matsur

We spend a lot of time and thought building out our incident management processes and tooling. We were not making things up as we went last night.

https://sre.google/resources/book-update/managing-incidents/ is Google focused, but our flavor of incident response is not too far off.

We blog regularly about what attacks we see and how we mitigate them. https://blog.cloudflare.com/tag/ddos/

Cloudflare | Product Managers (PM), Systems Eng (SDE), Reliability Eng (SRE), Design, lots more. | Remote, Austin, Champaign, Lisbon, London, Singapore, Seattle, SF, and more

Lots of roles open at Cloudflare in many disciplines and locations. https://www.cloudflare.com/careers/departments/

I'm specifically recruiting for PMs — please reach out to rustam @ if you're interested!

Said giant book: https://hts.usitc.gov/current

Cloudflare | Product Managers (PM), Systems Eng (SDE), Reliability Eng (SRE), Design, lots more. | Remote, Austin, Champaign, Lisbon, London, Singapore, Seattle, SF, and more

Lots of roles open at Cloudflare in many disciplines and locations. https://www.cloudflare.com/careers/departments/

I'm specifically recruiting for PMs — please reach out to rustam @ if you're interested!

https://blog.cloudflare.com/squeezing-the-firehose/ is our story of how we moved from lz4 to zstd (with a stop at snappy in between) in our kafka deployments. Results are/were similar to what Heap is reporting here.

Are you running TCP/UDP workloads or is NAT for any IP protocol needed?

We (Cloudflare) have got some things cooking here :)

I'd love to hear more about what problems you're trying to solve/features you'd like to see besides "cheaper" — can you email me at rustam at cloudflare ?

This is not what we observed. Less specific routes were still present in routing tables, but the more specifics that routed DNS traffic disappeared.

Yes, this. The beauty of the Unimog setup we run in production is we are resilient to ECMP rehash events — each server acting as a load balancer has access to state (backed by Consul) that tells it which flow belongs to which application server.

Cloudflare deploys software load balancers in all its datacenters, with every machine capable of acting as an LB for every other machine (and itself) within the datacenter. More here: https://blog.cloudflare.com/unimog-cloudflares-edge-load-bal...

Unimog is key to making the deployment described in the paper work.

Another way of thinking about this is that we have a single virtual load balancer (backed by all the physical machines in the DC) sitting in front of services that transform/terminate/filter/etc customer traffic.

Yes, Cloudflare behaves as you describe.

I'd be curious to hear about your experience and anyone else's using similar products — rustam@cloudflare if you want to chat. We're building out intrusion detection functionality and want to make sure we have more pros and fewer cons than the competition :)

The first internal demo of containers involved a bunch of CF employees playing Quake running on the edge :)

https://www.cloudflare.com/case-studies/wikimedia-foundation :)

Campy coming in with the 1x13! https://www.campagnolo.com/UK/en/ekar/1x13

/24 is the smallest block you can advertise on the Internet.

I work at Cloudflare. We offer protection for the "complex setups" you describe with BYO ASN, IP packet filtering + forwarding, and GRE (or PNI) for traffic return. And we're very good at it.

https://www.cloudflare.com/case-studies/wikimedia-foundation is an example deployment covering Wikimedia's datacenters.

As an aside from the paper, I'm a PM at Cloudflare and very interested in hearing from current IDS users on what you'd like to see out of the edge IDS we're building. Reach out to rustam @ cloudflare if you'd like to chat!

Yes, you can enable H3 support in the Cloudflare dashboard. We serve... lots... of H3 requests every second on behalf of our customers.

More on our blog https://blog.cloudflare.com/http3-the-past-present-and-futur...

The first jackets using Aerogel as insulation are just hitting the market. https://www.patagonia.com/product/mens-das-parka/85350.html?... is one example. The previous version of this jacket is a cult favorite; curious to see what reviews of the new Aerogel version look like.

CenturyLink requested depeering to give them some breathing room and stop the bleeding. Hug ops.

Specific isolation mechanisms depend on what products a customer is using. In general, there is additional encapsulation happening as data is ingested and before it's sent onward to customers.

Typical tiered memory hierarchies put more popular assets in faster tiers of memory. This post describes the opposite: putting less popular assets in faster tiers of memory to improve performance of the system.

Last mile networks do.

The product and engineering challenges involved in building out our network such that it is both performant and cost-effective to operate are fascinating.

The easiest way to learn the answer to this sort of question is to come work at Cloudflare :)

Cloudflare | PM, Systems Eng (SDE), Reliability Eng (SRE), Design, lots more. | Austin, Champaign, Lisbon, London, Singapore, Seattle (Kirkland), SF

Lots of roles open at Cloudflare in many disciplines and locations. https://www.cloudflare.com/careers/departments/

I'm specifically recruiting for PMs — please reach out to rustam @ if you're interested :)

I’m on the product team at Cloudflare. If you run a throughput sensitive workload on Aspera or similar, I’d love to chat — rustam@cloudflare.com

It's much easier to get the adoption flywheel moving for new application and transport protocols than things farther down in the OSI stack.

To get critical mass for HTTP/3 we'll need large server implementations (eg Cloudflare) and large client implementations (eg Chrome and Firefox) to build support and drive adoption. Which is what is happening!

Contrast this to v6 adoption which requires software support _and_ support from hardware vendors, network operators, etc.

Nice catch! As you've noticed, we plan to keep tracking the new drafts as they come out. 22 was the current version at the time we drafted this post, and 23 is now live.