Matt Bullock (@mibullock) header
Matt Bullock (@mibullock) profile picture

Product @ Cloudflare. Views are my own and are usually pretty boring.

Chelmsford & London
Joined January 2011
Photo by Matt Bullock (@mibullock)Photo by Matt Bullock (@mibullock)Photo by Matt Bullock (@mibullock)Photo by Matt Bullock (@mibullock)Photo by Matt Bullock (@mibullock)Photo by Matt Bullock (@mibullock)Photo by Matt Bullock (@mibullock)Photo by Matt Bullock (@mibullock)Photo by Matt Bullock (@mibullock)Photo by Matt Bullock (@mibullock)
Until this morning I did not know caching existed… great write up and congrats to the team for shipping this!
1
1
208
Matt Bullock retweeted
Naive byte-range caching can waste gigabytes of origin bandwidth on small requests. We rebuilt our cache architecture in Pingora to coordinate partial fetches automatically, cutting R2 p99 latency in half. cfl.re/4z69e2d
11
14
7
120
15,390
PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulns. The rules are available to all customers, including free. This is a STOPGAP only. Patch as soon as @ThePHPF releases the update at 14:00 UTC today.
The NCSC is encouraging UK organisations to prepare for immediate updating of systems using PHP. Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated. For more⬇️ ncsc.gov.uk/news/critical-se…
5
318
Matt Bullock retweeted
The NCSC is encouraging UK organisations to prepare for immediate updating of systems using PHP. Where immediate remediation is not feasible, organisations should consider taking the system offline until it can be fully mitigated. For more⬇️ ncsc.gov.uk/news/critical-se…
81
902
211
3,444
1,038,137
Matt Bullock retweeted
Cloudflare Tracing is now in open beta 🚀 Our teams rely on traces everyday to understand what happens to a request as it moves through our platform. Cloudflare Traces brings that same visibility to you. ✅Get automatic spans throughout the entire request ✅Control what gets traced with trace rules ✅Propagate traces across your stack a la W3C trace context ✅Query traces through our dashboard, SQL API or Cloudflare MCP ✅Export traces to any OTLP-compatible destination
Introducing Cloudflare Traces Today we're launching Cloudflare Traces, a way for you to get an unprecedented view into requests going through Cloudflare! Why was a request blocked? Why did a request fail? Why was a request slow? Find out with Traces! blog.cloudflare.com/cloudfla…
9
21
3
146
12,684
Matt Bullock retweeted
1
2
212
Matt Bullock retweeted
Changing headers on your origin can be hard. sometimes these headers can impact your cache, so we tried to make it as easy as possible to do what you want to make sure we're caching as much as possible blog.cloudflare.com/introduc…
4
18
4,190
Your @Cloudflare Worker now has its own cache!
Workers Cache — Your Cloudflare Worker now has its own tiered cache in front of it: blog.cloudflare.com/workers-… Workers Cache is a programmable tiered cache between Workers — even between code running in the same Worker we’ve seen pretty much every approach to caching over the years from our customers, and Workers Cache is the direct result of everything we’ve learned it takes all the workarounds and clever hacks we’ve seen to make sites and APIs fast, and simplifies them down to writing JavaScript and returning Cache-Control headers you can use for so much — for us this is like shipping 12 different things on the same day first up — you can use it to place your app near your database, cache its responses, and run code in front close to users:
1
10
455
Given how much more Internet traffic AI Agents are going to create, we need new strategies to ensure the network can keep up. Here’s one…
4
11
100
17,905
😂😂😂
4
137
Me and my first week using @opencode….
