April 2017 Summaries

Cloudflare is hosting several events in Berlin, Austin, and Portland for developers attending JS Conf EU, CSS Conf EU, or OSCON. In Berlin, John Fawcett's session on building JavaScript libraries will be held at both conferences. The Cloudflare Hacker Lounge will also be available for those who have made a Cloudflare App or are working on one. In Austin, Zack Bloom will introduce the new Cloudflare Apps and provide assistance to developers during an inaugural meetup at Capital Factory. In Portland, Eric Teffen Ellis will live-code a Cloudflare App at PDXnode Presentation Night. T-shirts, food, and special goodies are available for attendees at these events.

Cloudflare has introduced Orbit, a security solution designed to protect Internet of Things (IoT) devices from becoming part of botnets used for Distributed Denial of Service (DDoS) attacks. The company observed an increase in the use of IoT devices in DDoS attacks and decided to create a solution that would prevent these devices from being exploited in the first place. Orbit is designed to sit one layer before the device, providing a shield of security even if the device's operating system is outdated. The solution has already been adopted by over 120 million IoT devices and allows manufacturers to write logic on Cloudflare's edge and create their own firewall rules without requiring users to install updates. Additionally, Orbit can compress transmitted data and speed up traffic, improving device performance.

Cloudflare offers numerous benefits to ecommerce sites, including advanced DDOS protection and an industry-leading Web Application Firewall (WAF). One key feature is caching, which allows content to be served closer to the end user from their global network of data centers. This improves the user's shopping experience and contributes to increasing the proportion of people completing a purchase (conversion rate). Cloudflare operates over 110 data centers around the world and can store content such as images, JavaScript, CSS, and HTML on their servers, speeding up access to those resources for end-users. By default, Cloudflare caches static content based on a fixed list of file extensions. To make the most of Cloudflare and to help maximize the speed of your website, serve as much content as possible from the Cloudflare cache. Cloudflare's Railgun technology optimizes the connection between Cloudflare and the website origin for accelerating dynamic HTML content - content that can't be served from the Cloudflare cache.

In a recent development, AES-CBC cipher suites have seen their market share drop significantly on Cloudflare's edge network, falling below that of ChaCha20-Poly1305 suites. Over the last six months, AES-CBC has lost more than 33% of its share, which is now held by AES-GCM (71.2%) and ChaCha20-Poly1305 (15.3%). Additionally, ECDSA signature usage surpassed RSA at the beginning of this year, with over 60% of all connections using ECDSA. Furthermore, 98.4% of all connections now use PFS (Perfect Forward Secrecy) for key exchange, up from 97.6% six months ago. This trend towards safer and faster cryptography is expected to continue with the finalization of TLS 1.3 later this year.

SSL for SaaS is a solution that allows SaaS companies to easily extend the benefits of Cloudflare to their customers' custom domains. This enables customers to host applications on their own domain while enjoying improved SEO and discoverability. The process involves setting up a CNAME record, making an API call, and allowing Cloudflare to handle the rest, including provisioning the hostname, acquiring SSL certificates, and protecting against DDoS attacks. SSL for SaaS offers all of Cloudflare's benefits, such as CDN, WAF, HTTP/2, load balancing, and more. This solution is suitable for various types of SaaS applications that allow customers to bring their own domain, including content management solutions, eCommerce platforms, web portals, and platform-as-a-service companies.

On April 18, 2017, Cloudflare announced the deployment of a new data center in Budapest, Hungary, serving six million websites faster and more securely across the country. This follows recent additions in Yerevan, Quito, Rome, Kansas City, Belgrade, Curacao, Djibouti, and Munich. Previously, Hungarian users were served from Cloudflare's data center in Frankfurt or Vienna. The company plans to continue expanding its network across five continents.

Security researcher Omer Gil has identified a new type of attack called the Web Cache Deception attack, which targets websites using reverse proxies like Cloudflare and are misconfigured in a particular way. The attack involves tricking users into visiting malicious URLs that appear legitimate but can be cached by the reverse proxy, exposing sensitive content. To defend against this attack, website owners should ensure their site isn't so permissive and never treats requests to nonexistent paths as equivalent to valid parent paths. Cloudflare has outlined its cache logic in two phases: eligibility and disqualification, with specific rules for each phase that determine whether a request is cached or not.

Cloudflare has extended its Rate Limiting service to all customers across all plans as an optional paid feature. The first 10,000 qualifying requests are free. Rate Limiting helps protect websites and APIs against denial-of-service attacks, brute-force password attempts, and other types of abusive behavior targeting the application layer. Several examples show how customers have successfully used Rate Limiting to mitigate malicious attacks, reduce infrastructure costs, and protect valuable information such as intellectual property and customer data.

