Cloudflare 2023 Year in Review special edition

Hello everyone and welcome to This Week in Net. It's the December the 15th, 2023 edition and this is a Cloudflare Radar 2023 Year in Review episode. I'm João Tomé Belson in Lisbon, Portugal, and with me I have David Belson, our Head of Data Insights. How are you, David? Doing well. Glad we got the Year in Review out and looking forward to some vacation after Christmas. That's right. Christmas is just around the corner for those who celebrate. There's also Anika going on. So a lot of celebrations. Just finished up last night. Exactly. And in this case, the Year in Review, for those who don't know, is something that we do for a number of years already, although every year changes a bit, right? It does. I was actually just talking about that with someone else, where we launched it in 2020. The big focus in 2020, with being in the middle of COVID at that point, or in the early days of COVID, I guess, was looking at traffic trends and how traffic moved around on more of a local level. So, you know, cities that previously saw a lot of Internet traffic within the city, how did that move to the suburbs, the outskirts? And I think there were some insights there on how people use the Internet as well. We first looked at aggregated traffic data around the top industries and verticals. So, you know, a lot of entertainment, a lot of gaming, obviously, because people were now stuck at home because of the pandemic. But it's evolved over the last few years. As you all know, obviously, in 2021, we added a blog post that covered the popular Internet services. And then last year and this year, we've expanded further to look at things like startling traffic trends, additional attack trends in various ways. This year, we added some more information, more insights about email and routing security, as well as looking at, you know, traffic on a sort of a whole IPv4 Internet level. So, yeah, we're definitely continuing to evolve it year over year. Exactly. It makes sense. And this is something that it has a microsite. We're going to show it in a few minutes. There's two blog posts that we published that are essentially reports of some highlights that we saw during the year. And this is also the culmination of a lot of analysis through the year that we do regarding outages, disruptions, changes in Internet traffic patterns. Absolutely. Yeah, it's a culmination of just a lot of the work that we do. Let me just share my screen here for people, those who are not hearing in the podcast format to see. If you're hearing in the podcast format, you can go to blog.clother.com and see the blog post we wrote and the microsite we did. Let's start with the Clother 2023 Year in Review blog post. In this case, a lot of what is the main, the key findings, let's say, like that people can have of 2023 as an Internet year? Yeah. I mean, so traffic up, Google's still popular. Open AI continues to be the breakout star in the generative AI space. Log4j, still a big threat, still a very popular threat. And that was something that came out basically two years ago now, but attackers are still targeting it. Was that in December? December of 2021, right? Exactly. Yeah. So two years ago and attackers are still actively targeting it. But HTTP2 Rapid Reset is, I think, an emerging threat. I think something we'll probably look at covering next year. And then I think email security, I was a little surprised that only about 3% of email being malicious, but I guess that doesn't count as spam. So I suspect a large portion of it is spam. And then there's a smaller percentage that's actually truly malicious. And I just start showing our microsite that people can explore. And you were mentioning malicious email. We can go directly to that page. So we saw the volume grow over the course of the year, the percentage, the share of emails that are malicious grow over the course of the year. Exactly. And there's a 2.65% of average of the year, but we can see that in November was much higher than it was in January. Yeah, it's interesting to see the spikiness there. I wonder if it's targeted around particular holidays or events where that first spike back to school and then obviously holiday shopping. So I wonder if the scammers, the bad actors are trying to take advantage of the fact that people are online looking for deals, looking to buy things, and they're sending them some sort of malicious email in that theme. Could be, could be. Actually, that's something interesting in the blog post I wrote about the Black Friday and Cyber Monday perspective. It was kind of interesting to see that the before the actual day than in the actual day. So it goes along that perspective. And we also have that Internet traffic growth that you were mentioning that is growing 25% worldwide. This year we're adding the 2022 line, so the previous year line for comparison. Right. It'll be interesting to see, again, if this year traffic peaks sort of around Black Friday, Cyber Monday, and then gradually heads down as people head offline in December. Exactly. That was the case last year. We can see it easily. And this case in November was clearly at its highest. Yep. And it hits that low point of Christmas and then sort of