Cloudflare One's AI offerings are converging into a unified control plane, integrating Workers AI and AI Gateway. This unification provides a single entrypoint (Workers binding and REST API) for accessing various AI models, including those hosted on Cloudflare's infrastructure (Workers AI) and external providers. The unified control plane offers automatic observability, logging, and cost attribution for all AI inference traffic, even for users who haven't explicitly configured an AI Gateway. New multimodal models like Clef-omni are being integrated, offering audio, video, image, and text input. Clef-flash has been made cheaper with a reduced context window, and Clef has seen performance improvements through serving infrastructure optimizations. Models are built on Qwen3-Omni-30B-A3B-Instruct mixture-of-experts (MoE) foundations, utilizing LoRA for training and Brier score calibration for robustness. Benchmarking shows competitive performance across various tasks and modalities.
Cloudflare's observability platform has evolved to unify logs, traces, analytics, alerts, dashboards, and exporting into a single, integrated experience. This includes a unified SQL API for querying diverse data sources (HTTP events, firewall events, Workers, Containers, R2, AI Gateway, analytics), end-to-end tracing from edge to origin, custom alerts based on SQL queries or anomalies, 30 days of domain analytics retention, and Logpush availability on all self-serve plans. The platform aims for comprehensive debugging and performance analysis, now including on-demand CPU and memory profiling for Workers and Durable Objects via flamegraphs, enabling detailed inspection of function-level resource usage in production.
Cloudflare Workers has evolved to support self-hosting via the integration of Deno's celld and Cloudflare's workerd. This unification aims to make it radically easy to build and operate distributed applications on developers' own infrastructure, leveraging primitives like Durable Objects, Queues, KV, and Durable Execution. The combined effort focuses on simplifying the management of distributed systems, including compute, relational databases, queues, and real-time communication, with object storage as the primary external dependency for celld.
Cloudflare Radar provides real-time tracking of global Internet traffic patterns, enabling the monitoring and analysis of Internet shutdowns, traffic mix changes, and country-specific data. This includes detailed views for domains and IP addresses, and the ability to analyze TCP connection resets and timeouts to infer network behavior and potential filtering or tampering. The platform's capabilities are used to corroborate external reports of network events, such as IP unblocking and firewall te
This redesign focuses on making Radar more accessible to a wider audience by introducing a map-based interface for global traffic and outage visualization, and a tabbed flow for guided data exploration. The design language is unified with Cloudflare's brand, blending marketing, content, and product experiences. Future work will focus on tools, visualizations, and storytelling frameworks to empower users with real-time insights across security, performance, and traffic.
Cloudflare OS, an open-source agent workspace, is now available as a fully managed deployment option. New capabilities include mounting existing Git repositories for agents to work with code, improved integration with Google Workspace (Gmail, Drive, Sheets, Calendar) via a Gatekeeper service, and enhanced export options for documents, presentations, and spreadsheets to common formats like .xlsx, CSV, PDF, Markdown. The AI agent harness for security operations speeds up data gathering, aggregation of detections, and accounting for missing sources, using specialist AI agents for traffic analysis, customer context, global telemetry, and threat intelligence. It leverages Clef for triage and decision-making, Workers AI for agentic reasoning, Workflows for orchestration, D1 for state persistence, R2 for evidence storage, and Durable Objects for case-chat state.
Cloudflare's DNS infrastructure has evolved to include Internal DNS, providing a unified platform for managing both public and private DNS resources. This integrates authoritative and recursive DNS for private networks onto Cloudflare's global network and control plane, simplifying split-horizon DNS, extending Zero Trust policies to DNS, and modernizing legacy infrastructure by retiring hardware appliances and cloud-locked resolvers. The system comprises a Gateway Resolver for recursive resoluti
Cloudflare One's Connectivity Cloud Platform continues to evolve by enabling hostname-based routing for Cloudflare Tunnels, allowing for the creation of Zero Trust and egress policies based on hostnames rather than IP addresses, simplifying management and enhancing security. This capability extends to both private and public applications, and supports granular access control for specific resources. The platform also enhances outbound traffic control by allowing policies to be defined based on ho
Cloudflare's privacy-preserving infrastructure continues to expand with the introduction of the Cloudflare OHTTP Gateway. This managed service, deployed globally across Cloudflare's network, allows customers to receive Oblivious HTTP (OHTTP) traffic, enabling app servers to receive HTTP requests without seeing user IP addresses or TLS fingerprints. This complements the existing Cloudflare OHTTP Relay, offering a choice between self-hosted or managed gateways. The OHTTP Gateway integrates seamlessly with existing zones, intercepting OHTTP requests to a `/.well-known/ohttp-gateway` endpoint, decrypting them, issuing subrequests to app servers, and returning encrypted responses. It supports both standard and chunked OHTTP, with a focus on minimizing latency and operational overhead for developers. This evolution aims to make privacy-preserving infrastructure more accessible and easier to adopt.
Cloudflare One's capabilities for identifying and controlling AI agent traffic (MCP) have evolved. This includes detecting MCP traffic based on protocol signals beyond simple hostnames/paths, distinguishing between approved MCP Portals and unmanaged connections, and providing granular controls at the client, network, and server levels. New features allow for the identification of MCP traffic even when it bypasses standard hostnames/paths, and enforce access policies based on protocol headers and
Cloudflare K2 is a new durable event streaming primitive on the Developer Platform, built on R2 object storage. It implements a partitioned, durable log for high-scale data movement, long-term retention, and fan-out consumption. K2 offers serverless operation, scales to vast quantities of data, and supports long-term retention. It differs from Queues by focusing on batch processing for high-scale data movement and fan-out consumption, whereas Queues are designed for tracking individual items of expensive or time-consuming work with message-level retries. K2's produce latency is approximately 1 second at the 99th percentile due to batching and writing to object storage. Future plans include higher write parallelism, message keys, push-based worker consumers, and Kafka client support.
Cloudflare's configuration distribution system has evolved from a custom-built system (Quicksilver) to address limitations in scalability, performance, and reliability. Quicksilver v1.5 introduces a proxy/replica model to reduce disk space usage by caching hot keys on disk instead of replicating the full dataset everywhere. This design faces challenges with consistency due to asynchronous replication and is being addressed with Multiversion Concurrency Control (MVCC) to maintain sequential consistency. Workers KV Instant now leverages Quicksilver for instant global replication of key-value data, offering significantly faster reads and writes compared to classic Workers KV, with a pricing model optimized for read-heavy workloads.
Cloudflare's security posture continues to evolve with the integration of post-quantum cryptography primitives into Cloudflare Workers' Web Crypto API. This enables developers to experiment with and integrate ML-KEM and ML-DSA algorithms, providing building blocks for future secure protocols like HPKE and OHTTP. The implementation leverages BoringSSL and adds support for `getPublicKey()` and `SubtleCrypto.supports()` for better interoperability. Future work may include broader algorithm support and protocol-level integrations.
Cloudflare Artifacts, a versioned filesystem designed for agents, is now in open beta. New capabilities include connecting Artifacts repositories to Workers for automated builds and deployments, managing Artifacts directly from Workers via bindings, subscribing to repository events for workflow automation, and choosing data jurisdiction (US or EU). Metrics for repository operations are now available in the dashboard and via API. Pricing based on operations and storage will commence October 15, 2026. A competition is being held to encourage the development of next-generation Git platforms on Cloudflare using Workers and Artifacts.
Cloudflare Basin is a serverless data analytics platform built on Apache Iceberg and R2 Object Storage. It includes Basin Pipelines for event ingestion and transformation, Basin Catalog for managing Iceberg metadata and performing automatic maintenance, and Basin SQL for serverless querying of Iceberg tables. The platform emphasizes speed, openness, and cost efficiency, with usage-based pricing and zero egress fees. Future plans include custom partitioning, schema migrations, support for Iceberg V3, and enhanced jurisdiction controls.
Cloudflare's API management has evolved to enforce positive security policies for web applications and APIs through Application Profiles. This feature analyzes traffic structure and format to identify deviations from learned expected request patterns, allowing for the creation of rules to block non-conforming requests. It extends existing API security capabilities by applying schema learning and validation to web assets, providing an always-on detection layer that enriches requests with metadata. The Monetization Gateway further enhances API management by enabling per-use charging for API access, leveraging the HTTP 402 status code and stablecoin transactions for agent-native payments. This allows for flexible pricing schemes and direct payment settlement for API consumption, aligning business models with agent consumption patterns.
Cloudflare Registrar API is now in beta, enabling programmatic domain search, availability checks, and registration. This is designed for agentic workflows and automation, allowing developers to integrate domain purchasing directly into their development environments. Future expansion will include management features like transfers and renewals, aiming for a registrar-as-a-service offering. The new domain search experience provides a faster, more comprehensive way to explore domain possibilities across all supported extensions, with improved filtering, sorting, and transparent pricing. The API has been expanded with a sandbox environment and support for domain transfers, and is integrated with Cloudflare MCP and the cf CLI for agentic workflows.
Cloudflare One's AI offerings are converging into a unified control plane, integrating Workers AI and AI Gateway. This unification provides a single entrypoint (Workers binding and REST API) for accessing various AI models, including those hosted on Cloudflare's infrastructure (Workers AI) and external providers. The unified control plane offers automatic observability, logging, and cost attribution for all AI inference traffic, even for users who haven't explicitly configured an AI Gateway. New features include Threat Signals, which automates the ingestion and processing of open-source threat intelligence reports into actionable indicators and threat events, making this capability available to all Cloudflare accounts.
Cloudflare is becoming a public Certificate Authority (CA), aiming to provide free, automated certificates with wide compatibility. This involves acquiring an established root from GlobalSign for immediate reach and developing a new root for future compatibility, including post-quantum certificates. The CA will be ACME-first, support Merkle Tree Certificates (MTCs) for post-quantum security, and emphasize transparency, resilience, and fail-small principles in its operations. Cloudflare will act as a CA and a Mirroring Cosigner for other CAs, and will support MTC issuance for classical and post-quantum certificates. The issuance process involves batching certificates into an append-only Merkle tree, where the CA signs the root of the tree. Clients verify certificates using a compact inclusion proof against a signed tree head. The CA operates issuance and mirroring software stacks, and will fork Boulder for ACME support. Mirroring cosigners durably store a copy of the CA's issuance log and verify its consistency. Chrome's Quantum-resistant Root Program draft policy mandates at least two cosignatures: one from a Chrome-recognized Mirroring Cosigner operated by a distinct organization, and one from the issuing MTC CA itself.
Cloudflare's Universal SSL has evolved to include Automatic Key Exchange, an extension of Automatic SSL/TLS. This feature probes origin servers to determine their supported key agreement algorithms and prefers post-quantum hybrid algorithms like X25519MLKEM768 where supported. This reduces HelloRetryRequests, cutting connection handshake latency by over 150 ms at p90, and enables automatic post-quantum secure origin connections without manual configuration. This post extends this by introducing post-quantum (PQ) cryptography visibility tools into Cloudflare's Application Security and Logs products, allowing customers to inspect and graph the adoption of post-quantum TLS 1.3 encryption for live traffic from directly within Logpush, Log Explorer, and the HTTP Traffic Analytics dashboard. This provides granular, per-connection telemetry to audit post-quantum posture, assess compliance, and identify cryptographic gaps across domains.
