prdonahue

Who cares if there’s a marketing component to it? P0’s efforts make the Internet more secure for everyone. ETA: They also need to draw attention sometimes to slow actors in addressing the fixes.

Yes, especially as compliance and regulatory frameworks continue to evolve and become more difficult to adhere to as mentioned elsewhere in the comments.

We're inherently faster than other "serverless" platforms due to the scale and homogeneous design of our network, and that network has presence in nearly 50% more cities than it did just 3 years ago. We were plenty fast enough then and we're even faster now.

Other things that customers (still) really care about: developer experience, ease of use, and cost. Nobody likes paying the AWS tax to move data around—they just want to use the best solution from the best cloud provider. Workers and the associated storage primitives allow them to pick and choose from the best that AWS, Azure, Cloudflare, GCP, et al. have to offer.

(Disclaimer: I'm a long time Cloudflare employee focused on App Sec, and I speak to customers regularly who look to Workers largely for compliance reasons, but I don't work on the Developer Platform business. Am sure my Dev Platform peers will chime in with more nuanced answers!)

SpaceVenture from the ex-Sierra Space Quest developers took 10+ years on Kickstarter. Easier to slip deadlines when you don’t have a studio making external commitments.

Do you have a support ticket # you can email me w/details (pat at cloudflare)?

We take every reported false negative as an opportunity to improve our DDoS mitigations, and these reports are very helpful.

As of a few weeks ago, you can now report FNs/FPs for Bot Mitigation directly in the dashboard, and we'll be expanding this pattern for use with DDoS Mitigation as well.

I agree this is a problem, and we're actively working to fix it.

Specifically, there's a ticket in progress to improve how bot mitigation handles requests for certain types of static content (including RSS feeds).

We're (Cloudflare) working on expanding our URL scanning tool, currently located within the Security Center "Investigate" tab.

Any feature requests or things you'd like to see that Cloudflare could do differently?

Happy to answer any questions about the offering.

Appreciate the speculation, but using Firefox does not increase your likelihood of being flagged as a bot nor does it increase your threat score.

(I’m responsible for Cloudflare’s L7 security products)

While we can’t comment on the specifics of any customer configuration, we do not block or challenge Firefox by default—either with our Bot Management products or with any other L7 security controls.

You can confirm this by signing up a free zone and making a request from Firefox.

Alternatively, you could just run Cloudflare Access and use stronger auth without having to worry about rate limiting: https://developers.cloudflare.com/cloudflare-one/tutorials/r....

> It ensures that they're protected against a trivial and fairly outdated set of threats. You might say that's better than nothing, but questionable protection leading to a sense of security is more dangerous than having nothing and knowing it (also, false positives).

Rules for remotely exploitable vulnerabilities like log4j are typically crafted within hours of a CVE being released, and deployed as quickly as possible to minimize false positives. I'm not sure I'd consider such threats "outdated".

> However, to the best of my knowledge they were unable to fully mitigate the threat ... Fundamentally, having a WAF in the face of log4j did nothing for you.

If you're only able to mitigate 9X% of a rapidly evolving zero-day and not 100%, should you not use a WAF at all? Security is about reducing risk, and raising the cost for attackers.

Cloudflare tracked and responded to active exploitation attempts[1] in the wild with updated rules, while imploring customers to patch, e.g., from our second CVE (CVE-2021-45046) post[2] discussing additional rules we deployed:

"This vulnerability is actively being exploited and anyone using Log4J should update to version 2.16.0 as soon as possible, even if you have previously updated to 2.15.0. The latest version can be found on the Log4J download page."

> You still have to patch everything, you still had to try and figure out if you'd been compromised, and you still had to update/alert your clients/customers.

Yes, of course. Nobody is arguing otherwise. Such is the nature of these massive vulnerabilities that pop up every few years.

[1] - https://blog.cloudflare.com/exploitation-of-cve-2021-44228-b...

[2] - https://blog.cloudflare.com/protection-against-cve-2021-4504...

