December 2017 Summaries

The text discusses the performance and cost of cryptography in real-world TLS deployments. It mentions that BoringSSL consumes only 1.8% of CPU time for processing different cipher suites, with GCM using less CPU time than CBC. Public key algorithms such as ECDHE (P256 and x25519) and RSA are also discussed, highlighting the expense of RSA operations compared to ECDSA. The text concludes that modern crypto is fast and efficient, but the future remains uncertain with the advent of quantum computers.

The Transport Layer Security (TLS) protocol, which ensures secure web browsing with HTTPS, is undergoing its first major overhaul with the introduction of TLS 1.3. However, none of the major browsers have enabled TLS 1.3 by default yet due to issues with middleboxes - network appliances designed to monitor and sometimes intercept HTTPS traffic inside corporate environments and mobile networks. The original design of TLS lent itself to this type of failure as implementers implemented to the reality of the protocol, not the intention of its designer or the text of the specification. To prevent servers from ossifying in future, David Benjamin proposed a way to keep the most important joints in TLS oiled through his GREASE proposal for TLS.

The text presents three short cryptography challenges that can be solved with basic knowledge of hashing algorithms, HTTP Strict Transport Security (HSTS), and AES-256 encryption. The first challenge involves cracking five password hashes generated using BCrypt. The second challenge requires understanding how to strip HTTPS from a website using HSTS. The third challenge involves decrypting two images encrypted with AES-256 in CTR mode. Solutions and hints are provided for each challenge, along with an explanation of the vulnerabilities exploited in the process.

On December 25th, Cloudflare offices around the world closed for the holidays, with engineers closely monitoring their mobile phones while on-call. Software engineering pro-tip advises not to deploy this week as it may lead to debugging issues from personal devices during holiday gatherings. The author shares tips on cybersecurity that can be given to family members who ask for advice in the tech industry. Tips include installing updates, using unique passwords across multiple sites, enabling two-factor authentication, and checking website addresses before inputting personal information.

The role of finance in the history of technology has been significant, even before the advent of the internet. One example is the semaphore system used in France during the Napoleonic era, which allowed messages to be transmitted at almost 900 miles per hour. Stock trading was a major driver for fast long-distance communication, with methods such as bribing operators and using telegraph systems being employed. The development of stock ticker machines like the Quotron II also played a crucial role in providing real-time financial information to traders. Today, over three trillion dollars worth of stocks are traded every month on computerized stock exchanges, highlighting the ongoing importance of finance in technological advancement.

The text discusses the challenges faced in securing Internet of Things (IoT) devices from Distributed Denial of Service (DDoS) attacks and other vulnerabilities. It highlights that IoT developers often overlook security aspects, leading to potential exploitation by hackers. Two main areas of concern are software updates and Transport Layer Security (TLS). The text emphasizes the importance of implementing proper update mechanisms for IoT devices, as many users may not be aware of the need to update their devices. It also discusses the limitations of TLS in IoT due to its added overhead and compatibility issues with certain protocols. The author suggests that network-level protection can help mitigate these vulnerabilities by filtering out malicious traffic. Additionally, newer versions of TLS like 1.3 are being developed to address some of these concerns.

In 2017, Cloudflare published 172 blog posts covering various topics such as industry collaboration to dismantle a DDoS attack, the use of Lava Lamp randomness in their network, comparison between Intel and ARM-based servers, monkey patching the Linux kernel, introduction of Cloudflare Workers for edge computing, Geo Key Manager for granular control over private key locations, quantum-resistant cryptography implementation, history of CSS languages, SystemTap scripts for performance analysis, rate limiting feature, reflection attacks and their statistics, dangers of Intel's frequency scaling, handling 1 million DNS queries per second, AES-CBC security bug impact analysis, LuaJIT optimization, Privacy Pass project's mathematical background, leap second affecting Cloudflare DNS, and the absence of a leap second in 2018.

In 2017, John Graham-Cumming made seven predictions including an increase in DDoS attack size, more prevalent use of QUIC protocols, IPv6 becoming the norm for mobile networks, and a SHA-1 collision being announced. He scored 9 out of 14 on these predictions. For 2018, he predicts that over half of HTTPS connections will be via TLS 1.3, vendor lock-in with cloud computing vendors will become a major concern, deep learning hype will subside but AI/ML salaries will remain high, k8s will dominate as the platform for cloud computing, quantum resistant crypto will be widely deployed in machine-to-machine links across the internet, mobile traffic will account for 60% of all Internet traffic by year end, and stable BTC/USD exchanges will emerge.

