Archive

Category Archives for "Networking"

Cloudflare Workers and Containers now support inbound TCP connections and gRPC

AI is changing how people interact with computers, and voice is becoming an increasingly important part of that shift. Real-time assistants, AI-powered dictation, and other voice interfaces need low-latency communication between clients, models, and supporting services. Many developers use gRPC, a Remote Procedure Call (RPC) framework built on HTTP/2 and TCP, for this infrastructure.

Ever since Workers launched in 2017, we’ve been expanding their capabilities, including adding the ability to open outbound TCP connections and a JavaScript-native RPC system built on Cap’n Proto. And so as part of Agents Week, we’re extending Workers in the other direction, supporting inbound TCP connections and adding new ways to run gRPC applications on Cloudflare.

Today, we’re announcing:

  • connect(socket) — a new handler in the Workers runtime that lets your Worker directly accept an inbound TCP socket provided by Spectrum (Cloudflare’s ingress proxy for non-HTTP traffic)
  • Full-duplex, bi-directional gRPC from Cloudflare Containers — forward the socket from your Worker to your gRPC server running in a container
  • Workers can serve unary and server-streaming gRPC APIs and call gRPC servers — you write your code using gRPC-web, and Cloudflare automatically converts incoming and outgoing requests to gRPC

We’re introducing this in private beta — Continue reading

Welcome to Agents Week

This week is Agents Week.

As we started thinking about and planning the week, we wrestled with a broader question of what it means to support this new era of agents and what a purpose-built foundation for agents actually looks like.  Which brought us to a simpler framing: what is an Agent Cloud? 

We quickly realized however, that our framing was wrong. Not because it’s the wrong question to ask, but because of who we were asking — ourselves, instead of our agents. It’s no longer about us and what we think, but about what agents need. 

That, in a nutshell, is what Agents Week is about. 

The cloud we have today, and the web it sits on, were built for people. Every layer assumes a human is watching: pages designed to hold your attention, dashboards to click through, interfaces tuned for how we read and decide. But agents don't work that way. They don't get distracted, tired or fatigued…  and they have their own needs around speed, structure, and access.

An Agent Cloud has to do two things at once. It has to set us up for an agent-native future, where the primitives are built Continue reading

Worth Reading 080126


The honest target is goodput, meaning requests per second that actually met your latency targets. Count anything else and you are counting cold plates.

 


I find it strange that as a software industry, we put in so much effort to make our systems efficient to design, build, and scale with DevOps practices, cloud native architectures, event-driven functions, optimized databases and storage, and resource-sipping Lean IT — then we threw it all out the window when Big AI came along.

 


If there is one universal law in internet infrastructure, it is that no good intention goes unpunished by the practical realities of legacy software maintenance.

 


This Article updates and expands on 2012 research on encryption and globalization, analyzing what the authors call “Round 3” of the Going Dark Debate: the current controversies over end-to-end encryption (E2EE).

 


Using our unique position on the Internet, we took an investigative look at one of the well-known mandatory attributes in BGP, the ORIGIN attribute.

An API for MoQ: provision your own isolated relays

Last year, we enabled Media over QUIC (MoQ) on every Cloudflare server and opened the network for anyone to test. It provided a global MoQ endpoint, but not the isolation and access controls needed to run an application.

Today, we’re adding those isolation and access controls. The new MoQ provisioning API lets you create an isolated relay for your application and issue separate credentials for publishers and subscribers. The relays you create are available across Cloudflare’s network within seconds, with no servers to deploy, size, or load balance.
Cloudflare now supports the draft-14 and draft-16 versions of the MoQ Transport protocol with authentication support.

You can create relays through the API and the Cloudflare dashboard. They are completely free to use during beta.

A QUIC recap on MoQ

MoQ (originally short for Media over QUIC) is a new open protocol under development at the Internet Engineering Task Force (IETF), the standards body that also standardized HTTP, TLS, and QUIC. It is being developed in the open and will become a free public standard (an RFC) that anyone can implement. No single company owns it.

MoQ is a publish/subscribe system. A publisher sends out streams of data that have names, and Continue reading

IETF 126 in Space

The IETF does not launch rockets, or design spacecraft, or even work on radio systems and spectrum assignment, but it has been engaged in the standardisation of communications protocols used to communicate with these spacecraft. Here's a few topics that were presented at IETF 126.

DNS is infrastructure. It’s time to manage it that way.

Attackers aren’t always the reason for DNS failures — they can often be something much more routine. For example, the failure could result from regular domain management operations at the registrar level, as one Cloudflare 1.1.1.1 2025 DNS global outage last summer that lasted for 62 minutes. It occurred not because of a cyberattack, but a misconfiguration in their systems.  Anthony Eden, founder and CEO of DNSimple Beyond routing traffic, domains carry business value, intellectual property, and brand identity for enterprises, which is why those enterprises spend large sums on them. Those domains breathe inside the vendor dashboard — whether a registrar’s or a DNS host — and multiple stakeholders manage them manually, often leaving no record of who changed what.  When asked about the management gap, DNSimple — a developer-focused domain management automation and DNS hosting company — tells The New Stack, “Most engineers who are working at companies are already required to use tools like Terraform or Ansible to control all of their other services. So that means deploying servers and managing storage Continue reading

Dogfooding at scale: migrating cdnjs to Cloudflare’s Developer Platform

As of June 23, 2026, cdnjs, one of the Internet's busiest open-source CDNs, is running exclusively on Cloudflare’s Developer Platform. Along the way, cdnjs surfaced limits in the platform, and the platform grew to meet them.

cdnjs is a free, open-source content delivery network for JavaScript and CSS libraries. Instead of using a bundler or self-hosting jQuery, Bootstrap, or Lodash, you drop a <script> tag pointing to cdnjs.cloudflare.com and the library loads from Cloudflare's edge, instantly, anywhere in the world, with no signup, no API keys, and no rate limits. It's the infrastructure behind a significant portion of “intro to JavaScript” tutorials, CodePen demos, and Stack Overflow answers.

