November 2017 Summaries

Cloudflare recently held a company retreat for its 453 employees from various global locations. The event included professional development sessions with Harvard Business School professors, Ally Skills workshops, and team-building activities such as biking, hiking, kayaking, or visiting the Monterey Bay Aquarium. The retreat aimed to strengthen connections among employees, foster empathy and curiosity, and provide shared experiences that align with Cloudflare's values. Planning for next year's retreat is already underway, with a focus on thought leadership activities related to solving internet problems.

In November 2017, Teffen Ellis from Cloudflare shared updates on new features and improvements for their app platform. These included enhancements to paid app products, the addition of comments and ratings for customer feedback, and the ability for developers to manage a customer's DNS records through apps. Other notable changes included onboarding new customers with apps after registration, updated documentation, and the option to link to public GitHub repositories. Additionally, they introduced a new input type: numbers with units. The platform also offered up to $100k in Google Cloud credits for app developers.

On November 23, 2017, a blog post announced the launch of Argo Tunnel (formerly known as Warp), a product by Cloudflare that allows users to expose locally running web servers to the internet without needing a public IP address or opening firewall ports. The tunnel connects the web server directly to the Cloudflare network, where Cloudflare acts as the gateway. This setup provides enhanced security and control over incoming requests, including rate limits, access policies, and authentication before they reach the origin server. Warp is easy to set up and can be used for load balancing multiple instances of an application or setting up user authentication for exposing internal tools to the internet. The post also mentioned that users could automate Warp with Docker for seamless integration with containerized applications.

Recent trends show that DDoS attacks have become more sophisticated and are now targeting applications rather than just network layers. This shift is due to the increased capacity of networks, making it harder for attackers to overwhelm victims with junk traffic. As a result, attackers have started using advanced application-layer attack strategies such as botnets, IoT devices, and DNS amplification. Cloudflare has observed a dramatic reduction in simple attempts to flood its network with junk traffic, but the frequency of Application Layer DDoS attacks remains high. To mitigate these attacks, it is crucial for applications to have a high-capacity DDoS mitigation network, aggressive caching, and rate limiting.

In this guest post by Emily Schwartz, Product Manager for AddThis team at Oracle, she discusses the process of building an app on Cloudflare Apps platform. The decision to build a simpler version of their floating sharing sidebar was made due to time and resource constraints. They opted to serve auto-personalized buttons and limit settings to cosmetic changes like number of services displayed and bordered styling. Users don't even need to register an AddThis account to use the share buttons on Cloudflare Apps or work with any code. The team is now considering connecting the app to the addthis.com dashboard and including other tool styles or types in the future.

In recent years, there has been an increasing recognition of the need for companies to have a strategy around hosting their applications on multiple cloud providers. This is in response to concerns about vendor lock-in and the potential risks associated with relying on a single cloud provider. Companies are looking to diversify their cloud computing vendors to take advantage of cost efficiencies, improve negotiation strength, enhance business continuity or high availability, and enable experimentation with new features and products. Cloudflare plays an important role in this multi-cloud strategy by minimizing the layers of lock-in between companies and their providers, providing a centralized point for security and operational control, and enabling seamless traffic management across multiple clouds.

The US Supreme Court is set to hear arguments on the Inter Partes Review (IPR) process at the US Patent and Trademark Office (USPTO), which determines the validity of patents. This case, Oil States Energy Services, LLC vs. Greene’s Energy Group, LLC, will decide whether this administrative process is constitutional. The IPR process has greatly reduced anticipated costs and threats from patent troll litigation. Should it be deemed unconstitutional, the entire system of USPTO administrative review would shut down, which could have significant implications for technology companies. Cloudflare joined other tech companies in a brief amici curiae supporting the IPR process, arguing that it has a substantial positive impact on technological innovation in the United States.

Cloudflare has acquired Neumob to integrate its technology into their global network, enhancing mobile app performance and increasing conversions. This acquisition is part of a long-term plan to provide end devices with secure and fast communication from device to origin server. The Neumob software will be relaunched under a new name for iOS and Android app developers worldwide, allowing them to accelerate and protect their applications' connectivity by adding just two lines of code. Cloudflare is hiring to grow the mobile team in San Francisco, Sunnyvale, and Austin.

Cloudflare Apps now offers 95 apps that help site owners increase user engagement, grow email lists, acquire new customers, and make more money without requiring any coding or development skills. Some of the notable apps include Privy for capturing website visitors, AddThis Share Buttons for social media sharing, Vimeo and SoundCloud for embedding videos and audio tracks respectively, Drift for lead generation through messaging, Skype Live Chat for customer support, and Weather Widget for displaying weather updates. These apps are highly customizable and can be easily integrated into any website to enhance user engagement.

The author of this text discusses their experience benchmarking the performance of Golang on a many-core machine. They initially ran into issues with garbage collection (GC) when running multiple goroutines, which led to excessive GC overhead and reduced performance. To address this issue, they experimented with adjusting the GOGC variable, eventually finding an optimal value that significantly improved performance. The author emphasizes the importance of understanding and tuning garbage collection in languages like Golang, especially as many-core CPUs become more common.

