April 2021 Summaries

John Graham-Cumming received a Raspberry Pi 400 as a gift and decided to set it up with Cloudflare's Auditable Terminal, which provides an SSH client in the browser. He shares his step-by-step process of setting up the Pi 400 on his home network, using Cloudflare Tunnel to connect it to the Cloudflare network, and then using Auditable Terminal to access the Pi 400 via a browser. The setup includes preparing the Pi 400, setting up Cloudflare Tunnel, configuring Cloudflare for Teams, connecting all components together, and finally testing the connection. This process allows him to log into the Pi 400 from anywhere using just a browser, providing a powerful and convenient solution for remote access.

Cloudflare is facing another patent troll lawsuit from Sable Networks, which has already sued over a dozen technology companies. In response, Cloudflare is launching Project Jengo 2.0, offering a $100,000 bounty for prior art that can be used to invalidate Sable's patents. The company aims to turn the normal incentive structure on its head by fighting back against patent trolls and making it harder for them to file frivolous lawsuits. Prior art submissions will be made public, potentially helping others fight back against patent trolling as well.

Cloudflare has achieved ISO/IEC 27701:2019 certification, making it one of the first organizations in its industry to do so. The company is also the first web performance and security firm to be certified as both a data processor and controller under this new international privacy standard. This certification provides assurance to Cloudflare's customers that their personal data will be handled according to GDPR requirements. The ISO 27701 standard focuses on protecting and managing the processing of personal data, aligning closely with the GDPR. It is a privacy extension to the existing industry standards ISO/IEC 27001 and ISO/IEC 27002. Cloudflare's certification as both a data controller and processor demonstrates its commitment to maintaining high-standards in data handling practices and transparency about those practices.

Cloudflare has introduced a private network feature allowing teams to create their own private networks on the company's network. Team members can connect to private IP addresses in environments controlled by administrators, who deploy a lightweight software connector replacing traditional VPN appliances. The new feature combines IP level connectivity and Zero Trust controls, with plans for additional identity-based network-level rules. This solution aims to provide the convenience of a private network while moving towards a Zero Trust model. It is available at no cost for organizations with 50 or fewer team members.

Cloudflare has announced the beta release of Cloudflare Images, a service designed to store, resize, optimize, and deliver images at scale. Similar to Stream, which was launched in 2018 for videos, Cloudflare Images eliminates the need for users to manage storage buckets, egress costs, and other common problems. The service is aimed at businesses that require efficient image infrastructure, such as those with large numbers of high-resolution product images or apps for creators. With its straightforward APIs and simple pricing structure, Cloudflare Images aims to reduce the time developers spend maintaining infrastructure so they can focus on their products' unique features. The service also eliminates egress costs and storage bucket management, offering a single source of truth for different ways of securing and optimizing image uploads in a product.

During Developer Week at Cloudflare, several new products were released, including improvements to Workers and a new Radar DDoS Report page. The autonomous edge DDoS protection system was introduced last month, which can drop attacks at wire speed without impacting performance. In Q1 2021, China had the highest percentage of HTTP attack traffic, while Telecommunication was the most attacked industry. On the Cloudflare network, the highest DDoS activity was observed in Rwanda, China, and Brunei. Top emerging threats include attacks targeting Jenkins and TeamSpeak3 servers, which increased by 940% and 203% QoQ, respectively.

Ash Mathur joins Cloudflare as Head of Sales for Canada to expand the company's growth in the region. Internet security, privacy, and performance are key drivers for businesses, individuals, and public sector organizations. As companies move from on-premise infrastructure to a cloud-first approach, new complexities and opportunities arise. The rapid shift to remote work has made Zero Trust architecture a strategic priority for many organizations. Cloudflare's global network helps protect enterprise networks, applications, and users in a way that reduces complexity and enables organizational agility. Mathur is excited to help Canadian organizations scale and optimize their businesses with innovative solutions from Cloudflare.

Cloudflare has announced the opening of its first Canadian office and team in Toronto. The company helps ensure anything connected to the Internet is fast, safe, and reliable by running a distributed global cloud platform that delivers network services to businesses of all sizes. Today, they work with thousands of customers in Canada, including entrepreneurs, universities, non-profits, large enterprises, and small businesses. Cloudflare has also seen an increase in cyberattacks originating from Canada, which highlights the importance of their services in protecting Canadian organizations. The company is committed to supporting more great Canadian organizations by hiring a local team.

Cloudflare and HashiCorp have partnered since 2018 to integrate Terraform, HashiCorp's infrastructure-as-code product, with Cloudflare's technology. Today, they announced a major update to their Terraform bootstrapping tool, cf-terraforming. The new version of the tool simplifies management and makes it easier for developers to get started using Terraform with Cloudflare. It also addresses challenges in managing such tools, including duplication of effort when resources change, impact of changes to Terraform, and TF state management.

