🎂 Welcome to Birthday Week

Hi, everyone. Welcome to Birthday Week. My name is Dina Kozlov. I'm a product manager here at Cloudflare, and we have today a very special guest, John Graham-Cumming, who's our CTO, and we are here today to talk about Birthday Week. So, John, you've been at Cloudflare for a really long time, so you have seen the very beginnings of Birthday Week. Could you tell us a bit more about how it came to be and the whole history behind it? Sure. Yeah. I mean, the way in which it worked was that early on, actually, so before I joined, so I've been at Cloudflare for 12 years, right? Cloudflare's 13. It's going to be a teenager this year. I've been there for 12 of those years. The first year, I wasn't here for Birthday Week. I joined a couple of months later, but what happened was there was just a blog post, and actually, the team did stuff together, like celebrated the birthday, and that became a little bit of a tradition, but over time, it grew into a thing where we were releasing products, and then it grew and grew and grew. As you know, it's grown into a thing where we're releasing a ton of stuff. The focus has tended to be on, although there may be product announcements, things that might be a gift to the Internet. We've tried to give away things that are helpful to everybody or things that are game-changing, and I don't mean that in a silly company way, but things that we think actually change the way which people think about, say, CDNs or DDoS or computing or stuff like that. It's using surprising stuff. We have another tradition, which is April 1st, we've also launched surprising things. That's slightly different. Birthday Week tends to be a week of packed announcements, and this coming up one really is as well. No, for sure. Definitely going to be honored to get a sneak peek of the whole week, and we have so many exciting things. Looking back, what have been some of the announcements that you've loved that we've had over the years? I know a few come to mind for me for game-changers, especially Universal SSL, making that universally available. I was going to actually pick Universal SSL as my first one because that was my third year at Cloud. That was 2014, so nine years ago now. It's hard to realize that nine years ago, having SSL on your website was a bit unusual. A bank would have it, Amazon would have it, but it was hard to get an SSL certificate. It was expensive and it was complicated. What we did is we said, we're just going to bundle SSL, as you know super well, into our platform so that everybody who puts a domain on Cloud Player gets an SSL certificate. That was, first of all, surprising in terms of the scale of what happened, in terms of the number of certificates got issued over a very short period, because we didn't start issuing them until the day of the announcement. Then the whole thing fell over because we were issuing so many. In fact, one of our partners who was actually doing the certificate issuance, a certificate authority, they actually asked us to slow down because their HSM, which stores the private keys for their root, was overheating. The cool thing is we pretty much doubled the size of the encrypted web. We had about two million domains using us at that point. We'll see a huge number more now. At that point, we gave them all SSL. That was the original. It also is a time that I worked very closely with Lee Holloway, who was Cloud Player's technical founder. When I say worked closely with him, actually what happened that night, it was really interesting, was the night before this announcement went out in September of 2014, it didn't work. Universal SSL wasn't available. Lee was hunkered down in a hoodie. I'm wearing a hoodie as a celebration of that time today, in front of his laptop. He used multiple laptops simultaneously, where he developed on one and he had the whole of Cloud Player running on another laptop. He could test. None of us disturbed him. He had his hoodie on like this, down in front of his machine, literally. We're all there sitting around in silence, wondering what was going to happen. We were waiting for this announcement to happen and make sure things were working. I was there, Dane was there, a bunch of other people. At some point, Lee just goes, it's done. I just left, got up and left the office. All of us then went and looked at it and tried it out. That became the announcement the next day. I think that's probably the one that I'm super excited about, as an early one. IPv6, I think IPv6 being available on Cloud Player as a default and automatic thing was also a birthday week one. If you think about those two things together, the story of them is supporting standards that are out there and trying to drive them forward. IPv6 has been around for a long time. SSL has been around for a long time. Getting it into people's hands, making it easy, supporting that. I think we've done that going forward with TLS 1.2 and 1.3 and HTTP 2 and HTTP 3 and QUIC and on and on and on and on. No, exactly. That's one of the things that I think is so incredible is I wasn't around Cloudflare at the time, but I'm sure it felt so revolutionary to launch these things. Now, looking back to the last five to 10 years, it's crazy to see the adoption of it. Now, you take it for granted. It's like, of course, everyone has a TLS certificate. Of course, we're using IPv6 and we're moving towards TLS 1.3. I'm also really excited to start seeing what are the things that we're starting to launch now that we're going to look back on and watch that progression grow. It's very true. You forget that these things were ever needed to be launched in a way. Now, we're going to launch them. Exactly. With that, what are some of the trends that we're seeing right now that you're excited about and how are we helping drive innovation in this space? Well, I think another birthday week announcement from a few years ago now was Cloudflare Workers. Cloudflare Workers was 2017, so it's hard to