Cloudflare One's security posture management capabilities have evolved to provide real-time discovery and inventory of assets and documents across SaaS and web applications. This includes continuous asset-aware threat detection and risk assessment, with prioritized remediation suggestions. For SaaS applications, a dynamic and real-time data collection pipeline using Cloudflare Workers, R2, and Queues has replaced batch crawlers to ingest vendor webhook events, providing near real-time insights. The WAF has been enhanced with AI-driven testing to identify and mitigate new attack vectors, including those generated by frontier AI models, leading to the creation of new detections and hardening of existing rules.
Cloudflare's API definition strategy has evolved to support gRPC over HTTP/2, enhancing security, reliability, and performance for gRPC APIs. This builds upon previous efforts to define APIs using JSON-REST and Protocol Buffers. The CLI tooling is being unified under a new schema-driven code generation pipeline to support all Cloudflare products, with a technical preview of `cf` and a new Local Explorer feature for local development. The new `cf` CLI is designed for agentic development, offering a fresh approach to generating SDKs, CLIs, docs, and libraries through an open-source, pluggable pipeline called Forge. Forge enables preview builds for every pull request, supports chaining of generation targets, and facilitates API versioning without breaking old clients. It aims to empower developers to own and control their API generation processes.
Cloudflare's understanding of website performance metrics has evolved to go beyond basic Time To First Byte (TTFB). This includes detailed analysis of client-side timing measurements from tools like cURL and Chrome, mapping them to network events like DNS lookup, TCP handshake, and TLS setup. The focus is shifting towards measuring the actual user experience, considering factors like page interactivity and resource loading, rather than just the initial byte arrival. Browser Insights provides Real User Monitoring (RUM) data, and the BEACON dataset expands this by providing billions of real-world performance measurements across 10,000 of the largest websites, updated daily in Google BigQuery. BEACON reports Core Web Vitals (LCP, CLS, INP) as full histograms, allowing for percentile analysis. It also includes LCP and INP sub-parts to separate loading and interaction stages, and analyzes the impact of application architecture like single-page applications (SPAs) with soft navigations. Researchers can combine BEACON with other datasets, such as GDP per capita, to explore correlations between economic conditions and web performance. Cloudflare Radar will integrate BEACON data into its Web Performance section, correlating Internet Quality Index (IQI) with website performance.
Cloudflare's engineering blog has explored advanced programming techniques, particularly focusing on compile-time code generation and metaprogramming. This thread began with an in-depth look at Rust's powerful macro system, demonstrating how to implement complex logic like Reverse Polish Notation (RPN) evaluation directly at compile time. This capability allows for significant performance optimizations and the creation of highly specialized code without runtime overhead. More recently, Cloudflare has integrated VoidZero, a team focused on open-source JavaScript toolchains like Vite, Vitest, Rolldown, and Oxc. This integration has led to significant performance improvements in these tools, including a 10x faster React Compiler (Oxc), up to 50% faster Vitest, 18x faster tsgolint, and 7x faster Oxfmt. The development of Vite+ 1.0 unifies these tools with great defaults, and progress is being made on "Bundled Dev" for faster development servers in large applications. Cloudflare's commitment to open source is further demonstrated through ecosystem funds and ongoing contributions.
Cloudflare Pages has evolved to support headless CMS integrations through Deploy Hooks, enabling automated deployments triggered by content updates. This enhances the developer experience by decoupling content management from code deployments and allows marketing teams to update sites autonomously. Partnerships with Sanity, Strapi, Contentful, and WordPress are highlighted, with ongoing efforts to build further integrations. Deploy Hooks allow external services to trigger site builds on Pages via
EmDash 1.0 is a stable, free, and open-source CMS built on Astro, ready for production websites, agency platforms, and hosting company site-building experiences. It integrates editorial, media, localization, migration, and deployment workflows. A decentralized plugin registry allows developers to publish without central marketplace ownership, and site owners can discover and install plugins directly from within EmDash. Key features include production-tested editorial workflows, media management, localization, migration, and deployment capabilities. Performance optimizations include KV object caching, Hyperdrive database adapter, and Workers Cache compatibility, spawned from the Cloudflare Blog migration project. The plugin registry is built on AT Protocol, enabling decentralized publishing and discovery.
Cloudflare's security posture management has evolved to include advanced vulnerability discovery and remediation techniques. This includes leveraging AI-assisted systems for vulnerability discovery, enhancing static analysis tools with custom rulesets, and implementing robust Linux kernel security modules with eBPF. The company is also actively working to reduce entire classes of vulnerabilities through secure-by-design principles and by addressing specific kernel vulnerabilities like those found in traffic control and connection tracking. Furthermore, Cloudflare has enhanced its container security by addressing cross-tenant data exposure vulnerabilities in its Containers and Sandboxes services, which involved understanding and mitigating issues with Linux device mapper thin provisioning and block zeroing behavior. The company has also invested in fuzzing the Linux kernel, particularly its Netlink machinery, to proactively identify and fix potential security flaws.
Cloudflare's cache management has evolved to offer all purge methods (URL, hostname, tag, prefix, everything) to all customers, enabled by a rebuilt "Instant Purge" pipeline. This pipeline utilizes RocksDB-based "CacheDB" alongside cache proxies for active purging, reducing storage requirements by 10x and improving cache hit ratios. Rate limits have also been increased across plans, with Enterprise customers receiving significantly higher throughput. Future work includes optimizing single-file purge performance and enhancing filtering techniques.
Cloudflare's platform is expanding to offer a comprehensive CI/CD solution, integrating code storage (Artifacts), build/test/deploy pipelines (Workflows, CI SDK), and self-healing capabilities powered by AI agents. This allows for platform-managed or custom CI pipelines, running code in isolated sandbox environments with dependency caching and automated deployment upon successful builds. The integration aims to simplify the developer experience for managing millions of repositories. Workers Build
Cloudflare One's account access management and permissions have evolved to support granular controls for Workers and other Developer Platform products. This includes new roles (Metadata Read-Only, Content Read-Only, Editor, Admin) that can be applied at the Developer Platform, Product, or Resource level. These roles allow for fine-grained access control for both human users and agents, ensuring least privilege access. This system is being extended to other Developer Platform products like D1, R2. The integration with Okta for sharing user risk scores allows for dynamic enforcement of access policies based on real-time risk assessments, enhancing Zero Trust principles by incorporating rich context into access decisions.
Cloudflare Workers has evolved its security model to address side-channel attacks like Spectre and improve the isolation of customer code. This includes leveraging hardware-assisted memory protection keys to isolate V8 heaps between isolates, achieving a 92% protection rate against data leakage. Additionally, the V8 sandbox, a software-based security boundary, is being adopted to prevent memory corruption attacks from escalating. This involves using compressed pointers and removing pointers from the heap to thwart buffer overflow and other memory corruption vulnerabilities, aiming for 100% protection against certain attack vectors.
Cloudflare's BGP traffic engineering has evolved to leverage AS-SETs for improved route validation and filtering. The platform now provides public visibility into AS-SET memberships via Cloudflare Radar, enabling network operators to monitor their own and others' AS-SET configurations. This enhances the ability to prevent route leaks by ensuring that only authorized prefixes are propagated. Future developments include pushing for adoption of RFC9234 and ASPA for more authoritative provider authorization. This post details an incident where a BGP hijack and route leak of the 1.1.1.1/32 and 1.1.1.0/24 prefixes respectively caused temporary unreachability and high latency for users of the 1.1.1.1 DNS resolver. The incident highlights the ongoing challenges with BGP security despite RPKI adoption and the need for improved detection and prevention mechanisms.
Cloudflare's DDoS mitigation architecture has evolved to incorporate an anomaly detection pipeline that builds statistical models to flag unusual traffic patterns. This system uses a multi-dimensional approach, analyzing features beyond just traffic volume, and employs techniques like Principal Component Analysis (PCA) and Mahalanobis distance to create a spherical representation of normal traffic. This allows for global tuning of anomaly detection thresholds, enabling protection against novel and evolving attack vectors. The Q1 2024 report indicates a significant increase in overall DDoS attacks, particularly DNS-based attacks, and highlights new attack vectors like HTTP/2 Continuation Flood, while also noting the continued prevalence of Mirai variants. Cloudflare's advanced defense systems, including the new Advanced DNS Protection system, continue to mitigate millions of attacks.
Cloudflare is launching a Billable Usage API for self-serve accounts, providing programmatic access to usage and cost data broken down by product and service period. This API aims to offer visibility for automated systems and FinOps toolchains, with plans for real-time data, forecasting, and enterprise coverage. The initial release aligns with the FinOps Open Cost and Usage Specification (FOCUS) naming conventions and includes a partnership with Vantage for integrated cost management.
Cloudflare Stream has evolved to offer first-class portrait (vertical) video support, automatically processing newly uploaded or ingested portrait videos in full HD quality. This addresses a previous limitation where portrait videos were encoded with lower quality dimensions, leading to a grainy appearance on portrait-first devices. The encoding pipeline has been updated to use a constrained target width for portrait videos, generating resolutions from 240x426 up to 1080x1920. This change impacts the Stream API service, the on-the-fly encoding pipeline (hosted on Cloudflare Workers), and the Stream player's quality selection labels. Post-release, a bug causing negative bitrates for some portrait livestream renditions and another causing download failures for very small videos were identified and fixed. The PSNR metric shows an increase in quality up to 8% for portrait videos.
Cloudflare's cdnjs platform has evolved its security posture and operational architecture by migrating its entire ecosystem to Cloudflare's Developer Platform. This includes leveraging R2 for single source of truth file storage, KV for metadata, Workers Cache for tiered caching, and Cloudflare Workflows for a robust, durable ingestion pipeline. The migration addresses previous pain points in observability, storage split-brain, pipeline orchestration, and GitHub repository limitations, leading to improved reliability and reduced operational complexity.
Cloudflare's global network has expanded to include new data centers and increased server capacity across existing locations, enhancing performance and reliability for users worldwide. This expansion aims to reduce latency, improve bandwidth availability, and provide regional redundancy by deploying infrastructure closer to end-users. The addition of new locations and increased capacity contributes to handling growing traffic demands. The network now exceeds 500 Tbps of external capacity, with a focus on building out regional backbones to reduce traffic tromboning and support data localization.
Cloudflare is developing Meerkat, an experimental global consensus service powered by the QuePaxa algorithm. This service aims to provide strongly consistent and highly available control-plane state management across its distributed data centers, overcoming limitations of traditional leader-based consensus algorithms like Raft in wide-area networks. Meerkat will initially manage small pieces of control plane state, such as leadership for replicated databases, and will be kept internal-only.
Cloudflare Workers now supports direct integration with PostgreSQL databases, enabling developers to build serverless applications with familiar relational database backends. This integration leverages Hyperdrive for global connection pooling and caching, and PostgREST for exposing PostgreSQL functionality as a REST API. Hyperdrive has evolved to support Postgres protocol-level named prepared statements, improving performance and developer experience by caching query execution plans and handling session scope complexities.
Cloudflare Workflows, a serverless durable execution engine for building long-running, multi-step applications on Workers, is now Generally Available. It offers production-ready reliability with step-based architecture, automatic retries, and state persistence. New capabilities include the `waitForEvent` API for human-in-the-loop interactions and AI agent integration. Pricing now includes storage costs for persisted state, with a grace period for the new storage charges. Workflows continue to scale and evolve with new features.
