July 2016 Summaries

On July 21, 2016, web performance experts Ilya Grigorik from Google and Suzanne Aldrich from Cloudflare will discuss the latest developments in HTTP/2 and Server Push. The talk will cover tools and resources for building fast and scalable web applications, as well as ways to optimize content delivery across devices. The event is scheduled for 1pm-2pm Eastern Time (1500 – 1600 UTC).

On July 18, 2016, Ben Cartwright-Cox announced a new vulnerability called httpoxy that affects applications using "classic" CGI execution models and could lead to API token disclosure of services your application communicates with. Cloudflare has implemented automatic protection for all customers against this vulnerability. By default, harmful httpoxy requests are modified to be harmless and allowed through. However, customers can also use Web Application Firewall rule 100050 in Cloudflare Specials to block such requests that could lead to the httpoxy vulnerability.

CloudFlare's Data Team reports on their edge network logs processing, detailing the numbers from an ordinary day in July 2016. They handle nearly 360TB of raw, Cap’n Proto event logs daily, using two Kafka clusters and a significant amount of hardware for data consolidation. The team highlights what has worked well in their system, such as the log forwarder, Kafka, persistence for log sharing, CitusDB, and the platform and SRE. They also discuss areas they want to improve or add in the near future, including making services more reliable, new analytics, new data pipelines, and better support for complex analysis. The Data Team invites feedback and comments on their work.

The use of the Linux kernel's TCP stack is a subject of interest due to its ability to handle multiple network applications and provide hardware independence and easy-to-use APIs. However, some argue for using a userspace network stack for better performance and lower latency. At CloudFlare, they use a "partial kernel bypass" technique to offload their anti-DDoS iptables to a very fast userspace process, saving Linux from processing attack packets and avoiding IRQ storms situations. Despite the potential benefits of kernel bypass, it is unlikely to become mainstream due to the lack of stable open-source partial kernel bypass technology and the rich ecosystem provided by the Linux TCP stack.