January 2025 Summaries

Cloudflare's network spans over 330 cities in more than 120 countries, providing a unique perspective on Internet resilience. The company observed government-directed Internet shutdowns, including protests and maintenance efforts, as well as power outages caused by natural disasters such as hurricanes and earthquakes. Terrestrial cable cuts also impacted connectivity in two African countries. Unexpected issues with maintenance efforts caused outages at two European providers, while Verizon customers in several US states experienced a brief but unexplained outage. The company's monitoring revealed that resilient Internet connectivity helped minimize the impact of submarine cable cuts and other disruptions.

Cloudflare has successfully completed audits against the Global Cross-Border Privacy Rules (Global CBPRs) for data controllers and the Global Privacy Recognition for Processors (Global PRP), making it the first organization to announce completion of these global standards. This achievement demonstrates Cloudflare's support and adherence to global privacy-respecting data flows across jurisdictions, providing reassurance to customers that its privacy practices are recognized by governments worldwide. The company has been an ardent supporter of the free flow of data across jurisdictional borders and has added its fourth and fifth privacy validations, with the Global CBPRs and Global PRP being the latest additions. Cloudflare's participation in these global standards covers a range of requirements, including notice, choice, collection limitation, security safeguards, and accountability, which are consistent with the core principles of the Organisation for Economic Co-operation and Development (OECD) Guidelines on the Protection of Privacy and Trans-Border Flows of Personal Data. The company's commitment to transparency, data minimization, and accountability is reflected in its implementation of an information security program and its use of a customer data processing addendum with vendors handling personal information.

Cloudflare's network provides an enormous array of services to its customers, collecting and delivering associated data in the form of event logs and aggregated analytics. The company's data pipeline is designed to handle up to 706M events per second, representing a 100x growth since 2018. To efficiently process this high volume of data, Cloudflare employs various techniques, including downsampling, which involves reducing the amount of data while retaining valuable information. Downsampling allows for the retention of information from more than half a billion events per second, even when some data must be dropped. The pipeline uses a combination of hardware and software to achieve this, including a robust system for estimating the "blur" or loss of detail in downsampled data. Additionally, Cloudflare's analytics APIs provide customers with confidence intervals for their data, allowing them to build dashboards with accurate estimates and confidence bands. Despite the challenges of scaling its data pipeline, Cloudflare continues to work on improving its systems to ensure they remain resilient and useful to its customers.

January marks International Holocaust Remembrance Day, a solemn occasion to honor the memory of six million Jews who perished in the Holocaust. The United Nations General Assembly designated this day as a reminder of the catastrophic consequences of prejudice and extremism. Cloudflare has begun publishing annual reports on cyberattacks targeting Jewish and Holocaust remembrance websites, with a significant rise in antisemitic incidents worldwide. These attacks have surged since the October 7, 2023, Hamas-led attack, with over 10,000 reported incidents in the U.S. alone. Cloudflare's Project Galileo initiative provides free security protections to vulnerable groups, including Muzeon, a museum dedicated to preserving Jewish history. The organization has seen drastic reductions in cyberattacks after implementing Cloudflare's solutions, allowing it to focus on its mission and expand its interactive exhibits.

The Cloudflare DDoS Threat Report for Q4 2024 highlights an increase in hyper-volumetric network layer DDoS attacks, with the largest attack breaking a previous record at 5.6 Tbps. This rise is attributed to powerful botnets and geopolitical factors, making capacity-limited cloud DDoS protection services obsolete. The report also notes a surge in Ransom DDoS attacks, with 12% of targeted customers reporting being threatened or extorted for ransom payments. China maintained its position as the most attacked country, followed by Philippines and Taiwan. The Telecommunications, Service Providers and Carriers industry emerged as the most attacked industry, while Internet and Marketing and Advertising industries were in second and third place respectively. Cloudflare's 321 Tbps network spanning 330 cities globally remains committed to providing unmetered DDoS protection against current and emerging threats.