Cloudflare's process management and graceful upgrades have evolved with the introduction of udpgrm, a lightweight daemon that leverages Linux's SO_REUSEPORT API and eBPF for stateful flow tracking to enable zero-downtime restarts for UDP servers. This addresses the challenges of migrating flow state for stateful UDP protocols like QUIC, WireGuard, and SIP, which were previously difficult to handle gracefully. udpgrm manages the complexity of socket generation, flow dissectors, and eBPF program installation, allowing server processes to focus on their core logic.
Cloudflare's Apps program has evolved from offering simple integrations to a robust platform for third-party tools and services. Initially focused on enhancing websites, it expanded to include a more organized dashboard and acquired Eager. The program has now integrated with Cloudflare Workers, enabling developers to build and package serverless applications, creating the world's first serverless Apps platform. This evolution includes enabling codeless integrations for complex security solutions.
Cloudflare is developing Oxy, a next-generation, Rust-based proxy framework designed to handle high-load scenarios and support a wide array of communication protocols. This includes exploring and implementing MASQUE (Multiplexing And Secure Communication over QUIC Express) to enable efficient tunneling of UDP traffic over QUIC, building on the DATAGRAM frame extension and extended CONNECT requests. This allows for proxying of protocols like HTTP/3 and other UDP-based applications, with consideration for kernel bypass techniques and efficient data handling. The Images service utilizes hyper, an open-source HTTP library for Rust, for managing socket connections and handling data flow between services. Debugging efforts focused on a race condition within hyper's buffer management when handling large responses, leading to data truncation. The investigation involved deep system-level tracing with strace to understand syscall behavior during successful and failing requests, ultimately identifying a timing-sensitive race condition in hyper's buffer flushing mechanism that occurred under high concurrency and large data loads. A four-line code fix was implemented to address the issue.
Cloudflare's DMARC Management has evolved to general availability with a redesigned experience focused on simplifying the path to full DMARC enforcement. This includes deeper report visibility with source investigation, an email authentication record status view, and an SPF lookup audit. The platform aims to provide self-service tools for understanding and improving DMARC posture, mitigating deliverability penalties, and protecting against brand impersonation.
Cloudflare's Email Service, encompassing Email Routing and Email Sending, is now generally available. Email Sending allows developers to send transactional emails directly from Cloudflare Workers, integrating seamlessly with the Developer Platform. It automatically configures DNS records (SPF, DKIM, DMARC) for improved deliverability and offers global low-latency delivery. Developers can use the `Email` binding for secure credential management, process incoming mail with Workers, and leverage `wrangler` for local emulation. Observability features include bounce rates and delivery events. The service supports REST APIs, SMTP, and rich HTML emails via frameworks like React Email. Email Routing enables programmatic handling of incoming messages with Workers, facilitating AI-powered parsing, ticket creation, and attachment processing. The unified service closes the loop for application email needs, with Email Sending requiring a paid Workers subscription and charging based on messages sent.
Cloudflare Spectrum now supports load balancing traffic to private IP endpoints, extending Layer 4 load balancing capabilities to non-HTTP(S) TCP and UDP traffic destined for private networks. This integration with Apollo and Director allows for secure, private origin access via Cloudflare Tunnels, eliminating the need for on-premise hardware and enhancing security by keeping origins inaccessible from the public internet. Future enhancements include support for authenticated device traffic and internal-only traffic.
Cloudflare Mesh extends Cloudflare One's SASE and Zero Trust suite to provide secure, bidirectional private networking for users, nodes, and autonomous agents. It integrates with the Cloudflare Developer Platform, allowing Workers and Durable Objects to access private infrastructure directly. Mesh leverages existing WARP Connector and Client infrastructure, now rebranded as Mesh nodes and Cloudflare One Client respectively, to create a unified private network. Existing Gateway policies, Access r
Cloudflare's hardware infrastructure and performance optimization efforts have evolved to include strategic adoption of new server generations (Gen 12) featuring increased CPU core counts (AMD EPYC 9684X Genoa-X), improved memory capacity and bandwidth (DDR5), faster NVMe storage, and enhanced networking capabilities (25 GbE NICs). This evolution focuses on maximizing compute density and performance per watt to handle growing traffic demands and reduce data center expansion costs. The Gen 12 servers offer a 145% performance improvement and 63% power efficiency improvement over Gen 11 servers. The design also incorporates hardware root of trust (HRoT) and modular baseboard management controllers (OCP DC-SCM) for enhanced security and vendor-agnosticism, supporting openBMC. A multi-vendor strategy is employed to mitigate supply chain risks.
Cloudflare's Linux kernel upgrade process has evolved to be more consistent and automated across its network and control plane infrastructure. This includes a standardized monthly Edge Reboot Release cycle for the network and the development of Reboau for automated, rack-aware reboot logic in the Control Plane. The company is also leveraging live patching for faster critical security updates and has implemented robust testing and phased rollout strategies to ensure security and reliability.
Cloudflare's TCP congestion control algorithms have evolved to be more responsive to the dynamic and often sporadic nature of network congestion, particularly on mobile networks. By analyzing real-world network data from its global network, Cloudflare tunes its algorithms on a per-network basis to optimize performance, especially for networks experiencing high loss rates. This continuous tuning based on network growth and data analysis is core to Cloudflare's mission of building a better Internet. This post details how Cloudflare leverages its massive Free Plan user base and passive log data, combined with Real User Measurement (RUM) data, to extrapolate and predict user experience, enabling more fine-grained optimization of congestion control algorithms beyond the lifetime of a single connection. Early results show performance increases averaging 10% faster than the prior baseline, with ongoing rollout to all customers planned.
Cloudflare Pages has significantly improved its build infrastructure, reducing build initialization time to 2-3 seconds through pre-warmed machines and gVisor sandboxing. Build logs are now streamable for faster debugging. Users gain control over branch builds, allowing specification of branches for automatic deployments and the use of 'CI Skip' commands. Future plans include incremental builds and caching, updated build images, and more productive error messaging. Direct uploads now allow users to serve first-party tags directly from their domain, integrating with Google tag gateway for advertisers. This simplifies setup, improves performance and accuracy by intercepting and re-routing Google tag calls through the user's domain, and ensures cookies are set under the user's domain.
Cloudflare's Linux kernel infrastructure security has evolved to include robust processes for responding to vulnerabilities like 'Copy Fail' (CVE-2026-31431). This involves rapid assessment, validation of existing behavioral detections, proactive threat hunting, and the engineering of runtime mitigations (e.g., bpf-lsm) and kernel patches. The company leverages a standardized monthly Edge Reboot Release (ERR) cycle for edge infrastructure and a more flexible approach for control plane updates, ensuring timely deployment of security fixes without impacting production services or customer data. The process emphasizes a secure-by-design approach, with a focus on minimizing the attack surface and ensuring fleet-wide resilience.
Cloudflare's control plane and analytics services experienced an outage due to a catastrophic failure at a third-party data center provider. While many core services remained online due to a robust high availability cluster design, critical systems like Kafka and ClickHouse, powering analytics, had tight dependencies on services exclusively running in the affected facility. This incident highlighted the need to formally require all new products and their associated databases to integrate with the global network and ensure resilience against single points of failure.
Cloudflare has launched Flagship, a native feature flag service built on its own infrastructure (Workers, Durable Objects, KV). This service provides edge-based evaluation of feature flags, integrating with OpenFeature for cross-provider compatibility. It supports complex targeting rules, percentage rollouts, and is designed to facilitate AI-driven autonomous code deployment by providing safety nets for rapid iteration and testing in production.
Cloudflare's network performance testing capabilities have evolved to provide users with a more nuanced understanding of their internet connection quality beyond raw throughput. The Cloudflare Speed Test, built on the Network Quality API and Workers, measures metrics like throughput under realistic usage patterns, loaded and idle latency, jitter, and packet loss. It aims to translate these measurements into an Aggregated Internet Measurement (AIM) score, offering insights into how well a connection supports various use cases like streaming, gaming, and video conferencing. The test acknowledges that results include bottlenecks beyond the ISP, such as the browser and local Wi-Fi, and emphasizes that no single speed test is a definitive measure of ISP service but rather a helpful resource for assessing experience with Cloudflare's network.
Cloudflare is leveraging eBPF within Linux Security Modules (LSM) to implement granular security policies without requiring kernel module modifications or extensive configuration. This approach is being used to address specific security risks, such as preventing unprivileged users from escalating privileges via USER namespaces using the `unshare` syscall. The LSM BPF framework allows for dynamic policy enforcement at specific kernel hook points, offering a flexible and robust security mechanism. This post details the patching of a critical bash vulnerability (CVE-2014-6271 and CVE-2014-7169) across Cloudflare's infrastructure and the provision of WAF rules for customers.
Cloudflare's edge compute hardware has evolved from cache-heavy architectures (Gen 12) to throughput-optimized designs (Gen 13). This evolution is driven by the development of new software stacks (FL2) that can leverage increased core counts and improved IPC without being bottlenecked by reduced L3 cache. This enables higher performance per watt and increased rack throughput, supporting the company's global network expansion and sustainability goals.
Cloudflare's Data Localization Suite provides tools for customers to control the geographic location where their data is stored and processed. This includes features like Keyless SSL, Geo Key Manager for controlling private key access, Regional Services for inspecting traffic in specific regions, and Edge Log Delivery for sending logs directly from the edge to a customer's preferred region. Additionally, Workers Durable Objects now support Jurisdiction Restrictions, allowing developers to ensure data processing occurs within specified geographic boundaries. This post announces expanded Regional Services capabilities with new defined regions and introduces the concept of Software Defined Regionalization (SDR) for more granular control over traffic localization.
Cloudflare's platform has evolved to address the complexities and pitfalls of IP fragmentation. This includes understanding the limitations of IPv4 and IPv6 fragmentation, the critical role of Path MTU Discovery (PMTUD) and the 'Don't Fragment' (DF) flag, and the challenges posed by network middleboxes, NAT, and load balancing techniques like ECMP and Anycast. The company actively works to mitigate issues arising from dropped ICMP 'Packet too big' messages and misconfigured routers, aiming to enable the Cloudflare One Client to dynamically adjust its virtual interface MTU on the fly by periodically validating the capacity of the path, ensuring seamless transitions between networks with different MTU limits and maintaining stable connections for applications.
Cloudflare R2 object storage now offers Local Uploads in open beta, allowing object data to be written to a storage location close to the client first, then asynchronously copied to the bucket's region. This significantly reduces upload request duration (TTLB) by up to 75% for cross-region uploads. The feature utilizes Cloudflare Queues for asynchronous replication tasks and a pull model for queue consumers. Data remains strongly consistent and immediately accessible after the initial write. Local Uploads are now generally available.
Cloudflare's platform has evolved to support Web3 development by offering managed gateways for Ethereum and IPFS, enabling developers to build scalable decentralized applications. This includes open-source examples for deploying and managing NFTs using Cloudflare Workers and Pages, providing a full-stack solution for minting, displaying, and serving NFT metadata. The platform aims to be foundational to the future of Web3, supporting Metaverses, DAOs, DeFi, and other decentralized applications. The evolution of Web3 is driven by the desire for a more decentralized and user-owned internet, building upon the principles of peer-to-peer networks and blockchain technology.