Community-driven, cdnjs is used on roughly 12% of all websites, a 48.3% share of the JavaScript CDN market. It serves an average of 108,000 requests per second, 9 billion per day, across more than 330 Cloudflare data centers, with a 98.6% cache hit rate. Pretty cool, Internet!

In 2011, when bundlers were exotic, npm was barely a year old, and "just drop a <script> tag" was how the web shipped JavaScript, Ryan Kirkman and Thomas Davis built cdnjs as a free, community-run mirror of every popular Continue reading

Some BGP Topics at IETF 126

The 126th meeting of the Internet Engineering Task Force (IETF) was held in Vienna at the end of July 2026. It’s a busy week with a large number of meetings and conversations. These are some notes from sessions that had BGP-related content that I found to be of interest.

Post-quantum authentication to origins is now supported

Cloudflare's Authenticated Origin Pulls and Custom Origin Trust Store now support post-quantum authentication.

Here we’ll explain how you can configure fully post-quantum secure mutually authenticated TLS connections to your origin server, dive into the engineering details of how we built it, make a shameful confession, and finally explain how this work fits into our overall post-quantum migration roadmap.

Reaching a major milestone

Our focus for the past several years has been in deploying post-quantum encryption to protect against harvest-now/decrypt-later attacks, where an attacker quietly stockpiles your encrypted data with the hope of decrypting it in the future with a quantum computer.

However, recent breakthroughs in quantum computing and cryptanalysis pulled the timelines for upgrading to post-quantum cryptography forward across industry and government and have caused us to shift our attention to deploying post-quantum authentication, to protect against attackers who will soon be able to use quantum computers to break classical credentials and carry out impersonation attacks.

In a previous post, we announced that Cloudflare is targeting 2029 for full post-quantum security, and laid out several milestones to hit along the way. We have reached the first of those milestones: our Authenticated Origin Pulls and Custom Origin Trust Store products Continue reading

DNS Topics at IETF 126

The 126th meeting of the Internet Engineering Task Force (IETF) was held in Vienna at the end of July 2026. It’s a busy week with a large number of meetings and conversations. These are some notes from sessions that had DNS topics that I found to be of interest.

HW084: Spatial Reuse in Wi-Fi

Jake Snyder joins Keith Parsons to explain the mechanics of spatial reuse in Wi-Fi. They discuss practical implementation, the trade-offs involved in increasing signal detection thresholds, and why effective RF design remains the primary method for optimizing network performance. Episode Links: Jake Snyder’s Website

The Consumable Space Data Center

I’ll admit that I’m already shaking my head when I hear someone talking about the concept of data centers in space. You’re always going to hear the same three points trying to sell it. There is unlimited solar power, no land or water constraints, and cooling in space is free because it’s cold. Sounds good in theory but physics always wins. The costs associated with the drawbacks means that what you’re being sold is entirely different from what is being delivered.

Lots of companies are jumping in to get into space. Starcloud, Axiom, Sophia Space, Google Project Suncatcher, and even the crazy million satellite promise from SpaceX want a piece of the action. However, read through the marketing and you’ll see that these companies aren’t building data centers in space. They’re really building disposable compute modules that just happen to be in space because calling them “data centers” is where you get your funding.

The hints are there if you look closely. Coverage of India’s space aspirations talk about plans to deorbit failed modules and replace them, much like Starlink satellites or mobile phones. Other consultants have talked about servicing and unit refreshes as the real Continue reading

MCP’s Auth Hardening: What the Six New OAuth SEPs Fix, and What They Still Don’t

In short, the MCP 2026-07-28 release candidate is getting attention for going stateless. The quieter story is a package of six SEPs that harden the protocol’s OAuth layer: issuer validation, credential binding, client type declaration, and cleanups around refresh tokens, scopes, and discovery. All six are worth shipping, and all six fix real failure modes. But they harden how a client authenticates to a server, and that was never the whole problem. Agent identity, per-request authorization, delegation, and audit still sit outside the spec. Which means they still sit with you.

The stateless core is soaking up most of the commentary on the new MCP release candidate, and fair enough: deleting the initialize handshake and the session ID changes how everyone deploys. But scroll past that section of the announcement and you hit six SEPs of authorization hardening that almost nobody is writing about. That’s a mistake. If you operate MCP servers that hold real credentials, this is the part of the spec that decides whether a confused client hands a token to the wrong party.

The final spec ships July 28, 2026. The release candidate was locked on May 21, and SDK maintainers are in a ten-week validation window Continue reading

1 … 5 6 7 8 9 … 3,531