Principal engineer @ Cloudflare Observability More active on BlueSky
Squamish, BC
Joined April 2012
- Tweets17.6K
- Following837
- Followers2.8K
- Likes108K
Jeremy Morrell retweeted
Me and a band of plucky misfits (@maks_mak_0 and a few others), codename the Alertocats 🙀, have started rebuilding Cloudflare's whole notifications and alerting experience.
First up: a brand new UI. Find it in the dash at Observability → Alerts 👇
Jeremy Morrell retweeted
Few people could help us understand such current design problems with as much respect for historical & human context as @Mappletons. In addition to being generally great, I also appreciated that I ended with more questions than I began, which accurately reflects how early we are.
New talk! About the divided human & agent worlds, boundary objects, and building thicker interfaces
I've been exploring how to improve "planning", aka. deciding what agents should build, how you want it built, & making the whole team part of that process
maggieappleton.com/planning-…
Jeremy Morrell retweeted
New talk! About the divided human & agent worlds, boundary objects, and building thicker interfaces
I've been exploring how to improve "planning", aka. deciding what agents should build, how you want it built, & making the whole team part of that process
maggieappleton.com/planning-…
"we need to use the relatively cheap and infinite labour of agents to construct rich layers of translation that serve humans really well"
see also xitter.cf/JeremyMorrell/status/2…
Jeremy Morrell retweeted
more new OTEL tracing APIs in the Workers runtime from @JeremyMorrell:
spanContext()
setStatus()
updateName()
say it with me now — OpenTelemetry with zero dependencies
developers.cloudflare.com/ch…
Jeremy Morrell retweeted
moving to SF and seeing some of your friends get rich but not you has always been the default experience
We're living in a horrifying, fascinating new era of Silicon Valley where:
1. You can build a startup in 9 months, get acquired (but rly acquihired) by OpenAI, Anthropic, or Cognition, and walk away a multi-millionaire
2. You can join the right company at 22 and become effectively post-economic
And I don't think we've even begun to grapple with the degree to which this is warping an entire generation's relationship with money, ambition, work, and success.
When your peers are making generational wealth before 25, what does a normal career even look like anymore
Jeremy Morrell retweeted
who wants to try an early preview of spend limits on cloudflare?? 👀👀👀
A lot of folks have asked for Spend management limits on @Cloudflare for some time now
I've spent the last three months rebuilding our billing usage platform to enable this for our product catalog starting with Workers and Durable Objects and I'm pleased to give you a quick sneak peek 🫣
Shipping on Cloudflare for humans and agents shortly along with an engineering deep dive on how we did it
Send me or @irvinebroque a DM if you want to try it early
I feel like a crazy person when I read advice like "throw out your unit tests, models produce good enough code" by the most AI-pilled when I suspect it's mostly just this
When listening to advice, make sure that person also has your same problems
I co-sign this take. Dashboards were always a junk drawer anyway.
realized i forgot to share the actual post,
tl;dr it's often faster for me to generate an entirely new view than to learn how to hold your interface the right way, excited to see this trend continues to develop
burcs.dev/notes/interfaces-a…
Jeremy Morrell retweeted
Same for Workers Observability.
@mattsimpsn dropped memory and cpu on the worker that ingests all the logs by like 50%
Jeremy Morrell retweeted
my lighting talk from cloudflare connect on building artifacts in 3 weeks is up!
youtu.be/D_tnYlZe5t8?is=LDkb…
Cursed idea I don't have time to play with: slop-fork celld's architecture into OCaml and run it in a unikernel
Jeremy Morrell retweeted
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
Jeremy Morrell retweeted
I was super critical for years that Cloudflare turns into a single point of failure for many sites. But the flipside is that it's also has a really good positive leverage affect on security. This is great stuff. xitter.cf/dok2001/status/2112811…
PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free.
We are seeing early attacks emerging and are updating mitigations as new vectors show up.
This is a STOPGAP only. Patch as soon as @ThePHPF releases the update at 14:00 UTC today.
Jeremy Morrell retweeted
If you self host software, you really should put it behind either Cloudflare or Vercel’s firewall
The firewall rules & data they have on how people try to run exploits are so critical right now
The Cloudflare's writeup on our php2shell response is up.
Rules went live at 03:02 UTC, about 9 hours before disclosure. Unfortunately the vulnerability leaked early, so we were already watching attackers mutate payloads against the rules and updating as variants appeared.
New rules keep landing in the WAF changelog.
Expect updates through out the day. We will have a more thorough post of what we had to build to better protect people coming shortly.
PHP runs almost 70% of websites. The flaw is in the runtime, so updating plugins won't fix it. Patch PHP.
blog.cloudflare.com/php-vuln…
Jeremy Morrell retweeted
The new capability that we built to help defend php2shell is live.
The @Cloudflare WAF now has full transaction detection that evaluates the request and the origin response together, and response rules block a match before it reaches the requester.
Example from the post: unauthenticated hit on /admin that comes back 200 text/html. Block it. Auth failures and redirects can then pass through untouched.
blog.cloudflare.com/full-tra…
The Cloudflare's writeup on our php2shell response is up.
Rules went live at 03:02 UTC, about 9 hours before disclosure. Unfortunately the vulnerability leaked early, so we were already watching attackers mutate payloads against the rules and updating as variants appeared.
New rules keep landing in the WAF changelog.
Expect updates through out the day. We will have a more thorough post of what we had to build to better protect people coming shortly.
PHP runs almost 70% of websites. The flaw is in the runtime, so updating plugins won't fix it. Patch PHP.
blog.cloudflare.com/php-vuln…
