majke

To solve the networking setup, typically some sort of "slirp" is needed. Slirp on one hand takes (fake or real) packets from somewhere and then on the other side pass it to a normal Linux process that does CONNECT / BIND / SEND / RECV.

It turns out you can do all the packet processing magic (connection tracking, syn handling, etc) in userspace totally fine, and then indeed hand it over this to userspace syscalls.

Being upset with classic C-based slirp and rust smoltcp (not enough features) I've dug up Fuchsia userspace tcp/ip stack - netstack - and wrapped it in slirp a-like envelope.

https://github.com/cloudflare/slirpnetstack

So this beast is basically that - on one hand you pass it packets (potentially from inside container) on the other hand it does connect/bind/etc to host OS.

This approach, in one form or another, is used by tailscale, podman and many other container runtimes.

  8. 80.239.216.210.  0.0%    78  123.2  64.6  42.9 141.8  30.6
  9. vl202.zur-itx1-dist-1.cdn77.com. 0.0%    78   60.1  58.8  43.7 136.5  24.2
  10. 89-187-165-194.bunnyinfra.net. 0.0%    78   45.9  63.5  41.8 131.9  31.0

so cdn77.com and bunny.net

First version was a three layer VM monster, with the main entrance done as HTTP proxy written in PHP.

>> made the internet better

One of the measures of "making The Internet" could be looking at RFC contributions:

https://www.rfc-editor.org/search/?q=cloudflare

I don't think you can buy a single "MI300X" unit, right? Only the box with x8 of these at a cost of ~250K EUR.

> Across all tested generations, divergent paths serialize linearly with the number of paths k, following T(k)≈sk with no super-linear reconvergence penalty. Warp execution efficiency falls as 32/k, the penalty is independent of occupancy, and predication removes the serialization cost

So... Nvidia did a good job?

There is more! I started to figure out how ADC/DAC chips actually work. I believe our CM6533 and its competitor the CM108 both use delta-sigma. The output isn't a staircase of those samples but a rapidly switching (MHz rates) 1-bit modulator (think: PCM) output, and a final analog filter smooths it into a continuous waveform.

Many countries now assume you have a phone. For example getting UK visa requires a smartphone. I don't think going without a phone is feasible nowadays.

Another question is if going with a burner phone that has just sim card and bank card, sufficient. But then you need appleid/google account on the device, and this again links back to your phone number, and it's not easy in practice to have proper clean device.

I'm a heavy user of NVIDIA LOP3 instruction (uint32). I wonder when AMD will finally support it well.

If you want to know more about the cache invalidation in the whole pipeline of DNS requests, take a look at this

https://blog.cloudflare.com/tld-glue-sticks-around-too-long/

I hinted there how the NS chain of lookups works from . to your domain. The point is that we wanted to be able to move name servers around the ip addresss, but that wouldn't work for many domains. So - in some contexts moving IP's rapidly is possible, in some it's not. Fun.

sockmap has been through a lot of changes since then. Some done by CF (hi Jakub!) some by others, including bytedance and isovalent.

Recently there has been a push to figure out the backpressure situation, so it's worth checking again.

Marek

This is great. So proper 386 on an fpga? How cool is that.

> A lot of self-hosters running CF tunnels because they don't know better also contributes.

Are you saying CF documentation is better than Computer Science / Networking education resources? Why don't people know better? I thought the tunnels are mostly used to bypass NAT's.

> Static blogs hiding behind bot protection

I'm not sure what is the proportion of the static vs dynamic sites, but I would argue that for wordpress CF is adding real value.

(I'm ex CF) This is backwards. Nobody "allowed" anyting. CF serves a customers need. You can argue with the solution but you can't argue with the core problem. It's more healthy to start the conversation of _why_ CF services are valuable.

Lysk | lysk.ai | AI/Geo Engineer | Full-time | Warsaw / Paris

Lysk is a European defence startup, based between Paris and Warsaw. Our mission is to create modern software tailored for hostile environments. Our customers include European military and police units. We are in stealth but have already been recognised as one of France’s top 20 seed companies. Backed by Project A, Europe’s leading defence VC, and angels including the founders of Cloudflare, Quantum Systems, and ElevenLabs. We’re assembling a world-class team at the intersection of modern software and defence. We do not work on weapons systems or hardware products.

Currently we're looking for:

- Junior LLM engineer (gguf, on-prem models, llm validation and pipelines)

- Junior Voice AI engineer (we need customised STT models)

- Senior GEO-AI engineer (interpreation of speech-based geographical information)

I've had more success. Flipper taught me about sdr, and I was able to reverse quite a lot from my garage door pilot. Then I went on an adventure of cracking Keeloq cipher, and I haven't stopped since.

No later than last week I was fishing in my boxes for two pieces of 2N2222 for a pet project!

> As of today, the full reference footage hasn't been released online.

A pity

I’m also contemplating a lego sorting machine.

Not necessarily. In classic C we often build complex state machines to handle errors - especially when there are many things that need to be initialized (malloced) one after another and each might fail. Think the infamous "goto error".

I think defer{} can simplify these flows sometimes, so it can indeed be useful for good old style C.

Ispc looks interesting. Does it work with amd? They hint on gpu’s , i guess mostly intel ones?

So... does it mean that nobody reads the law? Is it good or bad? What is the takeaway?

Richard Jones is still alive and kicking https://x.com/metabrew

Back in 2022 I published a doc on how the egress IPs work at Cloudflare:

https://blog.cloudflare.com/cloudflare-servers-dont-own-ips-...

In summary, the location at which an IP egresses Cloudflare network has nothing to do with the geo-ip mapping of that IP. In some cases the decision on where to egress is optimised for "location closest to the user", but this is also not always true.

And then there is the Internet. Often some country (say Iran) egresses from a totally different place (like Frankfurt) due to geopolitics and just location of cables.

Hey! Popcount used to be my favorite instruction. Now I think I prefer LOP3 though :)

> Coordinator sees Node A has significantly fewer rows (logical count) than the cluster average. It flags Node A as "underutilized."

Ok, so you are dealing with a classic - you measure A, but what matters is B. For "load" balancing a decent metric is, well, response time (and jitter).

For data partitioning - I guess number of rows is not the right metric? Change it to number*avg_size or something?

If you can't measure the thing directly, then take a look at stuff like "PID controller". This can be approach as a typical controller loop problem, although in 99% doing PID for software systems is an overkill.

Questions for "questions for cloudflare" owner

> > faster - less context switches and copies

This is very much newbie way of thinking. How do you know? Did you profile it?

It turns out there is surprisingly little dumb zero-copy potential at CF. Most of the stuff is TLS, so stuff needs to go through userspace anyway (kTLS exists, but I failed to actually use it, and what about QUIC).

Most of the cpu is burned on dumb things, like application logic. Turns out data copying and encryption and compression are actually pretty fast. I'm not saying these areas aren't ripe for optimization - but the majority of the cost was historically in much more obvious areas.

This happened before my watch, but I always was rooting for Linux. Linux is winning on many aspects. Consider the featureset of iptables (CF uses loads of stuff, from "comment" to "tproxy"), bpf for metrics is a killer (ebpf_exporter), bpf for DDoS (XDP), Tcp fast open, UDP segmentation stuff, kTLS (arguably half-working). Then there is non-networking things like Docker, virtio ecosystem (vhost), seccomp, namespaces (net namespace for testing network apps is awesome). And the list goes on. Not to mention hiring is easier for Linux admins.