starts to bounce back up in the last few days of the year. Exactly. And then on January 1st also drops, but that's more difficult to see. That's why we don't see that on this graph. And we spoke about this before. There are specific countries, like Muslim countries, that celebrate Ramadan. And for example, we can see here Ramadan in Morocco, clearly a bunch of days, around the one month between March and April. Right. There's also in the summer, a very important holiday, Muslim holiday here, that it was the drop in July, around July 1st here, but in the previous year. A little bit later, last year. Exactly. And we also noticed the earthquake, the Morocco earthquake here around September. Yeah. It's definitely interesting to be able to compare it with a previous time period to see just the significant impact. Guam is another great example there. They got hit by a typhoon this summer. And you can see right there, it basically knocked them almost completely offline. They began to recover fairly quickly, which is encouraging. But it took them several months before they got back to a normal level of traffic. Of course. And it's in the Pacific, so sometimes it takes more in some of those places, right? Right. Yeah, it depends on how much. In those cases, it largely depends on how much damage there is to submarine cables that connect them to other countries. Exactly. The microsite has different perspectives. We still didn't mention, but there's Internet services. The most popular Internet services are worldwide, with a few categories. There's iOS versus Android, where people can explore the country they want to see. This is actually also on radar, right? Yes. Yep. So on radar, you can look at it over the last, you know, whatever time period you want. And it'll give you that summary stat. Here, what we did is we aggregated over the course of the entire year and took the average. And we've discussed this before, but for example, the US in this category has a higher percentage of iOS devices than worldwide. Right. What I saw when I was looking at some of the data is that iOS versus Android preference aligned in some respects with, I'll call it disposable income. Where countries where the populace has a little more disposable income, is a little more well-off, I think tended towards more iOS usage. I was just doing some tests here. And for example, Norway is almost 60% of iOS, or Canada. But if we go to Brazil, it's only 18% of iOS devices. Or you look at some of the African countries also have similar sort of imbalances. Exactly. That's always interesting to see. There's also SpaceX, Starlink, Traffic Trans, right? This is actually in Nigeria. I just put Nigeria here. Yeah, it looks like they turned on service earlier this year and saw just absolutely massive growth over the course of the year. My guess is that even that 1000x growth is still a small number. They're not pushing terabits of traffic over Starlink, but clearly there's some pent-up demand there. And this is the worldwide perspective, 3.3 times growth. Global is a little more tempered, yeah. But still strong, still good. Yeah, it's still growing worldwide, which is interesting. This actually made the news. We were speaking before, this actually made the news. Some authors picked up on this, which is always interesting. Because it's a very specific Internet service, different from the typical submarine cable ones. But I think it's still one that's getting a lot of interest out there. There's still a lot of demand for it. We have some competitors that in theory will be launching services in 2024. So we'll see if that tempers their growth. We may have to look at growth on Kuiper and OneWeb and see what we can find there as well. See if they're growing at similar rates. Absolutely. And in this case, I'm showing Brazil, also major growth. And Brazil is one of those countries that is pretty big. There's areas where the access to Internet sometimes is a little bit more problematic. So a country like that, Australia, US, could definitely benefit in terms of those types of services, as you were saying. Absolutely. We have also some other prospects like HTTP versions. This is also about making the use of the Internet more secure in terms of the HTTP protocol. Higher performance, higher security. Those things generally tend to improve as the versions evolve. So that's certainly the case with H3. Exactly. We also have API client language popularity. This is the Node.js, which is the most popular choice here. And we also have now IPv4 traffic distribution, which is this amazing chart. Yeah, this is a fun one, Hilbert curve. It's a little bit hard to grok, but it's a good visualization to use for looking at the IPv4 Internet. And that's what we did here. We basically looked at the traffic we're seeing by blocks of, I think, 4,096 IP addresses. So it's interesting to see the different areas of the world, the different autonomous systems, and where we're seeing more or less traffic from and where we're not seeing any traffic from. That's also this button, zoom on my IP address, which we're using warp, our quad one service that doesn't have IPv4 in this case. So it's not applicable, but people can explore. And there's also something you know a lot about Internet outages. 