Cloudflare, Inc. is a U.S. company that provides a content delivery network, DDoS mitigation, Internet security services and distributed domain name server services, sitting between the visitor and the Cloudflare user's hosting provider, acting as a reverse proxy for websites. Cloudflare's headquarters are in San Francisco, California, with additional offices in London, Singapore, Champaign, Austin, Boston and Washington, D.C..
Video Cloudflare
History
Cloudflare was created in 2009 by Matthew Prince, Lee Holloway, and Michelle Zatlyn, who had previously worked on Project Honey Pot. Cloudflare was launched at the September 2010 TechCrunch Disrupt conference. It received media attention in June 2011, after providing security to LulzSec's website.
In June 2012, Cloudflare partnered with various web hosts, including HostPapa, to implement its Railgun technology.
In February 2014, Cloudflare mitigated the largest-ever recorded DDoS attack at that time, which peaked at 400 Gbit/s against an undisclosed customer. In November 2014, Cloudflare reported another massive DDoS attack with independent media sites being targeted at 500 Gbit/s.
Funding rounds
In November 2009, Cloudflare raised $2.1 million in a Series A round from Pelion Venture Partners and Venrock.
In July 2011, Cloudflare raised $20 million in a Series B round from New Enterprise Associates, Pelion Venture Partners, Venrock.
In December 2012, Cloudflare raised $50 million in a Series C round from New Enterprise Associates, Pelion Venture Partners, Venrock, Union Square Ventures, and Greenspring Associates.
In December 2014, Cloudflare raised $110 million in a Series D round led by Fidelity Investments, with participation from Google Capital, Microsoft, Qualcomm, and Baidu.
Acquisitions
In February 2014, it acquired StopTheHacker, which offers malware detection, automatic malware removal, and reputation and blacklist monitoring. In December 2016, Cloudflare acquired Eager, with the view of upgrading Cloudflare's Apps platform to allow for drag-and-drop of installation of third-party apps onto Cloudflare-enabled sites.
Maps Cloudflare
Services
DDoS protection
For all customers Cloudflare offers an "I'm Under Attack Mode" setting. Cloudflare claims this can mitigate advanced Layer 7 attacks by presenting a JavaScript computational challenge which must be completed by a user's browser before the user can access a website.
Cloudflare defended SpamHaus from a DDoS attack that exceeded 300Gbit/s. Akamai's chief architect stated that at the time it was "the largest publicly announced DDoS attack in the history of the Internet". Cloudflare have also reportedly absorbed attacks that have peaked over 400Gbit/s from an NTP Reflection attack.
Web application firewall
Cloudflare allows customers on paid plans to utilize a web application firewall service, by default; the firewall has the OWASP ModSecurity Core Rule Set alongside Cloudflare's own ruleset and rulesets for popular web applications.
Domain name server
Cloudflare offers free domain name server (DNS) for all clients which are powered by an anycast network. According to W3Cook Cloudflare's DNS service currently powers over 35% of managed DNS domains. SolveDNS have found Cloudflare to consistently have one of the fastest DNS lookup speeds worldwide, with a reported lookup speed of 8.66ms in April 2016.
Reverse proxy
A key functionality of Cloudflare is that they act as a reverse proxy for web traffic.
Cloudflare supports new web protocols, including SPDY and HTTP/2. In addition to this, Cloudflare offers support for HTTP/2 Server Push. Cloudflare also supports proxying Websockets.
Content delivery network
Cloudflare's network has the highest number of connections to Internet exchange points of any network worldwide. Cloudflare caches content to its edge locations to act as a content delivery network (CDN), all requests are then reverse proxied through Cloudflare with cached content served directly from Cloudflare.
Values
Cloudflare has been vocal of their values, with CEO Matthew Prince stating:
"One of the greatest strengths of the United States is a belief that speech, particularly political speech, is sacred. A website, of course, is nothing but speech...A website is speech. It is not a bomb. There is no imminent danger it creates and no provider has an affirmative obligation to monitor and make determinations about the theoretically harmful nature of speech a site may contain."
Cloudflare publishes a Transparency Report on a semiannual basis to show how often law enforcement agencies request data about its clients.
