An exposed apt signing key and how to improve apt security
Recently, we received a bug bounty report regarding the GPG signing key used for pkg.cloudflareclient.com, the Linux package repository for our Cloudflare WARP products.
Maybe there kinda is background-opacity?
I was reading Jake's "Cross-fading any two DOM elements is currently impossible" which is a wonderfully nerdy deep dive into how there is no real way to
Scaling the Practice of Architecture, Conversationally
Architecture need not be a monologue; delivered top-down from the minds and mouths of a centralised few. This article describes another way to do architecture; as a series of conversations, driven by a decentralised and empowering decision-making technique, and supported by four learning and alignment mechanisms: Decision Records, Advisory Forum, Team-sourced Principles, and a Technology Radar
A brief history of code search at GitHub
This blog post tells the story of why we built a new search engine optimized for code.
New tool: Mess with DNS!
New tool: Mess with DNS!
Charting the future of our bug bounty program
We’re tackling the industry-wide issue of scraping by expanding our bug bounty program to reward valid reports of scraping bugs and unprotected data sets. To the best of our knowledge, this is an industry first. Looking toward the future, we’re also launching new educational opportunities for researchers and hosting our first BountyConEDU — a three-day […]
Touch Design For Mobile Interfaces: Defining Mobile Devices (Excerpt) — Smashing Magazine
Before we can talk about how people interact, much less how to take advantage of that knowledge and design, it’s important to understand a bit about the history, the technology, and what today counts as a mobile touchscreen device at all. Touchscreens and our standard paradigms of interaction are not the same as the real physical world; touchscreen behaviors are as learned as the use of a mouse or
The future of Svelte, an interview with Rich Harris
In this 45-minute interview, hear Rich Harris (the creator of Svelte) talk about its plans for the future. Other topics include funding open-source, SvelteKit 1.0, the Edge-first future, and more.
Exploitation of Log4j CVE-2021-44228 before public disclosure and evolution of evasion and exfiltration
This article covers WAF evasion patterns and exfiltration attempts, trend data on attempted exploitation, and information on exploitation that we saw prior to the public disclosure of CVE-2021-44228.
Sanitizing Cloudflare Logs to protect customers from the Log4j vulnerability
Many Cloudflare customers consume their logs using software that uses Log4j, so we are mitigating any exploit attempts via Cloudflare Logs.
Think Without Boxes
What’s the one thing people can do to make their website better? Now that is a good question. One with many right answers, like improving performance, taking
Faulty logic
Ain't this the truth:
The Figma prototype challenge: 15 tips in 15 days
What we learned from 15 days of prototypes
You Can't Buy Integration
Commercial integration tools are a couple decades old now, but there has been little in the way of overarching architectural principles describing when and how to use them. In this article, I argue that “buy” decision mechanics have caused us to exaggerate the value proposition of such tools, often leading to mandates to use a certain integration tool over a general purpose language. I claim that
Using GitHub’s security features to help identify Log4j exposure in your codebase
Use GitHub’s security features to assess Apache Log4j exposure and, where possible, mitigate this vulnerability within your GitHub repositories.
How to define security requirements for your OSS project
Defining your security requirements is the most important proactive control you can implement for your project. Here’s how.
A Simple Kubernetes Admission Webhook
While adding a recent feature to our Kubernetes compute platform, we had the need to mutate newly-created pods based on annotations set by users. The mutation needed to follow simple business rules, and didn’t need to keep track of any state. Surely there must be a canonical solution to this simple problem? Well, sort of.…
Modifying Headers In HTTP(s) Requests In UI Automation Testing — Smashing Magazine
To be able to modify headers in a testing environment is a great thing to have, and a very powerful tool. It allows control over your application as one can bypass authentication, set cookies, and so on. In this article, Nafees Nehar explores some methods which allow modification of headers in an automation testing setup.
Maximum redirects, minimum effort: Announcing Bulk Redirects
Bulk Redirects is a new product that allows an administrator to upload and enable hundreds of thousands of URL redirects within minutes, without having to write a single line of code.
CSS-Tricks Chronicle XLI
Ya know, I used to do one of these posts after making a few podcast appearances I hadn't had a chance to link up yet, so I could share them. As fate would
File Scaffolding With Hygen
I read a recent Smashing Magazine post that included a recommendation for Hygen. I just happen to be doing quite a bit of new UI work in a Next.js app and the
Ship a Full-Stack App in Days with AWS Amplify Studio
Amazon has a vision with AWS Amplify. First, a premise:
Shadow Palette Generator
Josh's Shadow Palette Generator is a fantastic tool. The premise is that box-shadow pretty much always looks better when there are multiple layered shadows
Embrace the Platform
So what is the one thing that people can do is to make their website better? To answer that, let's take a step back in time …
