cloudflare
Cloudflare Workers Spectre Attack Leaks JWT From Co-Located Worker at 12 Bits/Second
Cybersecurity researchers have demonstrated a refined Spectre attack against Cloudflare Workers, successfully leaking a JWT from a co-located Worker at a rate of 12 bits per second. This new attack is significantly faster than previous iterations and exploits a weakness in Cloudflare's Dynamic Process Isolation (DyPrIs) implementation, particularly when combined with WebSocket activity. Cloudflare has since implemented several mitigations, including improved DyPrIs, V8 Sandbox integration, and Memory Protection Keys, and states there is no evidence of active exploitation.
Introducing Cache Response Rules
Cloudflare has introduced Cache Response Rules, a new feature designed to optimize content caching by running after an origin server responds but before the content is cached. These rules allow users to modify response headers, such as stripping `Set-Cookie` or adjusting `Cache-Control` directives, which were previously difficult or impossible to manage without origin server changes. This aims to improve cache hit ratios, reduce origin load, and enhance performance by addressing common caching inefficiencies.
Introducing Meerkat: an experiment in global consensus
Cloudflare has developed Meerkat, an experimental distributed consensus service designed to manage control-plane state across its global data centers. Unlike traditional consensus algorithms like Raft, which can suffer from leader failures and timeouts, Meerkat utilizes the QuePaxa algorithm. This allows all replicas to perform writes simultaneously and ensures continuous availability even during network disruptions, making it suitable for Cloudflare's expansive and unpredictable network infrastructure.