No Priors: Artificial Intelligence | Technology | Startups
00:09:46 · Sarah Guo, Dane Knecht
[00:09:46] S1: What have you learned about building secure production software internally already that you think people can learn from? Like, does that mean? Like shift left and like can we... And there are there are many theories of how to do this including, you know, broader use of formal verification, using agents for security in the development process. Like what what do you think is going to create better software from first delivery? [00:10:15] S0: I kind go back to first principles there is you want to reduce your attack surface area. The easiest thing you can do is to give less places for there to be vulnerabilities. So looking at all your software and saying, How can I simplify this? How can I reduce footprint, the code? Then beyond that, things like formal verification and things that are safer programming languages and things that are built into the runtimes that make everything safer will come. But I think it just starts with AI, at least the early AI is very verbose. It likes to create complexity. So AI in a sense of what we've been dealing with has actually not been helping build a more secure stuff right now, but I think we'll get there. I think that's where humans still come in and human judgment comes in and making sure that we design the software in a way that can stand on its own securely.
00:10:15 · Dane Knecht, Sarah Guo
[00:10:15] S0: I kind go back to first principles there is you want to reduce your attack surface area. The easiest thing you can do is to give less places for there to be vulnerabilities. So looking at all your software and saying, How can I simplify this? How can I reduce footprint, the code? Then beyond that, things like formal verification and things that are safer programming languages and things that are built into the runtimes that make everything safer will come. But I think it just starts with AI, at least the early AI is very verbose. It likes to create complexity. So AI in a sense of what we've been dealing with has actually not been helping build a more secure stuff right now, but I think we'll get there. I think that's where humans still come in and human judgment comes in and making sure that we design the software in a way that can stand on its own securely. [00:11:16] S1: That was actually going to be my reaction when you say we want to reduce the surface area. I'm like, Oh yes, of course, in principle. And that's not the natural inclination of today's models. Mhmm. Right? And, you know, I asked him to do something and I'm like, well, like, with one tenth the complexity, please try again. Is is that the role of engineering and security engineering today? Is that something that's gonna be solved at the model level?
00:11:42 · Dane Knecht, Sarah Guo
[00:11:42] S0: The the way that humans did before agents is it needs to be solved kind of at all levels. You need to train the engineers that are writing the code, the product engineers. The security teams still need to be involved in making sure that they're getting checks and balances, second set of eyes on things. You need to build in processes. We've gone to defining things a lot more internally on how we build at Cloudflare, writing down our principles. We have a document called the Codex, which is kind of like buildup of a lot of RFCs that the teams have built for it. Here's how you build secure software in Cloudflare. Here's how you build available software in Cloudflare. Here's our best practices. And then it kind of gets pulled up into some 10 commandments that the agents know how to follow and use in every part of the review process that can help enforce those things. So you have agents out there that are just writing a lot of the slop, and then you have deeper down the factory, you have people that are doing the performance runs and the security runs. Just like helping company operate before, you need those adversarial reviews. [00:12:49] S1: When you zoom out a little bit and just look at overall traffic on the Internet and how much of it has become agent driven over the last year, I think it's outpaced most people's expectations. What has updated in your worldview of what web a year from now looks like either from an economic model perspective or a security or requisite infrastructure perspective?
00:12:49 · Sarah Guo, Dane Knecht
[00:12:49] S1: When you zoom out a little bit and just look at overall traffic on the Internet and how much of it has become agent driven over the last year, I think it's outpaced most people's expectations. What has updated in your worldview of what web a year from now looks like either from an economic model perspective or a security or requisite infrastructure perspective? [00:13:18] S0: Yeah. I mean, I kind of think of it as we're in the messy middle right now where humans and agents are riding the same rails on the Internet, where, you know, agents are trying to parse a human web when one is just inefficient and was designed for humans that could do things at different speeds. Going to a website and being able to read and see the ads and participate in more of the full economic model versus an agent that now can go to a thousand web pages in the same period of time, which is great. It's just you need to find a new economic model to support that. Do we [00:13:57] S1: get parallel webs? Is there like a human web and a machine web? Like, everybody's trying to do... What's it called? AEO now? Yeah.
00:14:07 · Dane Knecht
[00:14:07] S0: I mean, yes. I think we do. I think we find ways to deliver the content and agents and humans where they are as opposed to trying to meet them in the same place. Right now, there's translation layers. There's a lot of companies that help an agent view a web page. These are just all extra burning of tokens for things that probably don't need to happen. The website usually knows what data... We've had things like this called... We've had APIs, ways that computers talk to each other for years. APIs only covered a small fraction of the information on the Internet, and agents have a thirst to understand everything. So they're going out and trying to explore the human Internet, and we need to make it easier for them. We need to make it less costly for the site owners, and we need to find a way for them to get compensated. I think it's a world where you can get very simple. Most likely, it's a good content website, like a Substack. They know what their CPM is for how much money they should be making on ads for that site. And so if an agent's reading the site, I think there is a world where you get to the point where an agent can decide whether or not they want to read the content, and then they can decide if they want to pay the CPM rate. Right? And that's where you need to then get new payment rails for the Internet that can do millions of transactions a second for all these little micro payments. All these things that we've been talking about for years, micro payments always are two years away. I think agents will actually push that forward and actually we will see a world where actually there is a new economic model for content creators.
00:16:01 · Sarah Guo, Dane Knecht
[00:16:01] S1: Who do you think the players are or what are the variations of that infrastructure? I think obviously Cloudflare has an important role to play here, but the rise of personal agents like Instinct and Muse have also made this like an immediate question from a transactional perspective. [00:16:20] S0: I don't think everyone knows on the, you know, on the other side what the business outcome is going to look like. You know, everyone's been through these transformations where the Internet, you know, if I was going to kill Main Street, it didn't kill Main Street. There's small businesses that are still thriving. But there weren't people that were displaced. So there's always kind of some skepticism there. And so there's some natural inclination to just block them out. Right? You saw Amazon just say, no personal shopping there from an agent. I I think these are all people that that messy middle where they're trying to figure out what that path forward is and trying to keep some of the negotiation leverage there. I think we will get to a place where Muse and Dots and all those personal agents will be able to accomplish tasks seamlessly as you as a human could do even easier. But I don't know if the technology's quite caught up to that yet and the business models either. [00:17:23] S1: Is there anything you're personally excited about on the roadmap or just from a technical exploration perspective on the Cloudflare front that you feel like is going to enable this ecosystem in the future?