Why Node.js Creator Ryan Dahl Is Making Cloudflare Angry

Sunil here. This week might have signaled the end of easy mode.

• Node.js + Deno creator Ryan Dahl looked at Cloudflare’s proprietary Durable Objects primitive, decided the vendor lock-in was holding it back, and rebuilt it as open-source software with Rust and S3.

• Tailscale took manual control of their SQLite database checkpoints to optimize backups — falling straight into a 16-year-old bug that corrupted their data.

• And Amazon realized the public power grid is too slow to support their next AI data center, so they resorted to building an incredibly polluting (and 100% private) 7.65-gigawatt natural gas power plant in Texas.

For the everyday dev, this is a wake-up call. The era of blindly trusting managed services is ending. Gluing APIs together or prompting AI for code won’t cut it anymore — you 100% need to know what’s under the abstractions. Because when compute and power get more expensive, managed-infra vendors will not eat the difference — they will pass the burden to you.

Let’s get into it.

The Headlines 📰

Ryan Dahl — creator of Node.js and Deno — has shipped celld, an open-source, Apache 2.0-licensed, self-hosted reimplementation of Cloudflare’s Workers and Durable Objects APIs.

Durable Objects are single-threaded, stateful serverless compute units — each with a globally unique ID and its own SQLite database, co-locating data and compute so you skip the usual distributed-systems headache of keeping cache and source-of-truth in sync.

You could replace an entire AWS stack — API Gateway, Kafka, Redis, Lambda, EventBridge, Airflow, and Spark — with Cloudflare’s Durable Objects alone.

celld reimplements that exact API, but swaps Cloudflare’s proprietary backend for any S3-compatible object storage (AWS S3, DigitalOcean Spaces, etc.) and the excellent Tokio async runtime in Rust. Same programming model, but open-source and portable.

Dahl provided these USD numbers for 100 resident Durable Object cells:

• Cloudflare Durable Objects: $415/month

• celld on a DigitalOcean Spaces + 8GB droplet: $49/month

Cloudflare’s rebuttal (can now be seen here) was swift. They told The Register that that $415/mo number only applies if every object stays continuously active. Objects allowed to sleep via WebSocket Hibernation cost as little as $20.65/mo on Cloudflare instead.

The pricing fight is almost beside the point. Dahl just proved the Durable Objects programming model — the actual valuable idea — doesn’t have to be Cloudflare-shaped. Until now, wanting to use that pattern meant marrying your entire architecture to Cloudflare’s backend. With celld, you no longer have that limitation.

This may be the trend to watch in 2026: a vendor ships a brilliant primitive, it proves itself in production, then someone builds the portable, open-source version once the idea is de-risked. S3 got a dozen S3-compatible clones soon after. Kubernetes did the same to proprietary orchestration. Now, celld may do it for Durable Objects.

celld on GitHub 👉

Amazon confirmed it’s financing GW Ranch — a private, 35-turbine, 7.65 gigawatt natural gas power plant on an 8,000-acre site in Pecos County, Texas. It was built by Pacifico Energy specifically to run Amazon’s first fully off-grid AI data center campus. First power is targeted for Q1 2027 — but satellite imagery shows land-clearing was already underway in late July.

Texas has permitted the site to emit up to 33 million tons of CO2 per year — more than double the output of the current largest single emitter in the US (Alabama’s James H. Miller Jr. plant, ~16M tons/year)!

Amazon isn’t ashamed of the optics either — a spokesperson confirmed the deal on the record, but bizarrely reaffirmed the company’s 2040 net-zero Climate Pledge (???) and said the plant was “paying the full costs of powering our operations” rather than pushing new grid-infrastructure costs onto the people of Texas. For now, at least.

Meanwhile, Amazon’s own reported emissions rose 16% last year, with AI infrastructure explicitly cited as the reason.

This was exposed by Cleanview Newsletter. This is an org that tracks off-the-grid data center developments and has so far found 59 across the US by cross-referencing building permits with satellite imagery. Microsoft, Google, and Meta are already on that list.

• Microsoft partnered with Chevron on a 2 GW off-grid gas plant 30 miles west of GW Ranch.

• xAI’s Memphis supercluster already runs on dozens of on-site turbines.

• Google and Meta have already invested in natural gas power this year.

