Principal engineer @ Cloudflare Observability More active on BlueSky

Squamish, BC
Joined April 2012
I co-sign this take. Dashboards were always a junk drawer anyway.
realized i forgot to share the actual post, tl;dr it's often faster for me to generate an entirely new view than to learn how to hold your interface the right way, excited to see this trend continues to develop burcs.dev/notes/interfaces-a…
1
3
334
Jeremy Morrell retweeted
Same for Workers Observability. @mattsimpsn dropped memory and cpu on the worker that ingests all the logs by like 50%
the beauty of building on our platform: we just used the new CPU profiler on the worker behind d1 improved CPU utilization by 30% and improved RPS throughput for customers 🤯
3
4
20
544
Cursed idea I don't have time to play with: slop-fork celld's architecture into OCaml and run it in a unikernel
1
10
541
Jeremy Morrell retweeted
Some stats on #php2shell. In the 10 hours before it was publicly announced, across the @Cloudflare network we saw thousands of attempts to exploit it. That jumped to tens of thousands in the 45 minutes post announcement, hundreds of thousands within 2 hours, and millions now.
287
3,265
659
22,580
2,217,906
Jeremy Morrell retweeted
I was super critical for years that Cloudflare turns into a single point of failure for many sites. But the flipside is that it's also has a really good positive leverage affect on security. This is great stuff. xitter.cf/dok2001/status/2112811…
PHP sites behind Cloudflare already have an initial set of WAF rules deployed for the known exploit vectors in these vulnerabilities. The rules are available to all customers, including free. We are seeing early attacks emerging and are updating mitigations as new vectors show up. This is a STOPGAP only. Patch as soon as @ThePHPF releases the update at 14:00 UTC today.
12
24
5
589
18,941
Jeremy Morrell retweeted
If you self host software, you really should put it behind either Cloudflare or Vercel’s firewall The firewall rules & data they have on how people try to run exploits are so critical right now
The Cloudflare's writeup on our php2shell response is up. Rules went live at 03:02 UTC, about 9 hours before disclosure. Unfortunately the vulnerability leaked early, so we were already watching attackers mutate payloads against the rules and updating as variants appeared. New rules keep landing in the WAF changelog. Expect updates through out the day. We will have a more thorough post of what we had to build to better protect people coming shortly. PHP runs almost 70% of websites. The flaw is in the runtime, so updating plugins won't fix it. Patch PHP. blog.cloudflare.com/php-vuln…
22
20
5
844
25,370
Jeremy Morrell retweeted
The new capability that we built to help defend php2shell is live. The @Cloudflare WAF now has full transaction detection that evaluates the request and the origin response together, and response rules block a match before it reaches the requester. Example from the post: unauthenticated hit on /admin that comes back 200 text/html. Block it. Auth failures and redirects can then pass through untouched. blog.cloudflare.com/full-tra…
The Cloudflare's writeup on our php2shell response is up. Rules went live at 03:02 UTC, about 9 hours before disclosure. Unfortunately the vulnerability leaked early, so we were already watching attackers mutate payloads against the rules and updating as variants appeared. New rules keep landing in the WAF changelog. Expect updates through out the day. We will have a more thorough post of what we had to build to better protect people coming shortly. PHP runs almost 70% of websites. The flaw is in the runtime, so updating plugins won't fix it. Patch PHP. blog.cloudflare.com/php-vuln…
6
60
10
446
102,734
Jeremy Morrell retweeted
!!
11
29
19
296
30,921
From my feed I'm not quite sure if Cloudflare Connect is a customer conference or a company on-site #FOMO
6
43
1,807
Whoa 🤯 That's such a good idea! "It is still fast, typed, and cheap, but it answers with values directly extracted from the input, computed from it, or predicted beyond it."
1
8
470
@michellechen immense props to the team, and to the author of the blog post! It's so well-explained and the examples are great. I think this might be my favorite post on the blog this year!
1
2
70
In a bunch of different areas I keep exploring new ideas and then realizing "Damn, that's just Cloudflare OS again" It's like the LLM version of re-inventing trains from first principles
Prediction: Most people will stop using docs, slides, or spreadsheets in the next year, instead prompting an agent for custom code for every task. Each of these apps is just as "easy mode" version of something else that used to take far more time and skill to create: Docs: Easy mode web site. Slides: Easy mode video / animation. Spreadsheets: Easy mode custom app + database. But now you can just prompt an agent to build the "hard mode" version for you and they are damned good at it. (Note: I'm not suggesting that humans shouldn't write. You can still write text, and then ask an agent to turn it into a web site that supplements your text with diagrams, animations, hierarchical organization, etc.)
1
4
421
This came back across my feed so I'm reposting it again because it's a bop
We open sourced Void v1.1.11 and we made a music video for it. void.cloud
1
5
474
Jeremy Morrell retweeted
Progress! My eval reports now link directly to investigator traces, individual tool-call spans, and grader spans. You can click on a failed tool call's span ID, and inspect the command/error in context. Also according to my evals, Luna 6 is a weird little chaos gremlin.
1
1
83
Jeremy Morrell retweeted
I don’t think personal software will kill OSS and I think it’s very overrated. It’s super fun to jangle the keys in front of your own face and vibe code up a copy of something else that exists in this world. But truly owning it, operating it, having a vision for it kinda sucks! OSS still wins out on the a value proposition that it’s free and you can shunt those concerns off to someone else. The talking computers don’t actually know exactly what individual people want and most people don’t feel like just living with whatever an agent confabulated as a design and architecture. The future for OSS probably involves a token market where you can yield some tokens to allow a maintainer group make the right decisions for you.
4
2
1
23
941
"everyone is twelve now" still seems to perfectly explain so much of current discourse
5
232
Jeremy Morrell retweeted
🧠: Okay, so we are working on something really cool right now and want to present it to our peers in a technically proficient and approachab... 👄: GET IN BITCHES WE'RE DOING EVALS! Work in progress obviously, but stay tuned!
1
62
Jeremy Morrell retweeted
prototyping visualizations in the new cf cli got nerdsniped by @nevikashah
1
7
22
1,121