The United States ban on TikTok went into effect on January 19, 2025, with DNS traffic to TikTok-related domains dropping by as much as 85% compared to the previous week. After a 14-hour shutdown, TikTok announced it was starting service restoration following assurances from Donald Trump, and DNS traffic began to recover slightly. However, traffic from ByteDance's network in the US never fully recovered, remaining around 80% below pre-shutdown levels. Meanwhile, RedNote (Xiaohongshu) alternatives have been steadily increasing in DNS traffic since January 13, with a surge of up to 291% on January 19, and also showing growth in other countries such as Mexico, Brazil, France, Germany, Canada, Spain, Portugal, the UK, Australia, Japan, and others.

The US ban on TikTok went into effect on January 19, 2025, with a clear impact on DNS traffic to TikTok-related domains starting after 03:30 UTC. The ban was part of the "Protecting Americans from Foreign Adversary Controlled Applications Act," which ordered ByteDance to divest due to alleged security concerns. Following the ban, DNS traffic for TikTok alternatives such as RedNote surged in the US and other countries including Mexico, Canada, UK, Germany, and France. The surge was consistent with apps like RedNote rising on top of the Android and iOS App Stores. On January 20, 2025, after a partial shutdown, TikTok announced it was beginning service restoration following assurances from President-elect Donald Trump, and DNS traffic began to recover slightly.

Cloudflare has committed to securing its software systems through its participation in the United States Cybersecurity and Infrastructure Agency's (CISA) Secure-by-Design pledge. The company aims to reduce entire classes of vulnerabilities by implementing a proactive detection and prevention strategy, which includes building secure defaults, leveraging automation, and empowering developers. Cloudflare's focus on addressing vulnerability classes such as injection and secrets has led to significant reductions in these types of threats, with notable decreases in secrets in code and potential SQL injection and code injection vulnerabilities. The company will continue to mature its security practices, including providing secure frameworks, threat modeling at scale, and integrating automated security tooling into the software development lifecycle. By following CISA's principles, Cloudflare is committed to creating resilient systems where security is not just a feature but a foundational principle.

The Cloudflare developer documentation team treats developer content like a product, iterating and refining it based on user feedback. They approach their documentation similarly to how an open source software project is created and maintained, making both the content and framework publicly accessible for contributions. This transparency fosters collaboration, learning, and innovation among developers. The team has recently migrated from Gatsby to Astro, a new custom documentation engine that brings significant improvements, including faster development flow, custom components, structured changelog management, improved performance, enhanced content organization, extensibility, development experience, JavaScript/TypeScript support, CSS management, and content collections. The migration was nearly twice as large as the previous one, but with careful planning and coordination, it resulted in removing a net 19,624 lines of code from maintenance burden and was a major success without downtime or rollbacks.

MPTCP (Multi-Path TCP) is a major extension to the TCP protocol, designed to exploit multi-path opportunities in end-to-end communication. It allows devices with multiple interfaces, such as mobile phones, to establish multiple paths for data transmission, improving reliability and performance in scenarios like mobility or network congestion. MPTCP has had a long history of development but faces challenges in implementation, particularly in creating practical use cases beyond Linux server and macOS/iOS client configurations. The current state of MPTCP is promising, with improvements in path management, scheduler, and BPF extensions, but its adoption remains limited compared to other TCP extensions like QUIC.

Cloudflare's Stream Live accepts audio/video content from broadcasters and delivers it to viewers around the world in real-time through the Cloudflare network. The service leverages the distributed nature of Cloudflare's network, with ingest and delivery happening at multiple data centers worldwide. Stream Live ingests content using protocols such as RTMPS, SRT, or WHIP, which define how content is packaged and transmitted. Once ingested, content is handled by a Spectrum application that exposes listening ports to specific broadcasters, forwarding connections to an ingest service running on the same server. The ingest service uses Durable Objects to store customer configuration and broadcast state, allowing for geographically distributed broadcasts while maintaining high availability. Content is then delivered to viewers through HLS or DASH playlists, which contain segment metadata for progressive downloading. A Cloudflare Worker called delivery-worker handles all requests for Stream content, rendering playlists and performing various functions. On-the-fly encoding by OTFE (on-the-fly-encoder) service encodes segments in real-time based on viewer request formats, optimizing power and CPU usage. The service is built on top of the Cloudflare network, utilizing tiered caching and request coalescing to support multiple viewers simultaneously.