January 2022 Summaries

Cloudflare has announced the next evolution of its Channel and Alliances Partner Program, specifically designed for partners that provide services around Cloudflare products. The program aims to support "service partners" with recurring revenue streams as they equip businesses of all sizes and types with Cloudflare's leading Zero Trust and SASE solutions. New enhancements include new program paths, a Managed Services Partner (MSP) Accreditation, new support and go-to-market motions, and an invitation for select partners to join the pilot program. The goal is to enable more partners in creating cloud-based security solutions and further Cloudflare's mission of helping build a better Internet.

On Data Privacy Day 2022, Cloudflare highlights key topics that shaped the landscape in 2021 and will continue to be important in 2022. These include data security and privacy, data localization, regulatory enforcement actions on cookies, and new or updated data protection regulations worldwide. In terms of data security and privacy, Cloudflare has invested in technologies like its public DNS resolver and Oblivious DNS over HTTPs (ODoH) to enhance data privacy. The company also developed privacy-enhancing Zero Trust products such as Selective Logging for Cloudflare Gateway. In 2021, the focus was on data localization debates, with Austria's data protection authority setting a tone that shows no sign of slowing in 2022. Pro-Privacy analytics are expected to continue being an area of focus in 2022 as well, and Cloudflare is excited to play a role in ushering in a new era for websites running third-party tools like analytics in a faster, more secure, and privacy-protective way. The company will also continue to fine-tune its data localization offerings and expand to serve other regions where customers are finding a need to localize their data.

Google has announced that users of its "G Suite legacy free edition" must switch to a paid version by May 1, 2022, prompting many to consider alternatives. One such alternative is Cloudflare's Email Routing service, which allows users to create custom email addresses on their existing domains and automatically forward incoming traffic to any destination inboxes they wish. The service is privacy-first, secure, powerful, and free for all customers. With over two hundred thousand zones testing the service in production, it is set to enter open beta soon.

Today, January 27th, marks International Holocaust Remembrance Day, a day dedicated to commemorating the victims murdered by the Nazis during World War II. The Holocaust saw the extermination of one third of Europe's Jewish population, with six million Jews and countless others deemed "inferior" being killed due to their race or disability. Antisemitism played a significant role in these events, leading to laws that outlawed and dehumanized Jews, as well as violence against them. The Final Solution for the Jewish Question was implemented, which aimed at exterminating the entire Jewish race through methods such as mass shootings, gas vans, and gas chambers. Sadly, antisemitism is on the rise again in Europe and across UK university campuses. To combat this, education plays a crucial role in fighting bigotry and racism. Cloudflare's Project Galileo provides free protection to at-risk groups worldwide, including Holocaust educational and remembrance websites. In the past year alone, Cloudflare mitigated over a quarter of a million cyber threats launched against these sites. As part of its mission to help build a better internet, Cloudflare's Project Galileo offers robust security and performance products for vulnerable public interest websites at no cost. The initiative is open to any organization working on critical issues such as human rights, independent media, and Holocaust education.

The use of APIs has grown significantly over the past year, with APIs now accounting for more than half of all internet traffic. This growth is driven by changes in how applications are built, the rise of API-first businesses, and increased machine-to-machine communication. Industries such as Banking, Retail, and Financial Services have experienced the largest increase in API usage. The majority of API traffic comes from POST or GET requests, with JSON being the most commonly used payload encoding protocol. Encryption is key to securing APIs against snooping and tampering, with TLS v1.3 being the most adopted protocol. Cloudflare's security systems block malicious HTML requests twice as often as API requests, with common issues including non-compliant requests, rate limiting, and authentication/authorization problems.

On January 24, 2022, Cloudflare experienced an internal product migration issue that resulted in 24 hostnames, including www.cloudflare.com, being mistakenly redirected to the wrong origin (clickfunnels.com). This led to traffic intended for these hostnames being passed through to clickfunnels.com's origin and potentially displaying a clickfunnels.com page instead of the expected website. The incident affected API calls or other expected responses to and from these hostnames, which may not have responded properly or failed completely. Cloudflare has taken responsibility for the error and worked with ClickFunnels to delete logs of this event to ensure no data was retained by them. They are committed to improving their processes and technology to prevent reoccurrence and apologize for any disruption caused to customers and visitors.

On January 23, 2022, Burkina Faso experienced an internet shutdown that coincided with heavy gunfire during a military mutiny. This marked the third country to face major internet disruptions in 2022, following Tonga and Yemen. The outage affected both mobile and desktop traffic, with mobile devices typically representing 70% of internet usage in Burkina Faso. Internet connectivity was restored on January 24, 2022, after a 35-hour disruption.

On January 21, 2022, Yemen experienced a country-wide internet outage, likely due to airstrikes that reportedly hit a telecommunications building in Al-Hudaydah. The main state-owned ISP, Public Telecommunication Corporation (AS30873), was significantly affected by the outage. This follows other significant internet disruptions in 2022 for various reasons, including cable problems, unrest, coup plots, and natural disasters.

Tomonari Sato has recently joined Cloudflare as Vice-President and Managing Director in Japan. His role will focus on expanding Cloudflare's customer, partner base, and presence in the country. With a 35-year career in the IT industry, Sato brings extensive experience from various roles in sales and technical aspects of the business. He has previously worked with major technology companies such as AWS, Microsoft, SAP, and IBM. Sato is excited to contribute to Cloudflare's mission of building a better internet globally, including Japan. He believes that there are significant growth opportunities for digital transformation in Japan, which aligns well with Cloudflare's solutions and strategies.