182 major ones observed. And that arguably undercounts. I mean, those are the ones that we observed, that we tracked and we followed. There's a number of them, like in Ukraine or in Gaza, where we're essentially tracking it as sort of one outage event. But the reality of it is that there's a lot of small outages or disruptions that have been happening sort of over the period of time. And people can explore and see what were the days and the reasons of the outages. There's a lot to explore here, which is always interesting to see. The IPvC adoption perspective here in terms of the IP version. Yep, that's looking at web traffic. Carlos Rodriguez, one of our colleagues, actually also published a blog post yesterday that was really interesting that I'd encourage people to look at. That looked at IPv6 adoption from a DNS perspective. And looking at it sort of from a client and server and who can get to what. There's the growth. There's growth in that category, but not as the growth expected by many. Yeah, I mean, IPv6, that can be a whole segment unto itself. But IPv6 growth has taken a long time. I mean, I've been involved in evangelizing around there for almost 15 years. And it's just been a lot of stops and starts. It's a good area, but also a complex one. Absolutely. It hasn't evolved as quickly as some would. Right. We also have Internet quality with Iceland being the highest on speed in 2023. But people can also explore upload. Yeah, Iceland had strong showing on all the metrics. I think that's largely because they're more of a concentrated geographic area. And they have really, really good fiber penetration. So those two factors, and I don't know about the prices of their services, but I suspect they're probably reasonable as well, which means that you're going to have pretty decent uptake of those high-speed services, high -performance services. Makes sense. And Europe also performs well. Portugal is here, present in some of the metrics. They historically have. Northern Europe has historically performed. And I've been following this stuff for 15 years. Northern Europe has definitely performed well when it comes to Internet connectivity. There's also the mobile versus desktop perspective in terms of usage. Mitigated traffic, the percentage of global traffic that was mitigated. Some trends there, DDoS attacks are still a big thing, as we were mentioning in the beginning. ATP2 vulnerability was a major attack during this year. A new attack, in a sense, during this year. There's also bot traffic sources. Yeah, so this one was interesting. I don't know that I necessarily expected the U.S. to be responsible for a third of bot traffic. Although, having said that, one thing to point out and reinforce is that not all bot traffic is bad. So a lot of quote -unquote good bot traffic, verified bot traffic, like search engine crawlers, or performance testing bots, or uptime bots, things like that. Those may also be coming from data centers and systems and whatnot within the U.S. And I guess we sort of call that out below when we look at the shared by autonomous systems. So a lot of these bots are running in Amazon, in Google, and other major cloud providers. But a big percentage of that traffic, it's actually doing some useful things, in this case, depending on the bots. Bots have, by and large, I think, gotten a bad name. We also have, in terms of security, most attack industries. And people can explore throughout the year what was the percentage in terms of industries that were the most attacked. I think tech finance actually was the most attacked in 2023. We see that change over time. We see that change, exactly. Real estate also, for example, during the summer in the northern hemisphere here, with a very high percentage, which is interesting. You were mentioning in the beginning the vulnerabilities perspective for J. Here it is. Yeah, I was in a conversation the other day about this and why we're still seeing so much like for J traffic or attack traffic. And I think it's simply because it's still effective. There was actually an article that I saw this morning about another attack using log for J as a vector. So I think if we get to the point where everybody is really patched against it and it's really not providing the attackers any sort of return on their investment, then they'll switch to something else. But if they can continue to use like for J to infiltrate systems, to infiltrate enterprises, I think they're obviously going to continue to target the vulnerability. Makes sense. Makes sense. If it works, they continue. Actually, DDoS attacks are not new, but they continue because they're cheap. Exactly. It costs nothing to run the attack, so I might as well just keep trying. Exactly. And this is actually a new perspective that we added this year, post quantum encryption. For those who don't know, what is post quantum encryption? I will not do it justice, but the idea is that it is a new set of cryptography, essentially, that is believed to be... It's related to the quantum computers, right? So it's basically encryption that the quantum computers should not be able to break. So the idea there is that if there is some entity that is capturing all of the