Eating the Cloud from Outside In

See discussions on Hacker News and InfoQ.

Cloudflare launched on September 27, 2010, and every year since, it has made it a point to celebrate "Birthday Week" with a raft of launches. By far, the show-stopper this year was the announcement of R2 Storage, an S3-compatible Object Storage service that directly takes aim at AWS' "Hotel California" business model. This has been extremely well received, going by the response on HN and Twitter. In its past 5 birthdays, Cloudflare has gone from world-class CDN to offering:

• 2017: serverless compute
• 2018: eventually consistent datastore
• 2019: website hosting
• 2020: strongly consistent datastore
• 2021: object storage

This is an impressive pace and they are now declaring that they will be "the fourth major public cloud". When your market cap is $36 billion and your next biggest competitor is worth $1.6 trillion (~45x larger, albeit not pure-play), this is a bold statement. Many startups are trying by offering specialized Cloud Distros, but all building with AWS as the presumptive winner of the "first layer cloud" rather than trying to compete.

What's Cloudflare's strategy here?

My realization: The big 3 clouds are playing Chess, but Cloudflare is playing Go.

Two Kinds of Disruption

The canonical thoughtleader of Disruption theory is the legendary HBS Professor Clayton Christensen, and a lot has been made of Cloudflare's Disruption of AWS; in fact, Cloudflare cofounders Matthew Prince and Michelle Zatlyn were students of him at HBS. James Allworth, their Head of Innovation, studied and co-authored a book with him. Prince namechecked the Innovator's Dilemma at Cloudflare's launch in 2010, and in 2021 is still proudly showing off a handwritten note from him; in short, you can be sure his lessons are never far from Cloudflare's minds.

As Ben Thompson noted in his now-famous takedown of Christensen on the iPhone, people often miss that he had two theories of disruption:

• New Market Disruption: When incumbents ignore new technologies until it is too late.
  • Allworth recently wrote an instant-classic application of this on Intel (x86/CISC) vs Apple Silicon (ARM/RISC)
• Low-End Disruption: When vertically integrated premium incumbents get disrupted by "cheap and good enough" modular providers.

A third model of disruption comes from Kevin Kwok's Atomic Concepts, but that is a closer fit for the Cloud Distros thesis than Cloudflare.

On the first theory: Cloudflare has some excellent technologists — John Graham-Cumming, Kenton Varda and Rita Kozlov come to mind — and it is doing some cool things with V8 isolates and dynamic routing, but it doesn't (in my mind) have a clear claim on the overall new technology angle, since AWS created the modern serverless paradigm, open-sourced Firecracker, and is using Lambda for half of all new applications (though Cloudflare is also aggressively dogfooding Workers).

Most of the disruption discussion focuses on the second model of disruption, and it rings true. Cloudflare took a part of the cloud nobody valued, gave away an insanely good free offering, and quietly accumulated an 80% market share. Meanwhile, when people think of "Tier 1" AWS services, its Cloudflare equivalent, Amazon CloudFront, rarely gets any love, and the official AWS Twitter account hasn't tweeted about it in almost a year. Cloudflare leveraged their foothold into selling premium security services, and now is expanding into other value added pieces by leaning into a fundamentally different (high fixed cost, near zero marginal cost) business model the larger incumbents structurally cannot follow.

This, at least, is how Ben Thompson framed it in his writeup on Cloudflare's Disruption:

But this diagram is a little too neat. It imagines the two clouds as worlds apart. Yet R2 is explicitly designed as S3-compatible; in Prince's words, you can set it to "slurp" mode and you magically have a S3 interface with egress that is six orders of magnitude cheaper. Similarly, the original Cloudflare service could always be used together with EC2, and Cloudflare Workers have different enough usecases and limitations from AWS Lambda and Lambda@Edge that you could conceivably have a stack using all of them.

This isn't Apple vs Android; premium and vertically integrated vs cheap and modular; incompatible ecosystems, and never the twain shall meet.

This is something else.

Cloudflare and the Rules of Go

In the classic game of Go, you capture pieces by surrounding your opponents, instead of directly replacing their spot.

