Get the weekly digestSubscribe

/ THE FEED /

Read what ships.

Deep, recent reads ranked by depth and freshness.

Securityremove filterInfrastructureremove filterCloudflareremove filterDropboxremove filterClear all

  1. 01Cloudflare · architecture

    Bringing post-quantum cryptography to geographically fenced key management

    Cloudflare introduced a post-quantum geographically restricted key manager in closed beta to enforce data sovereignty and protect customers against harvest-now-decrypt-later attacks. The team implemented a hybrid ML-KEM-768 and X25519 cryptographic design that separates globally distributed wrapped private keys from regionally restricted root keys. This ensures that decryption keys are only accessible within authorized geographical boundaries and fails closed if validation fails.

    DEPTH ■■■■■12 min read2 days ago

    Security

    Sign in to save and rate

  2. 02Cloudflare · scaling

    Rewinding the exponential: How we keep hardware usage down

    Cloudflare tackled exponential traffic growth against linear hardware growth by continuously evolving their data pipeline architecture over five years. Key optimizations included breaking up monolithic schemas, switching to zstd compression, decoupling pipeline transit from database replication, decentralizing sampling, and moving aggregations earlier in the pipeline. These strategies significantly reduced backbone bandwidth usage, network congestion, and storage requirements while preserving data quality.

    DEPTH ■■■■■12 min read12 days ago

    Infrastructure

    Sign in to save and rate

  3. 03Dropbox · architecture

    Evolving our calendar assistant Reclaim to be AI-native without starting over

    Dropbox engineers evolved their calendar assistant, Reclaim, to support natural-language AI requests by building a custom agent platform that integrates with existing scheduling logic. They utilized a shared action system and a Preview Mode backed by Redis to ensure AI suggestions are consistent and reviewable before affecting real calendars. This approach allows the product to adopt AI capabilities without fragmenting its core architecture or duplicating functionality.

    DEPTH ■■■■■7 min read3 weeks ago

    InfrastructureMachine Learning

    Sign in to save and rate

  4. 04Cloudflare · architecture

    Cloudflare deploys protections against php2shell vulnerability

    Recent disclosures revealed critical remote code execution and data exposure vulnerabilities in the PHP runtime. To mitigate the threat before public disclosure, Cloudflare developed full transaction detection to combine request and response signals within the WAF. This capability enabled automatic deployment of rules protecting customers against the php2shell exploits.

    DEPTH ■■■■■6 min read4 days ago

    Security

    Sign in to save and rate

  5. 05Cloudflare · postmortem

    8 eMudhra certificates are compromised. Here's what you need to know

    Private keys associated with eight eMudhra intermediate certificates were compromised, allowing potential traffic interception. Cloudflare prioritized patching critical services, released client and tunnel updates, and deployed mitigations across its products. Customers are advised to upgrade affected software, update custom trust stores, and avoid disabling verification despite error messages.

    DEPTH ■■■■■4 min read4 days ago

    Security

    Sign in to save and rate

  6. 06Cloudflare · practice

    Localizing compliance at scale: achieving South Korea’s ISMS certification

    To achieve South Korea's ISMS certification, Cloudflare had to modify its account sign-up flow to itemize required consents and disable third-party social logins that bypassed the form. By combining IP geolocation with user country selection, the team ensured localized compliance without breaking global functionality. The resulting certification provides a localized assurance benchmark for Korean users.

    DEPTH ■■■■■8 min read3 days ago

    Security

    Sign in to save and rate

  7. 07Cloudflare · architecture

    Beyond the patch: Protecting your NetScaler gateway against future vulnerabilities

    Recent major vulnerabilities in Citrix NetScaler exposed public-facing authentication gateways to unauthenticated remote code execution. To prevent similar emergency patches, the team recommends placing an independent Zero Trust access layer, web application firewall, and strict origin connection controls in front of the application server. Implementing these defense-in-depth measures reduces exposure and ensures a single software flaw does not result in total system compromise.

    DEPTH ■■■■■9 min read6 days ago

    Security

    Sign in to save and rate