Looking back on the GitHub Security Lab Capture The Flag: CodeQL and chill
One year ago, the security research team at Semmle launched its first Capture the Flag (CTF), as part of the Hack In The Box (HITB) Amsterdam conference. We wanted to…
How Dropbox Security builds tools for threat detection and incident response
GitHub Enterprise Server 2.21 is here
GitHub Enterprise Server 2.21 is now available with updates to simplify collaboration, increase reliability and improve security.
The App Sandbox
Batten down the hatches! The app sandbox is now enabled for all web content. This is a fancy way of saying we’ve dialed up the security of the app. It wasn’t unsafe before, but it’s double safe now. What is the “app sandbox,” what is it protecting against, and why does it matter? This post…
Using data science and machine learning for improved customer support
In this blog post we’ll explore three tricks that can be used for data science that helped us solve real problems for our customer support group and our customers. Two for natural language processing in a customer support context and one for identifying attack Internet attack traffic.
The Octopus Scanner Malware: Attacking the open source supply chain
This post details how an open source supply chain malware spread through build artifacts. 26 open source projects were backdoored by this malware and were actively serving backdoored code.
Tanium’s endpoint security meets Cloudflare for Teams
Deploy comprehensive zero-trust security by integrating Tanium with Cloudflare for Teams.
Giving credit for Security Advisories
Saying thanks is now a core part of the Security Advisory workflow.
Tackling Authentication With Vue Using RESTful APIs
Authentication (logging in!) is a crucial part of many websites. Let’s look at how to go about it on a site using Vue, in the same way it can be done with any
A Brief History of TLS Certificates at Shopify - Shopify
In this post, we’ll cover Shopify’s journey from manually provisioning TLS certificates to the fully automated system that supports over 1M businesses.
Hot lava: A case study in hunting for network integer arithmetic flaws
We examine the dangers of network integer arithmetic based on a case study of security vulnerabilities reported to the ntop project.
Capture the Flag 4—CodeQL and chill
Join our Capture the Flag challenge to use your CodeQL skills or learn new ones.
A single dashboard for Cloudflare for Teams
Cloudflare Access is now available in the Cloudflare for Teams UI. You can now manage application and threat security for your organization in a single dashboard.
DDoS attacks have evolved, and so should your DDoS protection
Building a modern DDoS solution that is truly effective in thwarting ever-evolving DDoS attacks, to protect all of our customers has been a core tenet for us - enabling us to be an industry leader.
Triggering garbage collection with rejected promises to cause use-after-free in Chrome
In this post I’ll show how garbage collections (GC) in Chrome may be triggered with small memory allocations in unexpected places, which was then used to cause a use-after-free bug.
How to build an effective DevSecOps culture
By prioritizing secure development alongside speed, DevSecOps helps you ship safer applications by making security part of your current DevOps pipeline.
Deploying Gateway using a Raspberry Pi, DNS over HTTPS and Pi-hole
Like many, I work remotely and want to show how to deploy Cloudflare Gateway from home. Its DNS filtering protects networks from malware, phishing, ransomware, and other security threats effectively.
Dropping hashes: an idiom used to demonstrate provenance of documents
There exists an idiom called “dropping a hash” which is widely understood in the security community and not widely understood elsewhere. Somewhat surprisingly, there does not appear to be a canonical explanation. I have dropped hashes before and wrote this up to explain the significance of it to non-specialists.
Git credential helper vulnerability announced (Update)
Learn more about the security vulnerabilities affecting Git 2.26.1 and older.
Sawfish phishing campaign targets GitHub users
A phishing campaign targeting our customers lures GitHub users into providing their credentials (including two-factor authentication codes). Learn more about the threat and what you can do to protect yourself.
Git credential helper vulnerability announced
Learn more about the security vulnerabilities affecting Git 2.26 and older.
Cloudflare for SSH, RDP and Minecraft
Cloudflare now covers SSH, RDP and Minecraft, offering DDoS protection and increased network performance. Spectrum pay-as-you-go now available on all paid plans.