4
147
Yesterday a quasi-judicial body in Italy fined @Cloudflare $17 million for failing to go along with their scheme to censor the Internet. The scheme, which even the EU has called concerning, required us within a mere 30 minutes of notification to fully censor from the Internet any sites a shadowy cabal of European media elites deemed against their interests. No judicial oversight. No due process. No appeal. No transparency. It required us to not just remove customers, but also censor our 1.1.1.1 DNS resolver meaning it risked blacking out any site on the Internet. And it required us not just to censor the content in Italy but globally. In other words, Italy insists a shadowy, European media cabal should be able to dictate what is and is not allowed online. That, of course, is DISGUSTING and even before yesterday’s fine we had multiple legal challenges pending against the underlying scheme. We, of course, will now fight the unjust fine. Not just because it’s wrong for us but because it is wrong for democratic values. In addition, we are considering the following actions: 1) discontinuing the millions of dollars in pro bono cyber security services we are providing the upcoming Milano-Cortina Olympics; 2) discontinuing Cloudflare’s Free cyber security services for any Italy-based users; 3) removing all servers from Italian cities; and 4) terminating all plans to build an Italian Cloudflare office or make any investments in the country. Play stupid games, win stupid prizes. While there are things I would handle differently than the current U.S. administration, I appreciate @JDVance taking a leadership role in recognizing this type of regulation is a fundamental unfair trade issue that also threatens democratic values. And in this case @ElonMusk is right: #FreeSpeech is critical and under attack from an out-of-touch cabal of very disturbed European policy makers. I will be in DC first thing next week to discuss this with U.S. administration officials and I’ll be meeting with the IOC in Lausanne shortly after to outline the risk to the Olympic Games if @Cloudflare withdraws our cyber security protection. In the meantime, we remain happy to discuss this with Italian government officials who, so far, have been unwilling to engage beyond issuing fines. We believe Italy, like all countries, has a right to regulate the content on networks inside its borders. But they must do so following the Rule of Law and principles of Due Process. And Italy certainly has no right to regulate what is and is not allowed on the Internet in the United States, the United Kingdom, Canada, China, Brazil, India or anywhere outside its borders. THIS IS AN IMPORTANT FIGHT AND WE WILL WIN!!!
2,334
6,998
1,354
33,526
9,500,046
I see Encrypted ClientHello (ECH) is trending with confusion. Here's some facts: ECH and VPNs are apples and bananas. Not even close. Do not use a (public) VPN to replace ECH. ECH tends to incentivize centralization. The more sites are behind a single ECH config, or public domain name, the more privacy it offers (in theory). This is why CDNs like Cloudflare can deploy ECH to great effect. Personal servers with 2-3 sites on them? Not so much. (Since IP addresses are NOT hidden with ECH.) ECH encrypts an "inner" TLS ClientHello using an "outer" ClientHello. The inner one is the "real" one containing the sensitive data like the true domain name, and the outer one contains only public information that is shared by all clients. The spec is basically done, not technically finalized yet. No significant changes expected. Web servers also need to be built and configured to support ECH. Most don't support this out-of-the-box. (@caddyserver does, with a DNS plugin for your provider.) Even when a server enables ECH, clients won't know how to use it unless you distribute your ECH configs, which includes the public keys. In practice, this is done by publishing a DNS record, since clients do DNS lookups for IP addresses anyway. DNS is plaintext. Womp womp. Thus, in practice, ECH will only work when clients/browsers are configured to use encrypted DNS (such as DNS-over-HTTPS or DNS-over-TLS). Yes, the circular dependency is somewhat ironic. Simply setting your DNS resolver to Cloudflare (1.1.1.1) or similar will not use ECH. Actually, your DNS resolver doesn't matter. It just has to be encrypted. In at least some browsers, like Chrome, you also have to set a feature flag to enable ECH. Then, you need to make sure you clear your DNS cache, particularly the one in your browser, to ensure it picks up the ECH keys from DNS records. In summary: Enable DNS-over-TLS/HTTPS in your browser (and clear its DNS cache). Set feature flag if applicable. That's it. It will take time before most sites support ECH. Do not rely on it generally yet. But a proper ECH implementation should never leak the true server name in the clear on the wire. Even if there's an issue with the ECH config the client uses (because, maybe the server updated its keys and the client got out of sync), the protocol has a way to resolve that securely if the implementation of ECH is good on both the client and server. There's a lot more to ECH you can learn about, start here: caddyserver.com/docs/automat…
3
6
1
25
3,255
Our local GitLab server has been under attack by @AnthropicAI, @Google, @OVHcloud and more! These companies have been hammering our GitLab server, trying to scrape every Haskell commit we made in our lab, resulting in the whole server becoming unresponsive! This is only today!
213
418
70
6,184
845,457
I missed the @Cloudflare earnings call last night did we rebrand?
4
462
if you have 128kb of headers on an HTTP request I have a lot of questions for you but it now just works on Cloudflare thanks to @mibullock
9
6
138
10,443
Our @vercel bill before @Cloudflare, and after Cloudflare proxy.
98
118
32
3,416
492,396
Sundays and every day feel a little different now that Erin is here. Grateful to my amazing wife and the brilliant doctors, nurses, consultants, midwives, and NICU team at #Broomfield Hospital for making daddy walks possible.
19
716