September 2017 Summaries

Cloudflare is making its edge network programmable by allowing users to deploy JavaScript on their servers. This move is similar to how graphics hardware became programmable in the 2000s, allowing developers to experiment with new algorithms and techniques without relying on hardware vendors. The decision to use JavaScript was based on its ubiquity and security features provided by Google's V8 engine. Cloudflare Workers are written against the Service Worker API, which is designed for handling HTTP traffic and can be used for various purposes such as improving performance, enhancing security, and increasing reliability. The playground at cloudflareworkers.com allows users to try writing their own scripts and applying them to their sites.

The speed of light limits latency in internet applications, but Cloudflare's network of 117 data centers has reduced this by moving closer to end users. However, the code that makes these applications work is still located on servers or devices. Cloudflare Workers aims to create a third place where code can run: neither on the device nor in the backend server. This approach allows for faster and more efficient applications by reducing latency between users and servers. The platform enables developers to write JavaScript code that runs on every single one of Cloudflare's servers worldwide, allowing for instant updates and multiple versions available for testing and deployment.

Cloudflare has introduced a new security-conscious tool called Warp, which allows web applications to be exposed without needing to expose the server they run on. With Warp, traffic to an application is run over a private, encrypted, virtual tunnel from the Cloudflare edge, and traffic can only find and access the server if it routes through Cloudflare. This setup makes Cloudflare's edge act as a network shield in front of infrastructure, allowing policies to be described at the edge and unexpected traffic to be dropped before reaching servers. Warp also offers service discovery benefits by registering DNS records for applications when the agent is spun up. The beta version of Cloudflare Warp is available today.

Cloudflare Warp is an innovative solution for securely connecting your origin server to the Cloudflare network. Unlike traditional GRE tunnels, Warp uses HTTP/2-based multiplexing and HPACK header compression to optimize bandwidth usage and reduce latency. It also integrates with Argo for route optimization within the Cloudflare network, ensuring fast connections regardless of your server's location. Additionally, Warp introduces redundancy by connecting to multiple nearby PoPs, providing a backup in case of failure. The technology behind Warp is designed to complement and enhance existing systems and workflows, making it an attractive option for securing and optimizing connections between origin servers and the Cloudflare network.

In this September blog post, Teffen Ellis highlights recent platform improvements in developer analytics, user feedback, release notes, and more for the Cloudflare Apps community. Developers can now track their apps' popularity and growth through usage charts, as well as monitor financial performance of paid apps. User feedback has been enhanced with sentiment tags and optional messages from users when adding or removing apps from their site. Page Selectors have been introduced to limit entries to specific pages for apps with multiple options. Release notes can now be added in app submissions, improving communication between developers and users. The post also encourages developers to share feedback and suggestions for future improvements. Additionally, a new App Developer Playbook is featured as a step-by-step marketing guide for making money selling Cloudflare Apps.

On September 27, 2017, Cloudflare introduced its video streaming solution called Stream. The company aimed to simplify and improve the complexities of the existing market by integrating encoding, global delivery, and player into one package. This streamlined approach allows users to upload a video and have it available for adaptive streaming globally within seconds. Additionally, Cloudflare's pricing model is based on the duration people consume the video, aligning its interests with customers'. The company hopes to expand the number of companies using video streaming from 1,000 to 100,000 and support the next generation of developers building video into their applications.

Cloudflare Stream is an end-to-end video solution designed to bring instant video to any device and network connection. It optimizes video upload, encoding, and delivery through various mechanisms such as resumable uploads using Tus protocol, encoding videos into multiple formats for compatibility with different browsers, and adaptive streaming that adjusts the bitrate based on network connectivity. The service also leverages Cloudflare's global network to deliver content from underutilized data centers, reducing costs while maintaining high performance. An open platform for developers called Cloudflare Apps allows them to integrate video uploaders into their apps and access the Stream API.

