May 2021 Summaries

On May 27, 2021, the Internet Engineering Task Force published RFC 9000, standardizing the QUIC transport protocol. This marks a significant milestone in internet engineering as it overcomes challenges faced by traditional transport protocols like TCP. QUIC is designed to be secure by default and provides features that speed up connection handshakes and mitigate performance issues on networks with loss or delays. It also supports iterative development and deployment of new features or enhancements. As of May 28, 2021, the standardized version of QUIC is available to Cloudflare customers. The company has been supporting QUIC since 2018 and has seen a steady increase in its adoption, with around 12% of internet traffic using QUIC with HTTP/3 already. To enable QUIC and HTTP/3 for domains, users can turn it on from the "Network" tab of their dashboard. Cloudflare servers listen for QUIC traffic on UDP port 443, and clients initiate connections by sending an Initial QUIC packet in a UDP datagram. The deployment of QUIC is facilitated by HTTP Alternative Services (RFC 7838), which informs TCP-based clients about the availability of HTTP/3. Web browsers will use this method to determine which protocols to use, and Cloudflare has begun rolling out changes to its Alt-Svc advertisements to include support for QUIC v1. The implementation of QUIC at Cloudflare is powered by quiche, an open-source Rust library that exposes a C API. The company has built several tools to help with development and testing, including quiche-client, which provides detailed information on QUIC connections. As the adoption of QUIC continues to grow, the IETF will focus on maintenance, operations, extensibility, and the development of QUIC version 2.

Kristian Freeman has built a simple 3D multiplayer world called "Durable World" using Cloudflare Workers and Durable Objects to demonstrate the real-time consistency they provide in applications. The game is deployed entirely on the Cloudflare stack, with Pages for serving the client-side game and Workers as the coordination layer. The server uses Durable Objects and WebSockets to sync player position and other information like randomly generated usernames. This project showcases how Durable Objects can be used in building real-time applications such as games, with potential for further exploration and development.

Cloudflare has introduced its Security Operations Center (SOC) as a Service, which combines best-in-class security products and a team of cybersecurity experts within the company to augment customers' security and network teams. The SOC as a Service monitors enterprise environments 24x7x365 for security threats and operational disruptions, triages and responds to custom alerts, performs deep analysis to identify attack vectors and network outages, and implements countermeasures to mitigate incidents during attacks. This service aims to provide proactive threat detection and immediate triggering of the SOC as a Service incident response process for enterprises of all sizes and sophistication across Layers 3, 4, and 7. The alerting system is designed to minimize false positives and reduce alert fatigue while still surfacing suspicious patterns. Additionally, Cloudflare has partnered with several global companies to provide Managed Security Service Provider (MSSP) offerings that integrate third-party security tools, services, analytics, and SIEM platforms for a holistic view of customers' threat profiles outside just Cloudflare solutions.

On May 21, 2021, a new set of HTTP response headers called "CDN-Cache-Control" was announced. This feature allows customers to control how Cloudflare's CDN behaves without affecting other caches. The CDN-Cache-Control is similar to the Cache-Control header but provides more specific directives for managing CDN cache behavior. It helps solve problems caused by non-specific directives in Cache-Control, which can lead to unexpected behavior and confusion as the number of intermediary caches grows between an origin and the client. The new headers provide CDN-specific control for when to use stale assets to fulfill requests. Overall, CDN-Cache-Control allows finer grained control of how Cloudflare manages cache lifetimes and revalidation behavior on a per-asset basis.

Martin Hauskrecht from Labyrinth Labs shares their experience integrating Cloudflare's Analytics data with Prometheus and Grafana using a custom-built exporter in Go. The integration allows for better understanding of systems, correlation of metrics, and more efficient Day-2 operations. The exporter pulls data from Cloudflare's GraphQL Analytics API and transforms it into Prometheus metrics exposed on a /metrics endpoint. Deployment is made easier with a Docker image and Helm chart. Grafana is used to visualize the metrics, allowing for individual zone targeting and creation of alerts. The team plans to integrate more analytics data in the future.