Yes, the former. Think of it as orange clouding/proxying your email traffic.

After the deal closes, we plan to make it a single-click in the DNS dashboard (and elsewhere) to start filtering your email through Area 1's technology.

We'll talk more about plans in the near future on the Cloudflare blog.

Cloudflare employee here. When I graduated from college I left a publicly exposed box (in those days we had a flat, campus-wide /16 with no NAT'ing) server running in the basement of a dorm. I think they finally removed it and the DNS A record a year and a half later :)

The newest version removed the ability to use a local repo (on iCloud, etc.) and they force you to use their monthly cloud service vs. buying outright.

See here for more details: https://news.ycombinator.com/item?id=28145247.

Can you share data on how much latency this adds to TTFB?

Given the severity, we've also rolled this out to our Free plan customers, who don't otherwise have access to the WAF.

Stay tuned ..

Today we can help quite a bit by proxying TCP traffic using Cloudflare Spectrum, e.g., spoofed traffic will never reach origin as it can't complete a handshake, we can use things like SYN cookies to challenge source, etc.

In the future, there's a lot more we plan to do here.

Not really practical or effective to implement. The attacks more often than not come from botnets comprised of compromised consumer devices. You can’t just outright drop traffic from residential ISPs.

We didn’t disclose it at the time but this 17.2M rps attack came from (home) Mikrotik devices that were running proxy services: https://blog.cloudflare.com/cloudflare-thwarts-17-2m-rps-ddo....

Once you get to a certain scale, you don’t really worry about those vectors anymore.

The more interesting/difficult to mitigate attacks are those that complete handshakes (if TCP) and make fully formed requests at L7 that otherwise appear legitimate.

Drop me a note and I'll connect you with the right PM: pat at cloudflare.com.

We're hiring remotely for most roles these days, so long as you reside in a country where we're set up to hire people (tax presence, etc.).

So you can nick collide people, obviously.

No problem! Team is telling me that it was fixed in late May.

Can you check and confirm?

If you're still having issues please file a support ticket and email it to pat at cloudflare and I'll flag.

My point was there are no plan-specific limitations on disabling old TLS versions.

If you're unable to set a minimum version for Cloudflare Pages, that's a separate issue, which I'm going to flag for the team now (though sounds like they're probably already aware and planning to resolve when they can).

That's not true.

Any plan (including Free) can set a minimum TLS version of 1.2—or even 1.3 if you want.

Login to the dashboard, select your domain, click SSL/TLS → Edge Certificates → Minimum TLS Version.

(former CF SSL PM here)

The short answer is we don’t know yet. Our most pressing goal is getting solutions to customer problems in their hands as fast as possible (and learning from how they use it), and sometime the pricing lags this goal.

This was built by a team (Bots) that my team works closely with to bring to market, e.g., bot scores can be used in Firewall Rules and combined with other capabilities.

We’ll be working soon to determine pricing and exactly how this will be exposed in the product.

If you’re in interested in beta testing this, drop me an email and I’ll connect you with the right PM: pat at cloudflare.

Is that long? I backed a spinoff of Sierra's old Space Quest almost 9 years ago: https://www.kickstarter.com/projects/spaceventure/two-guys-s....

Still waiting patiently :)

Because it's really hard for your body to absorb, unless taken sublingually (or maybe with a fatty meal, given it's fat soluble).

All that matters is your serum level. 800IU may work for you, but you may need several times that. Best to just get it checked. People feel better at different levels, e.g., I seem to feel best around 35-40 ng/mL.

Check out Dr. Rhonda Patrick (@foundmyfitness) on the topic: https://www.youtube.com/watch?v=uc815fQn8iY.

Google is the ultimate arbitrager of data.

If you have data they can make better (creepier) use of, they'll pay a premium.

Can you elaborate on the "custom Host headers" ask?

Are you looking to rewrite the Host header as the request gets passed to the origin (without changing the resolution of the origin)? Or something more like domain fronting?

An example or two would be great so I can share with the team.