zackbloom

I work at Cloudflare. APNIC absolutely does not get individual DNS query logs. Their primary interest is in studying the other junk traffic which ends up hitting 1.1.1.1.

For the record, we don't build any sort of profile of DNS queryiers, map them back to any existing profile we have, or even keep the data you would need to have to do that.

I work at Cloudflare. We don't sell data of any form, and we don't keep anything which could map queries back to the individual who made them.

When we talk about aggregate data it's things like total number of queries made to 1.1.1.1, number made by AS, and geographic region. Its purpose is only to show us if people are using 1.1.1.1 and how that changes over time.

Cloudflare | Product Manager | Austin, SF | Onsite | Fulltime

I'm looking for developer-focused product managers. We are building new distributed compute and storage products with the goal of changing how people build everything which touches the Internet, and need empathetic, technical, and determined people who want to chart that course.

Cloudflare is a unique place to work where the Internet isn't just a playing field, it's something we can improve and change. Our ultimate mission is to help build the Internet we believe should exist in 2019 while maintaining the compatibility the world needs with the systems and protocols designed in the 70s and 80s.

You don't have to already be a Product Manager. I'm also interested in speaking with engineers who believe a role closer to product might be right for them.

Reach out -> zack@cloudflare.com

I think a generally cheaper and easier way to manage it would be to require all children, rich and poor, go to the same schools. The economic factors would change pretty dramatically for being a public school teacher.

It's worth pointing out we as a society are allowed to optimize for more than just shareholder value and the growth of our GDP.

There are advantages in being able to have a security barrier between your code and that of your customers, and that you can push releases etc without having to update every downstream consumer.

More importantly though, we're working on incorporating storage in a meaningful way.

Workers are network addressible which seems to directly respond to one of the complaints in the article. Beautifully, if you call one Worker from another they have a decent chance of running on not just the same server, but in the same process. When one Worker calls another its data doesn't even leave user-space, even if the two Workers are owned by different people. Imagine calling a third-party API and having your request never even need to leave the process to be handled.

What a great writer!

That would make me a little sad. I'm not excited about the idea that we figured out the ideal way for a program to be encapsulated in 1965 and it will never change.

Heh. Truthfully, what I'm most excited about right now is being able to start a worker in less time than it takes to make an internet request. When you can do that you get magical autoscaling and it becomes just as cheap to run it in hundreds of places as one. As long has you have to invest ~100ms of CPU to get one of these VMs running I'm not sure it will have quite the same economics.

There is a counter argument, if you continually shift your focus you will never allow your products to get to the point where they're really making money. Reusable stage two might be a year away, BFR five. That's four years of lost revenue.

It's because the IdPs most organizations use don't have the type of SSH flow you're talking about. For Cloudflare to authenticate you, you first have to go through your Okta, Google Apps, etc login flow which is browser-centric.

One of the fundamental truths or the move to the cloud has been large organizations which can focus on security tend to do it better than each of us doing our best alone. It just takes too many people to keep a modern system secure, that's unfortunate, but it seems true. All of the security failures we hear about tend to be in bespoke systems, not GCP or AWS.

Think how big the Earth is. How hard it would be to find a Xerox machine in the Amazon or the middle of the Atlantic if someone stuck it there. Space is much, much, bigger.

How are you defining 'healthy'?

Thanks for the suggestion, we'll look into integrating. There shouldn't be notable battery drain from the app though, it's not a VPN in the traditional sense.

No. We (Cloudflare) barely even store the data, we get rid of it as fast as we can.

It can be a privacy feature. It allows you to see exactly what the apps on your device are connecting to.

You can read some of the reaction here: https://www.cloudflare.com/cloudflare-criticism/

Your carrier's DNS may or may not be fast depending on how it is set up and who you use. In general 1.1.1.1 is faster than any of the other public DNS resolvers, and does a lot of preemptive caching that it's likely your ISP does not. Of course, it also doesn't sell your data which is a bonus.

It installs a VPN policy to do it, that's the only viable method on non-managed devices. There is another big difference as well, the app enables DNS-over-HTTPS which encrypts your DNS traffic.

We try to hold on to as few logs as possible, the goal of the project is improving privacy. You can read the full policy here: https://developers.cloudflare.com/1.1.1.1/commitment-to-priv...

No, the previous commenter was correct. You can run any WASM targeting language on Workers.

It's actually required to _start_ all requests within 15 seconds, they can take longer before completing.

Yes. One of our goals with this, not yet mentioned, is to get rid of the idea of availability zones or regions. Every worker runs in every data center. Any data center can be taken offline and traffic will be seemlessly rerouted at the BGP level.

I'm sorry you feel that way. In general we feel like our biggest target with this language are the millions of people who wouldn't care about TLS 1.3, or QUIC, etc if we didn't make it clear how important they are. To us it's not about the people who know and love CDNs, it's all the people who don't, we're trying to speak to.

The time limits for Workers are actual CPU time, not clock time.

What about our response was lacking to you? I can tell you from the inside that huge amounts of code are being moved to rust to prevent that type of vulnerability from ever happening again.

I think it's very reasonable that the best possible security is not implemented in microcode.

C/C++/Rust/Go all target WebAssembly.