IPB203: The Death of NAT
Network Address Translation (NAT), a foundational element of IPv4, faces critical reassessment as IPv6 deployment shifts the landscape. Ed and Tom evaluate the evolving role of NAT, questioning whether traditional translation models remain necessary when stateful packet inspection offers more robust, transparent security solutions. Episode Links: “Fanboy” series – IPv6 and NATs – YouTubeHow we built saga rollbacks for Cloudflare Workflows
Cloudflare Workflows allows you to build durable, multi-step applications with built-in retries and state persistence across long-running processes. When a Workflow executes, each step can call external systems, retry failures, and persist state across restarts. But if one step fails, it may leave earlier work from completed steps in an inconsistent or partial state.
Today we’re shipping saga rollbacks for Workflows, allowing you to declare rollback logic within the step itself, in case of failure.
For example, consider a workflow for transferring funds between accounts at two different banks:
Debit from account at Bank A
Credit to account at Bank B
Send email confirmation to both account owners
What happens if Step 2, the credit to account at Bank B, fails? Once the debit succeeds at Bank A, the transaction is committed and the money has left its system. As the orchestrator of the transaction, you cannot simply “undo” the operation in Bank A's system. Instead, the money must be credited back to the account at Bank A through a new operation that semantically reverses the first one.
This pairing of an operation and its compensation logic is called the saga pattern.
Before today, developers had to implement their own Continue reading
Worth Reading: Appearing Productive in The Workplace
The Appearing Productive in The Workplace article I stumbled upon is yet another masterful description of how AI slop, used by Expert Beginners, wastes everyone’s time and energy. Try to have fun reading it, even though it may be way too close to the mark.
D2DO305: Scaling Human Connection in Tech Communities
Kyler and Ned are joined by former AWS Community Program Manager Jason Dunn to discuss what it takes to build and maintain a thriving tech community. Jason shares his “benevolent dictatorship” philosophy on community management, emphasizing the importance of authentic human connections. They also explore how AI can empower non-technical individuals to build custom solutions... Read more »Anycast-Only Gateways in EVPN Asymmetric IRB
In the previous blog post, I described how ARP works in an EVPN asymmetric IRB environment where the PE devices share an anycast MAC/IP address in addition to a unicast MAC/IP address. Today, let’s see how well things work if the PE devices have only the anycast MAC/IP address:
Packet forwarding in an EVPN asymmetric IRB design using only anycast gateways
Unlocking the Cloudflare app ecosystem with OAuth for all
Cloudflare provides services that help run 20% of the web, but we don’t do it alone. Developers on our platform use a myriad of tools and services from other companies too. Cloudflare provides a rich API for our platform that enables developers to create automations, CI/CD, and integrations that glue together the various parts of their infrastructure. Earlier this month, we announced self-managed OAuth, making it easier for customers to create and manage their own OAuth clients for delegated access to the Cloudflare API.
Cloudflare isn’t new to OAuth. If you’ve used Wrangler, or used integrations from partners like PlanetScale, then you’ve already used it. However, until now, third-party OAuth was only available through a small number of manually onboarded integrations, and was not available to developers more broadly. That meant developers building their own integrations had to rely on API tokens, which are harder to manage and a poor fit for many delegated application flows.
Over the last year, we onboarded a growing number of early partners while improving the consent, revocation, and security model behind Cloudflare OAuth. But as our Developer Platform grew and agentic tools drove demand for delegated access, it became clear that opening Continue reading
HS136: How AI Is Changing Enterprise Software Development (Sponsored)
AI can generate working code quickly. Building reliable software to run infrastructure platforms is still a multi-year engineering challenge. In this sponsored episode, BlueCat chief strategy officer Andrew Wertkin joins John Burke and Scott Robohn to talk through the difference between code generation and enterprise software development, and the challenges and opportunities of engineering reliability... Read more »
The post-quantum EO is an important milestone. Now it’s time to get to work
On June 22, 2026, President Trump signed Executive Order 14409, "Securing the Nation Against Advanced Cryptographic Attacks." The order sets a December 31, 2030, deadline for federal agencies to transition their most sensitive systems to post-quantum encryption, and a December 31, 2031, deadline for post-quantum authentication. The EO also directs federal contractors to comply with post-quantum Federal Information Processing Standards (FIPS) by the end of 2030.
