March 2014 Summaries

On March 20th, 2014, CloudFlare's system engineer, Nick Sullivan, will conduct a security-themed webcast discussing ways to ensure server software stays secure. The discussion will cover advanced techniques such as anti-reverse engineering methods, secure key management, and designing a system for renewal. This is in line with CloudFlare's commitment to improving the security of their customers' websites. Those interested can register for the webcast here.

Martin J Levy shares his experience as a new Network Strategy employee at CloudFlare on March 10th, 2014. He was welcomed with a desk, computer, and other office items ready for him to start working. During his first day, he met various teams within the company and learned about their passion for IPv6. The company had recently reached 5,000 customers who signed up to have their web properties accelerated and protected by CloudFlare. Martin is an advocate of IPv6 and believes that it will help address the issue of limited IP addresses on the internet. He shares that CloudFlare has been running an IPv4/IPv6 gateway for its customers, allowing them to access websites over both protocols. In the upcoming weeks, CloudFlare plans to make the default setting "IPv6 on" for new customers and enable IPv6 for existing customers in a staggered release. Martin expresses excitement about joining the company and encourages others to check out their careers page as they are hiring.

The Texas Tribune, a nonprofit media organization, successfully supported livestreamed events at South by Southwest (SXSW) in 2014. They worked with the festival's organizers to stream interviews of major speakers Julian Assange and Edward Snowden. To prepare for high traffic levels and potential security threats, they assembled a team that included their director of technology, Amanda Krauss, and sought advice from Harper Reed, an advisor who had previously managed the website for Obama 2012. They implemented CloudFlare to enhance security and improve performance. On the day of the Snowden interview, The Texas Tribune experienced a 10X spike in traffic with viewers from over 200 countries.

On March 11, 2014, Simon Moore from CloudFlare discussed the issue of Layer 7 attacks targeting WordPress servers due to its widespread use on the web. He mentioned a large DDoS attack observed by Sucuri that exploited the pingback mechanism in WordPress. The attack involved using an XMLRPC endpoint and triggering HTTP requests to victim websites, causing server overload with minimal effort from the attacker. CloudFlare's WAF rule WP0001, "WordPress Pingback Blocker," prevents this type of abuse by stopping pingback usage on a WordPress blog. Additionally, their rule 100000, "WordPress Numbers Botnet," blocks mutating query strings in URLs to prevent server overload from repeated page generation attempts. Enabling these CloudFlare Wordpress rulesets can help protect websites from such attacks.

The World-Wide Web, a fundamental part of modern life, was proposed by Tim Berners-Lee in 1989. Since then, it has undergone significant changes and advancements. Key milestones include the release of the first web browser in 1990, the introduction of SSL for secure connections in 1995, the development of XMLHTTPRequest which helped kick off Web 2.0, and the ongoing work on HTML5 and CSS Level 3. Today, companies like CloudFlare help customers stay up-to-date with these evolving web technologies.

The blog post discusses the adoption of elliptic curve digital signature algorithm (ECDSA) for improving performance on the internet. It highlights that ECC-enabled TLS is faster and more scalable, providing the same or better security than the default cryptography in use on the web. The author explains how ECDSA can be used to improve performance on the Internet and announces that CloudFlare now supports custom ECDSA certificates for their customers. It also compares ECDSA with RSA and mentions the benefits of using ECDSA, such as smaller keys and faster algorithms for generating signatures. The post concludes by emphasizing the importance of proper implementation to prevent potential security vulnerabilities in ECDSA.

The article discusses how Go programs keep time with the help of the Linux kernel, focusing on the upcoming changes related to timekeeping in the Go 1.3 release. It explains that accurately determining the current time is important for many systems and provides a detailed overview of the Time package in Go's standard library. The author also delves into system calls available on Linux for obtaining the value of the clock, benchmarks comparing different versions of Go, and various sources of information related to timekeeping architecture in the kernel.