Cloudflare

Cloudflare details five Rust memory-layout changes to its 1.1.1.1 DNS cache — dropping Vec/String capacity fields, merging record lists with u16 offsets, omitting owner names when they match the query key, boxing large enum variants, and storing record data as wire-format bytes — cutting per-entry memory 56% and freeing roughly 100 TB fleet-wide. Performance also improved (inserts +43%, lookups −19%), though each change carries tradeoffs: allocator overhead and poor locality from boxing, sequential-only access for wire-format buffers, and records no longer self-contained.

Cloudflare argues that mixed-use crawlers (Applebot, Bingbot, Googlebot) forced site owners to choose between search discoverability and refusing AI training. Its new Disallow AI Training setting publishes a robots.txt preference that 'Accountable' operators honor, keeping search while blocking training; Block now applies to mixed-use crawlers too, affecting search. Settings migrate automatically on September 15, with stricter presets for ad-funded sites. Cloudflare frames AI summaries, with only partial controls today, as the next unresolved tradeoff.

Cloudflare details four malicious JavaScript campaigns found on storefronts—affiliate-commission hijacking, clickless affiliate theft, a remote-code backdoor, and a paid-traffic cloaker—that VirusTotal and URLScan largely missed, arguing behavioral ML analysis beats signature scanning for gated, conditionally executing scripts. The detection pipeline combines a graph neural network, a lightweight LLM on Workers AI, and a weighted frontier-model voting ensemble with human review. It is a vendor post promoting Cloudflare Client-Side Security, so evidence is detailed but conclusions favor the product.

Cloudflare cut ~100TB of RAM from its Pingora Backend Router by attacking pingora-ketama's consistent-hashing rings on two fronts: packing the per-point struct from 8 bytes to 6 (25% savings, done via a raw byte array because Rust's alignment rules negate simply shrinking the index field), and reducing hashes per server by 90%, justified by a derived formula (CV_k = sqrt((N-1)/(Nk+1))) showing the last 90,000 of ~100,000 hashes bought only ~0.7% error reduction while 32-bit collisions actually made error worse at high hash counts. The tradeoffs are that fewer hashes raises the theoretical load-imbalance error margin, and changing the ring re-routes cacheable requests and would invalidate cached content, so both rings ran side by side per request and the rollout proceeded data-center by data-center to limit cache churn and blast radius.