Hasty Briefsbeta

All tags

#cloudflare

136 stories total

Bilingual

Building a better online editor for TypeScript
7 months ago
- Val Town offers an integrated web editor for TypeScript automations and applications with fast deploys.
- The previous editor was buggy and slow, but now it's rewritten to be fast, accurate, and open-source.
- The old system ran TypeScript in a Web Worker, which struggled with Deno compatibility and NPM module sizes.
- The new system uses Deno Language Server (DenoLS) in cloud containers, improving performance and compatibility.
- DenoLS runs remotely, handling NPM dependencies server-side, reducing browser load.
- The architecture includes a WebSocket-based LSP protocol, inspired by existing solutions but optimized for Val Town.
- A custom CodeMirror LSP client was built to support WebSockets, external renderers, and callbacks.
- Cloudflare Containers are used for deployment, ensuring user isolation and session persistence.
- The solution leverages Cloudflare's durable objects for routing and lifecycle management without custom stateful routing.
- Future improvements include Val Town-specific language server features and diagnostics.
- The entire system is open-sourced as vtlsp, including client, server, and proxy components.
Cloudflare Bankrolls Fascists
7 months ago
- US politics is exhibiting fascist tendencies, including mass state violence, deportations, and press censorship.
- Fascism is rising, with fascists present in the FOSS community, identifiable by their support for fascist ideologies.
- Cloudflare's sponsorship of projects like Ladybird and Omarchy is controversial due to their association with fascist leaders.
- Omarchy, an Arch Linux spin, and Ladybird, a web browser project, are criticized for their leaders' fascist views.
- David Heinemeier Hansson (DHH) of Omarchy and Andreas Kling of Ladybird have expressed fascist and racist ideologies.
- Cloudflare's funding of these projects raises ethical concerns about supporting fascist-aligned initiatives.
A simpler path to a safer Internet: an update to our CSAM scanning tool
7 months ago
- Cloudflare launched a CSAM Scanning Tool to help websites detect child sexual abuse material (CSAM).
- The tool uses fuzzy hashing to identify altered images with high confidence.
- Previously, site owners needed to create NCMEC credentials, but now the process is simplified, leading to a 1,600% increase in adoption.
- The tool scans cached content, blocks URLs with matches, and notifies site owners for further action.
- Cloudflare aims to make Internet safety tools accessible to all, not just large companies.
Cloudflare Email Service: private beta
7 months ago
- Email is crucial for user communication in applications, including signup validation, notifications, and invoices.
- Cloudflare announces Email Sending, a new feature for sending transactional emails directly from Cloudflare Workers.
- Email Sending integrates with Email Routing to form the Cloudflare Email Service, offering a unified developer experience.
- The service focuses on deliverability and speed, ensuring emails land in inboxes reliably and quickly.
- Cloudflare Email Service automates DNS configurations (SPF, DKIM, DMARC) for better email trust and deliverability.
- Developers can easily send emails using Workers with simple bindings, eliminating the need for API keys.
- The service supports testing locally with Wrangler and integrates with existing email frameworks like React Email.
- Email Routing allows processing incoming emails programmatically, enabling workflows like AI summarization and support ticket creation.
- Combining Email Sending and Routing enables end-to-end email solutions, such as automated support responses.
- Email Sending will be a paid feature under Workers, with pricing details to be announced later.
- The private beta for Email Sending launches in November, while Email Routing remains free and available now.
Cloudflare Data Platform
7 months ago
- Cloudflare announced the public beta of R2 Data Catalog, a managed Apache Iceberg catalog on R2 object storage.
- Three new products were introduced: Cloudflare Pipelines, R2 Data Catalog, and R2 SQL, forming the Cloudflare Data Platform.
- Cloudflare Pipelines processes events via Workers or HTTP, transforms them with SQL, and ingests them into Iceberg or R2.
- R2 Data Catalog manages Iceberg metadata and now includes compaction to improve query performance.
- R2 SQL is a distributed SQL engine for petabyte-scale queries on R2 data.
- The platform runs on Cloudflare's global infrastructure, supports open standards, and has no egress fees.
