Thread by @grittygrease

Networking and performance stories today!
- A repeatable and probe-free methodology for measuring CDN performance (@Cloudflare wins, btw)
- A debugging story about global TLS termination
- How we identify multi-user IPs to improve our security services

#CloudflareResearch🔬

We know @Cloudflare is fast (the fastest in most places) and have the scans to prove it. However, most techniques that use active scanning to measure performance aren't verifiable, so as great as our scans are, they aren't enough to convince skeptics.
Enter research.

It turns out that performance can be predicted given a comprehensive map of the Internet's topology. By combining public data sources on Internet eXchange Points (IXPs), off-net caches, BGP, and geodata with smart path prediction algorithms, you can make an educated guess.

Today's blog post by @GVasilis and @marwanfayed goes into detail about just how good this guess can be.
The results show that Cloudflare has the lowest latency globally of any CDN. And now anyone can validate that claim without running a single scan.

blog.cloudflare.com/look-ma-no-pro…

We built the Geo Key Manager to give customers granular control of where their HTTPS certificate private keys are stored. Getting optimal performance out of a geographically distributed key management system is hard, especially at Cloudflare's scale.

blog.cloudflare.com/introducing-cl…

In this fun post, Tanya Verma takes us on a technical deep dive into some of the challenges we faced trying to scale up this service for bigger customers as our network grew larger.

blog.cloudflare.com/scaling-geo-ke…

Security products often take a simplistic view of client IP addresses and apply the same threat algorithms to all of them. The reality is that client IPs are not all equal. Some represent a single person and some represent thousands of individuals behind a NAT or VPN.

Security products that assess whether or not an incoming connection is malicious or not need to take multi-user IPs into account, or face negative consequences like lax security (false negatives) or over-blocking/unnecessary friction (false positives).

This post by interns Nate Sales and Alex Chen explains how we combine our knowledge of the Internet from public datasets with device-reported information to inform other teams at Cloudflare which source IPs are single-user and which are multi-user.

blog.cloudflare.com/multi-user-ip-…

And finally, join @bwesterb @armfazh and @WatsonLadd today at 1:00 on Cloudflare TV for CIRCL: our Go library now includes pairings and quantum-resistant cryptography

cloudflare.tv/event/5BK5weus…