September 2019 Summaries

Cloudflare has announced the beta release of HTMLRewriter, a streaming HTML parser with an easy-to-use selector-based JavaScript API for DOM manipulation. This feature is available in the Cloudflare Workers runtime and can be used to perform dynamic transformations on static HTML files hosted on Workers Sites. The combination of Workers Sites and HTMLRewriter allows developers to create serverless applications that are easy to scale, simplify web development workflow, and reduce latency by performing edge-side rendering. The HTMLRewriter API offers a jQuery-like experience for parsing and transforming HTML, allowing developers to build deeply functional applications with powerful JavaScript capabilities.

In 2019, Hady Mendez joined Cloudflare and was impressed by the company's commitment to diversity and inclusion through its ERGs. Upon starting at Cloudflare, she noticed a need for a Latinx ERG and took initiative to launch "Latinflare." The group aims to provide a space for networking, create a diverse pipeline of future employees, and be involved in the local communities where they work. Latinflare is preparing for Hispanic Heritage Month with events and activities, including their inaugural event on October 16th. They also plan to host quarterly meet-ups that will eventually allow them to network with external ERGs and organizations.

On September 28, 2019, Cloudflare released a new rule as part of its Cloudflare Specials Rulesets to protect customers against a high-severity vulnerability in vBulletin. The proprietary Internet forum software was found to have a zero-day vulnerability that could allow bad actors to gain privileged access and control over host servers through Remote Code Execution (RCE). This vulnerability has a CVSS score of 9.8/10 and affects seven out of the ten key risk areas of the OWASP Top 10 in 2017. RCE is considered a type of injection that can potentially lead to catastrophic attacks, allowing attackers to gain privileged access to host servers and perform malicious activities such as discovering additional vulnerabilities, checking for misconfigured file permissions, or deleting logs. Cloudflare's continuously learning Firewall provides protection against common RCE attacks, including the specific vBulletin vulnerability through a new rule in its Cloudflare Specials Rulesets (ruleId: 100166). Customers with Managed Rulesets and Cloudflare Specials enabled will be immediately protected. Those who don't have these features can deploy a patch from the vBulletin team to protect themselves.

Cloudflare has introduced Workers Sites, a platform that allows developers to upload their static sites directly onto the edge of the internet. This approach aims to improve web performance by reducing the distance between users and site assets. Workers Sites leverages the power of Cloudflare's existing Workers and Workers KV platforms, enabling developers to deploy entire websites closer to end-users. The platform supports any static site generator, such as Hugo, Gatsby or Jekyll, and can be used for blogs, marketing sites, portfolios, or even transitioning into a dynamic site. To get started with Workers Sites, users need to sign up for the Cloudflare Workers Unlimited plan and install the Wrangler CLI.

Cloudflare celebrated its 9th birthday by launching new offerings aimed at improving internet security and performance. These include "bot fight mode" for combating malicious bots, Browser Insights for analyzing website performance from users' perspectives, the rollout of their mobile app WARP, support for HTTP/3 in partnership with Google Chrome and Mozilla, and Workers Sites for deploying lightweight static sites without traditional backend server infrastructure. The company thanked its partners, employees, and customers for their ongoing support in building a better internet.

Cloudflare has introduced a new feature that allows users to deploy entire websites directly to Cloudflare Workers and Workers KV using the Wrangler CLI. This makes it possible for developers to statically generate assets for their site, such as with create-react-app, Jekyll, or WP2Static plugin, and then deploy them to Cloudflare's global network spanning 194 cities in more than 90 countries. The Workers Developer Experience Team has made this process significantly better by enabling users to deploy static sites to Workers in three easy steps: run wrangler init --site, configure the newly created wrangler.toml file with account and project details, and then publish it to Cloudflare's edge with wrangler publish. This feature highlights the flexibility of the entire Workers platform to easily support use cases that were not originally envisioned.

Cloudflare has announced support for QUIC and HTTP/3 on its edge network. The company has been working with industry peers through the Internet Engineering Task Force to iterate on the HTTP/3 and QUIC standards documents, while also improving support on their network. This announcement is significant as it marks a step towards making the web faster and more reliable for all users. Google Chrome and Mozilla Firefox are joining Cloudflare in this announcement, with both browsers providing support for HTTP/3.

Cloudflare's WireGuard-based VPN service, Warp, is now available to all users globally. The company has been testing the service since May 2019 with a beta version that was limited to mobile devices only. Warp aims to provide faster and more secure internet connections by routing traffic through Cloudflare's network of data centers. The launch comes after several months of testing and improvements based on user feedback. One significant change is the addition of Warp+, which offers even faster speeds for an additional cost. Warp+ uses Cloudflare's Argo technology to route traffic over the fastest available path. In addition to performance enhancements, Warp also includes several security features such as end-to-end encryption and protection against IP address leaks. Users can download the free version of Warp from the Apple App Store or Google Play Store for Android devices. Overall, Warp represents a major step forward in making VPN services more accessible and user-friendly. With its focus on speed and security, it has the potential to become one of the most popular VPN options available today.

Cloudflare has released its mobile app, WARP, which secures all internet traffic on a user's phone using their global network. The launch comes after a longer-than-expected wait due to the complexity of building a next-generation service without slowing down connections or draining battery life. Initially announced in April 2019, WARP was expected to roll out by July but faced challenges with diverse mobile networks and operating systems. The app is now available for free on iOS and Android devices, with an optional subscription for the faster version, WARP+.

