May 2020 Summaries

On May 31, 2020 at 12:00 PM, Connor Peshek introduced the sixteenth edition of The Serverlist, a resource for staying updated on serverless technology. It includes latest news, tutorials, discussions with fellow developers, and information about upcoming meetups and conferences. To receive this content directly in your email, sign up using the provided link while ensuring privacy is maintained.

Sam Rhea shares their experience using Cloudflare Gateway, a part of Cloudflare for Teams, to secure internet-connected devices on their WiFi network. They mention that Gateway has processed about 114,000 DNS queries and blocked nearly 100 as potential security risks. However, they find it difficult to analyze the data more thoroughly due to the large number of pages involved. To address this issue, starting today, users can configure automatic export of logs from Cloudflare Gateway to third-party storage destinations or SIEM tools. This feature builds on the same robust Cloudflare Logpush Service that powers data export from Cloudflare's infrastructure products. Cloudflare Gateway is a part of Cloudflare for Teams, which secures users, devices, and data by replacing on-premise appliances and security subscriptions with a single solution delivered closer to the users. It blocks threats on the public internet from becoming incidents inside an organization. Deployment takes less than 5 minutes, and administrators can block known threats or specific categories of websites. The Cloudflare for Teams UI presents some summary views of data, but each organization has different needs for audit, retention, or analysis. The best way to let users investigate the data in any way they need is to give them all of it. This is where Cloudflare Logpush comes into play, which exports the data captured by Cloudflare's network to storage destinations that users control. Logpush supports AWS S3, Google Cloud Storage, Sumo Logic, and Microsoft Azure out of the box. Administrators can configure exports of logs that will send deltas every five minutes from that point onward. The feature is only available to customers on a contract plan, but all Cloudflare for Teams plans include 30-days of data that can be searched in the UI.

Cloudflare has partnered with Tanium to enhance its zero-trust security solution, Cloudflare Access. The integration allows organizations to add a layer of device security into their deployment by combining Cloudflare's network with Tanium's endpoint management platform. This partnership aims to provide seamless and comprehensive protection for both users and devices accessing corporate resources. With this integration, administrators can now build rules that require users connecting to applications to authenticate with their identity provider and use a device managed by Tanium. The integration is available at no additional cost to all Cloudflare for Teams customers who have a Tanium deployment.

Cloudflare has introduced speed.cloudflare.com, a tool that provides detailed insights into the performance of consumer internet service providers (ISPs). The tool measures download, upload, and latency aspects of network connections, offering more precise results than other speed testing tools. It also prioritizes user privacy by not selling data to third parties and anonymizing all collected information under its Privacy Policy.

Secondary DNS is a crucial aspect of Domain Name System (DNS) infrastructure that provides redundancy and reliability by maintaining a read-only replica of DNS records from primary nameservers. This helps prevent service disruptions in case the primary server goes down or experiences an outage. As businesses scale their DNS infrastructure, they often move away from on-premise servers to managed DNS providers and multiple DNS vendors for increased redundancy against potential attacks. Cloudflare's Secondary DNS product offers a seamless experience with its new onboarding UI, allowing customers to configure their zone in just a few clicks. Additionally, secondary DNS customers can benefit from the same DNS analytics provided to authoritative DNS customers.

Cloudflare has introduced two significant updates to enhance its Domain Name System (DNS) management for customers. Firstly, a confirmation feature has been added for those using Cloudflare as their authoritative DNS provider, allowing users to review and confirm changes before propagation. Secondly, a new onboarding experience is provided for secondary DNS customers. These updates aim to improve the reliability of DNS management by preventing accidental mistakes that could lead to website or API outages. Feedback from customers is encouraged through a survey accessible in the dashboard's DNS tab.

Cloudflare has introduced a new feature allowing users to configure identity options on individual applications within its Cloudflare Access service, which is part of Cloudflare for Teams. This update enables organizations to show users the relevant identity provider when connecting to specific applications, reducing user confusion and overhead. The new feature also supports multiple sources of identity, avoiding the need to agree on a single standard. Users can now choose their specific provider, and Access checks that individual's login against the list of allowed users. This update is part of the new Cloudflare for Teams dashboard, with additional documentation available.

Cloudflare Gateway, part of the Cloudflare for Teams platform, offers secure DNS filtering and content blocking to protect users from threats on the public Internet. Today, they introduced a new feature that allows administrators to redirect end-user traffic to an alternative IP address. This feature is available in every one of Cloudflare's data centers worldwide, ensuring performance while keeping users safe as they navigate the Internet. The domain override function can be used for testing or during migration to SaaS applications and zero-trust solutions. With this new feature, organizations can maintain control over their internal traffic without compromising security or user experience.

Deep links are hyperlinks that direct users to specific content within a website rather than the homepage. In Cloudflare's Dashboard, deep linking is used to enhance user experiences by enabling direct navigation to new or changed features and providing clearer troubleshooting directions. The challenge with deep linking in the Dashboard is that most interesting resources are locked behind an account and zone context. To address this, a solution was developed involving three main parts: dynamic value resolution in deep links URLs, a React component for routing and resolving deep links (DeepLink), and another React component for scrolling to specific content on a page (ScrollAnchor). The DeepLink component uses resolvers to handle unknown symbols that need automatic or user-interactive resolution. The ScrollAnchor component ensures that the browser scrolls to the desired content after the DOM has settled, providing a seamless user experience.