- R2 Data Catalog simplifies Iceberg setup and maintenance, with automatic compaction for better performance.
- R2 SQL allows serverless querying of R2 Data Catalog tables, with future plans for expanded SQL capabilities.
- Future updates include Logpush integration, user-defined functions, and enhanced R2 SQL features.
- The platform is designed to be easy to use with affordable, usage-based pricing.
Every Cloudflare enterprise feature, available to everyone
7 months ago
- Cloudflare is making nearly all features available to any customer without requiring enterprise accounts or sales interactions.
- Single Sign-On (SSO) is the first feature being made widely available, with more to follow in the coming months.
- Cloudflare commits to releasing all future features under this new model, avoiding enterprise-only periods.
- The initiative aims to democratize access to advanced tools, enhancing Internet security and speed for all users.
- Historically, some features were enterprise-only, creating a gap between large companies and smaller teams.
- Cloudflare is eliminating 'enterprise-only' features, improving accessibility and user experience across all customer tiers.
- Dashboard SSO is now available to all plans, with instructions provided for setup.
- GitHub is introduced as a social login provider for teams without a full-fledged identity provider.
- Cloudflare will extend this approach to other features, prioritizing those with broad impact.
- Some features, like Magic Transit, will be made available to all plans, despite their niche appeal.
- Pricing and billing models will be revisited to accommodate this new approach.
- Certain features, like the China Network, remain restricted due to legal complexities.
- Going forward, Cloudflare will not release 'enterprise-only' features, ensuring all new tools are immediately available to any customer.
- This strategy is expected to improve product development and accessibility, continuing Cloudflare's tradition of democratizing advanced tools.
マリウス – Thoughts on Cloudflare
7 months ago
- Cloudflare is criticized for becoming an oligopoly/monopoly, seen as a net negative for the internet.
- Cloudflare's security measures can be bypassed by bad actors using their own services.
- Cloudflare acts as a man-in-the-middle SSL-terminating proxy, raising privacy concerns (e.g., Cloudbleed incident).
- Cloudflare has ties to the US Department of Homeland Security and controversial business practices.
- Cloudflare has been accused of supporting politically sensitive and illegal activities while punishing open-source developers.
- Alternatives to Cloudflare are suggested to promote competition (e.g., Fastly, BunnyCDN, DigitalOcean Spaces).
- Users are advised to move domains away from Cloudflare and avoid letting CDN/hosting providers manage domain registrations.
- Browser extensions can help identify Cloudflare-reliant sites, but may compromise privacy.
- Despite occasional positive contributions, Cloudflare's dominance poses systemic risks to the internet.
Code Mode: the better way to use MCP
7 months ago
- MCP (Model Context Protocol) is a standard protocol for AI agents to access external tools.
- Traditional MCP usage exposes tools directly to LLMs, but converting tools into a TypeScript API improves performance and complexity handling.
- LLMs are better at writing code to call MCP tools than calling them directly due to extensive real-world TypeScript training data.
- MCP provides uniform connectivity, documentation, and authorization for AI agents, making it versatile for various APIs.
- Cloudflare Agents SDK now supports converting MCP tools into TypeScript APIs, enabling code generation for tool calls.
- Dynamic Worker Loading in Cloudflare Workers allows secure sandbox execution of AI-generated code without containers.
- Workers' isolates are lightweight, fast, and secure, making them ideal for running agent-generated code snippets.
- Bindings in Workers provide controlled access to MCP servers, enhancing security by hiding API keys and limiting network access.
- The new approach reduces token waste and improves efficiency by allowing LLMs to skip intermediate neural network processing.
Eliminating Cold Starts 2: shard and conquer
7 months ago
- Cloudflare introduced a technique to pre-warm Workers during TLS handshakes to eliminate cold starts.
- Workers have evolved to handle more complex applications, increasing cold start times beyond TLS handshake durations.
- Cloudflare deployed 'Worker sharding' using a consistent hash ring to reduce cold starts by routing requests to existing Workers.
- Cold starts involve fetching, compiling, and initializing Worker scripts, which have become more time-consuming.
