eBPF maps, hash collisions and a very long night (part 2)
Over the last few months we have spent a lot of time on eBPF maps, hash collisions and a very long night. This is what we learned.The numbersAcross the last quarter, 71%…
Engineering
Designing a risk score that analysts can explain
We get asked about designing a risk score that analysts can explain more than almost anything else, so here is the long answer.What we changedWe moved the decision from a single threshold…
How we deploy rule changes to every edge in under 30 seconds
Over the last few months we have spent a lot of time on how we deploy rule changes to every edge in under 30 seconds. This is what we learned.Observability firstEvery mitigation…
How we test WAF rules against seven days of real traffic (part 3)
how we test WAF rules against seven days of real traffic sounds like a narrow topic. It turns out to touch almost every part of how an edge network behaves under attack.What…
Measuring the real cost of a TLS handshake under attack (part 4)
measuring the real cost of a TLS handshake under attack sounds like a narrow topic. It turns out to touch almost every part of how an edge network behaves under attack.Challenges beat…
What we learned from load-testing our own edge to failure
Over the last few months we have spent a lot of time on what we learned from load-testing our own edge to failure. This is what we learned.Challenges beat blocksBlocking lists go…
The hidden cost of retries during a flood (part 3)
Over the last few months we have spent a lot of time on the hidden cost of retries during a flood. This is what we learned.Measuring successWe track three numbers for every…
HTTP/2 rapid reset one year later (part 3)
We get asked about hTTP/2 rapid reset one year later more than almost anything else, so here is the long answer.Challenges beat blocksBlocking lists go stale within minutes when attackers rotate through…
Measuring the real cost of a TLS handshake under attack (part 3)
Over the last few months we have spent a lot of time on measuring the real cost of a TLS handshake under attack. This is what we learned.Observability firstEvery mitigation decision is…
HTTP/2 rapid reset one year later
Here is a question we could not answer well a year ago: what really happens with hTTP/2 rapid reset one year later? We can answer it now.Testing in production, safelyEvery rule starts…
Building a per-route baseline without storing every request (part 2)
building a per-route baseline without storing every request sounds like a narrow topic. It turns out to touch almost every part of how an edge network behaves under attack.Challenges beat blocksBlocking lists…
The hidden cost of retries during a flood
We get asked about the hidden cost of retries during a flood more than almost anything else, so here is the long answer.Protecting the originNone of this matters if the attacker can…