December 2015 Summaries

In December 2015, CloudFlare launched a new data center in Cairo, Egypt, marking its third data center in Africa and the 74th globally. This expansion aims to improve performance for Egyptian websites using CloudFlare's services, with half of the top 20 sites in Egypt already experiencing a 2x improvement. The partnership with Telecom Egypt also reduces latency for users on Egypt's largest network. As part of their global strategy, CloudFlare plans to continue expanding its data centers across all inhabited continents in 2016.

On December 25th, most security engineers find it challenging to explain their jobs to family members due to the complexity of their work in cryptography. To help bridge this gap, an analogy can be drawn between traditional banks and encryption on the internet. Just as big fancy buildings convey trustworthiness for physical banks, TLS certificates serve a similar purpose online by ensuring that users are visiting the actual domain they intend to visit and not a phishing website. Encryption also protects sensitive information from intermediaries during transactions. To stay safe online, individuals should look for encrypted connections, double-check domain names, avoid sharing sensitive information through insecure channels, use different passwords for each account, enable two-factor authentication, and keep their systems updated.

On December 24, 2015, CloudFlare launched its latest European data center in Sofia, Bulgaria. This expansion brings the total number of European data centers to 20, including locations such as Amsterdam, Frankfurt, Paris, and London. The new data center improves web performance for millions of users across Bulgaria by reducing the distance between them and their network servers. CloudFlare's next data center will be announced in a different continent.

The article discusses the vulnerability of cryptographic hash functions, specifically the widely used SHA-1 and MD5 algorithms. It explains how these functions are designed to resist certain types of attacks but have been broken in practice. The author highlights the potential threat posed by a lack of collision resistance in these algorithms, which could lead to forged digital signatures and compromised trust on the web. The article also explores how hash collisions can be used to forge digital signatures, as demonstrated by the MD5 attacks. It describes the chosen-prefix attack technique, which allows an attacker to create two certificates with the same hash value by predicting certain values in the certificate structure. This technique was used to forge a certificate authority trusted by browsers and also played a role in the Flame malware attack. The author emphasizes that while SHA-1 is considered more secure than MD5, it too has been weakened by theoretical attacks and may be vulnerable to chosen-prefix collisions in the near future. To mitigate this risk, the article suggests requiring CAs to randomize serial numbers in certificates, making it significantly harder for attackers to predict these values and carry out chosen-prefix attacks. In conclusion, the article highlights the importance of maintaining strong cryptographic hash functions and ensuring that digital signatures remain secure against forgery. It advocates for measures such as requiring entropy in certificate serial numbers to protect against potential vulnerabilities in algorithms like SHA-1.

The Go programming language's standard library maintains a connection pool for each remote host that supports Connection: keep-alive to minimize roundtrip latency. When making an HTTP request, two goroutines race to establish a new connection or retrieve an idle one from the pool. Late binding is used in Chromium and CloudFlare's Railgun to ensure quick response times by prioritizing available connections. Connection pooling and late binding can be crucial for reducing latency as long as proper cleanup of bad connections and cancelled requests is ensured.

On December 18, 2015, Cloudflare announced the deployment of a new data center in Hamburg, Germany, making it their 4th in the country and 72nd globally. This expansion provides better performance for users in Germany and additional redundancy for existing data centers. With this addition, Cloudflare now has points of presence in 8 out of Europe's 10 most populous cities, with plans to reach all 10 soon. The company also hinted at more global deployments during the holiday season and offered a prize for guessing the number of data centers by year-end and the next location not yet on their system status page.

The text discusses a new feature in netmap, a kernel module that improves network performance by allowing direct access to NIC queues. Previously, all queues had to be detached from the host network stack for netmap mode to work. However, with the introduction of single-rx-queue mode, users can now partially put a network adapter in netmap mode, leaving some queues attached to the host stack. This feature is useful for specific use cases where only RX rings are needed without their TX counterparts. The text also provides instructions on how to build and test this new feature under Linux using the ixgbe driver.

On December 17, 2015, Cloudflare expanded its network in Canada by adding points of presence (PoPs) in Montreal and Vancouver, making it the second and third largest Canadian metropolitan areas respectively. This expansion brings the company's total number of PoPs globally to 71. The web sites, mobile apps, and APIs of all Cloudflare customers are now delivered at a speed that is millions of times faster than the fastest NHL slapshot. Canada has one of the highest internet penetration rates in the world with nearly 87% of Canadian households connected to the Internet. In 2013, Canadian enterprises sold over US$100 billion in goods and services online, up from US$87 billion a year earlier. Latency is an important factor affecting e-commerce transactions, as Amazon found that every 100ms of latency cost them 1% in sales. Cloudflare plans to add more data centers during the holiday season to further improve internet speeds and reduce latency for its users.

