Cloudflare Blog

Cloudflare’s blog is among my favorites. https://blog.cloudflare.com/

Check out the CloudFlare blog http://blog.cloudflare.com/ Here is a good read ( http://blog.cloudflare.com/technical-details-behind-a-400gbps-ntp-ampl… )

Cloudflare https://www.cloudflare.com/ | San Francisco, CA; London, UK; Singapore, SG; Urbana-Champaign, IL; Austin, TX; | VISA, ONSITE Cloudflare is building a better Internet. Our long term goal is to give every site the same performance, security, and reliability that major sites like Google and Facebook accomplish, without any specialized network hardware or complicated administration. We enhance millions of sites, including this one. We believe in working collaboratively with an emphasis on personal growth and responsibility. Working at Cloudflare lets you wear many hats, spearhead new projects, and shape your career. Product market fit is established, but there's a lot of great engineering, product, sales, and support work to be done. We're starting 2017 at 330 people, with plans to double that in the next year. We're always hiring for operations/SRE, sales, general systems engineering (mostly in Go, nginx, and network, as well as DNS at scale), and web development. Here's some specific roles we're keen to hire: 0) Engineering Manager -- We're looking for an Engineering Manager to lead our PlatOps team, and also generally looking for more managers. Our engineering management team is very strong and we are looking for experienced individuals to join. 1) Data Engineering(s) -- We have a ton of different technologies that our data engineers work with, and they are a really strong core team here. Kafka, PostgreSQL, Docker, Mesos, Marathon, Chronos, nginx, and so many more…

Cloudflare https://www.cloudflare.com/ | San Francisco, CA; London, UK; Singapore, SG; Urbana-Champaign, IL; Austin, TX; | VISA, ONSITE Cloudflare is building a better Internet. Our long term goal is to give every site the same performance, security, and reliability that major sites like Google and Facebook accomplish, without any specialized network hardware or complicated administration. We enhance millions of sites, including this one. We believe in working collaboratively with an emphasis on personal growth and responsibility. Working at Cloudflare lets you wear many hats, spearhead new projects, and shape your career. Product market fit is established, but there's a lot of great engineering, product, sales, and support work to be done. We're starting 2017 at 330 people, with plans to double that in the next year. We're always hiring for operations/SRE, sales, general systems engineering (mostly in Go, nginx, and network, as well as DNS at scale), and web development. Here's some specific roles we're keen to hire: 0) Engineering Manager -- We're looking for an Engineering Manager to lead our PlatOps team, and also generally looking for more managers. Our engineering management team is very strong and we are looking for experienced individuals to join. 1) Data Engineering(s) -- We have a ton of different technologies that our data engineers work with, and they are a really strong core team here. Kafka, PostgreSQL, Docker, Mesos, Marathon, Chronos, nginx, and so many…

CloudFlare https://www.cloudflare.com/ | San Francisco, CA; London, UK; Singapore, SG; Urbana-Champaign, IL; Austin, TX | VISA, ONSITE CloudFlare is building a better Internet -- performance and security optimization at the edge. Our long term goal is to give every site the same performance, security, and reliability that major sites like Google and Facebook accomplish, without any specialized network hardware or complicated administration. We enhance millions of sites, including this one. We're hiring for a variety of roles -- started 2015 at 128, ended around 220, doubling again in 2016. This is a perfect time to join -- product market fit is established, but there's a lot of great engineering, product, sales, and support work to be done. We've publicly said we're profitable and on track for long term independent success. You may wish to check out our blog to see the kinds of engineering work we do. (https://blog.cloudflare.com/). https://www.cloudflare.com/join-our-team has a listing of positions. We're always hiring for operations/SRE, sales, general systems engineering (mostly in Go, nginx, and network, as well as DNS at scale), and web development. Specific roles we're keen to hire include: 0) Great operations/SRE staff: operating our system at scale (80+ datacenters around the world, 24x7 coverage, >4 million sites) requires highly competent, hard-working, and communicative engineers. 1) Product designer(s) -- we're looking for great talent to help build UX…

CloudFlare | San Francisco, CA | Full Time | ONSITE CloudFlare | London, UK | Full Time | ONSITE | VISA We have new offices in both locations and are hiring for a lot of positions in engineering, security, and SRE. The big languages in use here are Go, C, and Lua, though we also have some projects in PHP and are hiring there too. Our positions are listed here: https://www.cloudflare.com/join-our-team But... if you're a great candidate and a perfect fit for CloudFlare, then even if there isn't a perfect role for you advertised on the jobs page please apply anyway. We are growing so fast that we do hire the right people and we recognise that our jobs page can lag behind our ambition. Special mention for all non-white, non-male candidates or those with jagged CVs ( http://www.georgeandersbooks.com/jaggedresume.html ) or lacking CompSci degrees... we really want to hear from you and you are encouraged to apply. If you're thinking of applying but would like to speak to someone first then drop me an email with some info (github, CV, whatever) and let me know what you're interested in working on and I'll intro you to whomever is best suited to answer your questions. My email is [email protected] . Finally, if you apply... read our blog to get a good idea what we do: https://blog.cloudflare.com/ . We're more than a CDN, and more than just security or DNS.