In January 2022, there have been four significant internet disruptions worldwide, including an ongoing outage in Tonga due to a volcanic eruption and subsequent tsunami warnings. The undersea fiber-optic cable connecting Tonga to the outside world may be broken, with repairs potentially taking up to four weeks. This highlights the importance of submarine cables for global internet connectivity, as approximately 99% of data traffic crossing oceans is carried by these cables. Other recent disruptions include an outage in The Gambia due to cable problems and shutdowns in Kazakhstan and Burkina Faso related to unrest and a coup plot, respectively.

Cloudflare has announced that customers on its Free plan can now receive real-time alerts about HTTP DDoS attacks automatically detected and mitigated by the company's systems. Previously, these alerts were available only to Pro plan users or higher. The announcement extends the DDoS alerts feature to Free plan users. Cloudflare's global network of data centers helps detect and mitigate DDoS attacks by routing traffic through its network and analyzing it for potential threats. Once an attack is detected, a real-time mitigation rule is automatically generated to block the attack requests while allowing legitimate user requests to pass through. Users can customize the settings of the mitigation system using the HTTP DDoS Managed Ruleset.

Cloudflare has made an optimization to its Workers runtime that reduces the amount of memory usage for Unbound Workers. The change allows the system to mark application code as "idle" as soon as response headers are returned, reducing the time a Worker is considered "in use" by an average of 70%. This change also applies to WebSocket proxying, reading from the cache, and streaming from KV. As a result, users may see a drop in their billing for these services.

The Three Billy Goats Gruff is a classic children's fairy tale about three goats trying to cross a bridge despite the threat of a troll underneath. In their battle against patent troll Sable Networks, Cloudflare has launched Project Jengo, offering $100,000 in cash prizes for finding prior art related to Sable's patents. Jean-Pierre Le Rouzic, a retired telecommunications R&D engineer from France, won the second round of the contest with his detailed submission addressing vulnerabilities in Sable's patent claims. Additionally, Cloudflare has made progress in fighting back against Sable Networks by seeking to invalidate two of its patents through inter partes review (IPR) proceedings at the U.S. Patent and Trademark Office.

In 2021, there was a significant increase in ransom DDoS attacks and application-layer DDoS attacks, with the manufacturing industry being the most targeted sector. The second half of the year saw record-breaking HTTP DDoS attacks and network-layer attacks observed over the Cloudflare network. China topped the charts as the country with the highest percentage of attack traffic originating from its networks. Ransom DDoS attacks increased by 29% YoY and 175% QoQ, while application-layer DDoS attacks saw a surge in the manufacturing industry. The Business Services and Gaming/Gambling industries were also heavily targeted. Cloudflare's systems automatically mitigated an almost 2 Tbps attack in November, which was a combination of DNS amplification attacks and UDP floods.

In July 2021, Brendan Coll launched Miniflare 1.0, a full-featured simulator for Cloudflare Workers. It has now become an official part of the Workers ecosystem and is integrated into wrangler 2.0. Today, he announces the release of Miniflare 2.0, which is more modular, lightweight, and accurate. The new version supports all features of Workers and includes a live-reload feature and first-class support for testing with Jest. It also provides better integration with wrangler 2.0 and allows users to customize their local environment. Miniflare is highly configurable and can be used with various test frameworks, including AVA. The plugin system in Miniflare 2.0 makes it easier to add support for new features like R2 Storage.

Cloudflare held seven Innovation Weeks in 2021, each focusing on different aspects of their business. Security Week featured foundational security announcements and partnerships aimed at building a more secure internet. Developer Week focused on making developers' lives easier with new features and tools. Impact Week highlighted the company's environmental, social, and governance initiatives. Speed Week showcased how Cloudflare is making the internet faster through performance enhancements and new features. Birthday Week celebrated the company's 11th anniversary with innovative product launches. Full Stack Week brought the vision of a full-stack application to life by providing developers with all necessary tools. Lastly, CIO Week demonstrated how Cloudflare One is helping Chief Information Officers transform their corporate networks and improve security.

On January 5, 2022, Kazakhstan experienced a nationwide internet shutdown amid mass protests against sudden energy price increases. The full shutdown occurred after restrictions to mobile internet access were imposed the previous day. This disruption affected telecommunication companies such as Kazakhtelecom and mobile internet services like Tele2 or Kcell. BGP updates from Kazakhstan's ASNs indicated a clear spike at the time of the shutdown, similar to other state-imposed shutdowns in situations of unrest or elections. The shutdown has impacted communications between families, businesses, media outlets, and Bitcoin mining operations in the country. There have been brief periods of internet restoration coinciding with public announcements by Kazakh President Kassym-Jomart Tokayev, but the shutdown continues as of January 7, 2022.

On January 4, 2022, The Gambia experienced a country-wide internet outage lasting over 8 hours. This was due to "technical issues on the backup links" as explained by Gamtel, the main state-owned telecommunications company in the West African nation. The incident highlights the dependency of The Gambia's internet access on a single provider, Gamtel, and its reliance on terrestrial connectivity via Senegal due to unavailability of international internet connectivity through the ACE submarine cable. The outage also underscores the vulnerability of internet connectivity in many countries that rely on a single network path for their access. The Gambia Public Utilities Regulatory Authority is exploring options for a second fibre cable backup to ensure more reliable internet connectivity in the future.