Cloudflare's QUIC and HTTP/3 support has evolved to be generally available on the edge network, enabling faster, more reliable, and more secure connections. This builds upon industry collaboration through the IETF and partnerships with browser vendors like Google Chrome and Mozilla Firefox. The implementation leverages QUIC as the transport layer, which encapsulates UDP datagrams and combines TCP and TLS handshakes for faster connection establishment and improved performance by eliminating head-of-line blocking. This post details structural enhancements to NGINX to improve HTTP/2 performance, specifically addressing data queuing and prioritization. Key changes include HTTP/2 frame write queue reclamation, allowing unwritten frames to be re-queued for subsequent prioritization rounds, and HTTP/2 frame write event re-ordering, which consolidates frame processing and prioritization into a single event to increase 'Potential' (a metric for how effectively prioritization strategies can be applied). These changes aim to improve overall throughput and the effectiveness of prioritization algorithms.
Cloudflare's protocol evolution capabilities have been enhanced by addressing a vulnerability in Mutual TLS session resumption. The issue, tracked as CVE-2025-23419, allowed a client with a valid mTLS certificate for one zone to resume a TLS session with another zone without re-authentication. Cloudflare mitigated this by disabling TLS session resumption for all customers with mTLS enabled. The company is exploring ways to reintroduce performance benefits while maintaining security and is providing customers with tools like Transform Rules and Logs Custom Fields to further harden their mTLS configurations and detect future issues. This evolution also includes the ability to pass detailed client certificate metadata to origins and use this information in WAF custom rules for enhanced security checks.
Cloudflare is developing methods to detect Carrier-Grade Network Address Translation (CGNAT) to mitigate collateral effects of IP-based security mechanisms. This involves building supervised learning classifiers trained on network measurement techniques like distributed traceroutes to distinguish CGNAT IPs from other IP sharing technologies and single-subscriber IPs. The goal is to enable fairer treatment of users behind CGNAT IPs and reduce unintentional bias, particularly in developing regions.
Cloudflare's understanding and utilization of Linux's conntrack subsystem has evolved from avoiding it for simplicity to actively investigating its intricacies for new product needs. This includes understanding its state management, capacity limits, and the implications of its behavior when full, such as implicit packet drops and EPERM errors for UDP flows. The company is exploring its use in containerized environments and the nuances of its strict vs. loose modes. This post details how conntrack's interaction with socket binding can lead to unexpected source port rewriting, necessitating solutions like TCP_REPAIR or TCP Fast Open for scenarios involving packet rewriting and socket usage, particularly for soft-unicast address spaces.
Cloudflare has a history of leveraging its scale for unique internal projects and data analysis. This began with ambitious, large-scale data collection and analysis efforts, such as the 'Internet Mince Pie Database' which, while seemingly whimsical, demonstrated the company's ability to mobilize resources for structured data gathering and review. This has evolved to more technically focused initiatives like optimizing data infrastructure for analytics, improving system-level operations, and developing frameworks for internet resilience and measurement. The research team actively publishes findings and collaborates with external bodies to advance internet transparency and resilience.
Cloudflare's Load Balancing service has evolved to offer Dynamic Steering, enabling automatic traffic direction to the fastest pool based on EWMA RTT measurements from Cloudflare regions. This feature addresses the limitations of manual Geo Steering by dynamically adapting to network conditions and user location. The system propagates pool RTT data via an in-house key-value store (QuickSilver) replicated across all machines in every data center to ensure low-latency steering decisions. This post extends this by enabling end-to-end private traffic flows and WARP authenticated device traffic, eliminating the need for dedicated hardware load balancers by integrating with Cloudflare One, Magic WAN, and WARP for private IP load balancers.
Cloudflare is contributing to the development of Web Application Integrity, Consistency, and Transparency (WAICT), a W3C-backed effort to bring stronger security guarantees to the web. WAICT aims to provide integrity, consistency, and transparency for web applications, similar to the security properties offered by app stores for smartphone applications. This includes defining web applications through integrity manifests and establishing a transparent, append-only log for web application code. The system is designed to be opt-in, avoid extra round trips, preserve user privacy, and be non-centralized and easily auditable.
Cloudflare's Go compiler bug analysis thread continues with the discovery and debugging of a race condition in the arm64 compiler. This post details the investigation into sporadic panics and segmentation faults observed in a kernel configuration service, tracing the root cause to an interaction between the Go runtime's asynchronous preemption mechanism and the `github.com/vishvananda/netlink` library. The analysis highlights the challenges of debugging rare, intermittent bugs at scale and the process of identifying upstream issues.
Cloudflare Workers now supports direct integration with PostgreSQL databases, enabling developers to build serverless applications with a familiar relational database backend. This integration leverages PostgREST to expose database functionality as a REST API, which can be securely accessed from Workers via Cloudflare Tunnel. This allows for the creation of globally distributed APIs and intelligent caching layers in front of Postgres, without requiring migration to a new database-as-a-service platform. Hyperdrive further enhances this by providing a connection pooler and caching for SQL databases, reducing latency and protecting origin databases from connection exhaustion.
Cloudflare's Web Analytics, part of its real user monitoring (RUM) tools, is being upgraded to combine client-side metrics with deep, in-network instrumentation. This platform aims to provide comprehensive performance monitoring and debugging capabilities while preserving user privacy by aggregating data at the edge and dropping client-specific information. Starting October 15, 2025, Web Analytics will be enabled by default for all free domains, offering insights into page painting, load times, and visitor counts. Future enhancements will include real-world debugging examples and tips for optimizing performance. The platform will deliver a privacy-first approach by not tracking individual users or using client-side state, with an option to exclude EU/UK visitors' data.
Cloudflare's Privacy Pass protocol has evolved with v2.0 of the browser extension, introducing TypeScript, a module bundler, and a refactored API for cryptographic primitives. This enhances maintainability and modularity, making it easier to integrate new service providers. The protocol is also progressing towards standardization at the IETF, with ongoing work on public verifiability and the inclusion of metadata in tokens to address hoarding attacks. Future work includes exploring blind signatures. Cloudflare's initial support for Privacy Pass, a privacy-preserving protocol leveraging zero-knowledge proofs, aimed to reduce the number of challenge pages presented to users accessing the web anonymously or through shared IPs. This helped improve the browsing experience for vulnerable users by allowing them to prove they are human across multiple sites on the Cloudflare network without revealing their identity or exposing customers to additional threats. The protocol is fully open source and available on GitHub.
Cloudflare for SaaS has evolved to be available to all customers, not just Enterprise. This solution provides SaaS providers with a unified platform to extend Cloudflare's network benefits, including performance, security (DDoS mitigation, WAF, Bot Management), and SSL certificate management, to their end customers. It integrates with Cloudflare Workers, allowing SaaS companies to focus on core product development while Cloudflare handles infrastructure, security, and performance at the edge. The deprecation of SSL for SaaS v1 (Managed CNAME) is nearing completion, with remaining customers being migrated to the more secure and validated Cloudflare for SaaS v2 model, which uses verified custom hostnames and eliminates IP-based routing risks.
Cloudflare is actively integrating and promoting CISA's 'Secure by Design' principles across its product development lifecycle. This involves building security into products from the outset, configuring them securely by default, taking ownership of customer security outcomes, embracing radical transparency and accountability, and leading from the top. Examples include the adoption of memory-safe languages like Rust for critical components (WAF, Pingora proxy), the default provision of security f
Cloudflare Workers has evolved into a powerful edge computing platform, enabling developers to run serverless JavaScript code globally. This post announces the open beta, highlighting the ability to intercept and modify requests, make outbound requests, and deploy globally in under 30 seconds. It provides examples for A/B testing, conditional routing, request filtering, response aggregation, and hotlink protection, with code available on GitHub and a community forum for feedback. Wrangler v2.0 s
Cloudflare's Linux kernel upgrade process has evolved to be more consistent and automated across its network and control plane infrastructure. This includes a standardized monthly Edge Reboot Release cycle for the network and the development of Reboau for automated, rack-aware reboot logic in the Control Plane. The company is also leveraging live patching for faster critical security updates and has implemented robust testing and phased rollout strategies to ensure security and reliability. This post details the investigation and debugging of hung tasks, a critical aspect of kernel stability and reliability, by analyzing kernel messages, stack traces, and system configurations to identify root causes such as filesystem pressure, coredump generation, and mutex contention.
This thread tracks the evolution of debugging and resolving complex issues within the Jest testing framework, specifically addressing persistent timeouts and cryptic error messages that hinder local development workflows. It details the process of identifying the root cause of a 27-second timeout, which was traced to an underlying system issue rather than a Jest configuration problem, and highlights the use of strace for deep system-level diagnostics.
Cloudflare's platform has evolved to enable innovative security solutions by leveraging DNSSEC for SSH key management. This allows for secure, centralized storage and retrieval of public keys via DNS TXT records, simplifying key distribution and revocation for administrators. This capability enhances the security posture of SSH deployments by integrating with DNSSEC's cryptographic validation, ensuring the integrity and authenticity of public keys used for authentication. This has now been extended to integrate with OpenID Connect (OIDC) via the OpenPubkey protocol, allowing for ephemeral SSH keys to be generated on-demand and authenticated using SSO tokens, eliminating the need for long-lived SSH keys and simplifying access management.
Cloudflare, in partnership with Vercel, Shopify, and core contributors to Node.js and Deno, has established the Web-interoperable Runtimes Community Group (WinterCG) under W3C. This group aims to standardize web APIs for non-browser JavaScript environments, ensuring code portability and consistency across runtimes like Cloudflare Workers, Node.js, and Deno. Key initiatives include defining a Minimum Common Web Platform API, developing specifications for Web Cryptography Streams to address limita. This post details the contribution of URLPattern API implementation to Node.js and Ada URL, enhancing interoperability and performance across JavaScript runtimes.
Cloudflare has a deep and reciprocal relationship with the open source community. Initially, the company relied heavily on open source software for its core infrastructure, including nginx and PostgreSQL. This evolved into actively contributing back to these projects, releasing their own open source tools and libraries, such as Red October, Lua Resty Shcache, Lua Resty Core, Go Libs, BM, Lua Raven, Lua Resty Logger Socket, conf, Lua Resty Kyoto Tycoon, Go LZ4, Aho Corasick, kt-fdw, Lua Resty Coo. This post details the company's philosophy of open-sourcing components and contributing to external projects, highlighting specific examples of contributions and sponsored work.
Cloudflare's password security and authentication mechanisms have evolved to include automatic checking of user passwords against threat intelligence sources that monitor data breaches in other services. If a password is found to be leaked, users are alerted and prompted to reset their password. The system uses password hashes for secure and fast lookups. The platform also encourages the adoption of two-factor authentication (2FA) and plans to expand single sign-on (SSO) capabilities.
Cloudflare has expanded its LavaRand system to incorporate new physical sources of entropy from its global offices, including wave machines in Lisbon, double pendulums in London, suspended rainbows in Austin, and lava lamps in San Francisco. These new sources, captured via cameras and processed into hashes, contribute to seeding Cryptographically Secure Pseudorandom Number Generators (CSPRNGs) for cryptographic security across Cloudflare's global infrastructure. The system makes this harnessed chaos available via an internal API, enabling developers to use pure randomness for various applications, including Cloudflare Workers and the drand API.
Cloudflare Images now integrates with the C2PA standard to preserve and cryptographically sign content provenance metadata. This allows creators and publishers to maintain an auditable chain of image creation and editing history, ensuring attribution and authenticity across the Cloudflare network. The integration supports existing Content Credentials and appends new, signed actions performed by Cloudflare Images, such as resizing or format changes. This enables end-users to verify the integrity of image metadata using open-source tools.