Here are some blog posts we wrote about CloudFlare's effects on SEO: http://blog.cloudflare.com/?search=seo&sort= Executive summary: while you should pick your vendor closely, we've worked with the major search engines to ensure that there will be no negative effect on your SEO rank. And, because search engines take speed into account with their rankings, most people see a moderate bump. One post we haven't ever written, but we should at some point, is the effect of our Always Online feature on SEO. One of the worst things that can happen to a site for SEO purposes is to have a search engine's crawler come and the server to be down. Crawlers are programmed to back off in these instances (lest they exacerbate to a struggling server's problems). That can quickly hurt rankings. Always Online, as well as the overall resiliency that CloudFlare provides, can help ensure that when a crawler comes to index your site its content will always be available. There's a bit about this in the following blog post: http://blog.cloudflare.com/an-american-story-surviving-the-crush-of-ho… But we should write more on it because it's probably more meaningful in terms of rankings for most sites than the speed boost we provide (since speed is a relatively small signal for ranking purposes).

Actually, regices with really bad running times are a known vulnerability class. For example (a) is exponential (factorial maybe?) and if you try to match user input against (a) someone who enters a long string of a followed by a single b will bring down your server. Oh you think you'll never write a regex like that? Think again. It took down all of Cloudflare once: https://blog.cloudflare.com/details-of-the-cloudflare-outage-on-july-2…

Also worth reading is the blog post by the Cloudflare CIO Sam Rhea on how they are actually using it internally, with some examples. https://blog.cloudflare.com/how-we-use-ai-with-cloudflare-os/

I wouldn't categorize it as a panic. Standards and security organizations are recommending moving to PQC based on projections of capability. CloudFlare and Google recently moved their timeline forward for PQC migration based on new data[1][2]. 1. https://blog.cloudflare.com/post-quantum-roadmap/ 2. https://blog.google/innovation-and-ai/technology/safety-security/crypt…

Sure! When Mythos was first announced, there was an obvious prediction to make: if what Anthropic says is even remotely true, the participants will start talking over the next few months about how Mythos has been a big deal for them. Then that happened (https://blog.mozilla.org/en/privacy-security/ai-security-zero-day-vuln… https://blog.cloudflare.com/cyber-frontier-models/, https://blogs.cisco.com/cisco-on-cisco/how-cisco-defends-against-ai-th… so I became convinced, although I shouldn't make it sound like I ever found the idea implausible. I might be un-convinced if someone published a clear technical explanation of what error these companies have all made. The only counterarguments I've seen so far are vague speculation about how bubble dynamics might incentivize them to say it worked great, and to me that's not persuasive.

https://blog.cloudflare.com/introducing-tld-insights-on-cloudflare-rad… Edit: I read it as .su followed by .com being highest in magnitude. .at is barely mentioned.

This is worth a read specifically for this section and the ones following it, re: custom vs. agentic-coding harnesses. https://blog.cloudflare.com/cyber-frontier-models/#why-pointing-a-gene… Claude Code's harness is remarkable for many use cases, particularly with 1M context sizes. But it's also limited when the scale of code or data to read becomes close to that, or exceeds it. The idea that a cluster of actors can work on a shared, structured set of context snippets, and have guidance around what is relevant to them, is an incredibly useful model outside of cybersecurity as well.

I recall this post[0] from cloudflare's CEO about when they terminated daily stormer back in 2017, and particularly this quote: > Like a lot of people, we’ve felt angry at these hateful people for a long time but we have followed the law and remained content neutral as a network. This is overall a very reasonable take and one I support from a player the size of Cloudflare: They should aim to remain as neutral as possible instead of enforcing arbitrary blocks on sites they disagree with. Now, this post is from nearly 10 years go and I'm sure there have been many more cases that happened since then, their methodology likely did evolve, but I don't mind them protecting any site, regardless of their opinion towards its content. [0] https://blog.cloudflare.com/why-we-terminated-daily-stormer/ [1] https://news.ycombinator.com/item?id=15031922

It does enable address space separation of secret keys from user space, which some people love: https://blog.cloudflare.com/the-linux-kernel-key-retention-service-and… https://www.youtube.com/watch?v=7djRRjxaCKk https://www.youtube.com/watch?v=lvZaDE578yc So it's not as simple as "should not exist". I agree though that there doesn't seem to be a valid need to expose authencesn to user space. Disclosure: I'm co-maintaining crypto/asymmetric_keys/ in the kernel and the author/presenter in the first two links is another co-maintainer.