Cloudflare is exploring the possibility of offering container services at the edge alongside its existing isolates-based platform. While isolates are considered ideal for distributed systems due to their lightweight nature, containers may be more suitable for certain applications such as single-player 3D video games and legacy systems. The company has already built a capability to run containers at the edge for its Browser Isolation product. However, moving container workloads from centralized locations to the edge may not necessarily result in significant speed improvements due to high overhead and cold start times. Cloudflare is currently inviting developers with use cases for running containers at the edge to sign up for early access.

Cloudflare Workers® has introduced three new improvements to enhance the developer experience. First, https://workers.new is a shortcut that takes users directly to a JavaScript editor for creating a new Worker. Second, custom builds have been released for wrangler, allowing developers to use any JavaScript bundler they want. Third, wrangler tail has been improved with better terminal output and easier accessibility. These updates aim to make it faster and simpler for developers to build and deploy applications using Cloudflare Workers.

Cloudflare Stream introduces a new API that enables users to associate their videos with Non-Fungible Tokens (NFTs). NFTs are smart contracts on the blockchain that allow provable ownership of digital content. By integrating NFTs, creators can claim ownership and control over their video works. The API takes an ERC-721 token ID and contact address to set it on a video. Once linked, the owner of the NFT can transfer admin rights on the video without involving the original user who uploaded it. Cloudflare Stream also offers accessibility features such as captions, compatibility with mobile and desktop devices, and automatic quality switching for videos.

On April 16, 2021, Cloudflare announced its support for Node.js on its Workers platform. This integration allows developers to create entire applications using only JavaScript, with the code running across Cloudflare's data centers in over 100 countries. Currently, more than 20k packages are supported by Workers, including popular ones like node-jose for encryption and itty-router for routing. The platform plans to increase worker sizes and support native APIs in the future. Cloudflare is also seeking user input on which libraries/APIs should be prioritized for compatibility with Node.js.

Cloudflare has announced partnerships with Macrometa and Fauna, two distributed data companies, to help developers choose an edge-first database when building new applications on Workers. The company is also introducing tutorials and guides for databases that already support HTTP connections to make connecting to existing databases easier. With these developments, the Workers runtime becomes the easiest way to handle both parts of your application that matter: code and state. Cloudflare's partnership with Macrometa provides a serverless data platform for developers to build rich, geo-distributed, stateful applications on the edge with Cloudflare Workers. The Macrometa Global Data Network (GDN) is an ultra-fast, globally replicated noSQL database with integrated features for search, pub/sub, streams, and stream processing. On the other hand, Fauna is a flexible, developer-friendly, global transactional database delivered as a secure, global, cloud API — no database operations required.

Cloudflare has announced the availability of its SaaS solution, renamed as "Cloudflare for SaaS", previously known as SSL for SaaS, to everyone. This solution is designed to help SaaS providers manage their customers' websites and SSL certificates at scale. It offers fast load times, unparalleled redundancy, and the strongest security to customers. Since its launch four years ago, it has been adopted by leading SaaS companies like WP Engine, Shopify, and HubSpot. The beta version of Cloudflare for SaaS is available today, allowing users to try out the solution.

Cloudflare has introduced a browser-based terminal that enables organizations to seamlessly connect to non-HTTP resources with the same level of audit control as web applications. The terminal renders a fully functional console, allowing users to authenticate with their organization's SSO and access resources based on Zero Trust rules. This solution aims to improve security for applications outside of the browser while enhancing user experience and performance. Cloudflare plans to add support for additional application types in the coming months.

Argo Tunnel, now renamed as Cloudflare Tunnel, is a secure method of connecting resources directly to Cloudflare. It creates an outbound-only connection between services and Cloudflare by deploying a lightweight connector in the user's environment. This feature was previously priced based on bandwidth consumption but is now available for free. Users can still add the paid Argo Smart Routing feature to accelerate traffic. The Tunnel enhances security by making outbound-only connections to Cloudflare, removing the need for poking ingress rules into machines and leaving infrastructure vulnerable to attacks. It also allows users to enforce Zero Trust rules through Cloudflare, validating each request to their resources.

The blog post discusses how to improve page experience of AMP pages by using AMP Optimizer in Cloudflare Workers. It highlights the importance of a great user experience on the web, which includes factors such as loading speed, responsiveness, and content stability. Core Web Vitals are introduced as a new way to measure user experience on the web based on real-world data. The post explains how AMP ensures good page experience by providing guardrails that help avoid common performance pitfalls. However, it also notes that some performance best practices required for performing well on Core Web Vitals can't be implemented at client-side and need to be done on the server. To address this issue, the AMP team has created AMP Optimizers, which will automatically perform common performance best practices for you. The post introduces a new integration of AMP Optimizer for Cloudflare Workers, making it easy to serve optimized AMP pages on your own origin. It also explains how the Cloudflare Worker works and its benefits, such as automatic preloading and responsive images out of the box. Finally, it mentions that Web performance is complex, and users should do their own performance testing on their own sites.