believe that Cloudflare Workers is six years old at this point. I think that when we launched that, it was a huge announcement. The fact that you could just deploy and run code on our entire global network. If you think now our global network has expanded to 300 locations, 300 cities, it's pretty stunning. Even me, I have done a couple of times live demos at conferences where I've written code in Cloudflare Workers and hit deploy and then change the tab in a browser and hit refresh. I remember once doing it at a conference. Actually, funnily enough, it was here in Lisbon. I didn't even pause between the two. I almost as I hit the refresh button, I thought to myself on stage, well, what if this actually deployed that fast? It's like, I don't know, under a second or whatever. But yes, of course it did because of how fast things... So that ability to scale that, and as you know, scaling that up and scaling that up over time. So I think that technology, which really shows the power of serverless or sometimes people call it edge on a global network, was a pretty big announcement six years ago. And if you think about stuff we've done, like smart placement, where we'll figure out the best place for your code to run, so you get the best performance. You think about the presence of our backbone that links all this stuff together. You think about our databases, you think about our... I mean, it's like this whole ecosystem that came from that initial announcement six years ago. And this birthday week, we have plenty of announcements around that. So I think we're still in the midst of this serverless this world, right? I mean, it's very easy as technologists to be like, oh yeah, serverless, edge workers, whatever you want to call them, that's just part of the landscape. But actually, if you go and talk to a customer, I literally was talking to a customer yesterday, they were on a journey to move things to the cloud. They were entirely on-premise with servers. So it takes time for a technology to be distributed evenly. So that's, I think, one area. And the other one is inevitable. You knew I was going to say this is AI, right? I mean, I think the thing that's significant about AI is that ChatGPT made people realize that, and to a certain extent, Stable Diffusion and DALI and everything made people realize how powerful these AI systems were. But very often, they were not realizing that those things already existed, but were not realizing. For example, my phone, I have my phone here, and I quite often use the text-based search mechanism in the photo album. And that's an example of AI, right? It's like, oh, wait a minute, I know. And for example, obviously, an obvious example is I have a cat, and I can type cat, and I can get every picture of the cat, which it turns out is way too many. But that's already an AI system that recognized an animal in a thing. But you can do many other things with the text search and images. You can search for text that's in those images, but you can also search for descriptions. Oh, wait a minute, there was that time when I saw a bottle of perfume in that, and you type in bottle of perfume, and oh, yeah, I did take, oh, that's right, it was this particular brand or whatever. Those are, in a way, almost mundane. We're just used to that now. Oh, yeah, I can do that. That's incredible. That's what's going to happen with AI. Every developer is going to build in AI experiences to their, whatever they're building, right? And it's not going to become surprising that you can do this kind of stuff. Well, in order to do that, you need to do two things. You need to train some sort of model, and if you look at something like Hugging Face, there are thousands and thousands of these models out there. There's been this incredible explosion since the meta-llama stuff got out there of people just building and building and building. So there's a lot of trained models out there, which can be specialized for particular situations, which we've done at Cloudflare. But the bigger world is the inference world, which is like the actual act of using a model to do something like pictures of cats. Show me all the pictures of cats, right? Or summarize this piece of text. So that, I think, is going to be huge. And obviously, you're going to see last year, earlier, we announced Constellation, which is our AI on our global network platform. If you think about that workers platform that we announced a long time ago, that is going to grow exponentially in terms of AI terms during birthday week. So I think that's another thing that's going on, which is super important that we're going to hear about in birthday week. It's that combination of global network, serverless compute stuff, and all that goes around it, and then AI. No, exactly. And I'm so excited for AI Day, because we really are going to show customers and give to them all the tools that they need to build these applications. And one of the incredible stories that I've been hearing is a lot of customers are starting to migrate their training data to R2. And because we don't have any egress fees, it's also allowed them to open source those data sets and allowed others to continue developing on top of those, which I think is such an incredible story of how we can innovate even more by doing that. And so one of the things that I love about birthday week is we take a lot of products that were previously expensive or enterprise only, and we either bring them to our PayGo plans or we just make them available for free. And so I'd love to know why do we do this and why is it so important for us to continue doing this? And I know this even lies within the core of the Cloudflare free plan, which is so important to us. Yeah. Well, I think there's a couple of things. First of all, if you think about technology, certainly if you think about as long as I've been doing technology, which is 31 years professionally, things that tended to be difficult to do and expensive and slow tend to