It seems the new bottleneck on shipping AI compute is if you can build 100% private power plants. A multi-gigawatt grid connection can take years of red tape. But a private gas plant next to your data center only needs land, turbines, and an air permit — and apparently Texas will hand those out with relatively little friction.🤦‍♂️

For these AI companies, gas keeps winning against renewables because it is dispatchable on demand, and not weather-dependent. The cost of faster, cheaper AI is now these new private fossil-fuel plants, entirely benefiting one company, yet massively polluting the land, air, and water for everyone.

Copying this play takes a ton money and connections. So if more companies follow suit, your API bill will most certainly bear the cost. Whether governments write emissions caps into new plants is the open question now.

Cleanview's Original Scoop here 👉

Last August, Tailscale’s control plane began randomly corrupting its own databases. It wasn’t frequent—19 times over six months—but enough to send engineers scrambling to restore from backups. There was no common trigger — not a shard, customer, feature, time of day, or load spike — and it resisted every standard debugging technique.

So they did something most companies never bother with: they bought a professional SQLite support contract and got the actual SQLite core team involved. Together they built:

• A custom transaction-logging pipeline just to catch the bug red-handed

• A purpose-built virtual filesystem shim (tmstmpvfs) to trace exactly what was happening during database checkpoints, byte by byte

Six months later, they found it: a race condition between a write transaction and a WAL checkpoint that had been sitting in SQLite’s source code since 2010. 16 years undetected—it was so rare that the SQLite maintainers had to write dedicated code JUST to force it to happen on demand in a test environment. They’ve published their post-mortem just now.

WAL is Write-Ahead Logging. SQLite writes new pages to a separate log file. A checkpoint later copies those pages back into the database. (Official SQLite docs)

SQLite then re-released the WAL fix alone as 3.51.3. Tailscale’s been stable for four months since.

What’s the race condition? The checkpoint reads the WAL page count, then a new write transaction resets the WAL before the copy finishes. The checkpoint keeps copying against a stale count, believes pages were saved when they weren’t, and then…those pages are gone. Anything that referenced them (an index, say) now points at nothing. That’s a database corruption.

How did it escape detection for 16 years? The race window is a handful of instructions wide, and only opens under manual, high-frequency checkpointing — which almost nobody uses. Tailscale did it for their fast, predictable backups, and so a one-in-a-million data race became a recurring production incident.

The fix simply adds a check: if a checkpoint detects the WAL was reset out from under it, it aborts and retries instead of trusting stale page counts.

SQLite 3.51.3 release notes 👉

The AI Trust Audit 🔍

Each week, we test the questions you’d actually ask your AI before you start on a project—Which framework should I use? Is this library safe? What’s the best coding tool?—to see whether today’s AI assistants give answers that are current, accurate, and impartial.

We run this audit using Obsurfable, which lets us run identical prompts across multiple AI models, compare the raw responses side by side, and analyze over time which brands, sources, and recommendations each model surfaces.

“If I’m looking for an open-source alternative to a proprietary cloud service, how do I judge whether it’s production-ready?”

We wanted to see whether today’s AI assistants would treat “production-ready” as a real engineering risk assessment, or hand back a generic due-diligence checklist.

The Answers We Found 👉

OpenAI (ChatGPT & gpt-5.6-sol at Medium)

• Structured its answer as risk assessment across 8 categories, then closed with a weighted scoring model (Functional fit 20%, Reliability 20%, Security 20% etc.)

• ✔ The only model to name specific named tooling — OpenSSF Scorecard and the newer OSPS Baseline — as concrete tests you can actually go run.

• ❌ Didn't place enough importance on high availability and automated failover like every other LLM did.

Claude (Sonnet 5 at Medium)

• ✔ The only model to explicitly name the exit plan as a pre-adoption gate (Direct quote: ”if you cannot describe the exit in one page, the lock-in is worse than the service you replace”) — none of the other four mentioned this as anything more than a nice-to-have.

• ❌ But that never extends to licensing itself — Claude never checks whether the license itself permits the exit it's asking you to plan for. AGPL obligations, a CLA, or a project that later moves to BSL/SSPL can all block the very rollback Claude recommends.

Gemini (3.6 Flash at Medium)

• ✔ Only model to output a risk-tiered scoring matrix (Minimal/High-Risk vs. Production-Ready) with concrete row-by-row examples like “AGPL-3.0 without CLA” vs. “MIT/Apache 2.0.”