In December 2017, Andrew Fitch and four other Cloudflare colleagues attended YHack, a hackathon at Yale University that attracted over 1,000 college students from various institutions. The event aimed to provide an environment for learning, creativity, and problem-solving while encouraging participants to create projects addressing real-world issues. Cloudflare sponsored the event and contributed in several ways: mentoring, providing challenges, distributing swag items, sponsoring, and offering support via Slack. The company submitted two challenges, with winners receiving various prizes, including free admission to Cloudflare's 2018 Internet Summit. The hackathon resulted in numerous innovative projects, some of which utilized Cloudflare services. One standout project was "TL;DR," an app that generates a summary of website content and won the challenge for creating a Cloudflare App. Other notable projects included K2, Money Moves, and Mad Invest, all of which integrated Cloudflare to enhance their performance or security. Overall, YHack provided a valuable opportunity for students to learn, collaborate, and showcase their skills while fostering connections with industry professionals like those from Cloudflare.

Cyberattacks on election infrastructure have become increasingly common in recent years, affecting both the United States and Europe. In addition to cyber threats, unpredictable website traffic patterns pose challenges for election officials. Cloudflare has protected numerous election-related websites from cyberattacks, including those of major political campaigns and foreign governments. The company's Athenian Project aims to provide free protection against cyberattacks for state and local government websites related to elections and voter data in the United States. By ensuring the stability and security of these sites, the project seeks to preserve confidence in democratic processes and enhance voter participation.

Mirai, an infamous Internet-of-Things (IoT) botnet, was responsible for massive distributed denial-of-service attacks in 2016. At its peak, it infected over 600,000 vulnerable IoT devices and took down major websites like OVH, Dyn, and Krebs on Security. Mirai is a self-propagating worm that replicates itself by finding, attacking, and infecting vulnerable IoT devices. It was initially used for gamer wars but later evolved into multiple hacking groups running their own Mirai botnets after the source code was leaked. The rise of copycats made attributing attacks and discerning motives significantly harder. Notable targets included major websites, gaming platforms, booter services, and even an entire country's network. IoT devices pose a significant risk due to their insecure nature, and implementing basic security best practices like eliminating default credentials, making auto-patching mandatory, and implementing rate limiting can help mitigate the threat of future attacks.

Cloudflare now supports all HTTP Cache-Control response directives, providing powerful control for origin server administrators worldwide. The company's Content Distribution Network (CDN) uses over 119 data centers globally to cache customers' web content and serve it to nearby visitors faster and more securely. CDNs store content closer to users, improving speed and reliability. Cache-Control headers allow servers to give explicit instructions on how edge caches should handle content. Cloudflare's strong support for these directives ensures that stale or incorrect content is not served from its edge cache.

The text discusses the challenges faced by an e-commerce site using Magento platform when trying to optimize its performance with Cloudflare while maintaining security. Despite initial improvements through HTTP/2 protocol, server push, lazy loading and dynamic image format conversion, the site's speed remained slow due to a long Time To First Byte (TTFB). The issue was traced back to Magento's page render time, which was optimized by enabling cookie-based caching for anonymous users. However, this led to an unexpected problem where the Add to Cart functionality failed on the first request. This issue was resolved by using a plugin that dynamically injected CSRF tokens into web pages just before the Add to Cart button was clicked. The author also mentions how Magento's security patches from 2015 caused this issue and how it became noticeable during the Black Friday season when many e-commerce sites started optimizing their performance with Cloudflare.

Phishing is a significant problem, and sometimes phishing campaigns use Cloudflare for free DNS services. To combat this issue, Cloudflare has developed a new method that causes malicious emails to disappear into the ether. The solution involves modifying the DMARC record of known phishing domains so that email clients reject all emails from those senders. This technique helps prevent successful phishing attempts and contributes to keeping people safe on the internet.

