October 2019 Summaries

Cloudflare has released an open-source implementation of Network Time Security (NTS), a protocol that enables secure time synchronization over the internet. The NTS protocol is structured as a suite of two sub-protocols, NTS Key Exchange (NTS-KE) and NTPv4. It maintains scalability by not requiring per-client state from servers while providing security through cookies. Cloudflare's implementation, cfnts, is written in Rust due to its memory safety, non-nullability, thread safety, and immutability features. The company has also shared their experience with implementing NTS and the challenges they faced during testing and deployment. They encourage more clients to support NTS for increased internet security.

In June 2019, Google and Cloudflare announced a post-quantum cryptography experiment using two key exchanges integrated into their TLS stack. The experiment aimed to evaluate the performance and feasibility of deployment in TLS of two post-quantum key agreement ciphers: isogeny-based SIKE and lattice-based HRSS. The results showed that CECPQ2 (HRSS + X25519) outperformed CECPQ2b (SIKE/p434 + X25519) for the majority of connections, indicating that fast algorithms with large keys may be more suitable for TLS than slow algorithms with small keys. However, for some devices like Windows computers and Android mobile devices, CECPQ2b outperformed CECPQ2 for the slowest connections. The HRSS algorithm performed surprisingly well in terms of speed, while SIKE incurred a significant overhead for every connection due to its computational expense.

On October 29, 1969, the first network packet was transmitted from UCLA's campus in Los Angeles to Stanford Research Institute (SRI) building in Palo Alto, marking the beginning of packet networking and the modern Internet. This event led to significant advancements in technology and communication over the past five decades. The article highlights some key figures who have contributed to the development of a better internet, including Leonard Kleinrock, Steve Crocker, Vint Cerf, Bob Kahn, Jon Postel, Bill Joy, Al Gore, Tim Berners-Lee, Sally Floyd, Jay Adelson, Al Avery, and many others. These individuals played crucial roles in the creation of protocols, software, hardware, and infrastructure that enabled the growth and success of the internet as we know it today. Cloudflare, a company founded in 2009, aims to continue building a better internet by providing various services and solutions for businesses and users worldwide.

The Domain Name System (DNS) is the address book of the internet, translating domain names into IP addresses. However, DNS queries and responses are typically unprotected, posing privacy and security risks. Encrypting DNS can improve user privacy and security. Two mechanisms for encrypting DNS exist: DNS over TLS (DoT) and DNS over HTTPS (DoH). Both are based on Transport Layer Security (TLS), which is also used to secure communication between a web server and client using HTTPS. Encrypting the web has made it possible for private and secure communications and commerce to flourish, and encrypting DNS will further enhance user privacy. Major public resolvers support DoT and DoH, but many ISP resolvers still lack support for them.

On October 29, 1969, the first full system test and remote host-to-host login over the Arpanet was successfully completed at UCLA. The Arpanet aimed to connect sites within the ARPA-funded computer science research community using packet-switching technology. In September 1969, BBN delivered the first Arpanet IMP (packet switch) to UCLA's laboratory. By October 29, testing began and the first host-to-host login on the Arpanet was completed after a brief configuration problem. The event marked the beginning of computer networking as we know it today.

At Cloudflare, a commitment is made to supporting and developing new privacy-preserving technologies like Privacy Pass protocol. The protocol allows clients to prove trust without revealing where and when the trust was provided. It has been integrated into an open-source browser extension available in Chrome & Firefox with over 150,000 individual downloads worldwide. Cloudflare is working on improving Privacy Pass by adding new features like support for Privacy Pass v2.0 browser extension, integration with new service provider (hCaptcha), and compliance with hash-to-curve draft.

This week, Cloudflare is sharing a series of blog posts about their work involving cryptography during Halloween season. They will discuss various projects such as Privacy Pass, Post-quantum Cryptography experiment, cfnts (Cloudflare's implementation of NTS in Rust), DNS Encryption Explained, Delegated Credentials for TLS, and keeping private keys secure from memory disclosure attacks. These milestones are made possible through partnerships with various organizations working together to build a better Internet.

Cloudflare has introduced support for short-lived certificates in its zero-trust security solution, Cloudflare Access, to replace static SSH keys. This feature aims to enhance security and simplify management of SSH connections across organizations. By integrating with popular identity providers (IdPs), Access enforces identity-based rules each time a user attempts to connect to a target resource. The new short-lived certificates eliminate the need for static keys, offering seamless revocation when users are removed from an IdP. This feature is available today for all Cloudflare Access customers and can be accessed through the provided documentation.

Three vulnerabilities were disclosed as Cache Poisoning Denial of Service attacks in a paper by Hoai Viet Nguyen, Luigi Lo Iacono, and Hannes Federrath of TH Köln - University of Applied Sciences. These attacks are similar to the cache poisoning attacks presented last year at DEFCON. Most customers do not have to take any action to protect themselves from the newly disclosed vulnerabilities. Some configuration changes are recommended if you are a Cloudflare customer running unpatched versions of Microsoft IIS and have request filtering enabled on your origin or have forced caching of HTTP response code 400 through the use of Cloudflare Workers. Cloudflare has not seen any attempted exploitation of the vulnerabilities described in this paper. The company maintains the integrity of its content caching infrastructure by building it to behave in ways compliant with industry standards and actively adding defenses to their caching logic to protect customers from common caching pitfalls.

