Cloudflare's own dashboard says the web is still two-thirds human
Matthew Prince tweeted that bots had finally passed humans online "for the first time in the Internet's history." A security researcher pulled up Cloudflare's public data and found the all-traffic number tells the opposite story.
Why a single tweet from Cloudflare's CEO ended up on trial
When Matthew Prince (HN handle eastdakota), Cloudflare's CEO, tweeted that "bots have now passed human traffic online for the first time in the Internet's history," he did the responsible thing and linked the data behind it. A security writer at flyingpenguin took him up on the offer, opened the same Cloudflare Radar dashboard, and concluded the headline number was cherry-picked.
The whole trick is HTML-only versus all-traffic
The author's argument is narrow and technical. Cloudflare's dashboard exposes two views. Filter to HTML requests only and bots edge past humans. Look at all traffic — every CSS file, image, script, and font a real browser dutifully fetches to render a page — and "online traffic is still about two thirds human." Prince published the first number as a fact about the entire internet and left the second one, on the same dashboard, unmentioned.
The reason the two diverge is mechanical: a scraper typically grabs one HTML page and stops, while a human's browser pulls dozens of sub-resources per page. Counting HTML-only inflates the bot share; counting everything deflates it. Neither is wrong, but only one was quoted.
The second charge is about category. Prince framed the surge as agentic traffic — AI agents browsing on a user's behalf. But in Cloudflare's own bot taxonomy, search crawlers are the largest slice by a factor of two, AI training scrapers like GPTBot and ClaudeBot are next, and agentic bots are the smallest bucket — "exactly the traffic his pay-to-crawl product exists to bill," the author notes.
The thread splits on the word "lying"
The loudest pushback was on the headline, not the math. Simon Willison, creator of Datasette and co-creator of Django, opened the thread defending the framing as overheated:
"'Cloudflare CEO is lying' is a bit of an aggressive take when he linked to the exact data so you can see it for yourself… It's also a single tweet that links to the data used to 'disprove' it. Would be a weird way to lie." — Simon Willison
Willison did concede the substance: the data supports "bots passed human traffic" but not the "agentic" attribution, since most of it is crawlers building indexes, not agents acting for owners.
A media executive in the thread defended the methodology itself:
"In the context of bot traffic on the web, looking at only GETs for HTML is a reasonable approach. If you're counting all requests for all assets then a single page view of nytimes.com would count 100x as much as one for HN." — the co-founder of Industry Dive, a B2B news publisher
But operators who actually fight scrapers brought receipts that cut the other way. An engineer who handles scraping for LessWrong explained why the measured bot share is itself shaky:
"It's easy to drastically underestimate the amount of bot traffic, because bots make efforts… to look human enough to evade blocking… traffic from badly behaved browser-impersonation bots exceeds traffic from named scrapers like GPTBot by something like 10x." — an engineer who handles scraper mitigation for LessWrong
And one commenter named the conflict of interest directly:
"There is an unfortunate incentive created when a 'business' depends on 'bot traffic'… Because the 'business' relies on the existence of 'bot traffic', there's an incentive to broaden the scope of what is labeled as 'bot traffic'." — a commenter on the bot-detection-vendor incentive
The real disagreement is definitional, not factual
Nobody in the thread actually disputes that bot traffic is large and growing — several operators report their own sites running 100x bots to humans. The fight is over two precise things: whether "HTML-only" can be sold as "the internet," and whether a surge dominated by index-building crawlers can be rebranded as "agentic." On both, Prince's own dashboard is the strongest witness against the tweet. "Lying" is the wrong word — the data is right there — but the gap between what the data shows and what the headline claimed is exactly as wide as the author says.
Get breakdowns like this every day
The top Hacker News stories, unpacked — by email, Telegram, or RSS.
The study that says Claude didn't break rsync was itself written by an LLM
An analysis defending AI commits in rsync runs permutation tests, Fisher's exact, severity-weighted bug rates — and lands on "no significant difference." The thread's reply: you reached that conclusion from exactly two Claude releases, and your own prose is AI slop.