encrypted traffic that's transiting the Internet these days and sort of storing it somewhere for potential decryption in the future, the idea is that anything that is using post quantum encryption will not be able to be decrypted by these quantum computers in the future. Exactly. It's bringing protection to... It's protecting current traffic from future threats. Exactly. And it's quite important. And it's interesting to see the post quantum encrypted traffic growing in this case. And it's still really, really early days. I mean, we've turned it on on our platform. Google has only turned it on in a portion of Chrome. But I think if they get to the point where in Chrome 121 or 122, let's say they just flip the switch and turn it on for everybody. Firefox picks it up when Apple Safari picks it up. I think we'll see an even more impressive growth curve there. And there's also malicious email that we were speaking before here. Present too. And top email threats. So these are the types of malicious emails, the threats that are there. Yeah. And it's really interesting to see that that was really one of the top threats. It makes me even more paranoid now. As I get an email, even the emails that I know are legit, I'm sort of looking at it going, yeah, I'm saying you're a thing for my healthcare provider about some appointment I just had. But you know what? I'm just going to go type the URL into the site anyway. Because I want to make sure that I'm not accidentally clicking on something that I shouldn't be. So it's a blessing and a curse, I guess, that we have insight into this. And Deceptive Link is one of those, without surprise, to be honest, it's one of those that are high in the list. And we already passed through, but there's also the Internet services that we have a specific blog post about. Anything that surprised you in the generative AI new perspective that we have? Not really surprising. I mean, I think that open AI clearly came out of the gate quickly last year with ChatGPT and really continued there straight this year. I think the turmoil in November, I think for about a weekend there, everybody was like, that's the end of ChatGPT, that's the end of open AI, they're imploding. And then I think it was just sort of more of a week or so of drama, but came out the other side. From a services perspective, largely unchanged. I think what'll be interesting is to see if and how the rankings there change over the next couple of years. I think it'll probably be a bit like the crypto space where there's a flurry of new entrants, they'll climb up the charts, they'll be big for a year, and then things will change though. There'll be some consolidation. And we can see the changes because, for example, BARD was launched during the year, and in Europe, I believe it was in June that was present. And we can see in our chart BARD appearing. They'll sort of shoot right up as they come out. And it ended the year in fifth, for example, which shows that it had a good presence there. It largely seems to be an arms race in this space, where it could be that if Anthropic comes out with something that bests ChatGPT, that people shift to use that. Well, I was saying BARD, but for example, Perplexity, also a good presence in the last part of the year. There's a few here that appeared during the year. So there's interesting services to follow through there. There's the more general, most popular Internet services perspective, where Google is number one, Facebook number two, Apple number three, and TikTok number four. In this regard, no big change compared with last year, actually. But I think the most interesting thing, for me at least, was first, YouTube is still a very big presence there. But also ex-Twitter was out of our top 10. For example, last year, Twitter got many days on top 10, the overall ranking. This year, not one day. And we actually have a perspective on that here, on the social media perspective, that shows that Twitter was more popular, now ex, was more popular during the football, soccer, for those in the US, days. When the decisions were made in the National League, especially the Premier League, late April and May, that was when Twitter was highest in our ranking, our general ranking. There's also the Twitter alternatives, or ex-alternatives. Macedon threads and others. Macedon higher, threads only appearing in July, of course, in the top 500, but still very far from the top places. It'll be interesting to see threads also, now that they're making more active noise about federation. The biggest news for us in Europe was that threads was launched for the first time yesterday in Europe. So Europeans are plushing to check it out, threads. Some never saw it before. I'm going to see how long I can resist threads and TikTok. I'm still not a TikTok user, I'm not a threads user. Trying to turn down my social media usage, to be honest. Threads seems a little bit of Twitter a few years ago. So more simple. For me, the biggest surprise of the year was TAMU. TAMU, for those who don't know, is an e-commerce platform that was launched in September 2022 in Boston, although it's from Chinese investment and other investments. They are a little bit like China for fast fashion. They are pretty much betting