August 2019 Summaries

On August 30, 2019, Cloudflare announced the general availability of API Tokens, a more secure way to interact with its API. The tokens are designed to follow the principle of least privilege, ensuring that customers can keep their Cloudflare services as secure as possible while automating management. API Tokens provide three main capabilities: scoping by Cloudflare resource, scoping by permission, and the ability to provision multiple tokens. These features allow for better implementation of least privilege access control when using Cloudflare's API.

The article discusses the role of a Customer Success Manager (CSM) in XaaS businesses, which operate on a subscription model and need to ensure continuous value for their customers. Cloudflare, an internet security company, assigns named CSMs to its Enterprise customers to help with various tasks such as on-boarding, project management, customer training, configuration recommendations, ongoing insights, best practices sharing, escalation points, etc. The article also highlights the importance of face-to-face interactions between CSMs and customers through meetups organized by Cloudflare in different regions across the world. These meetups provide an opportunity for customers to share their experiences with Cloudflare products, learn from each other's use cases, interact directly with product managers and engineers, and foster stronger relationships with the company. The article concludes by inviting readers to attend or present at future Cloudflare Customer Meetups.

Cloudflare has released an updated version of its Firewall Event log for Free, Pro, and Business customers. The new log offers a smoother user experience with no modals, expanded event information, additional matches per event, search capabilities for any field within a Firewall Event, and the ability to scope searches to specific date and time ranges. Feedback is encouraged on their Community forums or through Support tickets.

Matt Alonso, an intern on the Workers Developer Experience team at Cloudflare, worked to improve the Wrangler CLI for Cloudflare Workers. The Wrangler tool aims to make developing and publishing Workers projects a pleasant experience for all users. Alonso noticed that while testing with "wrangler preview" was fast, it opened multiple tabs, leading to messy results. To address this issue, he developed a feature inspired by `webpack-dev-server` and other similar watch-and-build tools, allowing for a single tab that refreshes live with the latest changes. The solution involved using Rust's notify crate for file system event monitoring and implementing a cooldown period to prevent wasteful builds. Additionally, Alonso used WebSockets for communication between the Wrangler CLI and previewer, working closely with the Workers UI team and security team to ensure proper implementation and protection from script content exposure. The Live Preview feature was released in Wrangler 1.2.0 under "wrangler preview --watch" and works for all types of Wrangler projects, including those using WebAssembly.

Cloudflare has expanded its global network to 193 cities across 90+ countries, adding new locations in 2019 such as Amman, Antananarivo, Arica, Asunción, Baku, Bengaluru, Buffalo, Casablanca, Córdoba, Cork, Curitiba, Dakar, Dar es Salaam, Fortaleza, Geneva, Göteborg, Guatemala City, Hyderabad, Kigali, Kolkata, Male, Maputo, Nagpur, Neuquén, Nicosia, Nouméa, Ottawa, Port-au-Prince, Porto Alegre, Querétaro, Ramallah, and Thessaloniki. The company initially focused on major Internet exchanges but has since partnered with local ISPs to improve speed and reduce costs for both parties. In addition to adding new locations, Cloudflare has increased capacity in existing cities by over 8,000 unique networks directly connected with them. Efficient infrastructure deployment is a key factor in their success, as they need to accommodate varying user bases and adapt to location-specific variables. The company's architecture enables every server to support every service, improving hardware efficiency and load balancing workloads between equipment and locations. Cloudflare is currently hiring for various positions within the Infrastructure group.

Cloudflare has open-sourced a new project called workers-graphql-server, which is an Apollo GraphQL server designed for quick setup and use with GraphQL. The platform leverages the strengths of Cloudflare Workers to provide low latency and fast deployment times. A demo GraphQL playground is available on Workers.dev for testing queries and mutations. Additionally, a tutorial has been added to the Workers documentation to guide users in building their own GraphQL server. The project is open-source and welcomes contributions and feedback from the community.

On August 13, 2019, Cloudflare announced Magic Transit, a service that extends the company's network to any IP traffic on the internet. This announcement follows nine years of building a robust global network spanning over 193 cities in more than 90 countries. Magic Transit operates at the IP layer and applies various network functions such as DoS mitigation, firewalling, routing, etc., on a packet-by-packet basis. The service is built on Cloudflare's existing network using techniques like anycast networking and homogeneous server architecture, allowing customers to run their network functions at the company's scale. Magic Transit leverages network namespaces for isolation and control, creating virtual instances of system resources that can be shared among a group of processes. This enables rapid application of customer-defined network configurations in isolation without any performance hit from userspace packet forwarding or proxying. The service also uses GRE tunneling to deliver traffic over the public internet, with anycast IP addresses allowing for multiple points of failure and redundancy. Overall, Magic Transit offers a powerful new way to deploy network functions at scale by leveraging Cloudflare's global network infrastructure.

Cloudflare has announced the launch of its new service, Magic Transit, which provides secure, performant, and reliable IP connectivity to the Internet. The service is built on standards and networking primitives familiar to users and delivered from Cloudflare's global edge network as a service. Magic Transit offers protection against DDoS attacks and enables provisioning of virtual network functions such as advanced packet filtering, load balancing, and traffic management tools. Deployed in front of an on-premise network, it extends the network presence globally and minimizes trade-offs between performance and security. The service aims to bring traditional datacenter hardware model into the cloud, packaging transit with all the necessary network functions for fast, reliable, and secure networks.

On August 13, 2019, multiple Denial of Service (DoS) vulnerabilities were disclosed for several HTTP/2 server implementations. Cloudflare, which uses NGINX for HTTP/2, has already protected its customers from these attacks. The individual vulnerabilities, discovered by Netflix and included in the announcement, are: CVE-2019-9511 to CVE-2019-9518. As soon as Cloudflare became aware of these vulnerabilities, their Protocols team started working on fixes. They first pushed a patch to detect any attack attempts and then mitigated the vulnerabilities. The changes were rolled out weeks ago, and they continue to monitor similar attacks. Customers who host web services over HTTP/2 on an alternative path not behind Cloudflare are advised to apply the latest security updates to their origin servers for protection against these HTTP/2 vulnerabilities.

On August 9th, 2019 at 5:01 PM, Connor Peshek introduced the seventh edition of "The Serverlist." This publication provides updates on serverless technology, offers developer tutorials, encourages discussions among serverless developers, and highlights upcoming meetups and conferences. To receive future editions directly in your email, sign up using the provided link while ensuring that your privacy is respected.

Cloudflare has launched a public beta of Certificate Transparency (CT) Monitoring, an initiative aimed at helping customers detect malicious certificates issued for their domains. The system crawls all public logs to find these certificates quickly and sends alerts whenever a certificate is issued for one of the user's domains. This service is currently available in the Crypto Tab of the Cloudflare dashboard. Certificate Transparency makes all certificates public and easy to audit, preventing malicious activities such as stealing login credentials or interrupting services by serving different content. The system also allows users to monitor their certificates and take necessary actions if something seems wrong.

On August 5, 2019, Matthew Prince of Cloudflare announced that they would be terminating their services for the website 8chan due to its role in inspiring multiple mass shootings. The company had previously faced criticism for providing security services to sites with reprehensible content but drew a line at platforms directly inspiring tragic events and lawlessness by design. Cloudflare's decision to remove 8chan from their network is expected to cause only a brief interruption in the site's operations, as it did when they removed the Daily Stormer two years prior. The company continues to engage with law enforcement and civil society organizations to find solutions for addressing hateful content online and preventing violence.