- Worker sharding optimizes memory usage and reduces eviction rates by coalescing requests to fewer instances.
- Load shedding techniques ensure graceful handling of overloaded Workers without errors.
- Cap’n Proto RPC is used for efficient cross-instance communication and handling nested Worker invocations.
- Worker sharding reduced global eviction rates by 10x and improved warm request rates from 99.9% to 99.99%.
- Power-law distribution of traffic means sharding a small percentage of requests significantly improves efficiency.
- Future goals include further reducing cold start rates to achieve five 9's in warm request rates.
Is everyone switching to MoQ from WebRTC?
7 months ago
- Cloudflare's blog post on Media over Quic (MoQ) critiques WebRTC inaccurately, claiming it's predominantly peer-to-peer, which is not the case in modern architectures.
- WebRTC is often used with server-side elements like SFUs or MCUs, not just in peer-to-peer setups, as evidenced by stable usage metrics in Chrome.
- Video media servers have existed long before WebRTC, debunking the idea that WebRTC introduced server-based media routing.
- MoQ's adoption is minimal, with WebTransport metrics showing sporadic and failed experiments rather than widespread use.
- Cloudflare's post appears aimed at generating attention for MoQ, possibly to support internal advocacy efforts within organizations.
- Despite claims, there's no evidence of successful large-scale switches from WebRTC to MoQ, based on Chrome usage data.
Unpacking Cloudflare Workers CPU Performance Benchmarks
7 months ago
- Independent developer Theo Browne published benchmarks comparing server-side JavaScript execution speed between Cloudflare Workers and Vercel, showing Cloudflare Workers performing worse by up to 3.5x.
- Cloudflare investigated and found several small issues contributing to the disparity, including infrastructure tuning, JavaScript library differences, and test issues, leading to performance improvements for all customers.
- Key fixes included updating the scheduling algorithm to better handle CPU-heavy workloads and adjusting V8 garbage collector tuning, resulting in Cloudflare Workers now performing on par with Vercel in most benchmarks.
- Next.js performance on Cloudflare Workers was still lagging due to issues like unnecessary buffer allocations and inefficient streams adapters, with ongoing work to optimize OpenNext and submit patches to Next.js and React.
- Cloudflare identified and fixed a Node.js trigonometry performance issue, submitting a pull request to enable faster trig functions in Node.js, benefiting the broader ecosystem.
- Benchmark methodology issues were addressed, including running tests from the same data center to minimize network latency and ensuring consistent configurations between Cloudflare and Vercel tests.
- Cloudflare plans further improvements to the Workers Runtime, OpenNext, and V8, with a focus on closing the remaining performance gap with Next.js on Vercel and continuing to contribute to open source projects.
The web infrastructure revolt over Google's AI Overviews
7 months ago
- Cloudflare updated robots.txt files to influence Google's crawling practices for AI products.
- The change, called Content Signals Policy, responds to publishers' concerns over revenue loss due to Google's AI Overviews.
- Publishers argue AI answer engines like Google's reduce traffic to original content sources.
- Cloudflare's influence is significant, supporting nearly 20% of the web.
- AI companies are willing to pay for content but fear Google's free access creates an unfair advantage.
- Google's dominance pressures publishers to allow content use in ways they might not prefer.
- Since 2023, Google allows opting out of LLM training but indexing requires accepting AI Overviews via RAG.
Cloudflare blocked in Spain; Proton VPN signups surge 200%
6 months ago
- Spanish ISPs blocked Cloudflare IPs to prevent illegal La Liga streaming, affecting legitimate services.
- The block peaked on October 19, causing a 200% surge in VPN signups in Spain.
- Gamers of 'Blue Protocol' were notably affected, unable to play without a VPN.
- Cloudflare and RootedCON challenged the blocks in court but were unsuccessful.
- The block ended on October 20 after football games concluded.
- VPNs like Proton VPN helped users bypass the restrictions by routing traffic through other countries.
- The incident highlights the dangers of overreaching internet censorship in democratic societies.
Proposal to Prevent LaLiga Site-Blocking Innocent Sites Rejected in Spain
6 months ago
- LaLiga obtained a court order to block pirate streaming services but faced challenges due to Cloudflare's reverse proxy service, which hides webhost IPs behind shared Cloudflare IPs.