Cloudflare has introduced a new feature called Geo Key Manager that allows customers to control where their private keys are stored when uploaded to the platform. This builds on previous innovations like Keyless SSL and a novel cryptographic access control mechanism based on identity-based encryption and broadcast encryption. The Geo Key Manager enables users to limit the exposure of their private keys to certain locations, reducing the risk associated with having them in various physical locations around the world. It is designed to be flexible and scalable, allowing customers to decide where their keys are kept while ensuring security and efficiency.

Cloudflare has introduced a new feature called Geo Key Manager that allows customers to control the distribution of their private SSL keys based on an assessment of physical controls. This comes as a response to increasing geopolitical concerns and regulatory frameworks, especially for multinational companies. The Geo Key Manager provides options such as "Everywhere", "U.S. Only" or "E.U. Only", and "Highest Security Data Centers". While the first HTTPS request made to a data center that does not hold your private key requires a bit of overhead, all subsequent requests after the initial one will be just as fast as if the key were local thanks to SSL/TLS session resumption. Cloudflare plans to extend Geo Key Manager to work with Dedicated Certificates and allow Enterprise users to specify a precise list of data centers for their keys.

Cloudflare, an internet security company, has announced "Unmetered Mitigation," which eliminates the industry standard of 'surge pricing' for DDoS attacks. This means customers will not be charged more if they are targeted by an attack. The company also stated that it will no longer terminate customers regardless of the size of the DDoS attacks they receive, and their bill will not increase after an attack. This marks a significant shift in the industry as Cloudflare hopes other companies will follow suit.

Cloudflare's architecture is designed to handle large DDoS attacks by distributing traffic across a large number of edge servers, using Anycast and ECMP. The company does not use separate scrubbing boxes or specialized hardware; instead, every edge server can perform advanced traffic filtering if needed. During normal operations, Cloudflare's attitude towards attacks is pragmatic, as the inbound traffic is distributed across hundreds of servers. However, during large attacks, mitigations are deployed to reduce the CPU consumed by malicious traffic. These mitigations include scattering domains between IP addresses, using iptables with specific extensions, and shifting attack traffic from kernel iptables to a kernel bypass user space program called floodgate. The company also developed an automatic mitigation system called Gatebot, which automates the detection, analysis, and deployment of mitigations across its servers and applications.

In this article, John Graham-Cumming discusses the problems associated with using scrubbing centers or servers for DDoS mitigation services. He identifies three main issues: bandwidth, cost, and knowledge. The bandwidth problem arises from the need to have a large amount of network capacity available to handle massive attacks, which can be expensive and complicated to provide and maintain. The cost issue is due to the requirement for exotic network hardware in scrubbing centers, making DDoS mitigation services traditionally very expensive. Lastly, the knowledge problem involves the difficulty in distinguishing good from bad traffic as attackers become more sophisticated. Graham-Cumming argues that dedicated scrubbers can lead to building better software and improving overall performance under load. He explains how Cloudflare's approach eliminates the need for scrubbing centers and hardware, changing the cost of building a DDoS mitigation service significantly. By using low-cost or commodity networking equipment and automation, they have built a scalable network capable of handling attack traffic globally with low latency links. The article also highlights how Cloudflare's custom DDoS mitigation stack uses iptables and kernel bypass techniques to offload processing and handle large attacks without affecting their multi-tenant service. Additionally, the company has open-sourced various tools and contributed to projects like OpenResty for building L7 defenses. In conclusion, Cloudflare's DDoS mitigation architecture and custom software enable Unmetered Mitigation, allowing them to withstand the largest attacks while their network grows.

The text discusses the evolution of email from its inception as a simple messaging system to its current status as an integral part of daily communication. It highlights key milestones such as the creation of ARPANET, the introduction of various email clients like RD, MSG, MH, Pine, Elm and Mutt, and the advent of webmail services like Hotmail and Gmail. The text also touches upon the potential impact of email on social development and raises questions about its future in light of emerging communication tools such as Slack, Facebook, and Snapchat.