The Federal Communications Commission (FCC) is scheduled to vote on December 14th to terminate its net neutrality rules. Net neutrality is the principle that networks should not discriminate against content that passes through them, protecting internet users and companies from abusive behavior by Internet Service Providers (ISPs). Without these rules in place, ISPs may be able to legally create a "pay-to-play" system, charging websites for faster service. Cloudflare has an app on its platform called Battle for the Net that allows site owners to host a popup encouraging users to contact their congresspeople to fight back against this potential repeal. The company is also hosting a Save the Internet! Net Neutrality Call-A-Thon in San Francisco, where participants can learn more about net neutrality and call their local representatives to voice their support for it.

McAllen, Texas is a strategic location for Cloudflare's 119th data center due to its proximity to Mexico and being halfway between Dallas, Texas and Mexico City. The border between the USA and Mexico is less than nine miles away from the data center. This placement reduces latency by approximately 500 miles or 12 milliseconds of round-trip latency for Mexican traffic. Additionally, a significant amount of Mexican Cloudflare traffic is delivered to ISPs and telcos just south of the border, further improving their performance. Furthermore, MEX-IX, a new Internet Exchange in McAllen, Texas, provides a way to interconnect with Mexican carriers already present in the area.

In a blog post on December 11, 2017, John Graham-Cumming discussed the evolution of Cloudflare's software stack over six years. The company has transitioned from NGINX, PHP, and PowerDNS to its own DNS server RRDNS, written in Go, and added technologies like Railgun, Warp, Argo, and Tiered Cache. Despite these changes, the servers still identify themselves as "Server: cloudflare-nginx." However, Cloudflare plans to transition to simply "Server: cloudflare" over the next month, with the change rolling out between December 18, 2017, and January 15, 2018.

Cloudflare's London office conducted an extensive review of 30 types of mince pies, with 68 participants rating them on four key metrics. The top five pies were Heston from Waitrose Spiced Shortcrust Mince Pies Lemon, Dunns Traditional Deep-Fill Pastry Mince Pies, Fortnum & Mason, Marks & Spencer Standard Mince Pies (red box), and Marks & Spencer Extra Special Mince Pies. Other notable mentions include Greggs, Costco, Mr Kipling, Aldi (Cognac Steeped), and Jimmy’s Home-made Pies. The detailed reviews provided insights into the pastry/filling ratio, pastry quality, filling flavors, and overall impression of each pie.

Cloudflare has removed the beta flag on DNS Certification Authority Authorization (CAA) Resource Record, allowing all users to add CAA records as they see fit without having to first contact support. The company began supporting the CAA in June 2017 behind a beta flag to observe how the presence of these records would affect SSL certificate issuance by publicly-trusted certification authorities. The beta period provided valuable insights into how CAA records have changed and will continue to change the commercial public-key infrastructure (PKI) ecosystem.

Cloudflare has been recognized as a leader in Forrester Wave's "DDoS Mitigation Solutions, Q4 2017" report. The company received the highest scores possible in 15 criteria, including attack mitigation and pricing model. This achievement is attributed to its architecture designed for high-volume attacks, elimination of surge pricing, unique view into types of attacks, integration with other security features, and a highly scalable network. Cloudflare's mission is to help build a better internet through performance, security, and reliability.

Cloudflare has migrated its edge SSL connection termination stack to use Google's crypto and SSL implementation, BoringSSL. The migration involved several months of work to ensure no negative impact on customer traffic. With this change, all of Cloudflare's edge SSL traffic is now handled by the same system without added complexity or increased latency. Additionally, new features such as X25519 for TLS 1.2 and RSA-PSS for TLS 1.2 have been implemented. The migration also brought improvements to internal features and allowed Cloudflare to contribute back to the open-source community.

The text discusses the challenges developers face when transitioning their code from development to production environments due to differences in operating systems, libraries, and runtimes. It highlights how containers help address these issues by ensuring that code runs smoothly on both developer and production machines. The rise of microservices is also mentioned as a way to optimize developer brain time by breaking down complex systems into smaller parts that can be understood and tested individually. The text then introduces Cloudflare Warp, a service that securely connects web servers to the Cloudflare network without requiring public IP addresses. It announces the launch of the Cloudflare Warp Ingress Controller for Kubernetes, an open-source project developed in collaboration with StackPointCloud. This controller automates the creation and management of secure Warp tunnels between Kubernetes services and Cloudflare, making it easy to expose these services securely via Cloudflare Warp. The text concludes by explaining how deploying Kubernetes clusters on StackPointCloud can be done with just a few clicks, providing benefits such as DDoS protection, WAF, global load balancing, and health checks through the integration with Cloudflare's network.