From 0 to 20 billion – How We Built Crawler Hints

From 0 to 20 billion - How We Built Crawler Hints
From 0 to 20 billion - How We Built Crawler Hints

In July 2021, as part of Impact Innovation Week, we announced our intention to launch Crawler Hints as a means to reduce the environmental impact of web searches. We spent the weeks following the announcement hard at work, and in October 2021, we announced General Availability for the first iteration of the product. This post explains how we built it, some of the interesting engineering problems we had to solve, and shares some metrics on how it's going so far.

Before We Begin...

Search indexers crawl sites periodically to check for new content. Algorithms vary by search provider, but are often based on either a regular interval or cadence of past updates, and these crawls are often not aligned with real world content changes. This naive crawling approach may harm customer page rank and also works to the detriment of search engines with respect to their operational costs and environmental impact. To make the Internet greener and more energy efficient, the goal of Crawler Hints is to help search indexers make more informed decisions on when content has changed, saving valuable compute cycles/bandwidth and having a net positive environmental impact.

Cloudflare is in an advantageous position to help inform Continue reading

Enterprise networking, 2022: Applying remote-work lessons as employees return to the office

As employees return to the office, IT teams can apply the lessons they learned supporting remote workers to transform their networks.Technologies such as SD-WAN and secure-access service edge (SASE) could continue to be useful. Network-as-a-service, (NaaS), is still in its early stages but could provide agility when it comes to acquiring network equipment. But, as the chip shortage and broader supply-chain issues continue to plague the tech industry, IT must be prepared to make compromises and prioritize needs in order to complete essential network projects.Brandon Butler, a research manager at IDC covering enterprise networking, joins Juliet to discuss what enterprise networking trends he predicts to see in 2022.To read this article in full, please click here

Marvell’s Silicon Strategy: Optimized Components For Different Workloads

Marvell has been rapidly building itself into a diversified supplier of IT infrastructure components. Through a combination of organic growth and recent acquisitions, Marvell has expanded its quarterly revenue by almost 70 percent over the past two years to more than $3.9 billion over the last four quarters. 2021 sales were greatly aided by two […]

The post Marvell’s Silicon Strategy: Optimized Components For Different Workloads appeared first on Packet Pushers.

Protection against CVE-2021-45046, the additional Log4j RCE vulnerability

Protection against CVE-2021-45046, the additional Log4j RCE vulnerability
Protection against CVE-2021-45046, the additional Log4j RCE vulnerability

Hot on the heels of CVE-2021-44228 a second Log4J CVE has been filed CVE-2021-45046. The rules that we previously released for CVE-2021-44228 give the same level of protection for this new CVE.

This vulnerability is actively being exploited and anyone using Log4J should update to version 2.16.0 as soon as possible, even if you have previously updated to 2.15.0. The latest version can be found on the Log4J download page.

Customers using the Cloudflare WAF have three rules to help mitigate any exploit attempts:

Rule ID Description Default Action
100514 (legacy WAF)
6b1cc72dff9746469d4695a474430f12 (new WAF)		 Log4J Headers BLOCK
100515 (legacy WAF)
0c054d4e4dd5455c9ff8f01efe5abb10 (new WAF)		 Log4J Body BLOCK
100516 (legacy WAF)
5f6744fa026a4638bda5b3d7d5e015dd (new WAF)		 Log4J URL BLOCK

The mitigation has been split across three rules inspecting HTTP headers, body and URL respectively.

In addition to the above rules we have also released a fourth rule that will protect against a much wider range of attacks at the cost of a higher false positive rate. For that reason we have made it available but not set it to BLOCK by default:

Rule ID Description Default Action
100517 (legacy WAF)
2c5413e155db4365befe0df160ba67d7 (new WAF)		 Log4J Advanced URI, Headers DISABLED

Who Continue reading

An exposed apt signing key and how to improve apt security

An exposed apt signing key and how to improve apt security
An exposed apt signing key and how to improve apt security

Recently, we received a bug bounty report regarding the GPG signing key used for pkg.cloudflareclient.com, the Linux package repository for our Cloudflare WARP products. The report stated that this private key had been exposed. We’ve since rotated this key and we are taking steps to ensure a similar problem can’t happen again. Before you read on, if you are a Linux user of Cloudflare WARP, please follow these instructions to rotate the Cloudflare GPG Public Key trusted by your package manager. This only affects WARP users who have installed WARP on Linux. It does not affect Cloudflare customers of any of our other products or WARP users on mobile devices.

But we also realized that the impact of an improperly secured private key can have consequences that extend beyond the scope of one third-party repository. The remainder of this blog shows how to improve the security of apt with third-party repositories.

The unexpected impact

At first, we thought that the exposed signing key could only be used by an attacker to forge packages distributed through our package repository. However, when reviewing impact for Debian and Ubuntu platforms we found that our instructions were outdated and insecure. In fact, Continue reading

Switch vSphere Enterprise Plus license to vSphere Standard on a NSX-T enabled cluster

This article describes the strange workaround of switching VMware NSX-T enabled cluster from using vSphere Enterprise Plus license to vSphere Standard license with vDS licensed through NSX-T. I really hope that you will not need to go through this as it is quite like bringing the whole environment up from scratch. But if you have two clusters with enough resources it will enable you to do it without downtime. Environment on which this was tested is vSphere 7.0.2 and NSX-T 3.1.2 NSX-T as a network and security platform enables network functions to be virtualised on your vSphere cluster. The way

The post Switch vSphere Enterprise Plus license to vSphere Standard on a NSX-T enabled cluster appeared first on How Does Internet Work.