In September 2017, Cloudflare introduced a new official binding for PHP, which is available via Packagist as cloudflare/sdk. The design of the API was based on simple object composition to provide a more straightforward object model and higher flexibility. The package also uses Dependency Injection to allow different components in the API to vary independently. Additionally, it utilizes the PSR-7 standard for HTTP responses, making it easier to add further abstractions for additional HTTP clients and mock HTTP responses for unit testing.

Cloudflare, a tech company, launched Project Jengo to challenge the validity of patents held by Blackbird Tech, a notorious patent troll. The project offered a $50,000 bounty for prior art that proves Blackbird's patents are invalid or overbroad. Since its inception, Project Jengo has received more than 230 submissions and awarded the first round of the bounty to 15 recipients totaling $7,500. The project is now focusing on challenging other Blackbird patents and encouraging participants to continue their search for prior art.

On September 19, 2017, Mexico City experienced a large earthquake causing significant damage and loss of life, exactly 32 years after the most damaging earthquake in its history occurred on the same date. In response to this disaster, Cloudflare has created the Mexico Earthquake App to facilitate donations to charities assisting those affected. The app is easy to install with no code changes required and currently lists two well-respected organizations actively helping people in need. Users can also customize their own list of charities by forking the source code.

Cloudflare and Google Cloud have partnered to offer developers resources needed to quickly launch and scale Cloudflare Apps. This initiative allows developers to access a wide range of benefits, including $3k - $100k of Google Cloud Platform (GCP) for one year at no cost. The partnership aims to help developers focus on building great apps without worrying about infrastructure costs. Hundreds of startups have already built successful applications on Cloudflare Apps, and this program with Google Cloud significantly decreases the friction to getting up and running on Cloudflare Apps.

In this discussion between Chris Cantwell, Co-Creator and Show Runner of Halt & Catch Fire, and John Graham-Cumming, CTO of Cloudflare, they delve into the creation process behind the show. They discuss how the storyline evolved from a focus on reverse engineering to an exploration of reinvention in both personal lives and technology. The characters' optimism is also examined, as well as their struggle to adapt to the rapidly changing tech landscape. Cantwell shares insights about researching for accuracy and maintaining human drama amidst technical details. They also touch upon the shift from engineers running companies to business types taking over in the 1990s. The conversation concludes with a Q&A session, addressing topics such as visualizing network activity and the potential for origin stories behind million-dollar companies.

The discussion between Lawrence Lessig, Roy L. Furman Professor of Law and Leadership at Harvard Law School, Darren Bolding, CTO of Cambridge Analytica, and Matthew Prince, Co-Founder & CEO of Cloudflare, revolved around the role of data in shaping political outcomes. They touched upon how Cambridge Analytica used data to help the Trump campaign win the presidency, debated whether finance or data is the real divider in politics, and discussed if technology like Cambridge Analytica's could corrode shared understanding. Lessig argued that while the internet has made communication easier than ever before, it has also undermined our ability to do democracy as we did before. Bolding maintained that data science can be part of the solution by allowing individuals to better communicate with people they know and build virtual communities in each "town." The discussion ended with a Q&A session where participants raised questions about Cambridge Analytica's role in creating problems like Willie Horton, ethical microtargeting, and how data science can be used responsibly.

Victoria Coleman, CTO of Wikimedia Foundation, spoke at the Internet Summit about the organization's mission and initiatives. The foundation supports 12 projects, including Wikipedia, with a focus on making information broadly available not-for-profit. They aim to reach people in hard-to-reach areas through research and communication efforts. While they don't deal in news, they ensure the reliability of their content by maintaining community principles and encouraging openness. The foundation is currently working on scaling its operations and making knowledge accessible globally.

The panel discussed the intersection of technology and law in content regulation on the internet. They highlighted that while the First Amendment does not constrain speech hosted by private companies, it is governed by norms and individual choices. Intermediary liability laws determine when platforms should take down user speech due to its illegality. These rules have created today's online ecosystem, with major content provider platforms existing because of these laws passed in the late 90s. The panel also touched upon the issue of private companies taking over government functions and the need for neutrality in internet platforms.