get easy to do fast and cheap over time. And so if you lock everything in for only your highest paying customers, you've created a trap for yourself, right? Where someone else will come along and do it cheaper. It will inevitably get cheaper and you're caught in this situation. So it makes sense in the long term for things to be made available to as many people as possible. That also does another thing, which it means that people can try it, right? And interestingly, the other day I was talking to another customer who said to me, and they were moving from a competitor to us. And they said, well, one of the things that makes a really big difference is that I can try everything Cloudflare does myself. I can read the documentation, I can play with the APIs. Whereas in other cases, the competitors they were moving from was a very enterprise-y, call us kind of company, we'll do a consulting project to install it. Two weeks later, you might get it. Two weeks later. And actually, funnily enough, I was talking to a chap who left Cloudflare and decided to come back. He was on the sales department this morning. And he was saying to me that one of the reasons he wanted to come back was he couldn't actually demo the product of the company he'd gone to, because they were so afraid something could go wrong with it. Whereas we were just like, yeah, well, try it, you know, see what happens. And I think you get that if you push your features down to the cheap accounts, to the free accounts, it has to work, because people are going to try it. And then you get this wonderful feedback, because people do try it, they tell you if there's a problem with it, they tell you how to improve it. Some of those people become paying customers. Although that's not really the most important thing about it. The most important thing is to get in people's hands, get the feedback, get them interested in it, because then it becomes this real flywheel of feedback. And you know what it's like, you know, when we release something, we get tons of feedback, we make tons of improvements over time. So I think that it's in our philosophy to take as many features as we can and push them out. There might be different levels of support, there might be some limits in some way, because maybe it takes a lot of compute on our side. But in general, push it down the stack, make it freely available to everybody. I think it has created the cloud that we know today. No, exactly. And I love what you said about the feedback. One of my favorite things is that our customers are so vocal, and it makes it so much easier and more fun to build products, because they tell you exactly what they're thinking, and how you can help them out. And then also, by having so much traffic on our network, because we're able to see so much, so many different attacks, I know we can constantly improve our DDoS mitigation. For example, today, we're going to be launching a blog post about our traffic manager, and how we can intelligently route traffic across our network. And so I think it's so incredible that we're using that to kind of make ourselves smarter, and make our products much, much better. Yeah, traffic manager is one of those cool things, right? When I joined cloud, I think we had four cities where we had hardware, and now we have 300. And in the beginning, it was tricky. You're doing everything manually, but at some point, you have to give up doing things manually. And what's interesting about traffic manager is there's traffic predictor, which goes along with it, right? And traffic predictor is in there, figuring out, well, if I were to make this change to cloud-based network, what would the effect be on real Internet traffic? And that's pretty wild. We do that global scale, right? And it sits there and says, where I need to shut off this connection, the traffic would move around like this. Some of this stuff is incredible. And of course, as an end user, you see none of this. What you should see is, oh, the website, or the app I was using, or my Zero Trust things at work, well, they just worked. And you don't know there's bad weather on the Internet or whatever. No, exactly. And I highly encourage everyone to check out our deep dive into traffic manager. One of the things that I love about the Cloudflare blog is that it's so informative. Before I joined Cloudflare, I knew nothing about how the Internet works. And I think after three days of reading through the blog, I was like, wow, I get it now. Yeah, of course. Yeah, yeah. And with that, how do you feel like the blog has changed over time? I know you read every single blog post and curated it to be such a great tool. And so I'd love to hear more about how you feel like it's changed or is going to change. Well, I think that the first thing about the blog is that you have to remember that when we originally were doing the blog, it was not for our customers. It was so that we could get new employees. And so what we wanted to do was write about the sorts of things that Cloudflare was doing internally, because that would attract people. Because you never know quite what it's like to work at a company and quite what the technologies that they're working on or whatever. So we let engineers and encouraged engineers to write about whatever they were working on. And, you know, I don't know what percentage of engineering read a blog post and thought Cloudflare was interesting, but that really worked. And to this day, I feel like almost every person I talk to, they're like, oh, I read the blog. Yeah, everybody is like reading it, and learning stuff. And so over time, that also gives a lot of confidence to customers, because customers can see what we do internally. And they feel it starts to create a relationship with the company because I understand and we're explaining all the stuff. We'd also explain technologies like HTTP2 or elliptic curve encryption. So people and what I've aimed for as you say, I edit every single one of these blog