/ THE FEED /

Read what ships.

Deep, recent reads ranked by depth and freshness.

Cloudflare Honeycomb Clear all

01Cloudflare · architecture
Origin Range Requests: Serving large files without range-request tuning
Cloudflare replaced a legacy, fixed-size range caching design that suffered from bandwidth waste and memory pressure with a Pingora-based chunk coordinator. The new implementation dynamically combines cached chunks and aligned origin fetches to serve range requests accurately without manual tuning. This approach cut p99 time to first byte in half for R2 storage and reduced tiered cache traffic by six percent.
DEPTH ■■■■■8 min read2 days ago
Databases Performance Redis
Sign in to save and rate
02Cloudflare · architecture
Bringing post-quantum cryptography to geographically fenced key management
Cloudflare introduced a post-quantum geographically restricted key manager in closed beta to enforce data sovereignty and protect customers against harvest-now-decrypt-later attacks. The team implemented a hybrid ML-KEM-768 and X25519 cryptographic design that separates globally distributed wrapped private keys from regionally restricted root keys. This ensures that decryption keys are only accessible within authorized geographical boundaries and fails closed if validation fails.
DEPTH ■■■■■12 min read2 days ago
Security
Sign in to save and rate
03Honeycomb · architecture
OpenTelemetry Collector Configuration for LLM Observability
LLM applications emit bulky telemetry containing sensitive user content and disparate attribute names. The team uses an OpenTelemetry Collector pipeline to normalize, enrich, redact, and export this data to Honeycomb. This centralizes control, protects data before it leaves the network, and maintains consistent observability.
DEPTH ■■■■■12 min read2 weeks ago
Sign in to save and rate
04Cloudflare · performance
Cutting our inference bill by 68% by being obsessive about optimization
An engineering team investigated a steady rise in AI code review costs and found that cache misses and redundant model calls were driving up expenses. By restructuring system prompts to enable cross-repository prompt caching, eliminating wasted tool calls, and switching to more efficient models, the team cut inference costs by 68% while also significantly improving review latency.
DEPTH ■■■■■15 min read6 days ago
Machine Learning
Sign in to save and rate
05Cloudflare · performance
Yandex outage: Data shows that instead of going dark, malicious bots went on the move
Following physical strikes on Yandex data centers, overall HTTP traffic from the network dropped significantly, leading to speculation that malicious bot farms had been disabled. However, traffic analysis revealed that search crawling simply decreased while malicious automation quickly migrated to other hosting providers with identical fingerprints. Consequently, overall malicious bot traffic remained flat, demonstrating that network disruptions do not stop portable automated workloads.
DEPTH ■■■■■8 min read11 days ago
Incidents & Postmortems
Sign in to save and rate
06Cloudflare · postmortem
Inside Hyperdrive: How we solved a rare Hyperdrive MySQL caching bug
During the beta of MySQL support for Hyperdrive, engineers investigated rare empty query responses and connection hangs occurring in 0.001% of requests. They discovered that sharing the data center cache between client and endpoint nodes caused protocol capability mismatches when translating MySQL wire messages. The team resolved the issue by standardizing the cache to always store responses encoded with canonical Hyperdrive capabilities.
DEPTH ■■■■■9 min read11 days ago
MySQL
Sign in to save and rate
07Honeycomb · practice
How Honeycomb Private Cloud Drinks From the Fire Hose
The Honeycomb Private Cloud team struggled to manually track and integrate rapid infrastructure and configuration changes produced by upstream teams. To solve this, they built custom scripts to generate automated drift reports and eventually integrated AI to help triage and track the necessary follow-up work. As a result, the team successfully scaled their integration process into a reliable daily workflow.
DEPTH ■■■■■10 min read2 weeks ago
Sign in to save and rate
08Cloudflare · architecture
Under the hood, off the hot path: How D1 scales to millions of databases
Cloudflare scaled its serverless SQLite database, D1, to support millions of databases by decoupling the control plane from the data plane. The team used distributed metadata caching via Workers KV, optimized database connections through Hyperdrive, and implemented a self-correcting heartbeat mechanism. This architecture prevents centralized bottlenecks and allows D1 to handle rapid on-demand database creation efficiently.
DEPTH ■■■■■22 min read12 days ago
Databases
Sign in to save and rate
09Cloudflare · scaling
Rewinding the exponential: How we keep hardware usage down
Cloudflare tackled exponential traffic growth against linear hardware growth by continuously evolving their data pipeline architecture over five years. Key optimizations included breaking up monolithic schemas, switching to zstd compression, decoupling pipeline transit from database replication, decentralizing sampling, and moving aggregations earlier in the pipeline. These strategies significantly reduced backbone bandwidth usage, network congestion, and storage requirements while preserving data quality.
DEPTH ■■■■■12 min read12 days ago
Infrastructure
Sign in to save and rate