Cloudflare is actively working to reduce entire classes of vulnerabilities in its software development lifecycle. This includes enhancing static analysis tools with custom rulesets to proactively detect and block injection vulnerabilities and secrets in code. The company leverages automation, secure defaults, and developer training to prevent these issues from reaching production, aiming to meet CISA's 'Secure by Design' pledge goals. This has resulted in a 79% reduction of secrets in code and a 44% reduction of potential SQL injection and code injection vulnerabilities in the second half of 2024.
Cloudflare's developer documentation platform has evolved from a custom Gatsby-based engine to a Hugo-based static site generator deployed on Cloudflare Pages. This migration significantly improved build performance, developer experience, and content quality by automating Markdown conversion, code formatting, and deployment processes. The new engine leverages a stricter Markdown standard and a more maintainable architecture for managing thousands of documentation pages and contributions. This post details the migration to Astro and Starlight, further enhancing content organization, extensibility, development experience, and CSS management. The migration process utilized ASTs and a utility called astray for efficient content transformation.
Cloudflare's exploration of Multi-Path TCP (MPTCP) continues, focusing on its implementation and practical application for enhancing connectivity. This post details the setup and configuration of MPTCP on Linux servers and clients, highlighting the use of subflows, path managers, and schedulers. It addresses challenges with existing implementations, particularly regarding client-side path management and server-side flags like 'allow_join_initial_addr_port' in Anycast environments. The post also touches upon the potential for MPTCP to improve mobility and bandwidth aggregation, while acknowledging its current immaturity and case-by-case applicability compared to traditional TCP.
Cloudflare has been actively working to internationalize its products and services, starting with the Cloudflare dashboard. This effort involves externalizing all user-facing strings, managing dynamic data within translations, handling pluralization, and incorporating rich text elements like links. The company has developed a repeatable process for internationalization and localization, aiming to make its platform accessible to a global and diverse customer base in their native languages. This post details the specific implementation for Cloudflare Radar, including strategies for hard-coding avoidance, pseudo-translation, text expansion management, and string concatenation best practices.
Cloudflare is enhancing the security and manageability of its server fleet by adopting OpenBMC, an open-source firmware for Baseboard Management Controllers (BMCs). This move aims to provide greater transparency, faster patching, and more control over firmware, including the integration of TLS certificates and fine-grained credential management. Furthermore, Cloudflare is extending its secure boot capabilities to the BMC itself, leveraging hardware root-of-trust and security co-processors to validate firmware integrity during boot. This post details how Cloudflare customized and extended OpenBMC to improve server boot reliability and diagnostics by better monitoring boot-up processes and addressing race conditions between the BMC and UEFI during subsystem initialization and memory module detection.
Cloudflare is leveraging KubeVirt to run virtual machines alongside containerized workloads within its multi-tenant Kubernetes clusters. This enables teams requiring deep integration with the Linux kernel, such as for build infrastructure and network simulation, to do so securely and efficiently. KubeVirt integrates with Kubernetes primitives and CRDs, allowing for scalable VM deployment and management. Use cases include Kubernetes scalability testing, development environments, kernel and iPXE testing, and build pipelines.
Cloudflare actively combats patent litigation abuse by crowdsourcing prior art through initiatives like Project Jengo, aiming to invalidate overbroad patents and protect innovators. This has led to significant wins, including the voluntary cancellation of Sable Networks' '932 patent and encouraging other companies like Coinbase to adopt similar anti-troll strategies. The program continues to offer bounties for prior art submissions, fostering a community effort against patent trolls. The recent victory against Sable IP and Sable Networks, where Cloudflare successfully defended against claims related to Magic Transit and Argo for Packets by demonstrating non-infringement and patent invalidity, further solidifies this approach. The company's technical experts and engineers played a crucial role in explaining complex technical differences between old router hardware technologies and modern software-defined services to the jury. This success reinforces Cloudflare's commitment to fighting meritless patent claims and protecting innovation.
Cloudflare's compression capabilities have evolved to include Zstandard (zstd) as a supported algorithm for browser-to-Cloudflare traffic. Zstandard offers faster compression and decompression speeds than Brotli while maintaining comparable compression ratios to GZIP, leading to reduced latency and improved website performance. This builds upon existing efforts in optimizing compression algorithms and protocols for better web performance. The post also discusses the rollout of Encrypted Client Hello (ECH) and ongoing work on HTTP/3 prioritization and BBR congestion control.
Cloudflare's understanding and utilization of Linux's conntrack subsystem has evolved from avoiding it for simplicity to actively investigating its intricacies for new product needs. This includes understanding its state management, capacity limits, and the implications of its behavior when full, such as implicit packet drops and EPERM errors for UDP flows. The company is exploring its use in containerized environments and the nuances of its strict vs. loose modes. This post details how conntrack is used to manage TCP port sharing behavior, particularly in scenarios with a large number of bound TCP sockets, and how increasing the LHTABLE size and binding to ANY_IP addresses for TCP traffic resolved latency issues.
Cloudflare is implementing Profile Guided Optimization (PGO) for its Go-based services to reduce CPU usage and improve resource efficiency. This involves collecting production CPU profiles, merging them, and recompiling services with the `-pgo` flag. Initial results show significant CPU savings, freeing up resources for customer requests. Future work includes automating profile collection, refining deployment processes, and exploring Link Time Optimization (LTO) techniques.
Cloudflare's API bindings have evolved to support automated generation from OpenAPI schemas, ensuring consistent quality, parity, and faster delivery of updates across multiple languages. This includes enforcing API design conventions and style guides through linting rules integrated into CI pipelines. The use of Stainless as a generation engine allows for SDK-specific customizations while maintaining a clear division of responsibilities between service teams, the API team, and the generation platform.
Cloudflare's fleet management has evolved from manual YAML file management to a robust, in-house system called Zinc. Zinc models logical and physical infrastructure assets (servers, network devices, data centers) in a strongly-typed system, providing APIs and interfaces for efficient fleet management. It integrates with other systems for workload assignment, maintenance scheduling, repair management, and diagnostics reporting. Zinc offers a native web interface and CLI tooling for engineers, with features like a change request and approval system, node reservations, and comprehensive metadata collection. It complements Netbox for physical inventory management.
Cloudflare's platform has evolved to support IPv6 transition by reducing internal and egress use of IPv4 addresses. This includes investigating and optimizing the performance of TCP connect() syscalls, particularly the port selection algorithm (__inet_hash_connect()), to improve efficiency when establishing a large number of connections. The goal is to minimize the number of source IPv4 addresses required for services like the cache, thereby reducing operational costs and improving performance. The Automatic IPv6 Gateway was launched, enabling users to access IPv6-only content from IPv4 networks and vice-versa, with options for full subdomain enablement or specific IPv6-only subdomains.
Cloudflare is actively involved in standardizing and implementing privacy-preserving technologies. This includes contributing to the Distributed Aggregation Protocol (DAP) for private aggregation and enhancing it with differential privacy to provide a stronger guarantee against data leakage. The company is developing an open-source implementation of DAP and a service to support partners, aiming to protect user privacy in various applications like telemetry and exposure notification systems.
Cloudflare's image optimization capabilities have evolved to include support for mozjpeg 2.0, offering improved compression ratios and success rates compared to libjpeg-turbo. This involves a rewritten Go executable for Polish and ongoing optimization efforts for Intel processors. The platform also supports AVIF format and blur options for image variants.
Cloudflare is actively working to reduce its environmental impact by optimizing its global network infrastructure for energy efficiency. This includes leveraging renewable energy, focusing on data centers with low PUE, and implementing waste diversion and energy efficiency measures. A key aspect of this evolution is the strategic adoption of hardware, such as Arm CPUs, to significantly improve performance per watt and reduce overall energy consumption. This also encourages broader industry shift. The company's network infrastructure is designed for high utilization, reducing idle hardware energy consumption. Caching is employed to reduce data transfer and origin server load, saving energy. Performance optimizations across the network and platform, including the use of isolates in Cloudflare Workers, further reduce energy consumption by eliminating overhead and enabling efficient execution of customer code. Cloudflare offsets its remaining carbon footprint by purchasing Renewable Energy Certificates (RECs) to match 100% of its global electricity usage.
Cloudflare's Traffic Sequence illustration has evolved into Cloudflare Trace, a comprehensive tool for understanding HTTP request traversal through the Cloudflare ecosystem. Trace provides detailed visualizations of applied rules and product interactions, enabling users to debug issues, validate security rules, and reduce support workload. It offers both a UI-based visualization and a programmatic JSON output for deeper analysis. Future enhancements include scheduling and alerts.
Cloudflare Workers is exploring and implementing advanced debugging capabilities for WebAssembly (Wasm) within its runtime. This includes investigating the potential for Wasm core dumps, a critical feature for post-mortem debugging of application crashes. While the core Wasm specification for core dumps is still experimental and not yet fully supported in the Cloudflare Workers runtime (workerd), the company is actively researching and developing polyfilling techniques using tools like wasm-coredump-rewriter to enable debugging of Rust and Wasm code in Workers.
Cloudflare is actively involved in securing Network Time Protocol (NTP) through the development and promotion of Network Time Security (NTS). This includes operating a time service that supports NTS on its officially assigned port (4460), contributing to the standardization process, releasing source code for specialized servers, and working with implementers to resolve bugs. The goal is to improve the security of time synchronization, which is foundational for other security protocols like TLS. This post details the launch of time.cloudflare.com, a free time service that supports both NTP and NTS, addressing vulnerabilities in NTP that allow for time manipulation and denial of service attacks, even from off-path attackers. The service provides secure time synchronization from Cloudflare's global datacenters.
Cloudflare's Linux kernel traffic control capabilities have evolved to address vulnerabilities, particularly those exploitable via USER namespaces. The 'noqueue' qdisc, when misapplied to classful qdiscs, was found to cause NULL pointer dereferences and kernel panics. The primary mitigation involved disallowing 'noqueue' for qdisc classes, aligning with documentation and preventing misuse. This evolution focuses on hardening the kernel's traffic control subsystem against unintended behavior and.
Cloudflare's dashboard has evolved to manage an ever-increasing number of products and features. To address this complexity, Cloudflare has introduced 'quick search,' a cross-dashboard search tool designed to speed up common interactions by allowing users to quickly find and navigate to specific pages, website-specific products, and account-wide services. The new dashboard also introduces a more organized app-based navigation metaphor, moving away from the 'My Websites' page and organizing features into logical categories.
Cloudflare's Geo Key Manager has evolved to v2, replacing its identity-based broadcast encryption and revocation scheme with Attribute-Based Encryption (ABE). This addresses limitations in flexibility, performance, and manual key rotation of the original system. GeoV2 allows for more dynamic and granular access control policies based on attributes, avoiding a single point of failure and simplifying the management of keys across a growing global network. The implementation of ABE is open-sourced.
Cloudflare's HTML parsing and modification capabilities have evolved from a complex, difficult-to-maintain Ragel-based parser to a new, faster, and more maintainable streaming parser named cf-html (LOL HTML). This evolution aims to improve the efficiency and reliability of features that modify HTML on the fly, such as email obfuscation, server-side excludes, and automatic HTTPS rewrites. The transition to cf-html is ongoing, with a focus on migrating all functionalities to the new parser. The HTML parser bug that caused memory leaks has been fixed by addressing pointer errors in the Ragel implementation and ensuring proper buffer handling, particularly at the end of buffers and in error conditions.