- LaLiga proceeded with blocking Cloudflare's shared IP addresses, leading to collateral damage complaints, but courts rejected these complaints.
- A Non-Legislative Proposal (PNL) was presented by the Galician Nationalist Bloc (BNG) to address the issue, advocating for precise domain/DNS blocking, host protocols, and disallowing IP blocking.
- The proposal was rejected in a vote (6 in favor, 17 against, 12 abstentions), with opponents arguing it ignored the economic impact on football clubs.
- LaLiga defended its blocking strategy as proportional and court-compliant, while criticizing Cloudflare for lack of cooperation.
- LaLiga's Global Content Protection Manager announced plans to seek global legal injunctions, citing EU Regulation 2015/2120 to justify ISP blocking of certain traffic.
From .com to .anything: Top-Level Domain (TLD) Insights on Cloudflare Radar
6 months ago
- The dot com boom in the early 2000s introduced Top-Level Domains (TLDs), which have since expanded to include ccTLDs, gTLDs, internationalized TLDs, and brand TLDs.
- Cloudflare Radar now features a new TLD page providing insights into TLD popularity, activity, and security, with links to Cloudflare Registrar for domain registration.
- Previously, Radar offered TLD insights scattered across different pages, including 'Most abused TLDs' from email security data and Certificate Transparency insights.
- The new TLD page ranks domains using DNS Magnitude, a metric estimating a TLD's visibility by considering unique client queries, with values ranging from 0 to 10.
- The ranking includes TLD types like gTLD, grTLD, ccTLD, iTLD, and sTLD, and shows delegated vs. non-delegated status, manager, and DNS magnitude.
- Surprisingly, the .su TLD (originally for the Soviet Union) ranks highest in DNS Magnitude, largely due to queries from the US, Germany, and Brazil.
- Individual TLD pages provide detailed insights, including general info, WHOIS data, DNS query volume, and Certificate Transparency data.
- Cloudflare Registrar supports over 400 TLDs, and users can register domains directly from the TLD pages.
- Future updates will include TLD name server performance insights, and current data is available via API, Data Explorer, and AI Assistant.
- Users can share TLD charts on social media and contact Cloudflare for feedback or suggestions.
Defending QUIC from acknowledgement-based DDoS attacks
6 months ago
- Cloudflare was notified of two QUIC-related vulnerabilities (CVE-2025-4820 and CVE-2025-4821) on April 10, 2025, via their Bug Bounty Program.
- The vulnerabilities involved improper ACK handling in the quiche library, potentially enabling DDoS attacks.
- Cloudflare patched the issues, with no evidence of exploitation or customer impact.
- QUIC relies on ACKs for network fairness and congestion control, similar to TCP but with added features like encryption and reduced handshake time.
- The vulnerabilities allowed malicious peers to manipulate ACKs, artificially increasing server send rates and potentially causing DDoS.
- Cloudflare implemented a dynamic CWND-aware skip frequency to mitigate Optimistic ACK attacks by making packet skipping unpredictable.
- The fix ensures fairness in network usage by adapting skip frequency based on the connection's send rate.
- Researchers Louis Navarre and Olivier Bonaventure responsibly disclosed the issue, also notifying other affected QUIC implementations.
Cloudflare just got faster and more secure, powered by Rust
6 months ago
- Cloudflare has upgraded its network software, reducing median response time by 10ms and improving performance by 25%.
- The new system, FL2, is built in Rust on the Oxy framework, replacing the older FL1 system based on NGINX and LuaJIT.
- FL2 introduces a modular architecture with strict rules to ensure explicit interactions between product logic, improving maintainability and performance.
- Oxy enables graceful restarts, reducing downtime during updates and improving reliability for long-lived connections like WebSockets.
- Cloudflare has gradually rolled out FL2, starting with free customers and progressively onboarding paying customers, with plans to fully retire FL1 by early 2026.
- FL2 uses less than half the CPU and memory of FL1, allowing Cloudflare to deliver more features efficiently.
- The migration to FL2 has been supported by a robust testing framework, automated rollouts, and feedback from the Cloudflare community.
- FL2 is more secure by design, leveraging Rust's memory safety features and strict coding standards to reduce vulnerabilities.
