Favorite engineering reads from the Cloudflare archive

Cloudflare's engineering blog has accumulated a deep library of technical posts over the years, covering everything from transport protocols and cryptography to post-quantum research and notable Internet outages. To surface the best of that material, we asked staff and readers which posts stood out, producing the list below. It spans roughly a decade of writing, with each entry offering a detailed look at a specific engineering problem or Internet mechanism.

Network performance and protocol internals

A recurring theme in the archive is the effort to squeeze more performance out of fundamental Internet protocols. Optimizing TCP for high WAN throughput while preserving low latency describes how Cloudflare tunes TCP parameters in depth, covering the trade-offs involved in balancing throughput against latency. A companion piece, When the window is not fully open, your TCP stack is doing more than you think, digs into how Linux manages TCP receive buffers and windows and explains how to tune a connection for best speed. Related posts cover How to stop running out of ephemeral ports and start to love long-lived connections and Everything you ever wanted to know about UDP sockets but were afraid to ask.

On web performance, Early Hints in the real world presents in-depth data on how the Early Hints feature speeds up page loads, based on work done jointly with Google and Shopify. Another post examines the retirement of Internet Explorer after Microsoft ended support, looking at what the browser's demise meant for the web and how Edge took its place.

Security research and cryptography fundamentals

Several reader favorites focus on vulnerabilities and cryptographic mechanisms. The Hertzbleed attack is explained with a comparison to a long-distance runner: dynamic voltage and frequency scaling (DVFS) on modern CPUs creates a side channel that affects cryptographic algorithms. Don't confuse it with the older, more widely known Heartbleed bug.

In post-quantum cryptography, one highlighted post, Sizing Up Post-Quantum Signatures, was described by a reader as "life changing." It analyzes the relationship between post-quantum signature sizes and TLS connection quality, showing how signature bloat affects real-world web performance. A companion piece explores future-proofing the SaltStack configuration system against quantum attackers, and an explainer on HPKE covers the newly standardized Hybrid Public Key Encryption scheme. For a gentler introduction, Securing the post-quantum world walks through why quantum computers threaten modern cryptography, with The Quantum Menace suggested as a starting point.

From earlier years, the archive offers foundational primers: A (Relatively Easy To Understand) Primer on Elliptic Curve Cryptography breaks down one of the most widely used yet least understood cryptographic primitives. Why TLS 1.3 isn't in browsers yet explains the difficulty of upgrading security protocols across the Internet's complex ecosystem, a story continued in a 2021 update on handshake encryption (ECH). How to build your own public key infrastructure describes how Cloudflare protects data between its data centers, arguing that good security architecture requires multiple layers of defense. And for randomness, LavaRand in Production dives into the technical details of using a wall of lava lamps in the San Francisco office as a source of entropy to seed cryptographic randomness.

How the Internet works and breaks

Some of the most-read posts explain large-scale outages, using them as a lens into core Internet mechanics. Why Google Went Offline Today and a Bit about How the Internet Works (2012) set the tone for Cloudflare's outage coverage, discussing routing and route leaks after Google briefly dropped offline—an incident that ended with the note: "Just another day in our ongoing efforts to #savetheweb." That post is credited with inspiring at least one employee to join the company. The same pattern continued with Understanding how Facebook disappeared from the Internet (2021) and Cloudflare's view of the Rogers Communications outage in Canada (2022), both demonstrating how BGP, the glue that binds the Internet's networks together, plays a central role in large-scale failures. The Rogers outage, which lasted over 17 hours, appeared to stem from an internal error rather than an external attack.

Other posts explain the foundations. Welcome to Speed Week and a Waitless Internet lays out the physical limits of Internet speed, from electrons in wires to lasers in fiber optics, and why "the speed of light is really slow" when you're building a global network. The post covers bandwidth, latency, reliability, caching, cryptography, DNS, preloading and cold starts, with references hidden throughout—movies, books and board games.

SAD DNS Explained examines a 2020 side-channel attack against DNS that leveraged flaws in the networking stack of modern operating systems. It's a vehicle for explaining how DNS and spoofing work, and how the industry can prevent similar attacks through measures like DNS encryption and Oblivious DoH over 1.1.1.1. Privacy needs to be built into the Internet discusses the three phases of the Internet: connectivity first (up to the 1990s), security after SSL arrived in 1994, and now the push for an always-on, always-secure, always-private third phase.

At a higher level, 50 Years of The Internet: Work in Progress to a Better Internet marks the anniversary of the first network packet sent from UCLA to Stanford Research Institute on the ARPANET, tracing how that moment launched the modern Internet. Work on making the network's foundations faster and more private also includes the introduction of the 1.1.1.1 DNS resolver, launched in 2018, and the research into eliminating CAPTCHAs. On that topic, Cloudflare estimates humanity wastes about 500 years per day on CAPTCHAs—a motivation for the work on cryptographic attestation of personhood and, more recently, eliminating CAPTCHAs on iPhones and Macs using open standards.

Platform milestones and infrastructure history

Some of the most technically dense posts describe the creation of core Cloudflare infrastructure. Live-patching the Linux kernel includes full code and Makefiles showing how eBPF is used to patch kernel security vulnerabilities without rebooting. Unlocking QUIC's proxying potential with MASQUE offers an up-to-date deep dive into the QUIC transport protocol, related to HTTP/3 usage trends.

The archive also holds the history of Cloudflare's own platform. Introducing Cloudflare Workers documents when Cloudflare made its network programmable; by 2019, the company had trademarked "The Network is the Computer®" to describe that vision. The Cloudflare IPFS Gateway, introduced in 2018, provided a different way to access the web's content, using a peer-to-peer distributed file system rather than the traditional host-and-path model. And for something lighter, What's the story behind the names of CloudFlare's name servers? answers a question the company often fielded in its early days—with a nod to Apple co-founder Steve Wozniak among the answers.

Not every deep dive is about protocols and packet flows. How Ramadan shows up in Internet trends looks at traffic patterns in countries where many observe Ramadan, showing clear shifts in usage before dawn and after sunset. The piece draws on Cloudflare Radar data, which has also been used to track major outages and single events, from elections to the Eurovision Song Contest, the Queen's Platinum Jubilee and the release of the first James Webb Space Telescope images.

Two Twitter threads by Nick Sullivan, Cloudflare's Head of Research, round out the recommendations. The first explains in simple terms how privacy works on the Internet, along with the challenges of protecting it now and in the future. The second starts with an announcement—Cloudflare now allows experiments with post-quantum cryptography—before unpacking the meaning of acronyms like TLS, the encryption and authentication protocol that protects web requests.