Salesforce engineers write about security tooling, machine learning, Kubernetes, and infrastructure they build and open source.
HN commenters mainly cite its JA3 TLS fingerprinting post as a way to identify clients, and also mention TransmogrifAI.
> It's not a lie. Cloudflare is the nameserver, and the CDN. So after resolution the end user still has just a Cloudflare IP.
> In 2011 Google wrote an IETF draft to send Client IP information using the EDNS0 extension and this is usually called ‘edns-client-subnet’. As a DNS client, it means that a truncated version of your IP address will be added into the DNS request. The DNS server will use this truncated IP address to make a more informed decision in how it responds so that you can be connected to the most optimal server. This standard is promoted by the Faster Internet initiative and already adopted by some leading vendors.
Because it is designed to keep privacy, the sender has the freedom to limit the client IP information. Instead of sending a full IP address, the DNS server is able to send partial information such as /24 only. For instance, if your IP address is 66.214.81.22, the DNS server will only expose the first three octets, so 66–214–81. Armed with the real IP address of the querying device, the DNS server can now come up with a much more accurate response.
With this more intelligent routing, customers have a better Internet experience with lower latency and faster speeds. Best of all, this integration is being done using an open standard that is available for any company to integrate into their own platform.
source: https://engineering.salesforce.com/why-is-edns-important-for-content-delivery-85f5690744ba
Cloudflare 1.1.1.1 for consumers kills EDNS…
For managing difrerent workloads, check out this blogs and this videos from Shopify, Salesforce, Goldman Sachs, and Electronic Arts, respectively:
- https://engineering.salesforce.com/how-to-etl-at-petabyte-scale-with-trino-5fe8ac134e36/
- https://shopify.engineering/faster-trino-query-execution-infrastructure
- https://trino.io/episodes/33.html
- https://www.youtube.com/watch?v=-5mlZGjt6H4
All use the Lyft "Presto but really Trino"-Gateway project to run different clusters to handle various workloads. They go into various details for how this is achieved.
https://github.com/lyft/presto-gateway
Regarding the Trino/Presto split. I recommend looking at this blog to better understand why these two communities aren't mergeing. TL;DR Presto is a Facebook-driven project that mainly considers running on the Facebook infrastructure. Trino is community-driven that works on running well with all clouds and common infasturcture in the Trino community which is why you see a higher velocity there.
https://trino.io/blog/2022/08/02/leaving-facebook-meta-best-for-trino.html
https://trino.io/blog/2020/12/27/announcing-trino.html
Soon we anticipate that Trino will become the common name in the community space but we'll always love the origins of the Trino project being Presto.
TLSv1.2 traffic contains the hostname of the site you're connecting to, and the list of ciphers. This can be fingerprinted to identify your browser, and the server-side software. [1]
TLSv1.3 on the other hand sometimes encrypts the hostname (eSNI) and most of the TLS handshake, so there's much less data to fingerprint. It's not as widely supported, but support is growing...
[1] https://engineering.salesforce.com/tls-fingerprinting-with-ja3-and-ja3s-247362855967
//Edited to clarify that eSNI isn't default behaviour of 1.3
Similar: https://ja3er.com/ which is formed by taking a bunch of (stable) attributes from your TLS handshake, appending them into a string, and hashing it.
They've also done the correlation with User Agent and it's surprisingly accurate.
Original post by Salesforce security team: https://engineering.salesforce.com/tls-fingerprinting-with-ja3-and-ja3s-247362855967?gi=f77290b060b7
Only sort of. You still have some HOL blocking problems with HTTP2 because you're still running on top of TCP. I recall this explicitly being one of the selling points of QUIC.
First resource I found on this matter from a quick search: https://engineering.salesforce.com/the-full-picture-on-http-2-and-hol-blocking-7f964b34d205
>Restricting the language to its target use: systems programming, not applications or data science or AI...
The only Go I ever touched in industry was the backend of a web-app at Salesforce. I'm not sure this counts as "systems programming".
https://engineering.salesforce.com/einstein-analytics-and-go-24e5aed2981f/