On July 22, 2019, in Austin, Texas, temperatures soared above 37°C (99°F). That day, the Cloudflare team began using their new service, Magic Transit, on a live network with real traffic from real people and apps. Magic Transit protects and accelerates customers' entire network infrastructure, not just web properties or TCP/UDP applications. The Austin office was used as a test for this new service. After onboarding the Austin office to Magic Transit in an always-on routing topology, Cloudflare began testing its DDoS mitigation capabilities by launching attacks from their Site Reliability Engineering (SRE) team. With the help of dynamic rules generated by Gatebot and DoSD systems, Cloudflare was able to detect and block these attacks within seconds, ensuring no degradation in service for the Austin team. The experiment provided valuable lessons on engineering and procedural aspects, allowing them to refine their run-books and reduce onboarding duration for customers.

On October 17, 2019, Cloudflare announced the availability of HTTP/3 on their edge network, aiming to improve security and performance on the internet. Users can now enable HTTP/3 on their Cloudflare zone and experiment with it using Chrome Canary or curl. To further promote adoption of QUIC and HTTP/3, Cloudflare has made an implementation of HTTP/3 and QUIC available as a patch to NGINX. This is not officially supported by the NGINX project but aims to help push adoption of these technologies. The integration involves downloading and unpacking the NGINX source code, applying the patch, building NGINX with HTTP/3 support enabled, and configuring it to accept incoming HTTP/3 connections.

Cloudflare has recently presented a solution for programming socket lookup with BPF at the Linux Plumbers Conference 2019 in Lisbon, Portugal. The company's edge servers are crowded with numerous public-facing services and internal ones that operate behind the scenes. To manage these efficiently, every Cloudflare edge server runs all services and responds to each Anycast address. However, setting up network services to listen on hundreds of IP addresses without overwhelming the network stack is a challenge. The solution proposed by Cloudflare engineers involves using BPF (Berkeley Packet Filter) to program the socket lookup with BPF inet_lookup. This new mechanism allows users to tweak how incoming packets are matched with listening sockets, ignoring the address the socket is bound to. This approach offers flexibility and can be used for various scenarios such as binding a service to a single port, all ports, or a network prefix. It also enables services to bind to all addresses and all ports without needing extra capabilities. The implementation of BPF inet_lookup has been made possible through teamwork, with contributions from Lorenz Bauer, Marek Majkowski, and Gilberto Bertin.

National Coming Out Day is observed on October 11th to promote a safe world for lesbian, gay, bisexual, transgender, and queer (LGBTQ) individuals to live truthfully and openly. The importance of coming out still matters as it helps change hearts and minds, creating new advocates for equality. Stories from Proudflare members highlight the experiences and challenges of coming out in the workplace, emphasizing the significance of supportive environments that celebrate diversity and inclusion.

On October 3rd, 2019, Cloudflare hosted an event in Central Jakarta, Indonesia, bringing together leaders from various industries to discuss cybersecurity and the future of the internet. The event featured speakers from PT Viva Media Baru and PT. Global Tiket Network, who shared their insights on current trends in cyber attacks and best practices for securing websites without compromising performance. Kate Fleming, Head of Customer Success for APAC, also highlighted Cloudflare's new data center in Jakarta, extending its Asia Pacific network to 64 cities and global network to 194 cities. The event aimed to inspire and encourage the cyberspace community in the region by fostering connections and sharing ideas.

This guest post by Dimitris Koutsourelis and Alexis Dimitriadis from Workable's Security Team discusses their journey into infrastructure-as-code practice, specifically managing Cloudflare configuration in a declarative and version-controlled way. They share their experience with Terraform and Terragrunt, the challenges they faced, different approaches taken, and parts of their solution. The authors explain how they structured their Terraform folder, implemented resources in various ways to cover their requirements efficiently, and dealt with issues such as managing zone groups and handling dependencies between resources. They conclude that there isn't a single best solution and it all comes down to the specific requirements while keeping a balance between complexity and simplicity.

John Graham-Cumming, CTO of Cloudflare, discussed the company's approach to internal security during a talk at Unbabel in Lisbon on September 25, 2019. Key points include: 1. Culture: A strong culture of reporting security problems is crucial for internal defense. Encouraging employees to report minor issues helps identify potential vulnerabilities early. 2. Hackers: Cloudflare uses HackerOne to receive external reports of security problems and has a private paid bug bounty program with around 150 hackers. 3. Identity: Effective identity management and authentication are critical for security. Cloudflare built its own solutions, reducing the number of passwords needed and increasing overall security. 4. Openness: Transparency about mistakes increases trust in a company's product and encourages people to report potential security problems. 5. Change: After experiencing issues like Cloudbleed, Cloudflare prioritized using memory-safe languages such as Go and Rust for software development. 6. Detection and Response: Collecting data about endpoint behavior helps detect anomalies and respond quickly to internal security incidents. 7. Edge Security: Ensuring the security of machines in 194 cities requires a combination of physical data center security and software measures, such as Keyless SSL for private key distribution. 8. Eating our own dogfood: Cloudflare uses its own products to secure itself and builds new security features based on internal feedback.

On October 2nd, 2019 at 5:25 PM, Connor Peshek introduced the eighth edition of The Serverlist, a resource for staying updated on serverless technology. It includes latest news, tutorials for developers, discussions with fellow serverless developers, and information about upcoming meetups and conferences. To receive this content directly in your email, sign up using the provided link while ensuring your privacy is respected.

On October 2nd, Cloudflare announced the launch of Workers Sites, a platform that allows developers to deploy entire websites directly to the Cloudflare Network using Cloudflare Workers and Workers KV. This service is designed for statically generated assets such as those produced by create-react-app, Jekyll, or WP2Static plugin. The company also revealed plans to host events featuring some of the developers who contributed to this product, allowing attendees to learn more about its creation and potential use cases. These events will take place in Austin and San Francisco, with more cities to be added soon.