Turnstile API – John Graham-Cumming, Cloudflare

This is texturung TV. everyone welcome back to Tech show I'm really actually thrilled to have him on was a long time getting it together. It's John Graham coming John is the CTO of cloudflare and let me say it the onset where a cloud Fair custom cloudflare customer here at Tech strong the cloudfair our site sit behind that cloudflare Network protecting us from D Dawson a whole bunch of other good stuff and making our sites snappier and faster.

Anyway. Hey John, welcome to Tech strong TV. Thanks for having me.

Pleasure to have you on look we're going to discuss this great new offering from cloudflare. But before we do I'm sitting here I take for granted. Everyone knows what cloudflare is but they're probably people, you know, even though we have a tech audience that are not familiar.

Maybe we should clue them in. You know, what's cloudflare about? Yeah.

I mean, we we're probably the biggest tech company you haven't heard of if you haven't heard of this and we operate 275 data centers around the world. So literally in all the big cities in the world and we protect about 20% of websites and we protect a whole load of other stuff. So including your websites, right but also businesses and all sorts of things apis apps all manner of things from Hackers from DDOS from hackers trying to break in from ransomware all this kind of stuff and we also do performance as well.

We're a cdns. That means that we distribute content around the world to make everything faster. And we also make it more private.

So what we do is we protect we accelerate we make private about 20% of the web and a lot of other stuff. And so I always say you've used us today without realizing it because you've gone to some website or something or use an app that cloudflare protects. So, you know, you may not have heard of us, but we are there helping keep the web and the internet safe.

absolutely, you know I first became aware of flare Say 2010. I used to host. Well America's growth Capital Partners AGC used to put on a conference every year around RSA.

Timer around RSA conference in San Francisco, and I used to host the cloud security. panel, yeah, and that I had your CEO on these early. Yeah.

Oh very early days. Yeah. Yeah.

We launched around that time. Give me the company since 2011. So yeah, it's you know, we we had that Vision at the beginning of doing what we do today.

We just did it with two data centers back then and now we have more than 275 well because back then I mean CDs were known, you know zakamai was the CDM but not come I wasn't known for this much for security then right? It was pure CNN cloudflare was kind of the first time I had the Concept of using a CDN for security as well. Right a shield rather than just a delivery mechanism.

So that's right. Yeah. Yeah, if you remember back then I mean Akamai was really the great Pioneer and cdns and that was a period when it was like how do I deliver a video to somebody on the internet and do it successfully around the world may build a whole lot at 420 or whatever whatever it was, right, you know travel took a sort of slightly different approach.

She was to say we'll just handle all of your traffic and that'll let us accelerate it and also do the security stuff. That's where we are today and that's become a very popular model for how cdns Now operate. Absolutely, we could talk about cdns and stuff another time.

But hey before we dive in also, just maybe a little bit about your background China. I know you have quite an interesting. CV well, I so my background is that I am I went to University in the UK.

I'd actually did a PhD in computer security stuff. So I was always interested in computer security and then I ended up working for startups. I actually worked for seven startups in a row.

Both in the UK than in the US then in France and Germany and then in the in the UK again, and actually I now live in Portugal. So I've traveled around quite review. I've done a lot of security and a lot of networking stuff over my career and I've been at you know, cloudless since it was a you know was it wasn't brand new, but it was pretty tiny.

Absolutely Portugal is good. We have I have several people here in my office looking to move to Port you have this new digital Nomad, you know visa and people looking there. Yeah.

Yeah. Anyway, let's dive into what we really kind of were gonna talk about today. And that is cloudfield cloudflare has come out with the a new offering API set of apis which seek to finally eliminate a scourge of many of us on the internet users.

And that is the capture things. Yeah, right. Yeah and tell us about well, first of all why I called the discourage.

I mean it is a sketch right? I mean it's a it's an incredible waste of time. If you think about it, which is you know, you're proving you're proving that people say you're proving that you are human.

Actually you're doing the opposite you're proving that you're not a robot and you know, you really shouldn't have to do that. Right? I mean, there's like nobody likes captures at all and they are they're bad for all of us.

They're very bad. If you have any sort of disability. So, you know, if you have right everybody seeing that can be in a difficulty with motor function.

I mean, they're just a complete nightmare. They also tend to be culturally biased like so for example a fire hydrant in the UK doesn't make anything like a fire hydrant in the US and you identify the fire because I'm like, well if I haven't seen American TV programs when I was growing up, I'd have no idea that it's that that is exactly pump as we call so they're real mess and also They don't actually work that well anymore because there are companies and hacker groups dedicated to breaking them even actually paying people to break them. So there are people who sit there all day just doing captions which sounds like absolutely terrible job, but and getting paid a pittance for it, so we wanted to go into captions, but we still need to block Bots right?

We still need to bot block these things. So you need to have something to Gets rid of this problem. And so we had done this for ourselves.

We built this. Well internally was called No capture which was to get rid of captures completely was to have a way of saying this person this web browser session that's happening right now is a human behind it. And we built a whole lot of Technology around this making sure your browser is genuine making sure you seem to be behaving like a human, you know humans tend to like move the mouse a little bit and you know things like this and doing and also sending challenges to the browser which you never see we ask the browser so browser comes along and says, you know, I'm Google Chrome version blah and we say our heart.