Rolling With The Punches: Shifting Attack Tactics & Dropping Packets Faster & Cheaper At The Edge
Over the past 6 months, volumetric DDoS attacks decreased by 82%. However volumetric attacks are not gone yet, still peaking as high as 418 Gbps. In this post, we cover the changing attack landscape and how Cloudflare adapts and evolves to keep the internet safe.
Free Google Book: Building Secure and Reliable Systems - High Scalability -
Google added another book into their excellent SRE series: Building Secure and Reliable Systems. It's free to download, so don't be shy. It's not short: 557 pages and 21 chapters! So what's it about? In short it's about "reliability through the lens of security." In long, Ana Oprea, one of the authors, gave a good overview. anaoprea: There are multiple questions about what this book is about, who
How To Use 1.1.1.1 w/ WARP App And Cloudflare Gateway To Protect Your Phone From Security Threats
Starting today, you can get even more out of your 1.1.1.1 app. By adding Cloudflare Gateway’s secure DNS filtering to your 1.1.1.1 app, you can add a layer of security and block malicious domains flagged as phishing, command and control, or spam.
Cloudflare now supports security keys with Web Authentication (WebAuthn)!
We’re excited to announce that Cloudflare now supports security keys as a two factor authentication (2FA) method for all users.
Announcing the Results of the 1.1.1.1 Public DNS Resolver Privacy Examination
We took a big step toward improving Internet privacy and security with the launch of the 1.1.1.1 public DNS resolver. And we really meant privacy first. We were not satisfied with the status quo and believed that secure DNS resolution with transparent privacy practices should be the new normal.
Speeding up Linux disk encryption
Encrypting data at rest is vital for Cloudflare with more than 200 data centres across the world. In this post, we will investigate the performance of disk encryption on Linux and explain how we made it at least two times faster for ourselves and our customers!
Six years of the GitHub Security Bug Bounty program
Learn more about the Bug Bounty program, including a recap of 2019’s bugs, our expanded scope, new features, and more.
Deploying security.txt: how Cloudflare’s security team builds on Workers
Today, we’re launching support for the security.txt initiative through Workers to help give security researchers a common location to learn about how to communicate with our team.
CERT partners with GitHub Security Lab for automated remediation
Learn more about how we found ways to scale our vulnerability hunting efforts and empower others to do the same. In this post, we’ll take a deep-dive in the remediation of a security vulnerability with CERT.
Announcing Network Analytics
Back in March 2019, we released Firewall Analytics which provides insights into HTTP security events across all of Cloudflare's protection suite; Firewall rule matches, HTTP DDoS Attacks, Site Security Level which harnesses Cloudflare's threat intelligence, and more.
Dropbox authorization in a Windows Store app
OAuth code flow implementation using Node.JS & Dropbox JavaScript SDK
In this blog post we show you how to implement an OAuth authorization code grant flow using Node.JS and Dropbox JavaScript SDK.
Protecting Security Researchers
Security culture, the Dropbox way
International Women’s Day 2020: Building a Modern Security Team
When we started at Cloudflare in the summer of 2018, we joined a small security team intent on helping it grow quickly. Cloudflare was already a successful “unicorn” startup and its profile was changing fast, providing cyber security protection for millions of Internet-facing properties.
Meet Securitybot: Open Sourcing Automated Security at Scale
Towards better vendor security assessments
Pwned Passwords Padding (ft. Lava Lamps and Workers)
Starting today, we are offering a new security advancement in the Pwned Passwords API - API clients can receive responses padded with random data.