Storage Capture

You could view Cloudflare's Bandwidth Alliance and R2 as an "encircling" move around AWS' previously secure market position with S3. By promising to be API compatible (including offering S3's eleven-nines durability guarantee and free infrequent access), Cloudflare has cut off nearly all of AWS' remaining "liberties", putting it in "atari". If Cloudflare's offering matures enough to be seen as a strict superset, it places the final stone, capturing the "cloud storage" territory.

Product Strategy

In Chess, pieces have different values and capabilities. Bishops are worth 3 points and move diagonally, Rooks are worth 5 and move in straight lines, and so on. Pieces are best deployed in a sequence chain where higher value pieces support lower value ones.

In Go, each piece is indistinguishable from the other; it is the network position that counts, not any individual piece. Support doesn't matter so much as adjacent territory claimed; in the picture below, the four white pieces on the left do far less than the four black pieces on the right.

Compare this to public statements about how Cloudflare works. From Prince:

Since every server in our network runs every service, once we’re in for one thing means everything we do in the region gets better and less expensive to operate. This means, counter intuitively, as we add more locations to our network our costs generally go down, not up.

So while AWS has 17 ways to run containers and 7 ways to do async message processing, all overlapping and reinforcing and supporting each other, Cloudflare will tend toward introducing singular primitives, stuff them in a box, and try to ship those boxes to as many places as will possibly take them. If they could install Cloudflare on your mobile phone, they would (this gets them dangerously close to being a real life Pied Piper).

Update: I have been informed that you can in fact install Cloudflare on your mobile phone...

Territory Wins

In Chess, you only win when you checkmate the King, which in effect has infinite point value, winner-take-all.

In Go, you win by amount of territory claimed, and it is near impossible for one side to end up with zero territory. Perhaps this is more true to real life.

While AWS boasts an impressive 230+ points of presence, Cloudflare has interconnects with 10,000 networks including "every major ISP, cloud provider, and enterprise". These aren't the same thing, but it reflects the substantially different game that Cloudflare is playing. From the point of view of users, Cloudflare can be much easier to use and is much more of a painkiller than other big cloud services in their stack, despite perhaps having a single digit % of mindshare and wallet share. This puts Cloudflare within a stone's throw of Ben Thompson's other big claim to fame in Tech Strategy, Aggregation Theory (the Intro to Tech Strategy chapter in my book is free if you want my take on it).

Strategically, "Territory over Positioning" happens to be exactly the right call. In a zero-sum market that isn't growing, you want to jockey for position and take out enemies. In a positive-sum, infinitely expanding market like Cloud, you want to encircle them.

Watch for Sente

To quote Wikipedia, a move that overwhelmingly compels a player into a particular follow-up move is said to have "sente" (先手), or "initiative". In most games, the player who maintains "sente" most of the time will win.

There is a lot of speculation that AWS will have to respond somehow to Cloudflare's provocations:

But beyond a standard PR response, I doubt AWS will respond to mere noise - S3 data egress revenues have to take a significant downturn before AWS will be compelled to act. But when it does, every future move of Cloudflare's will be taken increasingly seriously. Cloudflare acts and talks like it has "sente" now, but it isn't real until AWS (or the other big clouds for that matter) feel forced to specifically respond.

Conclusion: Establish, Envelop, Expand

While the tech industry is used to come-from-below disruption, and the software industry is increasingly grasping class-for-the-masses atomic concepts, I believe Cloudflare is writing a new playbook that is the little-guy counterpart of the embrace, extend, extinguish model used by Microsoft.

Because it involves API compatibility, this playbook is particularly relevant to developer tools, and is protected by the Supreme Court ruling in Google v Oracle. If I were to summarize it in three words, looking over Cloudflare's history and annual report, I might call it:

• Establish: Establish a foothold in something incumbents don't care enough about
• Envelop: Reverse-proxy something that incumbents don't serve customers well on
• Expand: cross-sell other premium products and services until they are more customers of you than they are customers of the incumbent.

Given Cloudflare's fundamentally less-centralized approach to growing its cloud, it is no surprise that it announced its first Ethereum product this Birthday Week; although it remains to be seen if a Web2-native company can really drop enough of its assumptions to handle Web3 threats or opportunities. If we are truly in the "early Internet" days of Web3, only the paranoid might survive here. Fortunately, Prince seems to be a vocal fan of Andy Grove as well.