Celso Martinho from Cloudflare describes the process of porting Doom multiplayer to work with their edge network using WebAssembly, Durable Objects and Workers. The project aimed to demonstrate how these technologies can be used to create real-time interactive applications that run on the edge, offering advantages from both client-side and server-side code execution environments. The resulting application allows users to play Doom multiplayer in their browser, with low latency due to its proximity to end-users. The source code for all components of this project is open-source and available on GitHub.

Cloudflare Tunnel allows users to securely connect applications to Cloudflare's edge, enabling teams to expose anything from internal subnets to containers in a fast and secure manner. With recent developments such as Named Tunnels and support for Terraform provider, automating the manual process of creating tunnels has become easier than ever before. This capability brings several benefits including putting more Cloudflare config in code, auto-scaling resources, dynamically spinning up resources like bastion servers for secure logins, and saving time from avoiding manually generating/maintaining tunnels. The ability to tie automation around tunnels allows teams to incorporate them into their existing CI/CD pipelines.

Cloudflare is launching an experiment to eliminate CAPTCHAs, which are used by online services to distinguish between humans and bots. The company estimates that the average time spent on a CAPTCHA challenge is 32 seconds, resulting in approximately 500 human years wasted daily. Instead of using traditional CAPTCHAs, Cloudflare aims to use hardware security keys like YubiKey for users to prove their humanity without revealing their identity. The experiment relies on Web Authentication (WebAuthn) Attestation, a standardized API that provides a secure interface for user authentication and cryptography capabilities of devices. This approach is expected to improve user experience and privacy while maintaining strong security measures for accessing internet properties protected by Cloudflare's global network.

Cloudflare Tunnel is a product used by customers to connect their services and private networks to Cloudflare without poking holes in their firewall. The tunnel connections are managed by cloudflared, which runs in the user's environment and ensures that all traffic goes through Cloudflare. Starting from May 12th, users can now run the same tunnel from multiple instances of cloudflared simultaneously. This enables graceful restarts, elastic auto-scaling, easier Kubernetes integration, and more reliable tunnels. The new feature allows teams to dynamically start more instances of cloudflared without changing their DNS or Load Balancer configuration. It also supports zero-downtime config changes and seamless scaling up or down of services independently.

The Cloudflare Web Application Firewall (WAF) has been improved with a focus on enhancing the dashboard experience for users. The design process involved identifying tasks customers were trying to complete using the WAF, prioritizing these tasks, and defining, creating, and refining the interface and interactions. Job Stories were used instead of user personas or stories to better empathize with Cloudflare's diverse range of customers. Key improvements include simplifying the process of enabling a particular ruleset, allowing for bulk edits and easy rule selection, and implementing Ruleset Actions that enable all rules within a ruleset to adhere to a single action. The new dashboard experience aims to make complex configuration tasks simple and efficient while increasing user confidence in their actions.

The text discusses the cost of branch instructions in computer code, specifically unconditional jumps (jmp), conditional jumps (je), function calls (call) and returns (ret). It explains how modern CPUs use a Branch Prediction Unit (BPU) to predict the target of a branching instruction early in the CPU pipeline. The BPU maintains a Branch Target Buffer (BTB) that stores the history of previously taken branches, allowing it to predict future branches with high confidence. The text presents an experiment where a sequence of unconditional jmp instructions is run on different CPUs to measure their performance under varying conditions. It finds that the cost of each branch increases as more branches are added, and there's a significant drop in performance after a certain number of branches (4096 for most CPUs). This suggests that having too many branches in the hot loop can lead to poor performance due to BTB overflows. The text also notes that conditional branches never-taken are essentially free, and function calls (call/ret) need a BTB entry for best performance. It recommends keeping the number of function calls under 2048 in the hot code for optimal performance on some CPUs. Finally, it compares the results on different CPUs including AMD EPYC, Intel Xeon and Apple Silicon M1, finding that while there are differences in details, the general trend is consistent across all CPUs: having too many branches can lead to poor performance due to BTB overflows.