Cloudflare has released support for WebSockets in its serverless computing platform, Cloudflare Workers. This feature enables developers to create live-updating and interactive applications by combining the power of WebSockets with Durable Objects, a solution for building coordinated state on the edge. The integration allows for real-time communication between clients and servers without continuous polling, unlocking use cases such as live sports scores, chat applications, and more. Additionally, Cloudflare has provided a new template and documentation to help developers get started with WebSockets in Workers.

Cloudflare has made its extended CPU limits of up to 30 seconds for HTTP requests generally available to customers on the Workers Paid plan. This move is aimed at allowing users to bring all their intensive workloads to Workers and access the benefits of its edge network without worrying about computation limits. The company also offers a private beta for Cron Triggers of up to 15 minutes for those who need even longer execution times. Furthermore, Cloudflare has cut its egress pricing in half from $0.09 per GB to $0.045 per GB and increased the usage that is included in its $5 a month cost. The Workers Unbound platform aims to be the cheapest general-purpose computing platform and offers developers more time to build applications with cutting edge technologies without worrying about their bill.

Cloudflare is extending its Workers platform to include support for NVIDIA GPUs and TensorFlow, enabling developers to build AI-based applications that run across the company's global edge network using pre-built or custom models. The partnership with NVIDIA aims to bring high performance, low latency AI to anyone by deploying machine learning at the edge within milliseconds of the global online population. Developers can use TensorFlow for building and running AI models, while Cloudflare plans to offer pre-trained models for tasks such as image labeling/object recognition and text detection.

Cloudflare has announced new partnerships with six observability-focused companies to enhance its existing analytics offerings for Cloudflare Workers, a serverless computing platform. The new partners include Sentry, New Relic, Datadog, Sumo Logic, Splunk, and Honeycomb. These partnerships aim to provide developers with robust tools to investigate, diagnose, fix, and monitor issues in their applications. By integrating these observability platforms into Cloudflare Workers, developers can gain full-stack visibility and contextualized insights from metrics, traces, logs, and user transactions across all of their infrastructure, applications, and services. This will enable teams to resolve incidents faster, optimize system performance, and ensure a strong security posture for their applications.

Cloudflare has announced an update to its serverless code platform, Cloudflare Workers, which now includes free access to geolocation data for all developers on the platform, including those on the free plan. This feature allows developers to create personalized experiences for users based on their location, unlocking new possibilities for building intuitive apps and services. The update also makes it easier to build server-rendered applications and customize services without needing configuration from users. Cloudflare has provided examples of how geolocation data can be used in various applications such as personalized UI design and location-based services, and encourages developers to explore the feature further and share their creations on its Workers Discord.

Cloudflare is extending its Workers platform to include support for NVIDIA GPUs and TensorFlow, enabling users to build AI-based applications that run across the company's global edge network using pre-built or custom models. The partnership with NVIDIA aims to bring machine learning capabilities closer to end users by deploying them within milliseconds of the global online population. This will enable high performance, low latency AI deployment for anyone. Cloudflare also plans to offer pre-trained models for tasks such as image labeling/object recognition and text detection.

Cloudflare has announced the Stream Connect beta, a feature that supports end-to-end live broadcasting on its platform. Stream Connect enables users to push RTMPS feeds to the Cloudflare edge and have them restreamed to multiple platforms such as Facebook, YouTube, and Twitch. The service aims to increase reliability and lower latency by removing the bandwidth bottleneck from local connections and automatically configuring the right ingest servers. Stream Connect also utilizes Argo Smart Routing for improved reliability and reduced latency during live broadcasts. The beta version of Stream Connect is available on an invite-only basis, with pricing details to be released later.

Cloudflare is hosting Developer Week from April 12 to April 19, featuring a series of Developer Challenges designed to help developers familiarize themselves with the company's developer tools and create new applications using Workers, KV, Pages, Durable Objects, and other products. The challenges are divided into two streams: one for beginners and another for experienced users. Participants can join the Discord server for updates on daily challenges and to connect with fellow developers. Successful completion of each challenge will be rewarded by sharing screenshots of their creations on Twitter using the hashtag #DevChallenges.

Cloudflare Pages, a fast, secure, and free platform for frontend developers to build, host, and collaborate on Jamstack sites, is now available for anyone and ready for production needs. The platform simplifies the development and deployment process by handling all tedious parts of web development, allowing developers to focus on creative aspects. New features include web analytics, built-in redirects, protected previews, live previews, and optimized images. Upcoming enhancements will support GitLab/Bitbucket integration, webhooks, A/B testing, and full-stack applications with Cloudflare Workers and Durable Objects.