on growth, aggressive growth. And they appear in seven in our list, but they are growing in the last part. They advertise really aggressively. Pricing is ridiculous. I don't know about the quality of the goods they ship. So I think they're going for volume and then they'll figure out the economics after the fact. The low price. They're actually pretty similar in that regard in terms of low price and things like that to shine. There's actually a lawsuit between the two, I believe. Back in the last couple of days. But we can see that actually in the beginning of the year, TAMU was way behind the overall ranking compared with Shine. But it surpassed during May Shine and it's higher in our ranking, which is interesting. And there's also some Black Friday perspectives here about a lot of these services. Best Buy, Nike, Adidas had their best year, best day during Black Friday, that Black Friday week. So there's different perspectives here. And also video streaming with YouTube and Netflix remaining uncontested. A lot of things for people to explore here, too. News perspectives with some of the Titan submersible implosion. Even the Hamas and Israel war is also present here in some cases. CNN. Not surprising. Not surprising, true. A lot of things to explore. Messaging, metaverse and gaming with Roblox and Oculus being one of those more highlighted there. And also financial services with some of the crypto services also appearing here. These are the crypto ones appearing. A little bit of movement in that space. CoinGecko actually having a very good last part of the year. Actually, PayPal and Klarna, with no surprise, and Stripe, which was also a good surprise here, taking number one, had great days during the Black Friday week. So that also makes sense. Makes sense. Exactly. Binance declined a bit, actually, during the last part of the year. This was also interesting. And we also have a Taylor Swift and Beyonce trend because they appear in our top 500 list in specific days. Taylor Swift was in August 10th when she announced her new album. And Beyonce was in June the 15th. That was when the Financial Times actually did a report about how inflation in Sweden increased during the start of Beyonce's tour there. That was on the news at the time. And Beyonce's official site was also being highlighted there. Right. A lot of friends for people to explore here. Yeah. I mean, that's one of the cool things about your review is that we do provide so much of the data there and so much of the ability to just go through and explore on your own. Exactly. And for 2020, for any wishes for not only for your own review, but why not in general, technology in general that you have? Boy, I don't know. I'm always troubled by predictions. I think for me, working with the team to continue to drive Radar forward, adding a lot more interesting stuff to it, adding a lot more content that can bring more usage. For your review next year, I think one of the things I'd love to do would be to explore what they call scrolly telling. So it's one of those visualization approaches where you have a larger story and that you scroll through it and there's some text and there's some visualizations. And then it's really kind of a cool way of telling a story. There's actually a really good one, a good example of that, that I was reading yesterday on Yahoo Pipes. For those of you that remember Yahoo Pipes. I think looking at what else can we add that's interesting and valuable and how else can we continue to tell stories and data-driven stories in an interesting and unique way. Absolutely, because so many things happen throughout the year. And we at Helfer have an amazing perspective on what happens on the Internet. And showing that in a storytelling way makes perfect sense. It's quite interesting to see. How do we capture it and visualize it in a way that people can understand? A lot of work there makes sense. And for Internet services, my wish on my wish list is the bi-country perspective. Because that will show other nuggets of information for specific countries. That could also be interesting. Yep, absolutely. We'll work on that in March. That's true. And I will be helping there too. Well, thank you so much, David. You're welcome. Good shot. And to everyone watching, have a good end of the year celebrations. May that be Christmas or others. Is this our final episode for the year? Or do you have one more? We still have one more for Wednesday. And then it's a wrap-up. Excellent. We end it for this week with our CDO, John Graham-Cumming, answering a few questions that were sent by our audience. Here's Ask the CDO. Now, someone asked me to delve into the future with what recent announcement do you expect to have the biggest impact on the industry? I was thinking about looking backwards in time because, as I'm speaking to you, it's Cloudflare's 13th birthday. And I went back 13 years. And I said, okay, if I look back, maybe that will help me look at the future. 