Highlights: Dynamic Negotiation of BGP Capabilities

The Dynamic Negotiation of BGP Capabilities blog post generated almost no comments, apart from the #facepalm realization that a certain network operating system resets IBGP sessions when the sole EBGP session goes down, but there were a few interesting comments on LinkedIn and Twitter.

While most engineers easily relate to the awkwardness of bringing down a BGP session to enable new functionality (Tearing down BGP session, as a solution reminds me rebooting a host, as a solution.), it’s not as easy as it looks. As Adam Chappell put it “Dynamic capability renegotiation does tend to sound a bit like changing the tyres while still moving. Very neat if you can pull it off but so much to go wrong…”

Read more …

Highlights: Dynamic Negotiation of BGP Capabilities

The Dynamic Negotiation of BGP Capabilities blog post generated almost no comments, apart from the #facepalm realization that a certain network operating system resets IBGP sessions when the sole EBGP session goes down, but there were a few interesting comments on LinkedIn and Twitter.

While most engineers easily relate to the awkwardness of bringing down a BGP session to enable new functionality (Tearing down BGP session, as a solution reminds me rebooting a host, as a solution.), it’s not as easy as it looks. As Adam Chappell put it “Dynamic capability renegotiation does tend to sound a bit like changing the tyres while still moving. Very neat if you can pull it off but so much to go wrong…”

Read more …

IPv4 Address Markets

We have come down a long and tortuous path with respect to the treatment of Internet addresses. The debate continues over whether the formation of markets for IPv4 addresses was a positive step for the Internet, or a forced decision that was taken with extreme reluctance. Let’s scratch at this topic and look at the formation of this market in IP addresses and the dynamics behind it and then look at the future prospects for this market.

Equinix expands adds more processors to its bare-metal service

Data-center giant Equinix has expanded its bare-metal services to offer CPU, GPU, and AI processors on its Equinix Metal service offering.The service now includes AMD’s Milan generation of Epyc processors, Ampere’s Arm-based Altra, and Intel’s Ice Lake generation of Xeon processors.[Get regularly scheduled insights by signing up for Network World newsletters.] In November, Nvidia and Equinix announced an expanded collaboration to bring Nvidia’s LaunchPad AI platform, which includes instant, short-term access to AI infrastructure, to nine Equinix International Business Exchange (IBX) data centers globally. Enterprise accounts can test AI apps on LaunchPad, then deploy and scale on Equinix Metal or Nvidia DGX Foundry, which are also running at Equinix. To read this article in full, please click here

Equinix expands adds more processors to its bare-metal service

Data-center giant Equinix has expanded its bare-metal services to offer CPU, GPU, and AI processors on its Equinix Metal service offering.The service now includes AMD’s Milan generation of Epyc processors, Ampere’s Arm-based Altra, and Intel’s Ice Lake generation of Xeon processors.[Get regularly scheduled insights by signing up for Network World newsletters.] In November, Nvidia and Equinix announced an expanded collaboration to bring Nvidia’s LaunchPad AI platform, which includes instant, short-term access to AI infrastructure, to nine Equinix International Business Exchange (IBX) data centers globally. Enterprise accounts can test AI apps on LaunchPad, then deploy and scale on Equinix Metal or Nvidia DGX Foundry, which are also running at Equinix. To read this article in full, please click here

Exploitation of Log4j CVE-2021-44228 before public disclosure and evolution of evasion and exfiltration

Exploitation of Log4j CVE-2021-44228 before public disclosure and evolution of evasion and exfiltration

In this blog post we will cover WAF evasion patterns and exfiltration attempts seen in the wild, trend data on attempted exploitation, and information on exploitation that we saw prior to the public disclosure of CVE-2021-44228.

In short, we saw limited testing of the vulnerability on December 1, eight days before public disclosure. We saw the first attempt to exploit the vulnerability just nine minutes after public disclosure showing just how fast attackers exploit newly found problems.

We also see mass attempts to evade WAFs that have tried to perform simple blocking, we see mass attempts to exfiltrate data including secret credentials and passwords.

WAF Evasion Patterns and Exfiltration Examples

Since the disclosure of CVE-2021-44228 (now commonly referred to as Log4Shell) we have seen attackers go from using simple attack strings to actively trying to evade blocking by WAFs. WAFs provide a useful tool for stopping external attackers and WAF evasion is commonly attempted to get past simplistic rules.

In the earliest stages of exploitation of the Log4j vulnerability attackers were using un-obfuscated strings typically starting with ${jndi:dns, ${jndi:rmi and ${jndi:ldap and simple rules to look for those patterns were effective.

Quickly after those strings were being blocked and attackers Continue reading

IBM, Samsung team on unconventional, super-efficient semiconductor

IBM and Samsung Electronics have designed what the tech giants call an unconventionally designed semiconductor that promises to reduce energy consumption by 85% over existing chips.The design would enable a ton of new applications including energy-efficient cryptomining and data encryption but also cell phone batteries that could hold a charge for over a week instead of days without being recharged, companies stated.[Get regularly scheduled insights by signing up for Network World newsletters.] The new semiconductor could also find its way into new internet of things (IoT) and edge devices that draw less energy, letting them operate in more diverse environments like ocean buoys, autonomous vehicles and spacecraft, the companies stated. To read this article in full, please click here

1 … 680 681 682 683 684 … 3,919