Developer Week 2021 will feature a series of announcements aimed at making developers' lives easier by addressing the challenges faced when transitioning from writing code to running it successfully and at scale. The event will focus on enhancing Cloudflare Workers, a platform for deploying internet-facing applications that start instantly and scale seamlessly. Expect new products, improved pricing, observability features, and partnerships during this week. Additionally, there will be developer challenges designed to introduce new users to the platform and help experienced users get the most out of it.

Load balancing is a crucial concept in managing server traffic efficiently. However, it becomes more complex as applications grow and interact with Host headers in HTTP requests. The Host header helps route each request to the correct origin server, ensuring users receive the information they requested from the start. This behavior can cause issues when using third-party applications like Google Compute Cloud, Google App Engine, Heroku, and Amazon S3, as these applications have an important effect on the requirements for a Host header. To address this problem, Cloudflare has added support to override the Host header on a per-origin basis within their Load Balancing solution. This means that users don't have to worry about sending errors back to end-users and can seamlessly integrate apps into their reliability solutions. The Host header override feature allows for flexibility in overriding the Host header on a per-origin basis, ensuring proper routing of requests without errors.

Cloudflare has introduced Transform Rules for all its plans, allowing administrators to create URL rewrite rules that transform HTTP requests as they flow through the platform. This feature provides an interpretation layer between human-friendly and computer-friendly URLs, making it easier for users to understand complex, contextless links. The Transform Rules support dynamic and static rewrites, with plans to add more rule types in the future. Additionally, Cloudflare has added new security functionality called URL Normalization, which prevents malicious actors from bypassing security rules within its products using URL-encoding in HTTP requests.

Jonathon Dixon has joined Cloudflare as Vice President and General Manager for Asia Pacific (including Japan and Greater China). With over 200 employees in the region, Cloudflare aims to expand its customer base and presence. The company's mission is to help build a better internet by providing security, enhancing performance of business-critical applications, and eliminating network hardware management costs. As Asia Pacific has the largest number of internet users globally, there is significant potential for growth in the region. Dixon's priorities include building a diverse team, generating brand visibility, creating strategic customer relationships, and leveraging learnings from within the region.

The pandemic led to an increase in interest in virtual happy hours, which coincided with a significant rise in wine-themed domain registrations. Recorded Future observed a 2-3 times increase in new wine-themed domain registrations post-COVID compared to pre-pandemic levels. Malicious wine-themed domains followed a similar trend, with the percentage of malicious domains ranging between 3% and 5%. Area 1 Security identified over 25,000 instances of these domains being used in phishing campaigns targeting various industries. The report suggests that spam and phishing campaigns leverage current trends and events to push malicious activity. To protect against such threats, organizations should implement a defense-in-depth strategy for email protection, use cloud email infrastructure, and augment it with intelligence from Recorded Future and Area 1 Security.

The World Health Organization (WHO) emerged as the 2021 March Hackness Champion, a title no organization wants to win. Researchers identified over 2 million phishing spoofs exploiting the WHO brand between May 2020 and February 2021. Attackers used sophisticated techniques such as display name spoofing, adding logos for legitimacy, and abusing legitimate services like Appspot.com to host their phishing sites. The COVID-19 pandemic influenced the attack patterns of phishing attacks in the U.S., with hackers exploiting trust in organizations like WHO, Moderna, CDC, Marketo, Columbia Sportswear, UPS, CNN, Zoom, Adidas, and Nike. Email authentication standards such as SPF, DKIM, and DMARC are not enough to prevent phishing attacks from reaching inboxes; comprehensive message analysis, computer vision, domain registration checks, and other techniques beyond email authentication are necessary for effective defense against sophisticated phish.

The new feature "Home" in the Cloudflare for Teams Dashboard aims to provide a comprehensive view of network and application traffic, while also promoting transparency, warmth, guidance, and adaptiveness. The design principles behind Home include making it easy to use, approachable, and flexible enough to accommodate future updates. With this feature, users can quickly identify anomalies in their network traffic or simply keep everything under control. Additionally, the Teams Home offers easy access to complementary features and empty state actions to help populate charts with data. The modular design of Home ensures that it will continue to evolve as new features are added, allowing for greater customization and user feedback integration.

In this post, we have continued our exploration of dynamic linking by implementing a basic loader program that can execute functions from an ELF object file. We started by adding some more complexity to the imported code and then extended our loader program to handle constant data and global variables dependencies. Finally, we successfully executed all the imported functions including those with references to external libraries. The complete source code for this post is available on GitHub. In the next post, we will look into importing and executing object code with references to external libraries. Stay tuned!