- Cloudflare plans to complete the migration of its HTTP & TLS termination service to Rust by early next year, further optimizing its network.
Oxy is Cloudflare's Rust-based next generation proxy framework
6 months ago
- Oxy is a modern proxy framework developed by Cloudflare using Rust.
- It serves as the foundation for several Cloudflare projects including Zero Trust Gateway and iCloud Private Relay.
- Oxy supports a wide range of protocols and allows for deep customization of proxy behavior.
- It enables multi-layer traffic processing, from L3 to L7, with features like traffic decapsulation.
- Oxy includes built-in tools for monitoring, logging, and security, such as TLS support and FIPS compliance.
- The framework is designed for high-load scenarios, offering extensibility and ease of configuration via YAML.
- Oxy's development follows an iterative approach, allowing for gradual feature addition and improvement.
- It distinguishes itself from Pingora, another Cloudflare proxy, by focusing on multipurpose use rather than handling obscure configurations.
- Future blog posts will delve deeper into Oxy's technical aspects and applications.
Cloudflare Tells U.S. Govt That Foreign Site Blocking Efforts Are Trade Barriers
6 months ago
- The USTR publishes an annual report on foreign trade barriers, influenced by industry input, including concerns from copyright groups about piracy.
- Cloudflare, a major network provider, has raised concerns about foreign site-blocking measures acting as trade barriers for U.S. tech companies.
- In Spain, broad IP blocking orders disrupt legitimate sites, causing collateral damage without judicial recourse.
- Italy's 'Piracy Shield' law imposes rapid blocking requirements, leading to overblocking and affecting services like Google Drive.
- France's new anti-piracy law risks automated IP blocking, potentially harming lawful services and cross-border operations.
- South Korea's revised Network Act mandates CDNs to block extensive URL lists, creating heavy compliance burdens.
- Cloudflare urges the USTR to address these barriers, conflicting with rightsholders' demands for more blocking measures.
- The USTR's 2026 report will reveal how these concerns are addressed.
What even are Cloudflare Durable Objects?
6 months ago
- Cloudflare Durable Objects (DOs) provide stateful serverless capabilities, allowing for long-lived connections and coordination without the operational overhead of traditional servers.
- DOs are unique per ID, ensuring global consistency and single-instance handling for specific IDs, unlike stateless serverless functions.
- They support multiple storage layers: in-memory state for active sessions, KV storage for metadata, SQLite for structured data, and external storage for large files.
- Parent-child relationships in DOs enable efficient multi-tenant applications by separating logical entities (e.g., workspaces and projects) into individual DOs.
- DOs can schedule operations with alarms, enabling just-in-time execution for tasks like subscription renewals without batch processing.
- The Hibernate API allows DOs to sleep while maintaining WebSocket connections, reducing costs and improving resource utilization.
- The Cloudflare Agents SDK simplifies building with DOs, offering features like WebSocket handling, HTTP routing, and task queues, even for non-AI applications.
- Common pitfalls include single-threaded processing per instance and the need to initialize DO identities explicitly.
- DOs are ideal for real-time collaboration, per-user databases, and coordinated tasks but not for large blobs or cross-user analytics.

first prev3next

About|Login

#cloudflare

Building a better online editor for TypeScript

Cloudflare Bankrolls Fascists

A simpler path to a safer Internet: an update to our CSAM scanning tool

Cloudflare Email Service: private beta

Cloudflare Data Platform

Every Cloudflare enterprise feature, available to everyone

マリウス – Thoughts on Cloudflare

Code Mode: the better way to use MCP

Eliminating Cold Starts 2: shard and conquer

Is everyone switching to MoQ from WebRTC?

Unpacking Cloudflare Workers CPU Performance Benchmarks

The web infrastructure revolt over Google's AI Overviews

Cloudflare blocked in Spain; Proton VPN signups surge 200%

Proposal to Prevent LaLiga Site-Blocking Innocent Sites Rejected in Spain

From .com to .anything: Top-Level Domain (TLD) Insights on Cloudflare Radar

Defending QUIC from acknowledgement-based DDoS attacks

Cloudflare just got faster and more secure, powered by Rust

Oxy is Cloudflare's Rust-based next generation proxy framework

Cloudflare Tells U.S. Govt That Foreign Site Blocking Efforts Are Trade Barriers

What even are Cloudflare Durable Objects?