The massive data breach at Equifax has significantly increased public awareness about security vulnerabilities, but it has not necessarily led to positive action. Keeping software up-to-date is important, but it's a reactive measure that doesn't protect against unknown threats. Security experts agree that maintaining systems is difficult and can lead to unforeseen issues when patches or upgrades are applied. Businesses must pay more attention to security vulnerabilities due to new data protection legislation like GDPR and NIST. The Equifax breach was caused by a single person responsible for communicating the availability of a patch, highlighting the importance of having multiple people responsible for threat communication. Attacks like Equifax can be avoided by understanding how they happen, such as through Remote Code Execution (RCE) and SQL Injection (SQLi). Cloudflare's Web Application Firewall (WAF) helps protect against these types of attacks and others, with over 138 million matches on an average week. Communication and awareness are crucial for understanding the risks associated with software vulnerabilities, and having protection in front of applications is essential to mitigate those risks.

Andrew Fitch from Cloudflare's Developer Relations team is offering to sponsor pizza for meetup groups focused on web development, web security, devops, or tech ops. To be eligible, the group must give a 30-second shoutout and tweet a photo of their event with @Cloudflare. The initiative aims to support community organizers and raise awareness about Cloudflare's broader offerings beyond CDN services. Examples of sponsored groups include Go London User Group, Women Who Code Portland, and GDG Phoenix / PHX Android.

The performance of the cipher ChaCha20-Poly1305 does not scale well when using Intel's AVX-512 instruction set, which consumes a lot of power and leads to dynamic frequency scaling. This results in reduced CPU frequencies when executing AVX-512 instructions, impacting server performance negatively. While the issue might be resolved with future generations of CPUs, users are advised to disable AVX-512 execution on their servers or desktops if they do not require it for specific high-performance tasks.

Cloudflare has introduced support for Privacy Pass, a privacy-preserving protocol developed in collaboration with researchers from Royal Holloway and the University of Waterloo. The protocol leverages zero-knowledge proofs to enable anonymous access across multiple sites without enabling tracking. Users can now use the Privacy Pass browser extension to reduce the number of challenge pages presented by Cloudflare, improving the browsing experience for some of the Internet's least privileged users. The Privacy Pass extension is available for both Chrome and Firefox.

In this guest post by Alex Davidson, a PhD student in Cryptography at Royal Holloway, University of London, he discusses the development of an open-source browser extension named ‘Privacy Pass’. The extension works with the Cloudflare edge to help honest users reduce the number of CAPTCHA pages they see when browsing the web. It uses cryptographically blinded tokens that can be signed by supporting servers following some receipt of authenticity, such as a CAPTCHA solution. The browser extension then uses these tokens to prove honesty in future communications with the server without having to solve more authenticity challenges. The post also covers how they developed the protocol and the security considerations taken into account, including using elliptic curve cryptography for efficiency benefits.

In this blog post, Vlad Krasnov shares his findings after testing the Qualcomm Centriq server and comparing it with Intel Skylake and Broadwell based servers. The author highlights that Falkor, the core of the Qualcomm server, looks competitive on paper and has a higher base frequency at a lower TDP rating compared to Intel's offerings. Although Intel still holds an advantage in terms of single-core performance, Falkor performs significantly better at the system level due to its higher core count. The author also discusses the current state of ecosystem readiness for ARM servers and provides benchmark results for OpenSSL, compression algorithms, Go language performance, LuaJIT, and NGINX workload. Overall, the engineering sample of Falkor impressed the author with its competitive performance and low power consumption.

In this blog post, the author discusses the REUSEPORT socket option, which changes the queuing model from "combined queue" to a dedicated accept queue per worker process. This helps distribute load more evenly but may affect latency distribution in certain conditions. The author also explains how REUSEPORT can improve packet locality and its performance implications. Three advanced SystemTap scripts are presented, which were used to understand and measure the packet locality. The author concludes that although they couldn't prove a significant improvement in performance by improving packet locality, writing these scripts was an educational experience and provided valuable insights into the Linux networking stack.

Cloudflare uses lava lamps in its lobby to generate random numbers for cryptography. The unpredictable flow of "lava" in the lamps provides a source of true entropy. A camera captures images of the lava lamps, which are then used to create an entropy feed available to production machines. LavaRand is designed to ensure that Cloudflare's production machines have access to secure randomness even if their local entropy sources are compromised.

Cloudflare uses lava lamps in the lobby of their San Francisco office to generate random numbers for cryptography. The unpredictable flow of "lava" in the lamps is captured by a camera, and the video feed is fed into a Cryptographically Secure Pseudorandom Number Generator (CSPRNG). This system, known as LavaRand, serves as an additional source of randomness for their production servers. The idea was inspired by a similar system proposed by Silicon Graphics in 1996.