Principal engineer @ Cloudflare Observability More active on BlueSky

Squamish, BC
Joined April 2012
Jeremy Morrell retweeted
Me and a band of plucky misfits (@maks_mak_0 and a few others), codename the Alertocats 🙀, have started rebuilding Cloudflare's whole notifications and alerting experience. First up: a brand new UI. Find it in the dash at Observability → Alerts 👇
8
13
5
69
3,344
Jeremy Morrell retweeted
Few people could help us understand such current design problems with as much respect for historical & human context as @Mappletons. In addition to being generally great, I also appreciated that I ended with more questions than I began, which accurately reflects how early we are.
New talk! About the divided human & agent worlds, boundary objects, and building thicker interfaces I've been exploring how to improve "planning", aka. deciding what agents should build, how you want it built, & making the whole team part of that process maggieappleton.com/planning-…
4
6
1
88
6,221
Jeremy Morrell retweeted
New talk! About the divided human & agent worlds, boundary objects, and building thicker interfaces I've been exploring how to improve "planning", aka. deciding what agents should build, how you want it built, & making the whole team part of that process maggieappleton.com/planning-…
35
59
18
612
60,008
more new OTEL tracing APIs in the Workers runtime from @JeremyMorrell: spanContext() setStatus() updateName() say it with me now — OpenTelemetry with zero dependencies developers.cloudflare.com/ch…
7
9
1
68
5,861
Jeremy Morrell retweeted
moving to SF and seeing some of your friends get rich but not you has always been the default experience
We're living in a horrifying, fascinating new era of Silicon Valley where: 1. You can build a startup in 9 months, get acquired (but rly acquihired) by OpenAI, Anthropic, or Cognition, and walk away a multi-millionaire 2. You can join the right company at 22 and become effectively post-economic And I don't think we've even begun to grapple with the degree to which this is warping an entire generation's relationship with money, ambition, work, and success. When your peers are making generational wealth before 25, what does a normal career even look like anymore
5
4
113
7,672
Jeremy Morrell retweeted
who wants to try an early preview of spend limits on cloudflare?? 👀👀👀
A lot of folks have asked for Spend management limits on @Cloudflare for some time now I've spent the last three months rebuilding our billing usage platform to enable this for our product catalog starting with Workers and Durable Objects and I'm pleased to give you a quick sneak peek 🫣 Shipping on Cloudflare for humans and agents shortly along with an engineering deep dive on how we did it Send me or @irvinebroque a DM if you want to try it early
73
10
1
201
10,850
Jeremy Morrell retweeted
Same for Workers Observability. @mattsimpsn dropped memory and cpu on the worker that ingests all the logs by like 50%
the beauty of building on our platform: we just used the new CPU profiler on the worker behind d1 improved CPU utilization by 30% and improved RPS throughput for customers 🤯
3
5
29
1,133
Jeremy Morrell retweeted
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
288
3,274
673
22,653
2,268,571
Jeremy Morrell retweeted
I was super critical for years that Cloudflare turns into a single point of failure for many sites. But the flipside is that it's also has a really good positive leverage affect on security. This is great stuff. xitter.cf/dok2001/status/2112811…
PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free. We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only. Patch as soon as @ThePHPF releases the update at 14:00 UTC today.
12
24
5
589
19,353
Jeremy Morrell retweeted
If you self host software, you really should put it behind either Cloudflare or Vercel’s firewall The firewall rules & data they have on how people try to run exploits are so critical right now
The Cloudflare's writeup on our php2shell response is up. Rules went live at 03:02 UTC, about 9 hours before disclosure. Unfortunately the vulnerability leaked early, so we were already watching attackers mutate payloads against the rules and updating as variants appeared. New rules keep landing in the WAF changelog. Expect updates through out the day. We will have a more thorough post of what we had to build to better protect people coming shortly. PHP runs almost 70% of websites. The flaw is in the runtime, so updating plugins won't fix it. Patch PHP. blog.cloudflare.com/php-vuln…
22
20
5
843
25,548
Jeremy Morrell retweeted
The new capability that we built to help defend php2shell is live. The @Cloudflare WAF now has full transaction detection that evaluates the request and the origin response together, and response rules block a match before it reaches the requester. Example from the post: unauthenticated hit on /admin that comes back 200 text/html. Block it. Auth failures and redirects can then pass through untouched. blog.cloudflare.com/full-tra…
The Cloudflare's writeup on our php2shell response is up. Rules went live at 03:02 UTC, about 9 hours before disclosure. Unfortunately the vulnerability leaked early, so we were already watching attackers mutate payloads against the rules and updating as variants appeared. New rules keep landing in the WAF changelog. Expect updates through out the day. We will have a more thorough post of what we had to build to better protect people coming shortly. PHP runs almost 70% of websites. The flaw is in the runtime, so updating plugins won't fix it. Patch PHP. blog.cloudflare.com/php-vuln…
6
60
10
446
104,488
Jeremy Morrell retweeted
!!
11
31
20
299
33,380
Jeremy Morrell retweeted
Progress! My eval reports now link directly to investigator traces, individual tool-call spans, and grader spans. You can click on a failed tool call's span ID, and inspect the command/error in context. Also according to my evals, Luna 6 is a weird little chaos gremlin.
1
1
84
Jeremy Morrell retweeted
I don’t think personal software will kill OSS and I think it’s very overrated. It’s super fun to jangle the keys in front of your own face and vibe code up a copy of something else that exists in this world. But truly owning it, operating it, having a vision for it kinda sucks! OSS still wins out on the a value proposition that it’s free and you can shunt those concerns off to someone else. The talking computers don’t actually know exactly what individual people want and most people don’t feel like just living with whatever an agent confabulated as a design and architecture. The future for OSS probably involves a token market where you can yield some tokens to allow a maintainer group make the right decisions for you.
4
2
1
23
945
Jeremy Morrell retweeted
🧠: Okay, so we are working on something really cool right now and want to present it to our peers in a technically proficient and approachab... 👄: GET IN BITCHES WE'RE DOING EVALS! Work in progress obviously, but stay tuned!
1
63
Jeremy Morrell retweeted
prototyping visualizations in the new cf cli got nerdsniped by @nevikashah
1
7
22
1,133
Jeremy Morrell retweeted
Workers Issues can detect and classify vulnerabilities scanning on your app If you get these pls go turn on waf u silly goose 🥰cloudflare.com/products/waf/
3
2
14
1,603
Jeremy Morrell retweeted
It's a shame Anthropic and OpenAI sub don't really give you programatic access to other models like text-to-speech and speech-to-text, so i've just been telling my agents to use the `cf ai run` command with *fantastic* results
6
3
90
4,701