posts, which this week is a lot of work because we got the birthday week. But my target reader is a person who's interested in learning something, not an expert in the subject they're reading about, not a native English speaker. Right. And the reason the last one is important is that we try to write for a global audience that speaks English. So the language we use, we try to be clear, concise, not overly clever. We're not trying to win any literary prizes with what we want you to come away feeling. You should better read it. You should be told a story about something. You should come away feeling smarter. And then if you do, hopefully you think, oh, those Cloudflare guys are smart, because I ended up feeling smart. So that does take a lot of work. The big change is the volume. I mean, the number of blog posts we have, because now we have more people writing because the company's got bigger. And I would say the other thing that happened to Cloudflare was in the beginning, it was only engineers writing basically. A few other people, but mostly like very technical content. Over time, we have a whole bunch of product managers who are managing products. And so they're able to describe the products in detail in a way that the engineers didn't. So there's more what I would call product management content on the blog. Still a ton of very, very technical content. Actually, just before I started speaking to you, I was reading a blog post called Tap Devices, The Missing Manual, which is super technical about tap devices. So that's going to be like, if you're interested in Linux internals kind of stuff, you're going to get a lot out of that. No, that's incredible. I'm honestly, I'm jealous of your position that you get to read each one of these blog posts and learn so much about what's going on. Sometimes, some people don't write very well. So sometimes I'm just like, tearing my hair out. Because people, the biggest problem with writing, as I described, is to be able to step back from what you're writing and describe it for that person who isn't you. And we have some great people who write for the blog, but there are occasionally people who write and I'm just like, you've got to step back, you've got to step back, you've got to step back because you're just too close to it. And the person doesn't know what this jargon means, or they they're not familiar enough with the context. And hopefully we get it right. I mean, I think there's been some great blog posts, some which I was like, I wish I could have beaten them into shape a bit more. But you know, that's life. Yeah, um, I actually, one of my favorite talks that I've listened to at Cloudflare was from our last head of engineering, Usman. And he did a talk on how to explain things. And I always think about that framework of start with a situation, what's the world like today? Okay, then like, what's not working out? What's the problem? And then go into the solution. And it feels so simple. I think it really changes how you tell, never start with a solution. No one's gonna understand what you're talking about. Well, also, because I really truly believe that humans are hardwired to enjoy stories. And I suspect since the first humans gathered around a fire somewhere, they probably told each other stories. And they do, if you think about all of our cultures around the world, they're often based on stories. And so like, it's like stories are us, right? Well, that's how we, I think we really understand the world. And so often with a blog, it's not necessarily a story with a hero and an antagonist, all that kind of stuff. But it's a story about perhaps a problem that needed solving or how, how, how we approach something. And that really helps people understand the context and then get into the detail. No, for sure. Um, and so at Cloudflare, we ship a lot, like you mentioned, especially with innovation weeks, we have anywhere from 40 to 50 announcements. And so I would love to hear from you what makes this fast pace of innovation possible at Cloudflare? And how do we continue doing this as we scale? I think we, um, first of all, having weeks helps, right? It's right. Because if you have a week, then you have a deadline, deadline that can't move, right? We're not going to move Cloudflare's birthday, September 27th, it doesn't change. So that means some stuff is going to go out the door. Some stuff won't go out the door. Some stuff will get removed from birthday. This happened, right, over time. But it gives us, it gives us a deadline. So that helps motivate things. I think the other thing is we always felt like companies stop innovating at some point. And yeah, they go concentrate on their customers. And we're very much like this. So concentrate on their customers get kind of locked into this thing where they're just building features for the customers, which is great. And we like making features for customers. But you have to think about what the long term story is a long term strategy for the company. And so that creates a sort of, I think, a sort of fear as kind of a fear of, um, you know, slowing down and not being innovative and not pushing the envelope on these things. And so I think some of the things that we've done in terms of innovation, probably have surprised people, for example, I mean, the fact that in the beginning, we have a CDN, which didn't charge for bandwidth, that was kind of surprising thing, right? And there was a birthday week announcement, which was unmetered DDoS mitigation, right? We just said, doesn't matter whether you're paying us nothing, or millions of dollars a year, doesn't matter what size of DDoS you get, we will handle it. And we've had, you know, close to two terabits per second DDoS attacks. And very often, the biggest DDoS attacks are against free customers. But DDoS is a scourge of the Internet. Now, the other way to look at it would be to said, two terabits per second, that's going to cost you a fortune, you know, we're going to charge