Are you really are you a robot pretending and we have as a little challenges we send so this whole thing is called turnstile and we built it for ourselves and then was like, you know cloudflare has this Mission help build a better internet and was like, we should just open it up for everybody. It's privacy preserving. You're not giving away private information, you know, unlike, you know Google we capture.

I mean Google themselves our company that is based on advertising and wants more and more data. And so, you know, if you the alternative is recapture, which is possible captures. And also you have to worry about where your data is going and with us first of all, that's not our business executable.

We have a very strong privacy Heritage and so like you know what we should just build this thing and make it available to everybody and that's turnstile. It's available now whether you're a cloudflare customer or not. You can just go and use it and we're starting to see okay.

Yeah. Yeah. It's it's a we've done this for a couple of privacy preserving products.

We have turnstile and we also have an analytics product which is sort of an alternative to Google analytics and you don't have to be an existing customer. You can just use it. And if you later on become a customer great, that's fantastic.

But the idea is that you can use the service we have the scale to run it for you know. People out there and it just makes you know, it makes us it makes us better if things are private and especially captures which are horrible. So yeah, no I The amount of times I've been frustrated because I didn't click every crosswalk or couldn't find all the bridges because they really have an overpassing they call that a bridge and yeah, you know or the old stock captures where you got to type in the the number letter sequence, but they have him hidden in like abstract art and what the hell is that?

Anyway, so now I'm heading the audio things or reads it out to me. What a pain? Yeah.

Oh analytics thing though. I I take a note to have our team. Look at that as well.

Yes. Exactly. You can just it's a JavaScript snippet, you know on your side you don't have to be using cloudflare for your website.

So if you don't want to that's fine and we will give you analytics about you know, who's, you know, the volume of traffic you're getting the number of clicks and all that kind of stuff. Very cool stuff. So John you mentioned this is a you don't have to be a cloud flare customer to use the API here.

Is it just like a little Java coach snippet we put in there JavaScript. Yeah, you can go shopping script. Yeah, just pop it in there and it you can make it.

It's kind of two ways to do it one is to actually have it show a little thing in the in the you know, like the Google has the little cap to this says we don't actually have to do anything. You can have that style or you can have a completely invisible just like it doesn't in the background and you decide that you know what you want but it's a one line, you know script insertion and it's done and this is free of charge. It's free of charge.

Yes. This is part of all, you know, help make the internet better. You know, we we think that captures.

I mean we use captures a lot ourselves, right? That was one of our Technologies we used recapture for years as a way to detecting Bots and we knew that people hated it and we're just like and we hated it. And so we have to get rid of it.

And once we got rid of it for ourselves, you know the scale we're operating you're talking about millions of characters per day and millions of the cat that now turn style tests. This will just make life better for everybody. So, you know, you can just sign up for it.

It's privacy preserving Place captures, and we're starting See it get included in Frameworks like a sort of like a WordPress type thing. You know where it's next Works in WordPress. And yeah, the other all these things yeah.

Yeah, it's it's okay. Yeah. Yeah.

So look, this sounds too good to be true. And I'm old enough to know nothing is too good to be true right very rarely. Is somehow is is cloud Fair capturing data somehow on this or that's not the idea that there's two things right.

One thing is we hope you love this so much or like how far is a cool company? I'm gonna use their twenty dollar a month service or they're 200 to learn a month. So something right?

So yeah, we because of the efficiency of our business we can make this available to people It also makes our capture thing better. Right? So if we suddenly notice that this thing is getting bypassed in some way because it's being used so widely then we're like, oh we can we can improve it.

Right? And so it's one of the reasons why we have these things at scale and so it's helpful for us right because then our use of turnstile becomes better and we hope you might want to become a customer and also a large amount if you think about our brand around helping build a better internet this tells that story really super clearly and that's helpful for us. So in the sense is not there's no like directly.

Oh, yeah, they're building a secret profile of users and gonna sell. No because and frankly that's not out the business we've ever been in. our customers are people like you right pay for the service use it to protect their website and that's great and that that pays for the rest of fantastic so I guess the big question is where do I go to get this?

You can go to the cloudflare blog. There's a great blog on there about announcing turnstile. com/turn style and sign up go get it.

John then what a what a great service for Humanity you guys have done here. Thank you. Thank you.

Thank you, you know, I'm in London right taxis on yellow in London. I can't know they're black attacks. They're black.

So it's like identify the taxis. There are none. Yeah, you know what I yeah stuff.

I just hope it gets adopted in the days of me having to click those stupid pictures. Over and over and over again or are behind me and I hope other people it doesn't this is not about coupling necessarily being the one who provides the service that maybe other capture providers can switch to something that isn't invasive and is privacy preserving and that would be fantastic and we'd all be happy about that, too. What could be next eliminating passwords that's sort of starting to happen isn't it with parsley?

Right that's beginning to happen. Right? And so I think that finally maybe we're gonna get those would be too too scourges off of Yeah, you know.

Yes, yes and real complexities for people right? I mean I think about passwords is it worries people people know they should have good passwords, but then they don't and this other you're creating stress for people. It's like it's Technologies.

We need to find a solution for that. Absolutely. I've had this discussion with some technologists over the months and years.

Anyway, hey John, we'd love. To hear we're about out of time for this interview, but come back keep us posted on what's going on at cloudflare exciting good things for people using the internet and we'd love to report more on it. Yeah.

Thank you so much for having me on the show. It's a pleasure John Graham coming. On textrung TV.

We're going to take a break. We'll be right back.