Cloudflare's Wrangler CLI has evolved its authentication process to improve the developer experience. Previously, users had to manually create API tokens through the Cloudflare dashboard. The new `wrangler login` command streamlines this by allowing users to authenticate directly with their Cloudflare credentials, similar to Argo Tunnel's login flow. This involves generating a public-private key pair, prompting the user to log in via the dashboard, automatically creating a Workers-scoped API token.
Cloudflare has enhanced its secure boot capabilities for Arm-based servers by implementing a Single Domain Secure Boot (SDSB) mechanism. This builds upon the Arm Trusted Firmware (ATF) Secure Boot process, allowing for cryptographic validation of the UEFI firmware using a hardware root-of-trust stored in eFuses. This provides a more robust security chain for Arm servers, similar to their existing solutions for x86 platforms.
Cloudflare is exploring the use of the Linux Kernel Key Retention Service to protect cryptographic keys. This service allows keys to be stored outside of application process address spaces, providing isolation and reducing the risk of leaks due to memory access violations. It offers a kernel-level agent for cryptographic operations, with associated permissions and lifecycle management tied to processes or users. The service supports various key types, including asymmetric keys for RSA operations, and keyrings for managing key lifetimes and access control.
Cloudflare's security posture has been significantly bolstered by its strategic adoption of BoringSSL, a fork of OpenSSL maintained by Google. This decision has proven critical in mitigating the impact of high-risk vulnerabilities like CVE-2014-0160 (Heartbleed), which affected OpenSSL 1.0.1. The company's internal systems, which rely on BoringSSL, were not impacted, demonstrating the effectiveness of this architectural choice in isolating the organization from widespread third-party library vul
Cloudflare's exploration of low-level hardware behaviors and their impact on system performance has evolved to include the analysis of dynamic voltage and frequency scaling (DVFS) and its data-dependent nature. This vulnerability, Hertzbleed, demonstrates how CPU power consumption variations, influenced by data characteristics like Hamming weight and Hamming distance, can lead to data-dependent CPU frequencies and execution times. This has implications for cryptographic software security, partic
Cloudflare's offerings have expanded to encompass website backup and recovery solutions, including tools and services that enable website owners to safeguard their digital assets. This has evolved to include passive origin monitoring, which proactively notifies customers when their origin servers are down, allowing them to take action to restore their sites and reduce the impact of downtime. Health Checks provide active monitoring with configurable checks and analytics. Health Check Analytics provide detailed insights into change events and unhealthy origins. Zero-Downtime Failover automatically retries requests to origin servers when initial connection attempts fail, improving availability by seamlessly switching to alternate origins within the same HTTP request or Load Balancing pool. Standalone Health Checks allow for origin monitoring without a Cloudflare Load Balancer, with configurable checks and analytics. Passive Origin Monitoring sends email alerts when origin downtime is detected for more than a few minutes. The Notification Center serves as a central hub for managing these notifications.
Cloudflare's research and development approach has evolved from a specialized Cryptography Research team to a broader Cloudflare Research initiative, driven by a hybrid model that embeds research engineers into product and operations teams for temporary assignments. This provides direct exposure to practical problems and leverages production data for experiments. The team also collaborates with industry and academia, focusing on impact-driven projects and open collaboration through public outreach, standardization, and large-scale implementation. This approach is applied to long-term projects like migrating the Internet to secure network protocols, and emerging areas like post-quantum cryptography and secure time synchronization.
Cloudflare is exploring and detailing the internal workings of io_uring, a high-performance asynchronous I/O API in the Linux kernel. This includes understanding how io_uring manages its worker thread pools for different types of I/O requests (bounded vs. unbounded), how to monitor and control these pools, and the implications for network I/O performance. The company is investigating the tracepoints and kernel mechanisms involved in worker creation and management to optimize its use of io_uring. This post also explores SOCKMAP, a new eBPF machinery for socket splicing, which aims to achieve zero-copy and zero-wakeup data forwarding purely in the kernel, though initial benchmarks showed it to be slower than other methods.
Cloudflare's io_uring implementation has evolved to provide detailed insights into worker pool management. This includes understanding the distinction between bounded and unbounded workers, how their sizes are controlled by system limits (e.g., RLIMIT_NPROC) and ring buffer configurations, and how to monitor their creation and behavior using kernel tracepoints. The platform now offers granular control and visibility into the underlying runtime for asynchronous I/O processing, enabling developers to optimize performance and resource utilization for network-intensive workloads.
Cloudflare's notification system has evolved to offer more robust delivery mechanisms and historical logging. Initially focused on email, it now supports webhooks for direct integration with messaging platforms like Slack, Microsoft Teams, Discord, and others, as well as observability tools like DataDog and Splunk. This expansion addresses the limitations of email delivery and provides more versatile integration points. Furthermore, a notification history feature has been introduced, allowing users to view past notifications for a specified duration (30 days for Free/Pro/Business, 90 days for Enterprise), accessible via API with future dashboard integration planned. This addresses the issue of lost notifications and aids in recovery and auditing.
Cloudflare is actively involved in securing RPKI validation software, addressing vulnerabilities in implementations like OctoRPKI. This includes developing and releasing patches for issues such as arbitrary file writes and resource consumption attacks, contributing to the overall security and reliability of BGP route validation. The post highlights the passing of the two hundred thousand ROA threshold, the launch of isbgpsafeyet.com, and the growth of RPKI Origin Validation deployment across net
Cloudflare's approach to engineering management and onboarding has evolved to be adaptable and inclusive, particularly in response to external crises. Initially focusing on structured in-person onboarding for new Engineering Managers and Solutions Engineers, the company has demonstrated a strong commitment to maintaining and even expanding internship programs during challenging times. This includes rapidly adapting to virtual onboarding processes, doubling internship class sizes, and providing comprehensive support for interns, with a recent significant expansion targeting 1,111 interns in 2026 to drive AI innovation.
Cloudflare's software delivery process has evolved to accommodate diverse team needs, moving beyond a single methodology. The company emphasizes high-level concepts like 'SHIPs' (customer-facing changes) and 'EPICs' (work items, including technical initiatives) managed through a transparent 'SHIP-board'. Planning occurs quarterly, with a focus on continuous delivery and pragmatic date management. Strict rules govern code deployment to ensure safety and reliability, balancing team autonomy with organizational needs.
Cloudflare actively fosters community and developer relations through various initiatives, including providing spaces for meetups and participating in global events. This has evolved to include the launch of a dedicated Cloudflare Community forum, serving as a centralized hub for users to share expertise, ask questions, provide feedback, and participate in early access programs. The company has now launched Cloudflare TV, a 24x7 live television broadcast streamed globally via the Cloudflare network. This post highlights Cloudflare's support for the HBCU Smart Cities Challenge, offering Project Galileo to protect and accelerate their online presence, demonstrating a commitment to community engagement and bridging the digital accessibility gap.
Cloudflare's founding vision is to democratize performance and security by building a global network and a platform that makes any website faster, safer, and better. This vision is realized through a deliberate approach to innovation, driven by cultivating curiosity within its team, leveraging its own technology (eating its own dog food) for product development, and deeply engaging with its vast free customer base for testing and insights. This iterative, customer-centric approach allows for rapid development and deployment of new features and products, as exemplified by the recent Birthday Week releases including email security, expanded office building network presence, and Web3 initiatives. The company's use of its own Workers platform as an abstraction layer enables massive development velocity and rapid global rollout of innovations. Smaller, focused teams, including dedicated Emerging Technology and Incubation and Research teams, are empowered to explore new products and define new standards. The company ships software in a consumer-like iterative process, rolling out initial concepts to subsets of users to gather feedback and guide development. This approach, combined with cost-effective network infrastructure, allows for significant savings passed on to customers, including free services. The vast free customer base serves as a critical testing ground for new capabilities, providing the scale and diversity of traffic and threat patterns needed to refine products before broad rollout. This iterative, customer-centric approach allows for rapid development and deployment of new features and products, as exemplified by the recent Birthday Week releases including email security, expanded office building network presence, and Web3 initiatives. The company's use of its own Workers platform as an abstraction layer enables massive development velocity and rapid global rollout of innovations. Smaller, focused teams, including dedicated Emerging Technology and Incubation and Research teams, are empowered to explore new products and define new standards. The company ships software in a consumer-like iterative process, rolling out initial concepts to subsets of users to gather feedback and guide development. This approach, combined with cost-effective network infrastructure, allows for significant savings passed on to customers, including free services. The vast free customer base serves as a critical testing ground for new capabilities, providing the scale and diversity of traffic and threat patterns needed to refine products before broad rollout.
Cloudflare's understanding of branch prediction performance has evolved, moving beyond the general rule that predictable branches have near-zero cost. Experiments have revealed that the cost of branches, even unconditional ones, can increase significantly with their number and density. This has led to a deeper investigation into the Branch Target Buffer (BTB) and its capacity, demonstrating that performance degrades when the number of branches exceeds certain thresholds (e.g., 4096 branches). This understanding informs code optimization strategies to avoid performance penalties associated with excessive branching.
Cloudflare has optimized memory usage by switching from glibc malloc to TCMalloc for services like Quicksilver, which uses RocksDB. This involved understanding the fragmentation issues inherent in glibc's arena-based allocation and the benefits of TCMalloc's front-end, middle-end, and back-end design for improved memory reuse across threads. The switch resulted in a 2.5x reduction in memory consumption.
Cloudflare has adopted HashiCorp Nomad as a dynamic task scheduling system to improve the availability and resource utilization of management services across its global edge data centers. This system ensures a desired number of service instances are reliably running, regardless of the underlying physical machine, and integrates with Consul for service discovery and Prometheus for observability. Challenges in deployment, such as initramfs rootfs compatibility and resource usage containment, have been addressed through upstream contributions and custom solutions. Nomad job files are templated and managed via configuration management tools, with rack metadata used to ensure distinct failure domains for service instances. Mutual TLS authentication is used to secure API access.
Cloudflare's image matching capabilities have evolved to address performance bottlenecks in high-dimensional data. Initial approaches using naive quadratic algorithms and SIMD optimizations (AVX2) showed limited gains due to memory bandwidth constraints. Advanced algorithms like VP-trees struggled with the 'curse of dimensionality' in 144-dimensional spaces. Subsequent efforts focused on optimizing brute-force methods by introducing a 'short distance' variation that computes a subset of dimensions, and further refined by considering the 'origin distance' to quickly discard non-matches based on a threshold.
Cloudflare's analysis of the SUNBURST malware's Domain Generation Algorithm (DGA) has uncovered additional details about its encoding schemes and how it exfiltrates compromised hostnames. This includes identifying a quirk where long hostnames are split across multiple DNS queries, requiring a novel method of reassembly based on XORing GUIDs. The analysis also refines understanding of base32 encoding variants used by the malware and provides tools for matching fragmented DNS messages.
Cloudflare's data center operations involve sophisticated power management, including the use of three-phase power distribution units (PDUs) to maximize efficiency and redundancy. This involves understanding AC power principles, Ohm's Law, Faraday's Law, and the advantages of three-phase over single-phase power for high-density computing environments. The company employs dual power supply configurations for servers and leverages PDUs with multiple circuit breakers for resilience. The implementation of three-phase power offers increased capacity and cost-effectiveness compared to single-phase setups, with a focus on maximizing compute performance and minimizing physical footprint.