The European Data Economy was valued at EUR 272 billion in 2015 and is expected to increase to EUR 643 billion by 2020, driven by emerging technologies like the Internet of Things and Artificial Intelligence. Companies benefit from data flow restrictions, allowing them to access better technologies, enter new markets, develop new products and services, and achieve efficiencies and cost reductions. Cloudflare is committed to user privacy, transparency, and business accountability, working towards full implementation of the EU's General Data Protection Regulation (GDPR) by May 2018. The UK needs to maintain adequate data protection measures post-Brexit to ensure seamless data flow between EU Member States and the UK.

Cloudflare is working with registrars and registries in the IETF to make Domain Name System Security Extensions (DNSSEC) easier for domain owners. Starting with .dk domains, they will enable DNSSEC automatically over the next two weeks. DNSSEC verifies the integrity of DNS answers by signing every DNS answer so clients can verify if it has been manipulated during transit. The challenge is that for a domain to have the opportunity to enable DNSSEC, its DNS provider, registrar and registry all need to support DNSSEC and the same encryption algorithms. Cloudflare proposes a new model for how DNS operators, registries and registrars could operate and communicate to make specific user-authorized changes to domains. The .dk registry has also recognized the outdated model and provides users with a programmatic way of installing and updating DS records.

On April 12, 2017, Cloudflare opened its latest data center in Munich, marking their 110th worldwide and fifth in Germany. Located just over a mile away from the historic Hofbräuhaus, this new deployment will help speed up six million websites across Bavaria while providing additional redundancy and capacity to withstand attacks. The expansion is part of Cloudflare's ongoing network growth that now spans 55 countries.

In 2017, Cloudflare announced significant improvements to its DNS infrastructure, which included replacing two core elements of the service: the part of their DNS server that answers authoritative queries and the data pipeline responsible for distributing changes made by customers to DNS records across the globe. The new system was designed to handle millions of zones more efficiently than the previous one. The new data model grouped data by RRSet, allowing a single request to be made to the KV store to retrieve all the data needed to answer a query. This change significantly reduced memory usage and improved performance. The team also switched from using JSON and Protocol Buffers to MessagePack for serialization, which further enhanced efficiency. A new data pipeline was implemented to distribute zone changes globally in seconds rather than minutes or hours. Global distribution is challenging due to various layers of caches, but the new system has been successful thus far. The authoritative rrDNS v2 filter was also rewritten from scratch to better suit the scale and shape of DNS traffic today. The migration process involved moving zones over gradually while keeping both systems in sync, allowing for quick rollbacks if needed. Overall, these improvements resulted in a 3x performance boost in code handling DNS queries, faster updates to DNS data globally, better system robustness, and more test coverage.

Cloudflare has recently added two new data centers (numbers 108 and 109) in Curaçao and Djibouti respectively. Both locations are significant due to their proximity to undersea cables, which play a crucial role in the global internet infrastructure. The Amsterdam Internet Exchange operates AMS-IX Caribbean in Willemstad, the capital of Curaçao, while Djibouti serves as a vital communications gateway for landlocked countries like Ethiopia and South Sudan. Undersea cables have become increasingly important in recent years, with their capacity to encode data in multi-Terabit range surpassing that of satellites. Cloudflare's expansion into these locations is part of its ongoing commitment to providing fast internet infrastructure across the globe.

On April 5th, 2017, Cloudflare opened its 107th data center in Belgrade, Serbia, making it the sister city to Chicago where their first data center was established. As a member of the Serbian Open Exchange, the leading internet exchange point in the country, they aim to help make over 6 million websites faster for nearly 6 million Internet users. The expansion brings Cloudflare's growing European network to 30 cities, including facilities in Amsterdam, Athens, Barcelona, Berlin, and more.

On April 5th, 2017, Cloudflare opened its 106th data center in Kansas City, Missouri, aiming to enhance the speed of over 6 million websites in the Midwest. This new facility joins existing US locations in cities such as Ashburn, Atlanta, Boston, Chicago, and Dallas. The text also highlights Kansas City's famous BBQ scene, with a mention of Joe's KC BBQ being featured in Anthony Bourdain's "13 Places to Eat Before You Die." Additionally, the city is home to the Nelson Atkins Art Museum, which features the world's largest shuttlecocks. The text concludes by teasing an upcoming data center opening 5,377 miles away from Kansas City.

On April 1, 2017, Cloudflare introduced two performance-enhancing features designed to make the internet more accessible and enjoyable for underrepresented demographics: cats and Australians. Feline Mode caters to users with a love of feline content, while Australia Mode addresses the challenges faced by Australian internet users due to their geographical location. Additionally, Cloudflare Apps allows developers to create add-ons that can be one-click installed on websites, including monetization through the Cloudflare Apps marketplace.