March 2015 Summaries

Google proposed a new HTTP compression method called SDCH (SanDwiCH) to create dictionaries for long strings appearing on many pages of the same domain or popular search results. The compression replaces these long strings with references to the dictionary, resulting in significant file size reduction. However, the drawbacks include large dictionary files and limited usefulness across different sets of pages. At CloudFlare, the challenge is supporting millions of domains with varying content. Better compression leads to smaller payloads and faster content delivery. Besides SDCH, common HTTP compression methods are gzip and DEFLATE, which perform identical compression but differ in header content and error detection functions. DEFLATE consists of two stages: LZ77 algorithm for string replacement and Huffman encoding for further compression. The algorithm's search for matches is determined by the compression level. A deflate dictionary can act as an initial back reference, improving compression ratio. An experiment using a 16KB or 32KB dictionary showed significant compression improvements without substantial performance hits. The utility to make a dictionary for DEFLATE and the optimized version of zlib used by CloudFlare are available at https://github.com/vkrasnov/dictator and https://github.com/cloudflare/zlib, respectively.

The text discusses an issue with goroutines and closures in Go programming language. It explains how using goroutines to run concurrently can lead to unexpected results when sharing a single variable across multiple closures, as demonstrated by the output "10 10 10..." instead of numbers from 0 to 9. The solution provided is to create a new variable and pass it as a parameter to the function call within each goroutine, ensuring that each closure has its own copy of the variable. This issue is also mentioned in the Go FAQ.

CloudFlare offers integrations for popular hosting control panels and billing systems such as WHMCS, cPanel, and Plesk. These integrations simplify the process of signing up for CloudFlare and adding domains. The recent update to WHMCS and cPanel plugins allows them to communicate with each other, providing a seamless experience for users who use multiple systems. The integration process involves direct communication between hosting control panels and CloudFlare's host API, making DNS changes accurate and easy. For partners using both WHMCS (billing) and cPanel (hosting), the latest version of the WHMCS integration can be downloaded from their website.

On March 19, 2015, multiple vulnerabilities were discovered in OpenSSL, a cryptographic library used by CloudFlare and most websites on the internet. The vulnerabilities primarily affect CloudFlare as a "Denial of Service" possibility rather than an information disclosure vulnerability. Customer traffic and SSL keys remain protected. CloudFlare has quickly tested the patched version and begun pushing it to their production environment. They encourage customers to upgrade to the latest patched versions of OpenSSL on their own servers, particularly if they are using the 1.0.2 branch of the library. The individual vulnerabilities included in this announcement are: CVE-2015-0291, CVE-2015-0204, CVE-2015-0290, CVE-2015-0207, CVE-2015-0286, CVE-2015-0208, CVE-2015-0287, CVE-2015-0289, CVE-2015-0292, CVE-2015-0293, CVE-2015-1787, CVE-2015-0285, CVE-2015-0209, and CVE-2015-0288. CloudFlare thanks the OpenSSL project and individual vulnerability reporters for their work in finding, disclosing, and remediating these issues.

On March 10, 2015, CloudFlare introduced Virtual DNS, a service that leverages its global DNS and proxying infrastructure to provide performance and security for any nameserver by acting as authoritative for its domains. The service helps protect against Distributed Denial of Service (DDoS) attacks on providers' nameservers, which can take down hundreds of thousands or millions of websites depending on those nameservers. Virtual DNS also offers two additional layers of security through the CloudFlare proxy: caching records at the edge for faster response times and masking the true origin IP addresses of the provider's nameservers to protect them from being targeted by attackers.

The Domain Name System (DNS) continues to evolve with new developments and resource records types being added regularly. One such record type, DNS ANY meta-query, is being deprecated due to its lack of justified uses and the complexity it adds to DNS server code bases. ANY queries are not widely used by real world software, except for unpatched versions of qmaild and Firefox version 36.0 to 36.0.1. The decision to phase out ANY queries is supported by examples from other operators who have limited or disabled them in the past with minimal impact on Internet users.

On March 5, 2015, Cloudflare opened a new data center in Düsseldorf, Germany, which serves as an important addition to their European network. The data center not only improves performance for users in Germany and Northern Europe but also provides additional redundancy for other data centers across the continent. This marks the beginning of a series of new Cloudflare data centers planned for 2015.

On March 04, 2015, John Graham-Cumming announced that CloudFlare's SSL customers are not affected by the FREAK vulnerability. The company does not support 'export grade' cryptography and upgraded to a non-vulnerable version of OpenSSL in early January. Their OpenSSL configuration is available on Github, along with patches for OpenSSL 1.0.2. CloudFlare stays proactive by disabling outdated protocols and ciphers while keeping up with the latest secure ones.