Historically, we’ve found that their tunnels have really high latency variance. For example something that’s normally 30-50ms to ec2 is now 115ms-750ms
No, they claim their edge is better for residential connections to your backend. We tried multiple SF to us-east-1 and it was always substantially worse
This requires no port forwarding, so someone brute force scanning your IP won't find this and your open port. they also might have a harder time figuring out what service has been exposed since the port number itself will be unknown.
Do you mean by getting the information from Cloudflare, or some other way? With DynDNS though, finding out my IP is trivial and does not require any special powers or skills, it is just a DNS lookup.
PS. Just re-watched your matrix LED pendant video. It is so well done, both the project, and the accompanying video!
This is handy, but I wonder how much it will cannibalize their services. I have a simple app deployed on cloudflare for a very niche single purpose use, but I wouldn't have bothered if I had this. Serving it from my own machine would have been fine.
My initial thought was desktops generally run 24/7, with laptops running when in use. At least for the customer at the market intersection for this type of product.
I often tell my dev colleagues to avoid having their PC turned on all the time, be it because of the electricity bill cost, environmental impact or simply to make the longevity of the hardware a little longer. Granted almost everyone just ignores those things even if they're conscious of it, so I'd say you're right
There's pros and cons on the longevity side. 24/7 use causes more wear to mechanical parts (fans for instance) but can be better for the electronics, as heat cycles are a big part of the problem there.
Yeah my desktop is on 24/7. Laptop is on when in use. Phone is on all the time too, of course, but I don't use it for browsing or work nearly as much as my desktop.
Maybe it's a nice way to quickly test a new service or change over the internet without going through the git process, same way one would use ngrok - I could see that being helpful when prototyping / pocs, etc - before deploying changes to your app via the proper channel, especially if you are already using cloudflare for your domains/apps. As other people said, it probably would not be practical or scalable for most people to run an app 24/7 from their laptop using their home or office internet connection.
Tunneling was something that recently fell out of the work I've been doing [1]. I've used Cloudflare Tunnels before but I just have low trust with them recently with how big they are getting. All of these nice things come at the cost of pushing _a lot_ of traffic through their systems.
They see all the traffic in cleartext. Plus you have to trust them not to maliciously alter your traffic. As a US company, their options may be limited if they are coerced by their government to do so.
Reality check - you are not pushing “_a lot_” of traffic relative to any hyperscaler or large scale CDN. They push hundreds of Tbps sustained. You don’t peak at a few Mbps.
They can monitor extreme outliers. It’s not an issue for them.
In hindsight, that was probably a confusing sentence. I was more pointing out how much traffic flows trough their systems which ends up making it an attractive honeypot, especially as a U.S. company.
Sure any centralization of infra is an obvious risk for a myriad of reasons eg DoS, manipulation, honeypots, etc.
But again my point applies - the chances they get enough people using it that it becomes a meaningfully worse security target than lots of other existing things seems … super low.
It’s a big world, people make many choices I can’t understand (nix? Haskell? Php? <flame wars to /dev/null>). Even if this product nailed it - the number of people who can use it is minuscule - yes even as we add Claude-enabled PMs to the software dev ranks.
Alt view with the old saying - “put all your eggs in one basket … and watch that basket!”
True. Same reason Hurricane Electric peers promiscuously. I'm surprised more networks don't, to be honest - wouldn't say DTAG prefer that you peer with DTAG than peer with HE upstream of DTAG?
I doubt that this is how wordy your communication is.
“It consists of a few systems” would be adequate. And if we had prior context about what else exists that surrounds “the substrate” the “substrate itself” distinction would be meaningful, but it’s not, because you are referring to one object, which is the system you built, and I doubt any enzymes act on it, so it’s likely not a substrate.
Can confirm. Coming from ngrok, the main reason we had to make tunneling not anonymized etc was because of scammers, etc on the internet. Other players in the space bypass this by open sourcing the tech, or separating the architecture entirely. This is cool and all, but ultimately gives nefarious actors on the internet more opportunities.
How does “open sourcing the tech” “give nefarious actors on the internet more opportunities”? Sounds like a paltry excuse for not open sourcing your tech.
These are the limitations mentioned on the docs [1]. Quick Tunnels are subject to a hard limit on the number of concurrent requests that can be proxied at any point in time. Currently, this limit is 200 in-flight requests. If a Quick Tunnel hits this limit, the HTTP response will return a 429 status code. Quick Tunnels do not support Server-Sent Events (SSE).
If your a hobbiest or dev just testing your services, it makes more sense to utilize onion services imho.
