July 2017 Summaries

On July 12th, known as "Net Neutrality Day", Fight for the Future (FFTF) launched a Cloudflare App to promote awareness and encourage users to contact their local congressional representatives about the importance of Net Neutrality. The app was installed on numerous websites worldwide, resulting in approximately 178 million page views. This led to over 2 million comments submitted to the Federal Communications Commission (FCC) and millions of emails and phone calls directed towards Congress. Cloudflare, a company that believes in equal voice on the internet, supports FFTF's efforts and highlights the effectiveness of online civic campaigns. To stay updated on future Fight for the Future initiatives, users can sign up for their mailing list. The source code for FFTF’s Battle for the Net Cloudflare App is available on Github, and instructions to create one's own app are provided in Cloudflare Apps documentation.

Cloudflare offers a service discovery solution for microservices deployed behind its network, providing security from DDoS attacks, IP masking, and authentication management. Service locations and metadata are stored in a distributed KV store across all 100+ Cloudflare edge locations (the service registry). Services register themselves to the service registry when they start up and deregister when they shut down via API calls. Traffic is distributed evenly between redundant nodes using a load balancer, with clients querying the service registry over DNS. Health checks are performed over HTTP and can be customized. Cloudflare also supports geographic routing rules and Argo for faster transit in traffic. Additionally, rate limiting and TLS client authentication (Enterprise only) can be set up.

Cloudflare has opened a new data center in Rio de Janeiro, Brazil, marking its eighth data center in South America and expanding the company's network to 116 cities across 57 countries. This expansion will improve performance and security for over six million internet applications in Brazil while providing redundancy to the existing São Paulo data center. As more ISPs connect with Cloudflare at local internet exchanges, the company aims to provide closer coverage to a growing share of Brazilian internet users. Rio de Janeiro has played a significant role in the history of the internet in Brazil, and today the city is well-connected with residents creating their own ISPs in some favelas. Cloudflare also has eight additional data centers planned across Latin America.

On July 18, 2017, a three-judge panel of the U.S. Ninth Circuit Court of Appeals endorsed the use of gag orders that restrict companies' disclosures related to national security letters (NSLs). The decision is disappointing for Cloudflare, which has been challenging the constitutionality of the FBI’s use of NSLs since 2013. While the court ruled that the current system does not violate the First Amendment, it did acknowledge that NSL gag orders are a form of prior restraint subject to strict scrutiny. Cloudflare will continue to report on NSLs and work with EFF to determine its next steps in challenging the decision.

On July 12, 2017, Jameson Sundell announced the launch of Cloudflare Apps platform. The platform aims to help users who run web services such as websites and APIs by making them faster, safer, and more reliable through leveraging over 115 data centers worldwide. The platform works by routing end-users through the best network path to a data center closest to them around the world. Users can now make changes or additions to their sites at the edge using Javascript and CSS. Some examples of existing apps include adding a donation button using PayPal, or injecting a video intelligently using JavaScript or CSS. The platform also allows users to create their own apps by forking Cloudflare's example app on GitHub. Once an app is created, it can be tested using the app creation dashboard and then submitted for moderation. Community feedback can be obtained before submitting the app.

Cloudflare has announced a new enhancement to its HTTPS service, High-Reliability OCSP stapling. The feature is aimed at enabling an important security feature on the web: certificate revocation checking. It also improves connection times by up to 30% in some cases. Digital certificates are the cornerstone of trust on the web and a digital certificate is like an identification card for a website, containing identity information including the website's hostname along with a cryptographic public key. The private key associated with each public key is kept secret by the site owner. If someone gets access to a certificate's private key, they can impersonate the site. Private key compromise is a serious risk to trust on the web. Certificate revocation checking is a way to mitigate this risk.

On July 12th, an "Internet-Wide Day of Action to save Net Neutrality" is being organized by Battle for the Net. Participating websites will display alerts on their homepages to raise awareness about the FCC's proposal to eliminate net neutrality protections and request public comments on whether any rules are needed to prevent ISPs from blocking or throttling web traffic, or creating "fast lanes" for some internet traffic. Cloudflare users can participate by installing the Battle For The Net App, which will display an alert modal for their site's visitors on July 12th.

The Internet continues to become more secure as an increasing number of websites adopt HTTPS, the encrypted version of HTTP. Mozilla reported that over 50% of Firefox requests were made using HTTPS in 2016. Enabling HTTPS offers numerous benefits such as improved performance with HTTP/2, SEO advantages for search engines like Google, and a lock icon in the address bar indicating security. Cloudflare provides free and automatic HTTPS support for all customers, requiring no configuration. To ensure all visitors are protected, websites should be made HTTPS-only by redirecting them from the HTTP to the HTTPS version of the site. This can be done with a simple click in the Cloudflare dashboard or through an API. Once the site is fully functional with HTTPS-only enabled, users can take additional steps such as enabling HTTP Strict Transport Security (HSTS) and securing the connection between Cloudflare and their origin server using Cloudflare's Origin CA to get a free certificate for their origin server.

In a recent blog post, John Graham-Cumming discussed some SSDP-based DDoS activity and introduced three command-line tools that are part of a small suite designed for handling data. These tools include mmhistogram, which generates ASCII histograms; mmwatch, which calculates rates from changing numbers in output; and mmsum, which sums floating point numbers. The author shared these tools on the Cloudflare Github after receiving a reader's request to open source them.

Cloudflare has open-sourced PAL, a tool that securely distributes secrets to Dockerized production applications. The company developed the tool to address the challenge of managing and deploying secrets in containerized environments. PAL is designed to work with existing code signing infrastructure and supports two encryption methods: PGP and Red October. It enables users to control which containers can decrypt a secret by leveraging labels that define which secrets a container can access. The tool aims to provide an identity for services running in containers, allowing them to safely receive secrets only in production environments.