February 2013 Summaries

CloudFlare, a company providing internet services, is expanding its operations by opening an office in London to support its growing customer base and network. The company currently has data centers in 23 locations worldwide and requires round-the-clock technical support. By establishing a presence in London, CloudFlare aims to tap into the city's talent pool for positions such as Technical Customer Support and Technical Operations Engineer.

On February 27, 2013, Matthew Prince announced that 30 of the world's largest hosting providers are now supporting CloudFlare's Railgun WAN optimization technology. Railgun uses delta compression to only transmit the parts of a dynamic page that have changed from one request to another, achieving an average 99.6% compression ratio. The blog post discusses using headers included in responses delivered from Railgun to track its performance. By examining these headers, users can see how much data is saved and the origin processing time for each request. The Claire Chrome Plugin simplifies this process by displaying only the most relevant information.

CloudFlare has announced version 3.3.3 of its Railgun technology, which is now available for download on most popular Linux and BSD variants. Additionally, an Amazon Machine Instance (AMI) for Amazon Web Services will be released soon. Thirty leading hosting providers have registered to support CloudFlare's Railgun technology, allowing users to enable it with a single click without needing to install any software or change code. This revolutionary protocol significantly improves dynamic web performance and reduces bandwidth usage.

The number of open resolvers across the Internet has decreased by more than 30% since October, following a blog post from CloudFlare that named and shamed networks with the largest number of open resolvers. These resolvers are one of the sources of the biggest DDoS attacks, as they can be exploited to amplify attacker resources. The long-term solution for the web is for providers to close these open resolvers on their networks. CloudFlare has engaged in a name-and-shame approach and provided assistance to network providers interested in cleanup efforts.

Cloudflare's I'm Under Attack Mode (IUAM) has been successful in stopping Layer 7 distributed denial of service (DDoS) attacks by presenting a simple math problem to visitors, which they must solve before accessing the site. However, recently malware named OutFlare was detected that could bypass IUAM's protection by solving the math problem and posting back the answer. In response, Cloudflare updated its IUAM protection, making it more complex and harder for attackers to reverse engineer. The company plans to continue adapting its defenses in real-time to stay ahead of new threats.

On February 8, 2013, a bug in Facebook's Connect script caused users to be redirected to a Facebook error page on various websites including CNN, MSNBC.com, and New York Magazine. This incident highlights the risk of Javascript widgets creating single points of failure (SPOF) on web pages. CloudFlare offers two ways to protect against such errors: its Rocket Loader feature optimizes Javascript widget loading and has failsafes to prevent hijacking, while apps in the CloudFlare Apps Marketplace are vetted for performance and can be quickly removed if problems arise.

On February 4, 2013, a new SSL vulnerability known as the Lucky Thirteen was announced. Although TLS 1.1/1.2 do not fix this issue, it is theoretically difficult to exploit and requires creating numerous connections and measuring timing differences. CloudFlare's default SSL configuration protects against this attack by deprioritizing the vulnerable cipher. To ensure protection from the new vulnerability, users should upgrade their OpenSSL or NGINX versions when a patch is released and prioritize the RC4 cipher in their web server settings.

CloudFlare has introduced a new feature called 'Edge cache expire TTL' that allows users to override existing headers and control how long their edge servers will cache a resource before requesting a fresh copy from the server. This feature is useful in situations such as large traffic surges, DDOS attacks, or when using WordPress and wanting to overwrite default settings. Additionally, CloudFlare offers different edge cache expire TTLs based on plan type: Free (2 hours), Pro (1 hour), Business (30 minutes), and Enterprise (as low as 30 seconds).