Addressing the Web’s Client-Side Security Challenge
Modern web architecture relies heavily on JavaScript and enabling third-party code to make client-side network requests. These innovations are built on client-heavy frameworks such as Angular, Ember, React, and Backbone that leverage the processing power of the browser
Instant GraphQL Backend with Fine-grained Security Using FaunaDB
GraphQL is becoming popular and developers are constantly looking for frameworks that make it easy to set up a fast, secure and scalable GraphQL API. In this
How To Build A Simple Cryptocurrency Blockchain In Node.js — Smashing Magazine
The blockchain technology is receiving a lot of attention because of its ability to enhance [security](https://www.smashingmagazine.com/category/security) in trustless environments, enforce decentralization, and make processes efficient. In this tutorial, Alfrick Opidi demonstrates how to create a simple cryptocurrency, called `smashingCoin`, using the concepts of JavaScript classes and Node.js. G
GitHub Enterprise Server 2.20 is here
Additional security features, a new internal visibility option, and more with the latest updates to GitHub Enterprise Server 2.20.
Django Highlights: User Models And Authentication (Part 1) — Smashing Magazine
Django is a framework for developing dynamic websites. While a static website is one that solely presents information, there is no interaction that gets registered to a server. In a static website, the server sends HTML, CSS, and JavaScript to a client and that’s it. More capabilities require a dynamic website, where the server stores information and responds to user interaction beyond just servin
HTTPS is Easy!
I've been guilty of publicly bemoaning the complexity of HTTPS. In the past, I've purchased SSL certificates from third-party vendors and had trouble
How To Create A Headless WordPress Site On The JAMstack — Smashing Magazine
In this post, we’ll set up a demo site and tutorial for headless WordPress, including a starter template! We’ll use the WordPress dashboard for rich content editing, while migrating the front-end architecture to the JAMstack to benefit from better security, performance, and reliability. We’ll do this by setting up a Vue application with Nuxt, pulling in the posts from our application via the WordP
A cost-effective and extensible testbed for transport protocol development
At Cloudflare, we develop protocols at multiple layers of the network stack. In the past, we focused on HTTP/1.1, HTTP/2, and TLS 1.3. Now, we are working on QUIC and HTTP/3, which are still in IETF draft, but gaining a lot of interest.
Security on the Internet with Cloudflare for Teams
When Cloudflare launched, businesses bought expensive on-premise hardware to keep their sites online. If they wanted those sites to be faster, or safer, they needed to buy more boxes.
Introducing Cloudflare for Teams
Ten years ago, when Cloudflare was created, the Internet was a place that people visited. People still talked about ‘surfing the web’ and the iPhone was less than two years old, but on July 4, 2009 large scale DDoS attacks were launched against websites in the US and South Korea.
Systems Security: A Primer
Fast builds, secure builds. Choose two
Stripe's continuous integration system is responsible for orchestrating build pipelines and executing tens of thousands of test suites. To meet our exceptionally high security bar, we lean on a combination of open-source tech and novel engineering.
Browser sandbox
To defend against attacks, a developer needs to mitigate vulnerabilities and add security features to an application. Luckily, on the web, the browser provides many security features, including the idea of a "sandbox".
Help users change passwords easily by adding a well-known URL for changing passwords
By redirecting requests to /.well-known/change-password to the change password URL, you can let users update their passwords easier than before.
Cross-Origin Resource Sharing (CORS)
The browser's same-origin policy blocks reading a resource from a different origin for security purposes. Enabling CORS lets the server tell the browser it can use an additional origin.
Content security policy
Content Security Policy can significantly reduce the risk and impact of cross-site scripting attacks in modern browsers.
First-party cookie recipes
Learn how to set first-party cookies to ensure security, cross-browser compatibility, and minimize chances of breakage once third-party cookies are phased out.
Glossary for hacked sites
The glossary covers a collection of technical terms that are referenced throughout our security documentation.
How to set up Signed HTTP Exchanges (SXG) using nginx
How to generate a TLS certificate with SXG extensions, install tools for generating SXG files, and configure nginx to serve SXG files.
Improve security and privacy by updating HTTP Cache
Forgetting or misusing the Cache-Control header might negatively impact the security of your website and your users' privacy. Get recommendations for high-value websites.