Cloudflare engineers are contributing to gVisor, a Linux container runtime, by implementing the /proc/[pid]/mem file interface. This enables detailed debugging and stack trace analysis within sandboxed environments, addressing limitations in accessing process memory for debugging purposes.
Cloudflare is leveraging seccomp filters in Linux to implement granular security policies without requiring kernel module modifications or extensive configuration. This approach is being used to address specific security risks, such as preventing unprivileged users from escalating privileges via USER namespaces using the `unshare` syscall. The LSM BPF framework allows for dynamic policy enforcement at specific kernel hook points, offering a flexible and robust security mechanism.
Cloudflare's Dashboard has evolved to support deep linking, allowing users to be directed to specific resources within the application. This includes dynamic resolution of account and zone IDs, and the ability to scroll to specific elements on a page. This enhances user experience by enabling direct links from marketing pages and troubleshooting documentation, and streamlines navigation by automatically scrolling to relevant settings.
Cloudflare is enhancing customer support security by introducing Time-Based One-Time Passwords (TOTP) for phone authentication. This allows Enterprise customers to prove their identity over the phone using tokens generated from the dashboard or a 2FA app, without discussing sensitive account settings. The system uses RFC 6238 for TOTP generation, with deviations for single-use tokens and dashboard-generated codes. Future work includes callback requests and integration with other authentication methods.
Cloudflare's internal tooling for network diagnostics, Crossbow, has undergone a significant refactor and rearchitecture. The tool now focuses on a CLI interface, deprecating the UI to streamline development and improve usability. The architecture has been modernized with a pub/sub pipeline, JWT authentication via Cloudflare Access, and deployment on Cloudflare Spectrum, removing the VPN requirement. Integration with other internal tools and the adoption of Test-Driven Development (TDD) and Continuous Integration (CI) have led to dramatic usage increases and improved delivery velocity.
Cloudflare launched 1.1.1.1 for Families, a filtered DNS service with default settings for Malware and Malware + Adult Content. The service uses licensed site categorization data. An error in selecting the 'Adult Content' feed led to the inadvertent blocking of LGBTQIA+ sites. The issue was resolved by correcting the feed and pushing an updated data structure. Future protections include pre-release checks against known sites to prevent similar mistakes.
This post introduces the investigation into Linux disk encryption performance, highlighting the trade-offs between block-level and file-level encryption, and hardware vs. software implementations. It details a benchmarking setup using RAM disks to measure the performance penalty of dm-crypt and sets the stage for exploring optimizations.
Cloudflare's TCP connection handling has evolved to utilize end-to-end Keep Alives, reducing TCP overhead and latency by maintaining persistent connections to origin servers for multiple requests. This optimization improves the time to first byte and overall site snappiness, especially for sites with consistent traffic. The implementation benefits sites whose origin servers support Keep Alive connections. This post details how disabling keepalives for internal connections between SSL and FL proc
Cloudflare's data analysis tooling has evolved to include command-line utilities for generating ASCII histograms, monitoring real-time rate of change, and summing floating-point numbers. This post details the development and open-sourcing of these tools (mmsum, mmwatch, mmhistogram) to aid engineers in quickly processing and understanding data from various sources, including network traffic and system metrics. The post also explores the performance implications of Bloom filters, highlighting the trade-off between memory access latency and computational cost, and introduces a custom tool 'mmuniq-bloom' to address large-scale deduplication challenges.
Cloudflare's API token management has evolved to provide granular access control, allowing users to create tokens scoped by resource (accounts and zones) and permission (specific services within a zone). This enhances security by enabling least privilege access and easier token rotation.
Cloudflare has actively engaged with and partnered with web hosting and service providers to extend its reach and value proposition. This includes collaborations with companies like (mt) Media Temple, DreamHost, Verio, and UK2 Group, focusing on enhancing their offerings for small businesses and customers. The strategy involves acquiring complementary services and integrating them to provide a more comprehensive solution, encompassing website creation, performance, security, and marketing services. This has evolved to include one-click integrations for Cloudflare services, custom bundled plans, and enhanced default configurations for hosting provider customers.
Cloudflare's XDP capabilities have evolved to include enhanced debugging and visibility tools. The development and open-sourcing of xdpcap, a tcpdump replacement for XDP, allows for efficient packet capture and analysis directly within the eBPF environment. This is facilitated by cbpfc, a compiler that translates classic BPF (cBPF) filters to eBPF, enabling dynamic instrumentation of XDP programs via tail-calls and exposure of matching packets to userspace through perf events. This enhances the ability to debug and troubleshoot network traffic processed at the edge.
Cloudflare is exploring and implementing the Linux AIO API for network I/O operations, moving beyond its traditional use for disk I/O. This involves understanding and leveraging `io_submit` for syscall batching and optimizing event retrieval by directly accessing the kernel's ring buffer, bypassing the `io_getevents` syscall for improved performance in high-concurrency network servers. The company is investigating the tracepoints and kernel mechanisms involved in worker creation and management to optimize its use of io_uring.
Cloudflare is actively involved in improving LuaJIT performance through a research project at King's College London. This project focuses on developing a comprehensive benchmark suite for Lua implementations, analyzing the performance of different LuaJIT forks (original LuaJIT and RaptorJIT), and identifying areas for optimization. The work aims to improve VM warmup behavior and performance characteristics across various benchmarks, leading to more predictable and faster execution for larger pro
Cloudflare has been involved in optimizing LuaJIT performance through a research project at King's College London. This project focused on developing a comprehensive benchmark suite for Lua implementations, analyzing the performance of different LuaJIT forks (original LuaJIT and RaptorJIT), and identifying areas for optimization. The work has led to a better understanding of VM warmup behavior and performance characteristics across various benchmarks.
Cloudflare's TLS handling architecture has evolved to support early adoption of TLS 1.3. This involved implementing a custom TLS 1.3 stack in Go (tls-tris) and using SCM_RIGHTS to pass established TCP connections from an nginx-based SSL termination layer to the Go process. This allows for selective TLS version handling and rapid iteration on new TLS versions without impacting the broader stack. The implementation details for Go and Rust are provided, showcasing the use of UNIX domain sockets and the SCM_RIGHTS mechanism for inter-process communication of file descriptors.
This post details the analysis of dynamic RAM refresh cycles and their measurable impact on system performance from userspace. It introduces techniques for detecting subtle hardware behaviors through software experiments and signal processing (FFT), demonstrating that even low-level hardware operations can be observed and analyzed, leading to potential security insights and performance optimizations.
Cloudflare has been offering full IPv6 support and an IPv6-to-IPv4 gateway since 2012, making it easy for customers to transition to IPv6. This includes features like IPv6 Compatibility enablement in the dashboard and Pseudo IPv4 for legacy IPv4 applications. The company actively supports emerging networking technologies and provides guidance for developers navigating IPv6-only environments, such as those mandated by Apple for iOS apps. This support aims to simplify the complex global transition. Universal SSL has been rolled out to all customers, including free tier users, doubling the number of SSL-enabled sites. This is achieved by automatically provisioning SSL certificates on Cloudflare's network, supporting both root domains and wildcard subdomains. For sites without prior SSL, Flexible SSL mode is enabled by default, encrypting traffic between browsers and Cloudflare. Full or Strict SSL modes are recommended for end-to-end encryption. The challenges of CPU load and IPv4 exhaustion were addressed by leveraging ECDSA cipher suites and Server Name Indication (SNI) for modern browsers, allowing multiple customer sites to share the same IP address. Legacy browsers, such as Internet Explorer on Windows XP and pre-Ice Cream Sandwich Android, are not supported on the free plan. Paid plans continue to support all browsers. Universal SSL also enables broader support for the SPDY protocol. Future plans include leveraging IPv6 connections for SNI-less browsers and encouraging users to upgrade to modern browsers and operating systems. A 'Better Browser' app is available to prompt users to upgrade. The decision to offer Universal SSL to all customers, even at a potential short-term revenue cost, aligns with Cloudflare's mission to build a better, encrypted internet. The rollout is ongoing, with full provisioning expected within 24 hours for most customers. Support for hosting partners will be enabled later.
Cloudflare launched 1.1.1.1, a consumer-facing DNS service focused on speed and privacy. This service aims to address the inherent privacy and censorship issues of traditional DNS resolvers by offering faster lookups and a commitment to not logging user data. The service leverages Cloudflare's global network for performance and was made possible through a collaboration with APNIC for IP address allocation. The launch also included accompanying mobile applications for iOS and Android.
Cloudflare's DDoS mitigation capabilities have evolved to analyze and defend against increasingly sophisticated amplification attacks. This includes deep dives into protocols like NTP (specifically the MONLIST command) and DNS, understanding their vulnerabilities, and developing strategies to counter large-scale UDP floods. The focus is on identifying and mitigating new attack vectors by analyzing traffic patterns, reflector IPs, and protocol-specific weaknesses to maintain network resilience. This post details the mechanics of NTP-based amplification attacks and provides guidance for mitigating them by securing NTP servers and implementing BCP-38.
Cloudflare has explored and implemented methods to use Go as a scripting language on Linux. This involves overcoming limitations of the standard `go run` command and the shebang mechanism by leveraging the Linux kernel's `binfmt_misc` module. This allows `.go` files to be executed directly as scripts, preserving proper error code propagation and enabling a seamless edit-execute cycle without requiring a separate build step for simple scripts. This approach enhances developer productivity for scr
Cloudflare's engineering blog has explored various aspects of advanced programming techniques, including the sophisticated use of Rust macros for compile-time code generation. This thread tracks the evolution of how Cloudflare engineers leverage metaprogramming to enhance code efficiency, reduce boilerplate, and enable complex computations at compile time. Early explorations focused on understanding and applying powerful macro systems like Rust's to solve specific problems, such as implementing Reverse Polish Notation evaluation at compile time. This demonstrates a commitment to pushing the boundaries of what can be achieved during the build process, leading to more optimized and robust software.
Cloudflare's understanding of processor bugs has evolved to include detailed analysis of hardware flaws, such as the Intel Xeon E5-2650 v4 (Broadwell) issue that caused unexpected core dumps. This has led to improved hardware validation processes and a deeper appreciation for the potential for hardware-level issues to manifest as software crashes.
Cloudflare's understanding and operation of SYN packet handling in Linux has evolved to include detailed analysis of the SYN and Accept queues, their size limits, and the impact of application performance on connection acceptance. This includes insights into SYN flood mitigation via SYN cookies and the behavior of TCP backlog parameters. The platform continues to refine its ability to manage and debug these critical networking components at scale.
Cloudflare has evolved its approach to engaging engineers with technical challenges, moving beyond theoretical discussions to practical, hands-on problem-solving. This post introduces a series of cryptography challenges, including password hashing, HSTS manipulation, and AES-256 decryption, designed to test and enhance practical security skills. The challenges are accompanied by hints and detailed solutions, demonstrating the application of tools like Hashcat and OpenSSL, and illustrating cryptographic concepts like the two-time pad attack. This initiative aims to foster a deeper understanding of security principles through active participation and problem-solving.