Breaking with its long-standing policy of total content neutrality, Cloudflare withdrew access to its services by white supremacist web site The Daily Stormer on 16 August 2017, in the aftermath of the fatal vehicular attack at the Charlottesville rally four days earlier. This withdrew the website's protection against distributed denial of service attack, and soon thereafter attackers took down the website. CEO Matthew Prince stated: "I woke up this morning in a bad mood and decided to kick them off the internet", the tipping point in the decision being "that the team behind Daily Stormer made the claim that we were secretly supporters of their ideology." Andrew Anglin, editor for The Daily Stormer, denied that his team made such a claim, and the move was criticised as 'dangerous' by Prince himself, Anglin, and the Electronic Frontier Foundation.. Simultaneously, Cloudflare cancelled Archive.is for its mirror archives of Daily Stormer content..
Customers
Cloudflare provides DNS services to 6 million websites, including Uber, OKCupid, and Fitbit, adding approximately 20,000 new customers every day.
Awards and recognition
- Awarded "Best Enterprise Startup" by TechCrunch at the 8th Annual Crunchies Awards in February 2015.
- Named the "Most Innovative Network & Internet Technology Company" for two years running by the Wall Street Journal.
- In 2012, Cloudflare was recognized by the World Economic Forum as a Technology Pioneer.
- Ranked among the world's 10 most innovative companies by Fast Company.
- In 2016, Cloudflare was ranked #11 on the Forbes Cloud 100 list.
Criticism and controversies
In September 2017, free-speech advocates criticized Cloudflare for dropping the American neo-Nazi website The Daily Stormer as a customer, which made it difficult for The Daily Stormer to stay online. "Denying security service to one Nazi website seems fine now, but what if Cloudflare started suspending service for a political candidate that its chief executive didn't like?" wrote Yale Law School doctoral candidate Kate Klonick in the New York Times. This is particularly troublesome, she wrote, because Cloudflare has so few competitors..
The hacker group UGNazi attacked Cloudflare partially via flaws in Google's authentication systems in June 2012, gaining administrative access to Cloudflare and using it to deface 4chan. Cloudflare published in full the details of the hack. Following this, Google publicly announced they had patched the flaw in the Google Enterprise App account recovery process which allowed the hackers to bypass two-step verification. Later the leader of the hacking group, Cosmo, was arrested and sentenced in California.
In May 2017 ProPublica reported that Cloudflare as a matter of policy relays the names and email addresses of persons complaining about hate sites to the sites in question, which has led to the complainants being harassed. Cloudflare's general counsel defended the company's policies by saying it is "base constitutional law that people can face their accusers." In response Cloudflare updated their abuse reporting process to provide greater control of who to notify for the complaining party.
From September 2016 until February 2017, a major CloudFlare bug (nicknamed Cloudbleed) leaked sensitive data--including passwords and authentication tokens from customer websites, by sending extra data in response to web requests. The leaks resulted from a buffer overflow, which occurred, according to analysis by CloudFlare, on approximately 1 in every 3,300,000 HTTP requests.
Criticism of total content neutrality
Cloudflare was ranked in the 7th rank among the top 50 Bad Hosts by HostExploit. The service has been used by Rescator, a website that sells payment card data.
Two of Islamic State of Iraq and the Levant's top three online chat forums are guarded by Cloudflare but U.S. law enforcement has not asked them to discontinue the service, and they have not chosen to do so themselves.
An October 2015 report found that Cloudflare provisioned 40% of SSL certificates used by phishing sites with deceptive domain names resembling those of banks and payment processors.
In November 2015, Anonymous discouraged the use of Cloudflare's services, following the ISIL attacks in Paris and the renewed accusation that it provides help to terrorists. Cloudflare responded by calling their accusers "15-year-old kids in Guy Fawkes masks" and saying that whenever such concerns are raised they consult actual anti-terrorism experts and abide by the law.
Cloudflare is listed on Spamhaus for providing spam support services (pink contract). The current list of Spamhaus listings changes on a near daily basis as reported issues are addressed with the responsible website owner.
References
External links
- Official website
- Registrar and domain name security check
Source of the article : Wikipedia
0 Comments