In a discussion between Paul Mockapetris (Inventor of DNS), David Conrad (CTO of ICANN) and Matthew Prince (Co-Founder & CEO, Cloudflare), the panelists discussed the current state of internet infrastructure, security concerns, and the future of internet governance. They expressed concern about the lack of innovation in internet infrastructure due to its complexity and the hesitancy to adopt new technologies like blockchain. The panelists also touched upon the issue of fragmentation of the internet, with countries like China imposing strict control over information flow. While they acknowledged that there is a risk of fragmentation, they believe that the value the internet brings will ensure its continued operation and growth.

The discussion revolves around the trends and innovations in the marketplace that have emerged over the last five years. One key point is the combination of data mass and velocity, leading to a more dynamic internet. Another significant development is the application of cloud lessons to telecom, resulting in centralized and virtualized systems. The conversation also touches upon the upcoming 5G standard, which is expected to be finalized by the end of next year or 2019. The discussion further explores the concept of bay stations and how they are becoming more centralized due to technological advancements. It's highlighted that the edge will not replace the cloud but rather augment it. The true edge is considered as the radio access network, which is the meeting point between wireless and wirelines. The role of data in driving innovation is also discussed, with a focus on how it is increasing exponentially and necessitating a re-architecture of the internet to deliver an augmented reality experience. The conversation concludes by touching upon the impact of regulation on development and the potential for more consumer choice in the future.

Blockchain technology was introduced in 2008 with the advent of Bitcoin. It solved the problem of digital cash by creating a method that didn’t rely on third-party intermediaries. The term "blockchain" refers to an indelible chain of blocks, where once information is inserted into one block, it remains there. Blockchain technology also offers public verifiability and reliance on cryptographic methods to achieve goals in clearing payments and verifying transactions. Currently, organizations like Tezos Foundation and Protocol Labs are working towards moving this technology forward. Tezos aims to solve the problem of upgrading blockchain technology by enabling coordination among users and decentralizing power structures that control the internet. It also seeks to innovate on formal verification of core base protocols to make applications more accessible. On the other hand, Protocol Labs is working on IPFS (InterPlanetary File System), a decentralized hypermedia protocol that aims to rethink the stack for how the web works by using content addressing rather than location addressing and peer-to-peer structure. This could lead to a utopian decentralized market where storage is a proper commodity, allowing ISPs to participate in cloud storage. The power of decentralization can be applied to various sectors such as finance, law, investment banking, and even social media platforms like Twitter. However, the tech still has to catch up with modern standards in terms of user experience and quality of platform. Decentralized consensus protocols like mining are used to propose values for the head of the chain, where a bunch of parties agree upon what that value is. In the future, proof of stake algorithms may replace proof of work systems, creating new incentive structures based on how many tokens one has. Governance of these systems will evolve dramatically over the next years.

The panel discussed the current state of affairs in patent and IP issues, focusing on challenges faced by inventors and businesses. They highlighted that the patent office tends to focus on patents rather than searching for prior art, leading to a high number of granted patents with limited economic value. The issue of patent trolling was also addressed, with suggestions made to drive it to a sustainable nuisance level. The panelists proposed several changes to improve the current system, such as increasing the time given to patent examiners for thorough evaluation and reallocating costs or raising review to prove the value of patents. They also emphasized the importance of preserving the ability to start companies and maintaining a sense of idealism about what patents represent. In terms of moving towards positive changes in patents, one suggestion was providing free lawyers for individuals involved in patent litigation, as the cost of legal representation often influences the outcome of cases more than the merits or demerits of the patents themselves. The panel also touched upon post-grant review and the Oil States case, discussing their potential impact on software patents and the overall patent system.