10Cloudflare · architecture
Filter, reshape, and redact logs before export with Transformers
Cloudflare integrated SQL-based log transformation directly into its Logpush export pipeline, allowing customers to filter, redact, and reshape logs before delivery. The team chose to embed the Apache DataFusion engine in-process using Rust and Go across an Arrow IPC boundary to ensure high throughput and avoid network latency. As a result, the system processes high-volume log streams efficiently while maintaining predictable resource usage and strict delivery reliability.
DEPTH ■■■■■8 min read13 days ago
Sign in to save and rate
11Cloudflare · architecture
Cloudflare deploys protections against php2shell vulnerability
Recent disclosures revealed critical remote code execution and data exposure vulnerabilities in the PHP runtime. To mitigate the threat before public disclosure, Cloudflare developed full transaction detection to combine request and response signals within the WAF. This capability enabled automatic deployment of rules protecting customers against the php2shell exploits.
DEPTH ■■■■■6 min read4 days ago
Security
Sign in to save and rate
12Honeycomb · practice
Our Limits Are Not Our Imagination
Software development practices are shifting as artificial intelligence makes advanced rigor, such as formal verification and property-based testing, an affordable default for greenfield projects. Developers can leverage AI agents to thoroughly review code and enforce strict architectural boundaries rather than just writing code faster. However, successful outcomes require comprehensive development systems and thinking rather than relying on AI alone.
DEPTH ■■■■■3 min read5 days ago
Sign in to save and rate
13Cloudflare · architecture
How Commerce.com and Cloudflare are getting storefronts ready for AI agents
Commerce.com and Cloudflare collaborated to enable WebMCP at the edge for nearly 100,000 storefronts, allowing AI agents to interact reliably with e-commerce sites using structured tools rather than fragile HTML scraping. The team implemented edge-level configuration rules using custom hostname metadata to provide individual merchants with a seamless opt-out mechanism and added support for custom MCP paths. This integration allows agents to execute shopping tasks directly within the active browser session while ensuring fallback safety and zero extra latency for opted-out stores.
DEPTH ■■■■■6 min read4 days ago
Machine Learning
Sign in to save and rate
14Cloudflare · postmortem
8 eMudhra certificates are compromised. Here's what you need to know
Private keys associated with eight eMudhra intermediate certificates were compromised, allowing potential traffic interception. Cloudflare prioritized patching critical services, released client and tunnel updates, and deployed mitigations across its products. Customers are advised to upgrade affected software, update custom trust stores, and avoid disabling verification despite error messages.
DEPTH ■■■■■4 min read4 days ago
Security
Sign in to save and rate
15Cloudflare · architecture
A fully programmable secure web gateway
Cloudflare integrated its secure web gateway and data loss prevention services with its edge computing platform to allow customers to run custom code inline during policy evaluation. The team introduced a new Forward action for traffic transformation and Custom Functions for dynamic rule evaluation without requiring external proxy infrastructure. This enables complex security logic, real-time alerting, and dynamic header injection with zero network hop overhead.
DEPTH ■■■■■13 min read10 days ago
Sign in to save and rate
16Honeycomb · practice
Dr. Cat Hicks on the Psychology of Software Teams
Engineering leaders must establish clear structures and cultural norms to reduce the psychological identity threat and anxiety developers experience when adopting AI tools. Research indicates that organizational trust regarding AI is currently fractured but repairable through realigned expectations and accountability. Furthermore, engineers are advised to build durable sources of professional identity rather than relying solely on mastery of specific languages or legacy codebases.
DEPTH ■■■■■3 min read3 weeks ago
Sign in to save and rate
17Cloudflare · practice
Localizing compliance at scale: achieving South Korea’s ISMS certification
To achieve South Korea's ISMS certification, Cloudflare had to modify its account sign-up flow to itemize required consents and disable third-party social logins that bypassed the form. By combining IP geolocation with user country selection, the team ensured localized compliance without breaking global functionality. The resulting certification provides a localized assurance benchmark for Korean users.
DEPTH ■■■■■8 min read3 days ago
Security
Sign in to save and rate
18Cloudflare · architecture
Beyond the patch: Protecting your NetScaler gateway against future vulnerabilities
Recent major vulnerabilities in Citrix NetScaler exposed public-facing authentication gateways to unauthenticated remote code execution. To prevent similar emergency patches, the team recommends placing an independent Zero Trust access layer, web application firewall, and strict origin connection controls in front of the application server. Implementing these defense-in-depth measures reduces exposure and ensures a single software flaw does not result in total system compromise.
DEPTH ■■■■■9 min read6 days ago
Security
Sign in to save and rate