Ultimately, if you're running in a virtualized cloud environment, you already trust your hosting company with your website's certificates (because there's no way to stop them from spying on your machine's core memory). So for most users, it's not a major change to expand the trusted set from {Amazon} to {Cloudflare, Amazon}. If you're the only one with root access to your hardware, then more power to you. But for most people I don't think it's a major change of threat model.

CDNs have existed since the 90s so everyone's had time to get used to it. The part which I think you're over-weighting is that this is not a third-party stranger but a third-party with whom you have a legal relationship — the use-cases for a CDN require external termination, otherwise you don't rent one, and the contracts commit to keeping it secure.

For a business, there are tons of trust relationships you handle this way: you trust Microsoft not to ship a trojan in Windows, Cisco/Juniper/etc. not to sniff your internal network traffic, Google not to ship your Chrome session keys back home, etc.

>you trust Microsoft not to ship a trojan in Windows

Speak for yourself, mate.

a) it was one of multiple examples b) do you personally run a business this way and, if so, how's that working out relative to the competition? My point was simply that all businesses have some parties they trust on the theory that they'll sue if a contractual agreement is broken. It's too expensive not to trust someone when you have no reasonable basis for expecting an attack and a solid legal basis for compensation if they did: if you dislike Microsoft, substitute Apple or Samsung, your bank, etc.

On a fun note, microsoft does ship a trojan in windows. Its called Cortana and Telemetry.

That’s not what the term means. If those services bother you, your advocacy will be more effective if it’s not misleading.

Please enlighten me on what that term means. Because All the telemetry/cortana does is disguise itself as a useful feature , while collecting user data and siphoning it off to its central servers.

Cloudflare is a service provider the site owner contracts with too, so why the distinction?

Because math doesn't break like contracts do mainly.

that doesn't address my point, since you can say the exact same about wherever the site is hosted unless you strictly self-host everything, which the vast majority of sites doesn't do.

To me there's a difference. Probably that terminating tls is base of CFs business model.

Or that I'm just being illogical. No idea, just...don't like it.

I'd argue the base is caching and load-balancing. And pretty much everything that has a business model of handling web traffic will need to handle HTTPS for its customers nowadays.

You are not illogical:

https://news.ycombinator.com/item?id=28714516

Cloudflare doesn't require terminating end to end encryption between the service provider and the user.

Sure if you just use it as a dns provider.