It does the exact same thing, except supported by a global network of volunteers around the world.
Sure, you get some latency, but this is actually ideal for testing. You should know how your service operates in non optimal lightning fast conditions.
This has existed for a long time and has been abused by quite a few people. I've seen some cc nodes using a random known cloudflare site and spoofing hostname to a temporary cloudflare site. IMO this should require a login at bare minimum.
I like Cloudflare Tunnels a lot, but something that annoys me is that officially you're not allowed to use them for streaming video, meaning I can't put it in front of my Jellyfin without breaking TOS.
I think that rule is more of a "we reserve the right to..." rule, but it makes me sad because I'd rather not open up ports on my router to expose my Jellyfin to my parents.
I discovered and set this up the other day, added jellyfin, immich and forgejo and was really happy about the result for five minutes, before I discovered that limitation in the TOS. Now I only use it for forgejo. Have you found a different solution to exposing jellyfin?
Use pangolin (you can self host), been using it for a while and it’s great, under the hood it’s a vpn+reverse proxy which you can do yourself too.
In pangolin you can have public or private resources, where private ones you need to authenticate through pangolin first (either pass or others like pin number for your parents so easy to remember). When you link your domain for public ones, I suggest you make a sub domain for it, so your apps will be a sub to your subdomain, that way you keep control of your main domain while having automatic assignment for your apps rather than manually, and if you didn’t issue a certificate, that sub.subdomain is basically invisible on the internet unless you host a service to expose it.
Bandwidth costs money and streaming video costs several orders of magnitude more than just your random web/dev apps. Asking CF to foot the bill for entertainment streaming is really quite a lot.
Are we in an age where no one even bothers to open the product pages they generate? The first subtitle with the font color almost matching the background. Or it's even worse that a human looked at it and said "yep, that's OK"?
frp is nice. I have the tiniest Amazon Lightsail instance running a tunnel to a Minecraft server in my basement. It’s cheaper than getting a fixed IP from my ISP, at sufficiently low traffic.
As far as I can tell, the difference is that they made a new website? The cloudflared instant tunnels have been around for years, including json output as far as I know.
Cool but the obvious flaw with this is that CF leaks DNS-records. So bots will find these urls instantly. Not sure why they have not fixed that or if it is even possible to fix.
263 comments
[ 1.4 ms ] story [ 64.6 ms ] thread- find my approximate physical location
- regularly scan ports on my IP and wait for me to accidentally expose a service I didn't mean to
- track me in any access logs they have access to
PS. Just re-watched your matrix LED pendant video. It is so well done, both the project, and the accompanying video!
edit: yeah, it says no account creation, neat!
So cloudflare sees your plaintext.
My initial thought was desktops generally run 24/7, with laptops running when in use. At least for the customer at the market intersection for this type of product.
[1]: https://dntls.substack.com/p/the-new-internet
I bet these new tunnels end up being a fraction of a percentage point of their network traffic.
They can monitor extreme outliers. It’s not an issue for them.
But again my point applies - the chances they get enough people using it that it becomes a meaningfully worse security target than lots of other existing things seems … super low.
It’s a big world, people make many choices I can’t understand (nix? Haskell? Php? <flame wars to /dev/null>). Even if this product nailed it - the number of people who can use it is minuscule - yes even as we add Claude-enabled PMs to the software dev ranks.
Alt view with the old saying - “put all your eggs in one basket … and watch that basket!”
I'm not trusting any of these corporates any more
“The substrate itself consists of a few systems…”
I doubt that this is how wordy your communication is.
“It consists of a few systems” would be adequate. And if we had prior context about what else exists that surrounds “the substrate” the “substrate itself” distinction would be meaningful, but it’s not, because you are referring to one object, which is the system you built, and I doubt any enzymes act on it, so it’s likely not a substrate.
[1]: https://developers.cloudflare.com/cloudflare-one/networks/co...
Thought it was very cool
It does the exact same thing, except supported by a global network of volunteers around the world.
Sure, you get some latency, but this is actually ideal for testing. You should know how your service operates in non optimal lightning fast conditions.
I think that rule is more of a "we reserve the right to..." rule, but it makes me sad because I'd rather not open up ports on my router to expose my Jellyfin to my parents.
https://github.com/anderspitman/awesome-tunneling
I have played around with frp, bore and ngrok.
> Free tunnels are meant to be used for testing and development, not for deploying a production website.
[0: https://developers.cloudflare.com/cloudflare-one/networks/co...
I used to use a service called ngrok for this, but it's nice that Cloudflare is offering one now.