In this video I’m talking about Cloudflare vs Vercel drama—again—but this time it’s not V-Next. The trigger is a blog post from the Vercel CTO about Cloudflare forking an open-source project called “justbash” (a sandboxed bash interpreter for AI agents written in TypeScript with an in-memory filesystem) and publishing it as “Cloudflare shell.” I walk through what justbash actually is, why it’s useful (agent-style bash access without spinning up a full VM), and the key detail: a lot of it runs directly in the browser with no backend. My main takeaway is nuanced: Cloudflare is legally allowed to fork (Apache 2.0), but that doesn’t automatically make it a good move—especially when the upstream project is actively developed and has a single maintainer who says there were no contribution attempts. I also dig into the security angle raised in the post: removing “beta” disclaimers, stripping defense-in-depth layers (like disabling eval/function constructors), and changes around Python/Pyodide that can widen the security surface when you claim “runs anywhere” (Workers, Node.js, browser). I end up fairly neutral: I think the concern is real and the heat Vercel is getting on X is probably overblown. At the same time, I don’t love this becoming public tech-theater—this could’ve been handled via PRs, issues, or backchannels instead of a blog-post showdown.