The testing function seems a little simple since branch density is a factor. I still love this reference: https://blog.cloudflare.com/branch-predictor/ Should be titled: How I Learned to Stop Worrying and Love the Branch Predictor

I remember reading a CF blog post about crawler separation and responsible AI bot principles where they argue every bot should have one distinct purpose. Now they're building crawling infrastructure themselves, and their own /crawl endpoint lists "training AI systems" as a use case alongside regular crawling. So not only are they in the crawling business now, they're not following the separation principle. To be fair, there's a business logic here. But it's hard not to notice the irony. https://blog.cloudflare.com/uk-google-ai-crawler-policy/

I believe cloudflare tries to work around that with Code Mode, right? https://blog.cloudflare.com/code-mode/ (but the OP is still useful for when classic MCP is needed)

I don't understand the fascination and focus on Vibe Coding. Sure, you can do that, it's an option, but no serious engineering effort is being left entirely up to the AI. Vibe coding is essentially the Jackson Pollock approach to software building. Throw a bunch of paint down, with very little control, and look, we have something novel. It doesn't mean your going to replace all the ways of making art with paint throwing. I'd love to start seeing more discussions about alternative approaches to working with AI. The recent Vinext article was great https://blog.cloudflare.com/vinext/. This seems to be "the way" for working with AI in a high stakes production environment, but what other ways are there. I fear the focus on vibe coding is diluting and taking focus away from far better alternatives. Maybe because the narrative around those aren't quite so dramatic?

I find it interesting that they bought Astro (https://blog.cloudflare.com/astro-joins-cloudflare/), which from my definitely-not-a-frontend-person perspective seems to tackle a similar problem to Next. A month ago. If it is so cheap to make something that they recommend using (rather than a proof of concept), why buy Astro (presumably it was more expensive than the token cost of this clone?). One conclusion is that, at the organisational level, it still makes sense to hire the “vision” behind the framework, rather than just clone it. Alternatively, maybe AI has improved that much in 1 month!

As a follow-up, Cloudflare came to the same conclusion: https://blog.cloudflare.com/bgp-route-leak-venezuela/ > The newsletter suggests “BGP shenanigans” and posits that such a leak could be exploited to collect intelligence useful to government entities. > > While we can’t say with certainty what caused this route leak, our data suggests that its likely cause was more mundane.

https://discord.com/blog https://blog.cloudflare.com/ https://netflixtechblog.com/

To be fair to Rust, the issue was an "unwrap" in the Rust code[0]. "unwrap" means "if the operation did not succeed then panic". Production Rust code should not use "unwrap", and should instead have logic to handle the failure case. You don't need exotic formal verification methods to enforce this best practice. You just need a linter. [0] https://blog.cloudflare.com/18-november-2025-outage/#memory-preallocat…

https://blog.cloudflare.com/how-cloudflare-is-using-automation-to-tack… Are you confusing their comments about (paraphrased) "horrible but legal" (up to a point) sites like dailystormer, 8chan, and kiwifarms, with actual blatant phishing sites? I find it very difficult to believe they won't remove sites involved in clear phishing or malware delivery campaigns, if they can verify it themselves or in cooperation with a security team at a company they trust. That's different from sites that are morally repugnant and whose members spew vitriol, but aren't making any particular threats (and even in cases where there are clear and present threats, CF usually seems to prefer to notify law enforcement, and then follow court orders, rather than inject themselves as a 3rd party judge into the proceedings).

While there is pingora https://blog.cloudflare.com/how-we-built-pingora-the-proxy-that-connec… I would recommend checking out envoy. Although not rust based, envoy has gained quite the repute for being extremely versatile and robust.

https://blog.cloudflare.com/enterprise-grade-features-for-all/ That's great - and maybe I'm cynical - but that's right where my mind went when I read that. Trading income for control isn't a bad game..

I wonder if the best solution is still just to create link mazes with garbage text like this: https://blog.cloudflare.com/ai-labyrinth/ It won't stop the crawlers immediately, but it might lead to an overhyped and underwhelming LLM release from a big name company, and force them to reassess their crawling strategy going forward?

Cloudflare has free AI Labyrinths if your goal is to target AI. The bots follow hidden links to a maze of unrelated content, and Cloudflare uses this to identify bots. https://blog.cloudflare.com/ai-labyrinth/

Yeah. Cloudflare writes some of the best ones in the industry, and they're very enjoyable to read: https://blog.cloudflare.com/tag/post-mortem/ I really do appreciate the transparency and ownership that comes with these. We all fuck up, but a lot of companies would rather hide their mistakes than own up to them. Cloudflare's approach makes me trust them more.

They don't make a secret of it: https://blog.cloudflare.com/log-analytics-using-clickhouse/ Clickhouse is great, but like any database if you run it at scale someone must tend to it.