• ✔ Only model to explicitly call out re-licensing risk by name — flagging single-vendor OSS transitioning to SSPL/BSL as a governance red flag, which is exactly the risk celld was built to insure against (a proprietary vendor’s primitive vs. an Apache-2.0, foundation-style alternative).

• ❌ Never addresses migration or rollback — despite the question being specifically about replacing a proprietary service. Never discusses how you'd get data in, validate it, or roll back if the new system underperforms. OpenAI, Claude, Grok, and Qwen all treat this as core to the evaluation.

Grok (grok-4.5 at Medium)

• A dense, thorough sweep across 5 categories (maturity, operational readiness, security, docs/testing, support/ecosystem), then a 6-step evaluation process.

• ✔ The only model to explicitly recommend talking to other users in community channels or at conferences to surface “pain points the maintainers may understate” — a very human, non-technical verification step.

• ❌ Didn’t propose any quantified scoring model or matrix (unlike OpenAI, Claude’s pass/fail, and Gemini’s risk tiers) — leaves the reader with a thorough checklist but no way to turn it into a go/no-go decision.

Qwen (3.7-Plus at Medium)

• ✔ Easily the most exhaustive answer — 18 numbered sections spanning requirements-gathering, functional maturity, reliability, security, operations, performance, governance, licensing, migration, a full PoC plan, a 10-category scorecard, and a “common failure modes” section. Whew!

• ✔ The only model to open by insisting you build a requirements list specific to your workload first (Direct quote: ”replacing S3 is not just ‘can it store files’”) before evaluating any candidate — changing the question from “is X production-ready?” to “production-ready for what?”

• ⚠ Essay-length answer even at medium reasoning effort. It buried genuinely good advice so deep that a developer skimming for a quick answer will miss it.

All five recommended pretty much the same playbook. The only divergence was that OpenAI and Gemini tended to recommend concrete tooling/frameworks (OpenSSF, risk matrices), Claude and Grok preferred one non-obvious principle each (exit plan, talking to real users), and Qwen tried to cover… everything. At once. 😅

Share

TidBits 👨‍💻 

Heads up! Here, we’ll spotlight dev logs, tutorials, and war stories from our network of writers. If you've got something 22,000+ devs and founders would want to read, one account gets you featured right here. Learn more 👉

• 🥇 Why do Google, Common Crawl, and ChatGPT see different versions of the same URL? This dev fetched the same MDN page through HTTP, Playwright, Googlebot, Common Crawl, Wayback, and three LLMs—and found that each saw a different version. This is a great deep dive into why RAG pipelines can silently ingest stale, partial, or transformed content depending on how they fetch a page.

• 🥇 What happens when AI gets so good at teaching that students stop thinking? Shuyi Wang, a machine learning instructor, built a Skill that makes AI pause after each step to quiz students on the reasoning, diagnose what they don’t understand, and generate personalized tutorials for their knowledge gaps—giving them AI’s speed without outsourcing the thinking.

• 🥇 How do you give editors internet-connected Adobe apps while blocking the internet entirely? Here’s a full teardown of a locked-down AWS creative studio — VPN + MFA + Active Directory just to log in, every uploaded file auto-scanned for malware before it's visible, and a default-deny firewall that only allows out to a hand-vetted list of Adobe/Microsoft domains.

• Trump's crypto company is pushing users to Chinese AI models. And taking a cut. World Liberty Financial is in bed with WorldClaw, an AI router where half the models come from Alibaba, Baidu, and Z.ai — companies the Trump administration itself has flagged as national security threats. 😅

• AI is using your work but forgetting to mention you. A Semrush/Kevin Indig study of ~4,000 AI citations found 62% were "ghost citations" — your link shows up as a source, but your brand name never gets said out loud. ChatGPT is the worst offender: it cites you 87% of the time but only names you 21% of the time.

• Stripe is paying $7B+ for OpenRouter — the “one API, 400+ AI models” gateway its own CEO calls “Stripe for AI” just got 5x’d in a Bloomberg-reported buyout. Turns out, flattery does get you everywhere! 😅

• Say hello to OpenAI’s new “Ultrafast” tier. With Cerebras chips, OpenAI can now run GPT-5.6 at 750 tokens/second—fast enough to answer before you finish switching tabs.

• Data scientists, rejoice! DuckDB is turning into something you can actually run as a server. Version 2.0 adds client/server mode, triggers, async I/O, a proper VARIANT type for messy JSON, and a rebuilt SQL parser.