The discussion between Ben Sadeghipour and Katie Moussouris, two experts in the field of hacking and cybersecurity, sheds light on various aspects of this industry. They talk about their roles as ethical hackers, explaining that they hack into systems with permission to identify security vulnerabilities. Both emphasize the importance of adhering to policies while engaging in such activities to avoid legal issues. They also discuss the concept of bug bounties, which involve paying hackers for finding and reporting bugs or vulnerabilities within a system. They explain that these programs are not just about money; they also provide recognition and opportunities for intellectual satisfaction. The motivation behind getting into hacking varies from curiosity to financial gain. The speakers suggest that companies looking to implement bug bounty programs should first ensure they have adequate automation on the backend and explore other efficient ways of discovering vulnerabilities before starting such a program. They also highlight the importance of understanding behavioral economics when attracting skilled hackers. In terms of protecting businesses from hackers, the experts recommend focusing on basic security measures like patch management, risk assessment, and regulatory compliance. Lastly, they address the issue of spying and espionage in the context of hacking, emphasizing that everyone is involved in some form or another.

In this discussion between Brandon Philips and Joe Beda, Co-Founders of CoreOS and Heptio respectively, they discuss the increasing risk of a few companies locking in customers as they gain more power over time. They talk about their experiences with Kubernetes and how it was chosen to be open source due to its underdog status at the time. The discussion also covers the tradeoffs between using containers or open-source tech, and how different levels (developer and operational) view these tradeoffs. They emphasize that while lock-in is unavoidable, the risk of it should be weighed against the benefits. They mention that Kubernetes makes lock-in an operational problem rather than a developmental one. The discussion also touches upon how cloud providers are approaching this issue and how Amazon's market position influences their strategies. The conversation concludes with a focus on the value proposition of CoreOS, which includes providing customers with APIs and integrating open source software into their applications. They also discuss the importance of automation in ensuring the security of infrastructure when vulnerabilities appear in the cloud.

The Internet Summit Team discussed the future of encryption and cryptography in light of potential quantum computing threats. Shay Gueron, an expert in post-quantum security, and Raluca Ada Popa, a specialist in computing over encrypted data, explained their work on developing new algorithms and encryption schemes to protect against these threats. They highlighted the practicality of encrypted computation and its potential to enable new functionalities across various industries, such as medical research and financial studies. The team also addressed concerns about the speed and costs associated with quantum-resistant encryption, emphasizing that there is still time for businesses to prepare for this shift in technology.

The discussion between Willie Tejada and Anthony Goldbloom revolved around the current state of AI and its impact on everyday life. They highlighted that we are in an unprecedented era where AI is making a significant difference, particularly in areas such as consumer selection, patient-centric care, fraud prediction, credit scoring, and automation of repetitive tasks like radiology. The combination of data sets and availability of resources is fueling the growth of AI. Tejada emphasized that algorithms are contributing to oncology and other life sciences by training systems based on the right human inputs. He also stressed the importance of maintaining assisted rather than replacement roles for AI in various sectors. Goldbloom, on the other hand, argued that while repetitive tasks can be automated, there will always be a combination of routine algorithm and more challenging cases for humans to handle. The discussion also touched upon how companies should shift their focus towards needing fewer but highly talented machine learners rather than many mediocre ones. Furthermore, they highlighted the need for collaboration between data and application teams in organizations as data is the fuel for AI. Looking forward, Goldbloom mentioned that challenges are mainly organizational and that Google Brain serves as an example of how to effectively productionize machine learning within a company. He also pointed out the potential use of AI in stock trading, ad targeting, and generative models that can write captions for images. Tejada argued that tax codes could be replaced by AI in the future, with systems having embedded AI accessible at a commodity level through the internet. The discussion concluded with addressing concerns about trust-building for broader adoption of AI and how it is use-case specific. They also touched upon the potential impact on jobs and provided career advice for students entering the workforce.

Avril Haines, former Deputy National Security Advisor under Obama administration, discussed cyber threats and their role in military operations during a summit on September 14, 2017. She highlighted the concept of "asymmetric threats" where state actors with high-value assets can hold others at risk without any threat to themselves. Haines emphasized the importance of widely accepted norms and rules for cyber activities and stressed that the private sector plays a crucial role in creating such a framework. Haines also touched upon the challenges posed by the lack of clear definitions and governance structures in the realm of cyber warfare, as well as the increasing influence of non-state actors in virtual communities. She predicted that cyber threats would become more tangible and could eventually lead to military responses if not addressed appropriately. In terms of future challenges, Haines mentioned the difficulty of maintaining secrecy in intelligence operations due to the digital footprint everyone leaves behind. She also expressed concern about the eroding faith people have in government and the need for a public conversation on the balance between privacy and security.

