May 2018 Summaries

The Cloudflare All-Stars Fantasy League is a group of fictitious sports teams that represent some of Cloudflare's most championed products and services. These teams include the DDoS Defenders, Athenian Project, Argo Argonauts, WAF Masons, Workers Bees, Stream Rapids, CDN Packets, and DNS Resolvers. Each team has its own unique badge and emblem inspired by real-life sports teams. The purpose of these teams is to help build a better internet. They will be showcased within the large Cloudflare HQ windows facing 2nd street in San Francisco for the next few months, with fans encouraged to take pictures and share them on social media using the provided hashtags.

Cloudflare has observed a significant increase in Layer 7 based DDoS attacks over the past six months. These attacks focus on exhausting server resources rather than using large payloads. To combat this, Cloudflare has introduced Rate Limiting, which is proving to be an effective tool for customers to protect their web applications and APIs from various types of attacks such as "low and slow" DDoS attacks, credential stuffing, content scraping, etc. The company has also added new capabilities like the Cloudflare JavaScript Challenge and Google reCaptcha (Challenge) mitigation actions for Pro and Business plans to help customers more accurately identify traffic. Additionally, Rate Limiting is now more dynamically scalable with a feature that allows it to count on Origin Response Headers for Business and Enterprise customers.

Joe Sullivan, Chief Security Officer, shares his passion for building a safer online environment. He explains that while working as a cybercrime federal prosecutor, he realized the importance of creating solutions to prevent harm at scale. In 2016, during hearings on internet security, he noticed the lack of government investment in preventing harm and decided to join teams focused on proactively securing the internet. He joined Cloudflare because of their mission to help build a better internet by making it safer and faster for everyone. Sullivan is excited to contribute to their efforts in preventing harm at an internet scale.

Cloudflare has announced that its TLS 1.3 feature is out of beta and will be enabled by default for all new zones. The company had been advocating for the adoption of TLS 1.3, which improves both speed and security, since 2016. However, due to non-compliant middleboxes causing issues with the protocol, it was not widely adopted until now. With new draft versions providing additional measures to mitigate the impact caused by these middleboxes, major browsers have enabled TLS 1.3 by default for all of their users. Currently, around 5-6% of TLS connections to Cloudflare websites use TLS 1.3, with this number steadily rising.

The issue was caused by a regression in the Linux kernel between versions 4.9 and 4.10. This resulted in increased CPU usage on servers running Kafka, causing performance degradation. The problem was identified through bisection, which helped to pinpoint the exact version where the issue first appeared. The solution involved enabling TCP segmentation offload (TSO) and other network offloading features on VLAN interfaces in the kernel configuration. This significantly improved performance by reducing CPU usage. In addition, a workaround was implemented to automatically enable these offloading features if they are disabled on boot for VLAN interfaces. A ticket was also filed upstream with systemd regarding this issue.

Today marks the one year anniversary of Project Jengo, a crowdsourced search for prior art funded by Cloudflare to combat patent trolls like Blackbird Technologies. The project has been successful in collecting hundreds of prior art submissions that read across much of Blackbird's patent portfolio. In response to Blackbird's lawsuit against Cloudflare, the U.S. District Court for the Northern District of California ruled the '335 Patent was too abstract to be valid and granted Cloudflare’s Motion to Dismiss. However, Blackbird recently appealed this ruling to the United States Court of Appeals for the Federal Circuit. Additionally, Project Jengo has challenged other patents in the Blackbird portfolio and submitted an ex parte reexamination request for U.S. Patent 7,797,448 ("GPS-internet Linkage"). The project plans to distribute more than $40,000 in bounty awards before it is completed.

On March 31st, Kenton Varda, tech lead and architect for Cloudflare Workers, delivered a talk in London about the future of Edge Compute and its impact on the Internet as a platform. Due to high demand from those who could not attend, a recording has been made available. For more information and discussions related to Cloudflare Workers, visit the dedicated category on their community forum.

The WWW team at Cloudflare is responsible for REST APIs, account management services, and the dashboard experience. They recently used Cloudflare Workers to detect end user request data at the edge and react to it in API responses and visually in the dashboard. Since being deployed, their worker has served over 400 million requests for both calls to api.cloudflare.com and the www.cloudflare.com dashboard. The team shared annotated source code of their worker, best practices, and tips and tricks discovered along the way. They also discussed asynchrony, logging and alerts via Sentry, failing open or closed behavior for workers, and using PagerDuty and Hipchat alerts.

In July 2016, Cloudflare integrated with Eager, an apps platform, aiming to provide a seamless experience for site owners installing apps on their sites. Initially, the integration used Cloudflare's Always Online crawler to pre-populate a tree of the user's site and ensure only valid pages appeared during installation. However, this approach depended on the Always Online feature being enabled, which was not always the case. To address these limitations, Cloudflare now allows users to type in any URL they wish to install an app, providing more control over the process while maintaining simplicity. The platform is expected to continue advancing with features like Cloudflare Workers and local testing.

On May 2nd, 2018, Emily Hancock announced that Cloudflare was launching a new Privacy Policy aimed at providing more transparent information about the data they collect and how it is used. This policy is part of their GDPR readiness journey and will go into effect on May 25th, the same day as the GDPR. The company also plans to follow other jurisdictions' data protection requirements as needed. As Data Protection Officer (DPO), Hancock will continue working with Cloudflare's leadership to fulfill their commitment to privacy by investing in privacy protections and solutions for users.

Cloudflare has extended its account sharing feature to all customers. Users can now invite others as administrators from the 'Members' tab in the new Account area on the dashboard. Enterprise customers still have access to the same roles as before with the addition of Administrator and Billing Roles. The company has also migrated the dashboard from www.cloudflare.com/a to dash.cloudflare.com, supporting TLS versions 1.2 and greater for compliance with PCI and NIST guidelines. This change is not just a UI update but includes backend improvements such as rewriting much of the dashboard from Backbone to React and overhauling the data model for account and user management.