During Q1 2020, there was a significant increase in Internet traffic due to global shelter-in-place orders, leading to a surge in DDoS attacks. Most of these attacks were relatively small, with 92% under 10 Gbps and lasting between 30 to 60 minutes. The rise of smaller, shorter attacks can be attributed to the availability of cheap, easy-to-use tools for launching DDoS attacks. Despite this trend, larger attacks still persist, with the largest attack in Q1 peaking at over 550 Gbps. Persistent attackers have also increased their efforts during the pandemic, targeting a single Cloudflare IP address with as many as 311 attacks per day. The top DDoS attack vectors in Q1 were SYN (60.1%), ACK (12.4%), and CLDAP (5.3%). To combat these shifting trends, Cloudflare offers a comprehensive and adaptive DDoS protection solution that can mitigate attacks quickly and at scale.

In May 2020, Backblaze, a founding Bandwidth Alliance partner, announced the introduction of S3 compatible APIs for their B2 Cloud Storage service. The history of the S3 API dates back to 2006 when Amazon Simple Storage Service (S3) was launched as a scalable and resilient tool for storing unlimited amounts of data without building it yourself. Over time, the S3 API has become a de facto standard HTTP File Storage API due to its broad adoption by developers in their codebases and internal systems. The engineering costs associated with changing storage providers have led many storage providers to natively support the S3 API, leveling the playing field for companies to focus on picking the most cost-effective provider. Backblaze's compatibility for the S3 API has made their storage platform highly compatible with existing code bases and legacy systems. The Bandwidth Alliance is a group of forward-thinking cloud and networking companies that are committed to discounting or waiving data transfer fees for shared customers, helping media and entertainment companies serving user-generated content save on first-mile costs. By switching to a Bandwidth Alliance partner like Backblaze, companies can slash their cloud bills, gain flexibility, and make no compromises to their performance.

In this post, we explore how various video coding settings can impact the quality of a video. We start with a high-quality video and intentionally degrade it by adjusting parameters such as resolution and bitrate. By comparing different versions of the video, we learn about factors that determine the perceived quality of a video, including frame rate, codec choice, level, profile, bitrate, resolution, color space, and keyframe frequency. We use FFmpeg to manipulate these settings and observe their effects on the resulting video. The post also discusses the importance of optimizing videos for different devices and resource-constrained environments.

The text discusses Cloudflare's IETF QUIC implementation, focusing on congestion control and loss recovery mechanisms. It introduces CUBIC and HyStart++ as improvements to the quiche congestion control module. The post also presents lab test results comparing TCP-CUBIC with various QUIC congestion control variants under different packet loss conditions. Visualization using qlog and qvis is highlighted as a useful tool for protocol development. Future tasks include working on advanced features such as packet pacing, advanced recovery, and BBR congestion control to enhance QUIC performance.

The text discusses the development and implementation of a Cloudflare Bot Management platform. This platform combines distributed systems, web development, machine learning, security, and research to detect and manage bots effectively. It provides definitions for bots, good bots, bad bots, and bot management. The author outlines the requirements for this platform, including simplicity, trustworthiness, flexibility, accuracy, and recoverability. They also discuss the technical requirements, such as scalability, low latency, configurability, modifiability, and security. The text introduces the concept of a "Trusted Score" or "Score," which indicates the likelihood that a request originated from a human versus an automated program. This score is used in conjunction with Firewall Rules to provide customers with telemetry about bots on a per-request basis. The author provides an overview of the platform's architecture, including core bot management services and edge bot management modules. They also discuss integration with other Cloudflare products like WAF and Workers. The text delves into the five detection mechanisms currently used by the Cloudflare Bot Management platform: machine learning, heuristics engine, behavioral analysis, verified bots, and JS fingerprinting. Each of these mechanisms is explained in detail, along with their respective properties and benefits. The author concludes by acknowledging the hard work of various teams involved in building this platform and hints at future blog posts exploring the internals of detection mechanisms.

In 2020, Cloudflare acquired S2 Systems, a start-up focused on developing remote browser isolation (RBI) technology. Since then, the RBI solution has been integrated into Cloudflare's product suite called Cloudflare for Teams, which consists of Access and Gateway. The team at S2 Systems previously faced challenges in securing their own products, but after joining Cloudflare, they discovered how seamlessly Cloudflare's solutions could address these issues. They found that using Cloudflare Access to manage access to their RBI service was much more efficient than building their own authentication platform. Additionally, Cloudflare Gateway provided a secure network solution for the team's office environment. The integration of S2 Systems into Cloudflare has led to improvements in both companies' products and services.

Cinco de Mayo is an annual celebration held in Mexico on May 5th, commemorating the Mexican Army's victory over the French Empire at the Battle of Puebla in 1862. The holiday has gained more significance in the United States as a celebration of Mexican-American culture and generates beer sales comparable to those during the Super Bowl. In Mexico, Cinco de Mayo is mostly ceremonial with events like military parades or battle reenactments. Some members of Cloudflare's LatinX Employee Resource Group shared their personal experiences and perspectives on the holiday. Despite some misconceptions about its significance, many people celebrate Cinco de Mayo by enjoying Mexican food and culture.

Cloudflare has integrated its Access security policy management tool into the Cloudflare for Teams dashboard, consolidating all features in one place. The new UI aims to solve confusion caused by previous designs and will serve as a foundation for upcoming feature releases. The integration also allows users to extend some configurations made in Access to Gateway, another product under Cloudflare for Teams.

The article discusses how changes in human behavior due to the pandemic have affected internet usage patterns. It highlights that while internet traffic usually follows a simple rhythm with peaks during early evenings, recent shifts towards remote work and home-schooling have led to additional morning peaks. Furthermore, it mentions how unusual events like "Clap for NHS" in the UK or Ramadan observances can cause noticeable dips or spikes in internet traffic. The author concludes that despite advancements in machine-to-machine communication, human directed internet usage still dominates and invites readers to share other ways human activity might impact these trends.