The article discusses how modern web browsers expose performance data that can help developers understand their website's performance from an end-user perspective. It introduces the Performance API, which consists of several individual APIs such as Navigation Timing, Resource Timing, and Paint Timing. These APIs provide timing information related to page navigation, loading of application resources, and paint operations during page construction respectively. The article primarily focuses on the Navigation Timing API and demonstrates how developers can use it to measure performance metrics like DNS query time, TCP connection establishment time, request and response times, document rendering time, load event duration, and total time. It also explains how Cloudflare uses these performance data to identify slowdowns or network issues on a website. The article concludes by mentioning future plans for Browser Insights, such as incorporating metrics from other APIs, tracking JavaScript errors, setting up monitoring/alerting based on the metrics, and more.

Cloudflare has launched Browser Insights, a new tool that measures website performance from users' perspectives. The tool helps identify where, when, and why web pages are slow. It uses Real User Monitoring to collect timing information within real web browsers, providing metrics about how web pages perform in the real world. Browser Insights can be enabled with one click for free. Future updates will include more metrics and dimensions, subresource analytics, A/B testing, error collection, alerting, and insights powered by Cloudflare to help users understand website performance issues.

Cloudflare has introduced "bot fight mode" in its Firewall settings, aiming to deter malicious bot attacks. Once enabled, the system will target bad bots by slowing them down with computationally intensive challenges and sharing their IP addresses with Bandwidth Alliance partners for shutdown. Additionally, Cloudflare plans to plant trees to offset the carbon cost of these bots. The company's large-scale operations allow it to detect bot behavior patterns and improve its bot detection methods over time.

Cloudflare is celebrating its ninth birthday with a week full of new products and innovations that support their mission of helping build a better internet. The company's focus on community collaboration is evident in the upcoming announcements, which include cybersecurity enhancements, performance insights tools, a new protocol launch, and updates to their serverless platform for developers. These developments aim to improve privacy, provide valuable data, and make the internet faster and safer for everyone.

In this blog post, the author discusses various scenarios where a TCP connection may notice issues with the other party going away. These scenarios include SYN-SENT, SYN-RECV, idle ESTABLISHED connections, busy ESTABLISHED connections, and zero-window ESTABLISHED connections. The author provides scripts to demonstrate the effects of timeout-related socket options under various network conditions. They also discuss how to tune a TCP connection to ensure that the remote host is actually up and provide tips for debugging networking issues.

Cloudflare has expanded its Cryptography Research team into a broader Computer Science Research group. The company's research model is based on a hybrid approach that combines practical problem-solving with long-term, impactful projects. This approach allows researchers to work closely with product and operations teams, ensuring their work remains grounded in real-world issues. Cloudflare's massive popularity enables it to conduct large-scale experiments and contribute significantly to the development of international technical standards. The company is currently focusing on areas such as security and privacy, cryptography, internet measurement, low-level networking, and emerging networking paradigms.

The latest update of Wrangler, version 1.3.1, introduces new features for developers building Cloudflare Workers, including built-in deployment environments and first-class support for Workers KV. The development team faced design challenges while creating these features, emphasizing the importance of deep empathy for users across the entire team. They introduced a host of new features such as creating KV namespaces, bulk uploading key-value pairs, and more. The process involved multiple iterations to improve usability and ensure consistency in command structures. The final version offers explicit commands for both individual and bulk actions with Workers KV, making it easier for users to integrate into their daily operations. Lessons learned from this experience include the use of taxonomies for subcommands, drawing inspiration from other popular CLIs, and avoiding logic that requires passing in raw ID strings. The team is excited to continue using these design principles as they grow Wrangler.

On September 14, 2019, Cloudflare went public on the New York Stock Exchange. To celebrate this event, they brought their favorite entropy machines, lava lamps, to the trading floor of NYSE. The footage of these lava lamps is being used as an additional seed for their entropy-generation system LavaRand, which helps secure over 20 million Internet properties worldwide. Lava lamps are a fantastic source of entropy due to their unpredictable nature. Cloudflare has a wall filled with dozens of lava lamps in its San Francisco headquarters and uses an algorithm called LavaRand to amplify the randomness from these lava lamps. They also facilitate the League of Entropy, a consortium generating verifiable randomness via a globally distributed network.

Cloudflare, founded in 2010 by Matthew Prince, Michelle Zatlyn, and Lee Holloway, aims to build a better internet. The company was formed to take advantage of the paradox shift from on-premise hardware and software to cloud services. It provides a suite of cloud services as replacements for traditional network appliances such as firewalls and load balancers. Cloudflare's platform is built on commodity hardware, with an architecture that allows any server in its network to run every service efficiently. The company offers security, performance, and reliability products as a service without requiring customers to install hardware or change their code. It has consistently grown over the long term by expanding its relationship with existing customers and moving up market. Cloudflare is focused on creating more value than it captures and continues to invest in R&D for new product development. The company's commitment to its mission is evident through its choice of "Project Holloway" as the code name for its IPO, honoring co-founder Lee Holloway who was instrumental in building Cloudflare's platform.

Johanna Larsson of Castle discusses the importance of strong security in protecting online accounts and shifting responsibility from end-users to companies. She highlights how Castle extends threat prevention and protection for both pre and post login, reducing friction while maintaining high security levels. The integration with Cloudflare Workers allows for a more friendly, simple, and safe process by placing the security layer directly between the end user and the application. This approach not only reduces end-user friction but also enables security teams to feel more confident in their decisions.

WordPress is the most popular CMS globally, powering over a third of the top 10 million websites. Hosting providers often face challenges in delivering high-performance services to their customers without modifying individual site codes. Cloudflare's Serverless Workers Platform has emerged as a solution for these providers, offering performance enhancements at the edge without code modification. Bluehost, a recommended WordPress host, collaborated with Cloudflare and achieved a 40% performance improvement using Workers. The platform will be offered to Bluehost customers in early 2020, resulting in faster response times, increased website visits, improved ad revenue, and higher ecommerce sales.