We welcome this executive order. The U.S. government has a long track record of using federal leadership and procurement to drive adoption of new technologies across the broader industry. We've seen this work with IPv6, with routing security and the Resource Public Key Infrastructure (RPKI), and with DNSSEC, and we’re glad to see this tradition continue with post-quantum cryptography.
The EO is especially important at this moment because the timeline for Q-Day, the day that quantum computers can break the public-key cryptography used across the Internet, has been accelerated. In April 2026, Cloudflare moved our own target for full post-quantum security to 2029, following research breakthroughs from Google and Oratomic. This EO updates guidance from 2024, when the National Institute of Standards Continue reading
HW082: Employee or Independent Contractor in the Wi-Fi Industry?
Is it better to be an employee or an independent contractor in the Wi-Fi industry? Keith walks us through the good, the bad, and the ugly of both sides of the equation, offering a candid look at the financial and professional realities of each. Keith helps provide a framework for listeners to assess their own... Read more »PP115: Palo Alto Networks: Reality of 109 to 1: Securing Machine Identities and AI Agents (Sponsored)
Machine identities now outnumber human identities in the enterprise 109 to 1 — and most of them are running without the governance controls you’d never skip for a human employee. Service accounts, API keys, tokens, workload credentials, and a fast-growing population of autonomous AI agents: all of them need access, all of them can be... Read more »Chapter 2: Installing SONiC NOS
ONIE-Based SONiC Installation
Many
switch vendors have added SONiC NOS support to at least part of their switch
portfolio. Depending on the vendor and switch model, customers may be able to
order a switch with a vendor-customized SONiC version that is supported at the
same level as the vendor's own network operating system. Some vendors also
allow customers to run the community-based SONiC distribution.
The
support model for Community SONiC depends on the vendor. Some hardware vendors
provide full support, while others provide no support at all. Compared with
vendor-specific SONiC distributions, Community SONiC provides greater
flexibility because it can be customized, rebuilt, and adapted to customer
requirements. However, running a Community SONiC deployment without vendor
support or in-house expertise is generally not a recommended operating model.
Community
SONiC is typically installed by using ONIE (Open Network Install Environment)
[1],
a small open-source installation environment that provides a standardized
method for installing network operating systems on supported switches. Figure
2-1 illustrates a conceptual ONIE-based Community SONiC installation process.
If the switch is delivered with a vendor-specific SONiC distribution already installed, it may boot directly into that operating system without requiring a separate ONIE installation workflow. For Community SONiC deployments, Continue reading
Worth Reading: My Network is Talking Back Thanks to SuzieQ MCP
Claudia de Luna published a step-by-step description of how you can use SuzieQ data with an AI agent.
That’s definitely interesting, but I found the list of MCP resources at the end of her blog post even more valuable; that’s a keeper even if you never looked at SuzieQ (in which case you REALLY SHOULD).
How we found a bug in the hyper HTTP library
The Images service, built in Rust on Workers, runs on every machine in Cloudflare’s edge network. To handle client connections, we use hyper, an open-source HTTP library for Rust.
Last year, we introduced the Images binding to enable custom, programmatic workflows for processing remote images in Workers. At the end of 2025, we rearchitected the binding to provide a more direct, local connection between the Workers runtime and the Images service.
Shortly after rollout, we received reports that transformation requests from the binding were failing — but only intermittently and only for larger images. Even stranger, the responses for these requests returned a 200 status without any errors logged. The image data was simply cut short: A response that should have been two megabytes might arrive with a few hundred kilobytes instead.
We spent six weeks chasing a nearly invisible bug — a race condition that occurred only under specific conditions — in the hyper library that impacted how the Images binding returned processed image data back to the client. In the end, it took four lines of code to fix it.
When developers build on Cloudflare, they compose full-stack applications from a set Continue reading