13 years ago, it was the iPhone 4. It was the first iPad. Inception was in cinemas. TikTok was big. The Kesha song, not TikTok the application. And I look back and I think, well, how could I predict where we were today from 13 years ago? I think I'm terrible at predicting the future. The best way to, you know, predict the future is to create it, which is, I think, a lot of what we're doing at Cloudflare, particularly with our recent announcements around AI and actually some other areas. But I do look back at one thing that I thought was really going to be significant. I remember at the time telling my friends, this is quite a long time ago now, and that was they should go and invest in touchscreen companies. I really thought that touchscreens were going to get better and better and better and everyone was going to be using touchscreens. And at the time, touchscreens were something that were, you know, insensitive to anything more than one finger. And it probably had, like, you know, 20 locations on the screen where you could touch. So maybe based on that, I'll make one prediction. I think that RISC-V is going to be a huge deal. I think that this alternative, you know, architecture for chips is going to be big. And I think we're going to see that grow enormously. It's not a recent announcement. It's been in development for a long time. But I think it's getting ahead of steam now. And I won't be surprised if we, you know, we're living in a world where there's Intel and AMD, there's Arm, and there's RISC-V or RISC-V. Someone asked me yet another question about future predictions, which I'm always really, really bad at. But it's how do you envision the Internet evolving over the next decade? So the answer is I don't know, because you go 10 years in the future, you know, it's hard to predict. Some things are easy, more bandwidth. We're bound to get more bandwidth because we're bound to end up with more and more bandwidth-hungry applications. And, you know, I think we will want to have multiple streams of perhaps augmented reality, virtual reality flowing into our homes and work. And over time, that will just become normal. I remember actually Bill Joy, who was one of the folks at Sun, and I remember reading an article ages ago in Wired that he'd written about how in the town he was living in, they had installed high-speed Internet. And that they had worked out that each person needed about one megabit per second, which now seems incredibly small. So I'm sure we're going to need more bandwidth. But I think the other thing we're going to need more than more bandwidth is low latency. One of the biggest things we can do to make the Internet faster is reduce latency. I mean, part of what Cloudflare does by having this large network is do that. We have machines close to end users, so you're fighting against the speed of light by having them close by because that's the only way you can do it. And I think low latency is going to matter a lot for interactive applications and also because we're expecting to be able to do things quickly on the Internet. And I think 5G will help realize that because it changes the architecture of how the Internet is delivered to the end devices, preventing some of the sort of silly distances that traffic has to travel on a mobile network today. So more bandwidth, lower latency, richer experiences, and undoubtedly even more embedded in our daily lives than it is today. So somebody asked, since you're English and a citizen of the world by now, do you find any cultural differences in how tech companies operate in Europe versus the U.S.? Well, yes. So I lived in Silicon Valley for a long time, right through the dot-com crash, actually from Netscape going public through the dot-com crash and after. And I've been back in Europe for more than 10 years. I mean, the biggest and obvious answer is risk taking. And the reason why there's, I think, more risk taking in the U.S. is two things. One is that there is money around to risk. And so just having the ability to build companies and have them fail and then start something new is easier. And that's related to just the supply of money, but also to cultural attitudes about failure. That's got a lot less in my lifetime. I mean, when I decided to do a computing related subject at university, it was not obvious to people in the U.K. that that was a good career. That was a technical thing. Probably should go in banking or be a lawyer or something like that. Now that seems ridiculous. Obviously, tech is really hot. So those attitudes have changed. The other thing I think makes a difference in terms of risk taking is personal risk taking in the sense that if you go to work for a startup in Silicon Valley, you have a pretty good idea that if it goes wrong, you're going to find something else to work on. There's going to be another company. And having that ecosystem, and this is why there are hubs in Europe, London perhaps, Paris, Berlin, where there are enough startups that people can start taking more risk because they think, well, if this company fails, I'll find another job. And that creates difference. I don't think that's really a cultural difference. That's just to do with the concentration of opportunity in one location. But I think the Internet has helped flatten this out. I think people see how things operate in different areas and take those things into account. People work remotely for different companies. So there are cultural differences, but I think over time they get less and less.