May 2024 Summaries

In 2023, Cloudflare introduced a new local traffic management (LTM) solution for load balancing HTTP(S) traffic between private or internal servers within region-specific data centers. The company has now extended these LTM capabilities to non-HTTP(S) traffic by integrating Cloudflare Spectrum, Cloudflare Tunnels, and Cloudflare load balancers. This feature is available for enterprise customers and allows them to use Cloudflare load balancers for all TCP and UDP traffic destined for private IP addresses, eliminating the need for expensive on-premise load balancers.

BastionZero, a Zero Trust infrastructure access platform, has joined Cloudflare to extend its Zero Trust Network Access (ZTNA) flows with native access management for infrastructure like servers, Kubernetes clusters, and databases. This acquisition aims to provide user- and device-based policies along with multi-factor authentication to protect infrastructure resources from cyberattacks. The integration of BastionZero into Cloudflare One will help organizations replace not only VPNs but also bastion hosts, SSH, Kubernetes, or database key management systems, and redundant Privileged Access Management (PAM) solutions.

Cloudforce One has published the results of its investigation into a phishing campaign by Russia-aligned threat actor FlyingYeti targeting Ukraine. The campaign capitalized on anxiety over potential loss of access to housing and utilities due to significant debt liability for Ukrainian citizens. FlyingYeti's malware, COOKBOX, was designed to infect targets and allow the actor to control their systems. Cloudforce One took measures to prevent FlyingYeti from launching its campaign, including detections and code takedowns, as well as external collaboration with third parties to remove the actor's cloud-hosted malware. The phishing theme used by FlyingYeti is likely one of many themes leveraged in a larger operation targeting Ukrainian entities, particularly their defense forces.

Cloudflare has announced expanded capabilities for its Regional Services, allowing users to configure data locality and sovereignty across an increased set of defined regions. These new regions will be available for early access starting in late May 2024, with general availability planned for June 2024. The expansion aims to help customers meet their specific requirements for controlling where their traffic is handled while addressing data localization needs and legal obligations. The new offerings include options to restrict inspection of data to certain jurisdictions or exclude it from others, as well as a region committed to powering operations with renewable energy.

Cloudflare has announced the General Availability of its AI Gateway during Developer Week in April 2024. The AI Gateway is an AI ops platform that provides a unified interface for managing and scaling generative AI workloads, acting as a proxy between your service and your inference provider(s). It offers features focused on performance, security, reliability, and observability. Key features available today include analytics, real-time logs, caching, rate limiting, support for popular providers, and universal endpoint. The platform aims to provide a single consistent control plane for all AI models and tools, regardless of changes in the rapidly evolving AI space. Future updates will include persistent logs, custom metadata, prompt management tools, built-in eval functionality, feedback API, and fine tune adapters. AI Gateway is available on all plans with core features offered for free, while premium features may be subject to fees.

The text discusses the challenges of managing consent online and introduces the Cloudflare Zaraz CMP, which simplifies the process by integrating with third-party tools and scripts on websites while respecting user demands. In April 2023, the platform announced compatibility with Interactive Advertising Bureau Transparency and Consent Framework (IAB TCF) requirements and full support for Google's Consent Mode v2 signals. The text also highlights improvements in bot management within Cloudflare Zaraz, allowing users to fine-tune which requests trigger analytics and conversion pixels. These features are available on all plans, including the free plan, making it easier for everyone to benefit from a faster, safer, and more private way to manage third parties online.

Golang 1.20 introduced Profile Guided Optimization (PGO), which allows guiding the compiler to introduce optimizations based on real-world behavior of a system. PGO can lead to CPU usage reductions, freeing up resources for better customer service. The process involves compiling a non-PGO binary and deploying it to production, collecting CPU profiles from the binary in production, and then compiling a second binary using that CPU profile. An example is provided where PGO was used on Cloudflare's "wshim" system, leading to significant CPU usage reductions. Future work includes automating profile collection, refining deployment processes, and implementing further improvements with other optimization techniques.

Cloudflare has announced its plan to transition traffic from its public IPFS gateway to the IPFS Foundation's gateway maintained by the Interplanetary Shipyard team. This move is part of an ongoing effort to support community-owned and managed protocols like IPFS, which was invented at Protocol Labs and incubated there before being transferred to the independent entity called Interplanetary Shipyard in April 2024. The transition will begin on May 14th, 2024, with all traffic using Cloudflare hostnames redirected to ipfs.io or dweb.link until August 14th, 2024. After this date, users must switch their hostname to ensure no service interruption takes place. The transition aims to boost ecosystem collaboration, increase protocol resiliency, and ensure healthy stewardship and governance.

On May 12, connectivity issues in East Africa were caused by disruptions to the ESSAy and Seacom submarine cables. This followed earlier cable cuts on February 24 that affected countries including Tanzania, Kenya, Uganda, and Mozambique. The recent cable faults led to varying degrees of traffic reduction across these nations. While some providers like Safaricom and Airtel Kenya have implemented redundancy measures to minimize service interruption, the overall impact on Internet connectivity remains significant. Repairs are expected to be completed in several days once permits are secured and cable faults located.

Cloudflare has partnered with the United States Department of the Treasury and the Pacific Northwest National Laboratory (PNNL) to create Custom Indicator Feeds that enable customers to integrate approved threat intelligence feeds directly into Cloudflare's platform. This initiative not only supports the federal effort to strengthen cybersecurity within critical infrastructure, including the financial sector, but also contributes directly to the ongoing improvement of shared security capabilities. The partnership offers financial institutions privileged access to threat data that was previously exclusive to the government and enables them to create DNS filtering policies through Cloudflare's Gateway product that leverage threat data directly from these government bodies.

In April 2020, a blog post discussed running COBOL on Cloudflare Workers by compiling to WebAssembly. Since then, the ecosystem around WebAssembly has grown significantly, enabling more languages to compile to WebAssembly for execution on servers and in browsers. Recently, work on LLVM has enabled Fortran to compile to WebAssembly. This allows Fortran code to run on Cloudflare Workers using a tool called Fortiche, which uses Flang and Emscripten under the hood. Despite its age, Fortran is still widely used for scientific applications due to its native functionality for arithmetic and handling large arrays and matrices.

Cloudflare has introduced a new suite called "Unified Risk Posture" to help enterprises manage their cybersecurity risk across an expanding attack surface. The platform evaluates risks posed by people and applications, exchanges risk indicators with best-in-class partners, and enforces automated risk controls at scale. This approach helps protect more of the attack surface while reducing security operations effort. Key use cases include enforcing Zero Trust with an expanded CrowdStrike partnership, protecting apps, APIs, and websites, and safeguarding sensitive data using user entity and behavior analytics (UEBA) models.