January 2019 Summaries

Cloudflare has integrated its Cache API with Cloudflare Workers, giving users programmatic control over caches worldwide. The integration enables customers to modify content before writing it to cache and implement various caching behaviors like TTL or cache tags. One common use case is caching POST requests, which can significantly reduce load on origin servers. Since the beta release in September, usage of the Cache API has grown to serve thousands of requests per second.

HTTP/3 is a new HTTP syntax that works on IETF QUIC, a UDP-based multiplexed and secure transport protocol. The development of HTTP/3 can be traced back through a lineage of experiments and evolution of web protocols, specifically the QUIC transport protocol. HTTP/3 was previously known as HTTP over QUIC, which itself was previously known as HTTP/2 over QUIC. Before that, we had HTTP/2 over gQUIC, and way back, we had SPDY over gQUIC. The IETF is currently working on standardizing HTTP/3, with the most recent draft version being 17, proposed in late October 2018.

Quintype, a digital publishing platform, has shared its experience using Cloudflare Workers to improve the performance and cost efficiency of their applications. They have found that by leveraging Cloudflare's CDN and Workers, they can maintain a high cache hit ratio, which reduces traffic to their origin servers. The use of Cloudflare Workers also allows them to cache previously "uncacheable" content and perform various tasks such as stripping URL parameters, short-circuiting API requests, implementing metered paywalls, and A/B testing. Quintype has developed a new framework called create-cloudflare-worker to streamline the development workflow for Cloudflare Workers, making it easier to start, build, test, and deploy workers from scratch.

The US Government shutdown in December 2018 resulted in the expiration of TLS certificates on some .gov websites, highlighting a common issue on the internet - the usage of expired certificates and their erosion of trust. This situation emphasizes the importance of regularly updating and renewing these certificates to maintain website security and user trust. TechCrunch recently published a list of soon-to-expire certificates for .gov domains, using data from 18F, the federal government's digital services unit. Cloudflare's Certificate Transparency (CT) monitor, Merkle Town, is one example of a third-party tool that can help track expired .gov certificates. The Nitty-Gritty section explains how this process works and provides an example of unexpected misconfigurations found during the research. Automating certificate renewals is suggested as a solution to prevent expired certificates and misconfigured TLS in the future.

Cloudflare has introduced Quiche, an open-source implementation of the QUIC protocol written in Rust. The design principle behind Quiche is to expose most of the QUIC complexity through a minimal and intuitive API without making too many assumptions about the application itself. Quiche uses BoringSSL for its TLS layer and Ring for packet protection, with some modifications made to Ring to support QUIC's unique cryptographic requirements. While Quiche is still under development, it has already demonstrated interoperability with other mature QUIC implementations and will continue to evolve as the standardization process progresses.

Cloudflare has partnered with Mesosphere on their new Argo Tunnel offering, available within the DC/OS (Data Center / Operating System) catalogue. The partnership aims to provide a simple multi-cloud solution for DC/OS customers. Argo Tunnel is a private connection between your services and Cloudflare, allowing traffic to be load balanced through the use of Argo Tunnel. This new offering will allow users to load balance their traffic to any host, wherever they are running on Earth, in any cloud provider. The requirements for using this application include having a zone on Cloudflare with the Argo service enabled and an Enterprise version of DC/OS.

SamKnows, a company that measures internet performance, has expanded its measurement infrastructure by leveraging Cloudflare Workers. The company uses high-capacity test servers worldwide to measure internet speed, latency, and packet loss between users' homes and the internet. Previously, they did not use cloud hosting providers due to expensive bandwidth costs and limited global coverage. However, with the launch of Cloudflare Workers, SamKnows can now run measurements in many new locations as Cloudflare has an extensive network spanning 165 data centers across six continents. The company tested Cloudflare's performance by configuring Whiteboxes to run measurements to both their existing servers and the Cloudflare Workers server. They found that on average, the difference in measured speed was only 0.1%. As a result of these tests, SamKnows is now offering Cloudflare Workers-powered measurement servers as part of its product portfolio.

The Domain Name System Security Extensions (DNSSEC) is a protocol designed to prevent DNS spoofing and ensure users reach the authentic address of a website. Launched in 2014, Cloudflare has made it free for all users but difficult to set up. With the launch of Cloudflare Registrar, enabling DNSSEC for domains registered with them is now as simple as a single click. This feature helps secure websites and contributes to making DNSSEC more widespread on the internet.

On January 15, 2019, Andrew Fitch and Zack Bloom discussed the future of serverless technology at Serverless Computing London Conference. They explored how serverless platforms built using isolates are helping to expand the kinds of applications built using serverless. The talk highlighted that some technical challenges of serverless (cold-start time, memory overhead, and CPU context switching) can be solved by a new architecture which translates technology developed for web browsers onto the server. Zack Bloom is the Director of Product for Product Strategy at Cloudflare and was a co-founder of Eager, an app platform for non-technical website owners, acquired by Cloudflare in 2016.

The text discusses a project undertaken by Timely to migrate their web applications from legacy Azure services to a modern PaaS offering. They started with their webhooks, which were grouped into four categories. To ensure a smooth migration of traffic, they considered three options: changing the CNAME to point to the new hosting infrastructure, using a traffic manager to shift a percentage of traffic, and using Cloudflare Workers and Workers KV. The latter option was chosen as it allowed them to migrate traffic one endpoint at a time, starting with low-risk endpoints and progressively moving up. They wrote a Cloudflare Worker script that detected the path, checked Workers KV for settings, and redirected requests if necessary. Using Workers KV enabled any team member to enable or disable endpoints using the Cloudflare API. They faced some issues during the live migration but were able to resolve them with proper debugging and rate limiting measures. The text concludes by stating that they have successfully transitioned all traffic, and will now move on to their new web application.

The article discusses the use of Linux AIO API for network sockets, an addition that was merged in 4.18 kernel. It explains how to use the strengths of Linux AIO API to write better and faster network servers. The author also provides a simplified version of the struct iocb passed to io_submit and the completion notification retrieved from io_getevents. Furthermore, it illustrates the batching aspect of io_submit with examples and demonstrates how to use io_submit for polling as an alternative to epoll(). The author concludes by expressing excitement about the new developments that allow developing faster network servers using Linux AIO API.

On December 30th, 2018, during the presidential election in the Democratic Republic of the Congo (DRC), internet access was shut down. This disruption continued as the results were published. The bandwidth drop started just before midday on December 31st and has remained low since then. Around 6.21% of DRC's population has internet access, with many using limited and expensive satellite connections that were not affected by this shutdown. This is not the first time such an event has occurred in the country; a similar incident happened less than a year ago. The Congolese government plans to restore internet access after election results are published on January 6th. Cloudflare's Project Galileo and Athenian Project aim to protect vulnerable websites from cyber attacks, supporting principles for an open internet.