A study published at NDSS 2017 found that between 4% and 10% of web's encrypted traffic (HTTPS) is intercepted, posing serious security risks as they weaken the encryption used to secure communications. Interception products often impersonate websites without users' knowledge by adding their own "root" certificate to the computer trust store. The study also revealed that while not always malicious, web traffic is primarily intercepted for two reasons: improving security and performing malicious activities. Furthermore, HTTPS implementations used for interception do not have the same automatic update mechanisms as browsers, making fixes less likely to be rolled out.

Since March 30, 2017, Cloudflare has been providing DNS Anycast service as additional F-Root instances under contract with ISC (the F-Root operator). The collaboration aimed to enhance the security and speed of the root server system. Through telemetry measurements, it was observed that F-Root's performance significantly improved after transit was enabled to Cloudflare DNS servers. It became one of the fastest performing root servers, with a drop in 90th percentile response times. As F-Root picked up speed, DNS resolvers started sending it more traffic. One external DNS monitor reported that F-Root is now the fastest for roughly one quarter of the countries tested from.

Hurricane Irma is expected to hit southern Florida as a category 5 storm this weekend, potentially causing disruption to Internet access in the region. Despite calls for evacuation, there has been no noticeable decrease in traffic in Miami. The city's Tier IV data center, which houses servers for Cloudflare and other internet operators, is designed to withstand catastrophic events such as Irma. It guarantees 99.995% uptime per year by being connected to separate power grids and providing fuel-powered backup generators for up to 96 hours of autonomy. In case the Miami data center goes offline, Cloudflare's Anycast routing will reroute packets to its nearest data centers in the United States. The company advises users to follow all precautions and evacuate as advised by local authorities.

Over two days, Cloudflare observed two events affecting global internet traffic levels. On September 5th, Togo's government restricted internet access due to political protests, joining other countries like Syria, Iraq, Turkey, and Libya that have limited or revoked internet access in the past. The second event occurred on September 6th when a category 5 hurricane hit the Caribbean islands, affecting Anguilla, Antigua and Barbuda, British Virgin Islands, Puerto Rico, Saint Barthelemy, Saint Kitts and Nevis, Saint Martin, Sint Maarten, and U.S. Virgin Islands. The storm caused significant damage to internet infrastructure on these islands, reducing traffic and connectivity. Internet access is crucial during natural disasters for communication and finding shelter, food, and clean water.

This blog post introduces a new cryptography primitive called p751sidh that is open-source. The author discusses the threat of quantum computers to current cryptographic systems and the need for quantum-resistant (or post-quantum) cryptography. They explain how TLS, used by Cloudflare for secure connections between clients and servers, can be improved with a hybrid key agreement combining X25519 and supersingular isogeny Diffie-Hellman (SIDH). The author also presents an implementation of SIDH in Go and its integration into TLS 1.3. They note that while SIDH is computationally expensive, it may be suitable for long-lived connections where the cost of the handshake can be amortized over the length of the connection.

On September 1st, 2017, Cloudflare deployed its newest data center in Portland, Oregon, marking its 27th data center in North America and the 117th worldwide. This expansion provides additional redundancy to existing data centers in Seattle and San Jose while increasing capacity for running services and combating cyber attacks. The Silicon Forest corridor around Portland holds a special place in Cloudflare's history, as it has had an internal data center in this region for years. The company is also working on expanding its edge network with at least a dozen additional data centers within North America and over 50 new cities globally.

On September 1st, 2017, Hurricane Harvey hit Texas as a Category 4 storm, bringing 50 inches of rain to Houston. The hurricane's impact has left many families displaced and in need of assistance. To help those affected by the disaster, a Hurricane Relief app allows visitors to donate to charities assisting Houston residents. The app is easy to install and requires no code change. Users can also customize their own list of charities for other causes if desired.