Cloudflare is actively addressing security anti-patterns in Internet of Things (IoT) devices, focusing on challenges related to software updates and TLS implementation. The company is developing network-level filtering solutions to compensate for unreliable device patching and is advocating for the adoption of TLS 1.3 and Elliptic Curve Cryptography (ECC) to mitigate the overhead and certificate size issues associated with TLS in resource-constrained IoT environments. The post also highlights the introduction of Cloudflare Orbit, a private network solution that provides a security shield before devices, allowing for network-level patching of vulnerabilities and an extra layer of authentication via TLS Client Authentication handled at the edge.
Cloudflare is evolving its Server header to simplify its identity from 'cloudflare-nginx' to a more generic 'cloudflare'. This change reflects the increasing complexity of Cloudflare's stack beyond just NGINX and anticipates future custom web serving or caching solutions. The transition is being rolled out in stages to allow dependent software to update.
Cloudflare's Go garbage collection tuning has evolved to optimize performance on multi-core machines by adjusting the GOGC variable. This post details how tuning GOGC can significantly improve throughput in scenarios with high allocation rates, such as benchmarks generating large amounts of short-lived data, leading to better performance scaling on many-core CPUs.
Cloudflare has developed PAL (Permissive Action Link), a tool to securely distribute secrets to Dockerized production applications. PAL addresses the challenge of bootstrapping service identity in containerized environments by allowing encrypted secrets to be decrypted at runtime after the service's identity has been established. It supports PGP and Red October for encryption and leverages container labels and cgroups for authorization, enabling secure access control for secrets and facilitating secure multi-party operations.
Cloudflare's TLS cryptographic modes and vulnerabilities management has evolved to proactively address emerging threats and improve security. This includes modifying OpenSSL to prevent the use of RC4 for TLS 1.1 and above, introducing ECDSA, and continuously evaluating cipher suites to ensure optimal security for customers, such as by utilizing Perfect Forward Secrecy. The company maintains a public GitHub repository (sslconfig) to track the history and current state of its SSL configuration, and has now deprecated RC4 as a preferred cipher suite, prioritizing AES-based ciphers for improved long-term security and to mitigate risks associated with RC4's known weaknesses and potential future breaks.
Cloudflare's platform has evolved to support robust automated API testing. This includes leveraging tools like Guzzle for HTTP client functionality and PHPUnit for assertion-based testing. The framework allows for the simulation of HTTP requests against APIs, verification of response status codes, content types, and response bodies. This enables developers to integrate comprehensive API testing into their CI/CD pipelines, ensuring reliability and productivity in API development and evolution.
This post details how to securely expose Go services to the internet by hardening the `crypto/tls` and `net/http` stacks. It covers TLS configuration, timeouts, HTTP/2 considerations, TCP Keep-Alives, and best practices for using `ServeMux` and logging. The post emphasizes the importance of upgrading to Go 1.8 for critical bug fixes and performance improvements in TLS and HTTP/2 handling.
Cloudflare's internal DNS resolution has evolved to address transient network issues, specifically packet loss, that could lead to spurious NXDOMAIN errors. The system now incorporates improved client-side handling of timeouts and retries, and a more robust understanding of how search domains interact with DNS failures. This ensures more reliable DNS lookups within the internal cluster, even under adverse network conditions.
Cloudflare has open-sourced its internal UI framework, cf-ui, built on React and Redux. This framework includes over 50 packages with dozens of components, utilities, and test helpers. It utilizes Lerna for managing a multi-package repository structure, enabling independent versioning and code sharing. The framework introduces 'builder' components that can be directly tied to Redux state, simplifying integration. It also includes integrated test utilities for Mocha, Sinon, and Redux, and wraps external APIs to allow for confident changes to underlying modules. Accessibility improvements were a key focus during the rewrite, with open-sourced libraries for keyboard navigation and focus management.
Cloudflare's support for WebSockets has evolved from an initial offering for Enterprise customers to general availability for all plans, with resources allocated based on plan level. This expansion aims to enable a wider range of real-time applications, such as chat, games, and collaborative editing, by providing a persistent, bidirectional communication channel that significantly reduces latency and HTTP header overhead compared to polling solutions. The underlying infrastructure has been scaled to handle the unique connection profiles of WebSockets, including addressing challenges with ephemeral port exhaustion and connection tuple limitations through techniques like SO_REUSEADDR and expanded ephemeral port ranges.
Cloudflare has developed and open-sourced a suite of command-line tools (mmsum, mmwatch, mmhistogram) to aid in data analysis and visualization. These tools provide capabilities for generating ASCII histograms, monitoring real-time rate of change for command output, and summing lists of floating-point numbers. This expands the internal tooling available for engineers to quickly understand and process data from various sources, including network traffic and system metrics. This post details the creation of a tool to check for vendored dependencies in Go projects using static analysis.
Cloudflare's approach to preventing HTTP request loops has evolved from implementing RFC 7230 compliant 'Via' header checks to actively addressing non-compliant proxy services that strip or modify these headers. This involves educating the industry and collaborating on solutions to ensure robust protection against resource exhaustion and denial of service attacks caused by such loops.
This post introduces a method for collecting Go test coverage data for end-to-end tests by creating a dummy test that executes the main function and running it with coverage enabled. It also details how to merge coverage profiles from unit and end-to-end tests using gocovmerge.
Cloudflare has fully embraced Go as a core language for its services, utilizing it for critical infrastructure components like DNS, SSL, and network compression. The company has developed and open-sourced various Go-based tools and libraries, including RRDNS for DNS infrastructure, Railgun for compression, Red October for cryptographic security, and SSL Bundler for certificate chain optimization. This adoption extends to experimentation with related technologies like CoreOS and Docker, and contributions to the Go language itself.
Cloudflare's engineering blog has explored various aspects of Go programming, including performance optimization and debugging. This post details the internal workings of the Go standard library's `net/http` client, specifically focusing on its connection pooling mechanism and the concept of 'late binding' to minimize roundtrip latency. The post illustrates how the client intentionally races between dialing a new connection and retrieving an idle connection from the pool, and how this mechanism.
Cloudflare has developed and contributed a 'single RX queue mode' to the Netmap project. This allows for kernel bypass on selected RX queues of network interfaces, enabling user-space applications to handle high packet rates for specific traffic flows while leaving other queues to the standard Linux kernel network stack. This is crucial for mitigating large packet floods and improving performance on NICs that do not natively support advanced kernel bypass features.
Cloudflare's image optimization capabilities have evolved to include significant performance improvements for jpegtran, a key tool in its Polish product. This involved profiling and applying SIMD instructions to accelerate Huffman coding and zero-value skipping, resulting in a 2.25x speedup for jpeg image processing. This optimization directly contributes to faster website performance for customers by reducing image sizes more efficiently.
Cloudflare's ability to track and analyze adoption rates of new operating system versions and their impact on network traffic, including IPv6 adoption, has been demonstrated through detailed analysis of user agent strings. This capability allows for real-time insights into global internet trends and the impact of major technology releases.
Cloudflare has optimized compression libraries, including a fork of zlib, to improve performance and compression ratios. This fork incorporates modern C practices, improved hash functions, hardware instructions (iSCSI CRC32, PLCMULQDQ), SIMD instructions, and optimized longest-match functions. Benchmarks show significant speedups and better compression rates compared to standard zlib and other implementations, making it suitable for applications like DNA sequencing file compression and image optimization.
Cloudflare's Go linker flags have evolved to directly embed version and build time information into binaries using the `-X` linker option, simplifying the build process and improving maintainability compared to older Makefile-based methods.
Cloudflare is developing and adopting advanced tooling for Go development, focusing on improving the debugging experience and enabling more robust software delivery processes. This includes the adoption of source-rewriting debuggers like godebug and the exploration of standardized frameworks for build process enhancements.
Cloudflare leverages low-level ASCII character manipulation techniques, such as bitwise AND operations, to optimize performance in high-throughput scenarios like DNS packet filtering. This involves understanding character set limitations and implementing efficient comparison algorithms.
Cloudflare's engineering practices have evolved to leverage Go interfaces for enhanced testability and modularity in software development. This approach simplifies unit testing by allowing for the creation of dummy implementations of complex components, isolating the logic under test. This capability is fundamental to building robust and maintainable software systems. This post details a common pitfall when using closures with goroutines in Go, where shared loop variables can lead to unexpected behavior. It provides a solution by passing the loop variable as a parameter to the goroutine's function.
Cloudflare has evolved its data replication mechanisms to ensure secure data transfer between data centers. Initially, data was replicated in plaintext. This has evolved to include mutually-authenticated encryption tunnels using TLS, preventing unauthorized parties from reading or modifying data in transit. This enhancement is crucial for distributing sensitive data like session ticket keys and DNS information across Cloudflare's global network.
Cloudflare's Go runtime stack management has evolved from segmented stacks to stack copying. Segmented stacks allowed stacks to grow and shrink on demand but suffered from a 'hot split' problem where shrinking was expensive. Stack copying addresses this by doubling the stack size on growth and making shrinking a free operation. This transition required a rewrite of large parts of the runtime in Go to ensure pointer information was available for garbage collection, enabling stack copying across the board. Special stacks are used for core runtime components like the scheduler and garbage collector.
Cloudflare's engineering practices have evolved to leverage Go interfaces for enhanced testability and modularity in software development. This approach simplifies unit testing by allowing for the creation of dummy implementations of complex components, isolating the logic under test. This capability is fundamental to building robust and maintainable software systems.
This post introduces an analysis of global bandwidth costs, detailing how Cloudflare procures transit and peering. It breaks down the relative costs of bandwidth in North America, Europe, and Asia, explaining the impact of peering exchanges and transit provider competition on pricing. The analysis highlights Europe as the least expensive region due to high peering rates and cost-effective exchanges, while Asia presents higher transit costs due to less competition.
This post introduces the evolution of timekeeping in Go programs on Linux, detailing the transition from traditional system calls like gettimeofday to the more efficient vDSO (Virtual Dynamically linked Shared Objects) mechanism for clock_gettime. It highlights the performance improvements achieved by leveraging vDSO for time.Now and runtime.nanotime, and discusses the underlying Linux kernel system calls (time, gettimeofday, clock_gettime) and their respective precisions and behaviors. Benchmarks demonstrate significant speedups, especially for time.Now, compared to older Go versions and traditional system calls. The post also touches upon the importance of accurate timekeeping in various systems, including NTP and the Year 2038 problem.
Cloudflare has developed and open-sourced lua-capnproto, a high-performance serialization library for Lua, leveraging the Cap'n Proto protocol. This library enables efficient data transfer between programs and across data centers, offering significant performance gains over JSON and Protocol Buffers. The project aims to improve serialization speed and reduce network bandwidth usage for Lua-based services.
Cloudflare's approach to memory management in Go has evolved from manual buffer recycling techniques using channels and custom recyclers to leveraging Go's built-in `sync.Pool` for efficient memory management in long-running network services. This evolution aims to reduce memory overhead, improve performance, and simplify development by providing a robust mechanism for reusing objects and reducing garbage collection pressure.
Cloudflare's analytics system has evolved to accurately count page views by differentiating between full page loads and AJAX requests, providing more intuitive reporting for website owners.
Cloudflare's API has evolved to provide access to visitor IP data, enabling customers to gain deeper insights into traffic origins and identify potential attacks. This feature allows for programmatic retrieval of IP addresses and associated metadata within a specified time range, enhancing security and traffic analysis capabilities.