The recent Joomla security issue is a critical vulnerability that allows unauthenticated remote code execution (RCE) on vulnerable websites. This vulnerability was discovered in the User-Agent HTTP header, which can be exploited to execute arbitrary PHP code on the server hosting the website. The attackers are using this vulnerability to upload and execute malicious PHP files, often disguised as legitimate files such as "ajax.php". These files act as a backdoor, allowing the attacker to gain full control over the affected website. The exploit is being actively used in the wild, with numerous attempts observed by security researchers. The issue was patched in Joomla 3.9.2 and later versions. However, many websites are still vulnerable due to outdated software or improper configurations. It is crucial for website administrators to update their Joomla installations to the latest version as soon as possible to mitigate this vulnerability. In addition to updating the software, it is also recommended to implement a Web Application Firewall (WAF) that can detect and block exploit attempts targeting this vulnerability. This will provide an additional layer of protection against potential attacks.

This article explains a technical demonstration comparing the performance of HTTP/1.1 and HTTP/2 on a demo page. Two inline frames (iframes) were used, one loading over an HTTP/1.1 CDN and the other over an HTTP/2 CDN. The iframes contained full HTML pages with JavaScript that built image tags in sequential order to highlight the performance gains of HTTP/2. The article also discusses caching policy, a Firefox caching bug/feature, SPDY fallback, and emphasizes that this is a demonstration, not a simulation.

The article discusses how web developers should optimize their websites for HTTP/2, which provides a 30% performance gain without requiring complex build and deploy processes. Unlike HTTP/1.1, where minimizing the number of HTTP requests was crucial, in HTTP/2, web developers should focus on tuning website caching behavior. The multiplexing feature of HTTP/2 allows multiple requests to share a single TCP connection, eliminating head-of-line blocking issues from HTTP/1.1. Header compression further reduces the overhead of multiple HTTP requests. Best practices for HTTP/2 web optimization include: 1. Stop concatenating files: Instead, focus on optimizing caching policy by isolating frequently changing files from rarely changed ones. 2. Stop inlining assets: Leverage HTTP/2's server push functionality instead of embedding CSS stylesheets, external JavaScript files, and images directly into HTML pages. 3. Stop sharding domains: Multiplexing allows multiple assets to download in parallel over a single connection, making domain sharding unnecessary. Some HTTP/1.1 best practices that still apply include minimizing DNS lookups, using content delivery networks (CDNs), leveraging browser caching, minimizing the size of HTTP requests and responses, eliminating unnecessary redirects, and keeping server-side redirects to a minimum.

Starting January 1, 2016, most certificate authorities will no longer issue new SSL certificates that use the SHA-1 hash algorithm due to its vulnerability to potential collision attacks. While this move is necessary for maintaining security on the modern internet, it could potentially cut off millions of users in developing countries who are still using older devices and browsers without support for the more secure SHA-256 (SHA-2) algorithm. To address this issue, Cloudflare has introduced a feature that allows its paid customers to automatically fall back to serving SHA-1 signed certificates for legacy browsers while continuing to use SHA-256 for modern ones. Other companies like Alibaba and Facebook also support SHA-1 fallback on their websites. The industry is urged to adopt the proposal of creating a new Legacy Verified (LV) certificate class that allows legacy signature protocols, such as SHA-1, but only be issued to organizations that properly issue certificates based on modern protocols for modern browsers while falling back for legacy ones.

This blog post discusses various tools and resources for testing, debugging, and understanding HTTP/2 connections on the web. It covers browser add-ons like HTTP/2 and SPDY Indicator extensions for Google Chrome and Firefox, online testing tools such as Claire by CloudFlare, command-line tools including is-http2-cli, curl, nghttp, h2c, openssl s_client, and h2i. It also mentions load testing tool h2load, conformance test tool h2spec, HTTP/2 libraries for different programming languages like C, Go, Ruby, and Haskell, and packet snooping using Wireshark. The post concludes with a Chrome Developer View feature that allows users to see which parts of a web page were downloaded using HTTP/2.

In November 2015, CloudFlare participated in the tenth annual Internet Governance Forum (IGF) held in João Pessoa, Brazil. The IGF is a platform for discussing decisions that will impact the future of the internet and has been influential in shaping corporate strategies, standards proposals, and national government policies. This year's event featured an extensive range of issues and diverse speakers. A major underlying debate was observed between two mindsets: "foresters" who advocate for permission-less innovation and a free market approach, and "gardeners" who believe in choosing the best technologies, business models, and policies rather than leaving it to the market. The future of IGF will be determined by discussions in New York City where UN member states will decide whether to renew its mandate and if it should continue as an equal platform for all stakeholders or change into a government-defined agenda setting entity.

CloudFlare has introduced HTTP/2 support for all customers using SSL/TLS connections while still supporting SPDY. Both protocols are automatically enabled for Free and Pro plan users, with Business and Enterprise plan users able to enable HTTP/2 within the "Network" application of the CloudFlare Dashboard. The main focus of both SPDY and HTTP/2 is performance, particularly latency as perceived by end-users while using a browser, with a secondary focus on network and server resource usage.