you for that. So I think we want to think about things that really work for the long term, that happens. And then I guess it's in the culture. Now, we just ship. And shipping feels good as well. Right? Shipping feels great. You got the thing out the door, it's going to be hell immediately afterwards, because people are going to say, why didn't you give me this feature? I want that I want that, but that's actually being alive. Whereas not shipping and trying to perfect something. And it just, it just would feel weird. I wouldn't want to work in a company that did that. I thought I did work in a company that did that. And I'm not there anymore. So no, exactly. And I love when everyone comes together from the team. It's like you launch it, you're watching the metrics, first bug is reported. Yeah. No, it's great. And so I was actually watching a previous Welcome to Birthday Week segment. And I love one of the questions that Jen asked, is she essentially said that as a part of having a birthday, it's really important that you can blow out candles and make a wish. And so I guess what would be your wish, maybe for the Internet for this year? You know, the Internet, there's a real threat to the Internet, which is that, you know, what makes it work is it's a network of networks. And there was a loose agreement on protocols, you know, TCP, IP. And, you know, it grew into this fabulous thing. We need to keep it that way. I mean, Carver has this rule internally. And if you've ever written for the blog, you will know that if you put a lowercase I on Internet, I will shout at you. Well, I'll shout at you. I would never make a mistake. And because we think there should be one Internet, not many different networks. And so my wish, I guess, for in a year's time is we're still in the same place. The Internet is continuing to grow. It's such a vital part of our lives. It's a piece of critical infrastructure for our lives. And I, it's hard, you know, you think of the number of things you do that involve the Internet in some way, it's crazy. You know, the number. And so hopefully keeping it free, keeping it open, keeping it something that can grow through agreement is really, really important. So I guess that's my wish for birthday 14 is that we're still in that position. And that Cloudflare, I mean, Cloudflare's part in that is roll out the latest protocol, roll out, you know, we're trying to build a proprietary Internet, we're trying to say the Internet needs to work well, right? I mean, the most recent example that is, you know, is post-quantum encryption. There's a lot of companies out there that are trying to sell you post-quantum encryption. That's the new threat. We can make money out of it. Not Cloudflare, it's included in every plan, no matter what plan you're on, doesn't matter what you're doing, everything's going to be post -quantum because that's the right thing to do. That's the new way of doing things. That's the latest protocols in this case, the latest encryption. So we're going to roll it out. So we want to keep it that way. And so we are hopefully by birthday 14, it's still going, it's going in the right direction at least. No, for sure. And one of the directions that I love that Cloudflare has been moving in is privacy. And so I know that this birthday week, we're going to be talking about how we're patching up some of the last privacy holes of the Internet. And kind of like you said, when the standards were first written out, a lot of these things were not considered. And so I really like that we're doing the right thing. We're going back and we're making sure to address this and make it better for the future. You're right. We did that with encrypted DNS, DOH, with 1.1.1. Obviously we rolled out the latest versions of TLS. And now we're talking about ECH, you're talking about there, which encrypted client hello, which stops what's called the SNI name, which is the name of the website you're going to basically from leaking to somebody who's observing your connection, be it in a coffee shop or in a sneaky ISP. But also in terms of other things, one of the other interesting announcements is around measuring things, but privately. It's very useful to be able to measure things. It's very useful to know how many people on the Internet are having a slow Internet, for example, or to measure how many people abandon their shopping cart. But doing that in a way that preserves people's privacy. So you can't then say, oh, it was Dina who abandoned her shopping cart, for example. That's really important. And there are very nifty ways of doing that with cryptography. So we're going to talk about that this week as well. So yeah, lots of privacy preserving technologies too. And so all of this sounds incredible. And so for anyone watching this, how can they follow along during birthday week and stay involved with all of these announcements? Well, obviously go to the blog. I mean, it's all on the blog. I'm not quite sure how many blog posts there are this time. It's something around 40, I think. A bunch of press releases out there. But I would go to the blog, use the RSS feed if you want to follow along on that. I think there's an email list if you want to get stuff emailed to you. But there'll be lots of announcements starting on Sunday with a welcome post and then running through the week, a whole bunch of stuff. So yes, stay tuned. There's lots of AI, but there's lots of everything else. Yes. And also feel free to check out Cloudflare TV. We have multiple segments every day discussing what we launched. Absolutely. And I'll be back with my regular show with Joao Tomé that we do this week in net, where we try to summarize things. We'll never get through all 40 blog posts, pick some highlights, but yeah, we'll be doing that too. Yeah. You can try to challenge 43 blogs in 43 minutes. But thank you so much. This has been incredible and welcome everyone to Cloudflare's 13th birthday week. Happy birthday, Cloudflare. Happy birthday.