Ask HN：你是否担心像 Cloudflare Tunnel 这样的 TLS 终止代理？
3 分•作者: thom-gtdp•3 个月前
我认为许多服务依赖 Cloudflare Tunnel 或类似产品，这些产品允许你将来自公共互联网的 Web 请求代理到你的服务器，而无需开放任何端口。
这种代理处理 TLS（HTTPS），因此无法使用 Cloudflare Tunnel 进行原始 TCP/UDP 直通。这很方便，因为它简化了使用，但可能令人担忧，因为 Cloudflare 在技术上可以访问所有明文流量，即使从最终用户的角度来看，连接是 HTTPS 并且看起来完全正常。
考虑到现在公开的大部分互联网流量都会被自动存储（参见维基百科文章“641A 室”作为良好的开端），这更让我感到担忧。
你对此有什么看法？这种代理对于任何严肃的 Web 服务来说是否不可取？
查看原文
I believe many services rely on Cloudflare Tunnels or similar products that lets you proxy web requests from the public internet to your server without opening any port.<p>This kind of proxy handles TLS (HTTPS), it's not possible to use Cloudflare Tunnels for raw TCP/UDP passthrough. This is convenient because it makes it more simple to use, but may be concerning because Cloudflare technically has access to all the plain-text traffic, even though seen from the end user the connection is HTTPS and looks perfectly normal<p>This is even more concerning to me given it's now public that most of internet traffic is automatically stored (see Wikipedia article "Room 641A for a good start)<p>What are your opinions about this? Are this kind of proxy a no-go for any serious web service?