•4/8/24, 9:32 PM

welp according to what i'm reading online - no way to put it in fetch(), and to upload custom edge certificates you need business plan or higher, which is $200/mo?

neoney•4/8/24, 9:32 PM

well yeah thats what im tryna do

neoney•4/8/24, 9:33 PM

apple pay expects me to use a cert from them and a key i got

neoney•4/8/24, 9:33 PM

in nodejs, i did dispatcher: new Agent({
connect: {
cert: readFileSync(join(dirname, "../app/apple_pay.pem"), "utf8"),
key: readFileSync(join(dirname, "../app/key.pem"), "utf8"),
},
}),

neoney•4/8/24, 9:33 PM

the only thing I can find talking about mtls is having incoming requests be verified

neoney•4/8/24, 9:34 PM

are you aware whether it works for pages, or I have to use workers?

Original message was deleted

neoney•4/8/24, 9:35 PM

thank you

neoney•4/8/24, 9:35 PM

ill try to put it directly in the pages project

neoney•4/8/24, 9:35 PM

if that doesnt work ill go workers

neoney•4/8/24, 9:35 PM

thank you very much!

thanhle•4/8/24, 11:15 PM

Hello does the workers working with pdf-js package?

Tthanhle Hello does the workers working with pdf-js package?

johtso•4/9/24, 12:07 AM

yes, I'm using it successfully

johtso•4/9/24, 12:09 AM

@thanhle this is what you want https://github.com/unjs/unpdf

there was a nice blog post recently about that: https://blog.cloudflare.com/workers-environment-live

Similar Threads

Similar Threads

Similar Threads