July 2013 Summaries

CloudFlare provides protection from Distributed Denial of Service (DDoS) attacks by acting as a filter to block bad traffic and only send legitimate traffic through to the origin server. However, it is crucial to keep the origin IP secure to protect against attackers who want to bypass CloudFlare's DDoS protection. Tips include keeping all subdomains on CloudFlare, reviewing DNS records, not hosting mail or other services on the same server as the web server, and changing the origin IP once configured for maximum DDoS protection. Following these steps will help keep your origin IP address private and help prevent DDoS attacks against your site.

CloudFlare operates at a significant scale, handling over a trillion requests through its network every month. To ensure efficiency, the company owns and operates all equipment in its 23 locations worldwide. In this article, Matthew Prince shares insights into the design of their fourth generation (G4) servers, which are built to handle high traffic volumes and DDoS attacks. The G4 servers feature increased storage capacity with SSDs, more RAM for caching popular resources, and upgraded CPU performance from Intel's Sandybridge chipset. Additionally, the network interfaces have been improved from 1Gbps to 10Gbps using Solarflare network cards. These enhancements enable better performance while reducing power consumption.

Matthew Prince, Co-Founder and CEO of CloudFlare, expresses concern over the secrecy surrounding government internet surveillance programs. He calls for a public debate on the extent to which governments should surveil the internet but emphasizes that first, there needs to be an understanding of the current state of affairs. Prince criticizes how internet giants are muzzled from disclosing information about legal orders they receive and highlights CloudFlare's commitment to fighting for its customers' rights. He encourages more companies to join in advocating for greater transparency around national security-related requests by the US government. The letter, signed by over 40 companies and organizations, urges the US government to allow internet service providers to regularly report statistics reflecting the number of government requests for information about their users under specific legal authorities.

Luxury Link, an ecommerce web property, has been using CloudFlare's Railgun acceleration technology since March 2013. The company saw immediate results with instant reductions in time to retrieve uncached HTML documents and a reduction in outbound bandwidth from their origin web servers. Railgun's delta compression algorithm significantly impacted outbound bandwidth consumption, resulting in dramatic peaks disappearing post-March. By accelerating the delivery of 'uncacheable' HTML pages, visitors experienced better response times and the company saw a big decrease in outbound bandwidth. The technology is especially attractive to cloud-hosted companies and businesses paying for every byte transferred in and out of their applications.

The text discusses how John Graham-Cumming, a representative from Cloudflare, explains their use of Transport Layer Security (TLS) and ciphersuites to ensure secure communication between clients and servers. They mention that they have been reevaluating the use of TLS due to recent news about security problems with RC4 cipher used for some TLS connections. The text provides a detailed explanation of how TLS works, including the negotiation process between client and server on which ciphersuite will be used. It also discusses forward secrecy, which is offered by ECDHE-based ciphers, and the recent attack against RC4 that could allow an attacker to recover parts of the original HTTP message when RC4 is used. The text concludes with Cloudflare's plan to deprecate TLSv1.1 and switch to TLSv1.2 for their internal systems, using ECDHE-RSA-AES128-GCM-SHA256 as the current cipher of choice.

CloudFlare, a web performance and security company, uses two technologies - PostgreSQL and Kyoto Tycoon (KT) - to manage its global network of datacenters. PostgreSQL is a classic SQL database engine that powers the CloudFlare website, while KT is a distributed key-value store used for replicating configuration changes across all datacenters. The company previously relied on scripts to reconcile data between these two systems, but with the introduction of writable foreign data wrappers (FDW) in PostgreSQL 9.3, they can now use database triggers to synchronize data more efficiently and simplify the process. CloudFlare has open-sourced their KT FDW code for others to benefit from this integration.