[1]: https://dntls.substack.com/p/the-new-internet

They can monitor extreme outliers. It’s not an issue for them.

But again my point applies - the chances they get enough people using it that it becomes a meaningfully worse security target than lots of other existing things seems … super low.

It’s a big world, people make many choices I can’t understand (nix? Haskell? Php? <flame wars to /dev/null>). Even if this product nailed it - the number of people who can use it is minuscule - yes even as we add Claude-enabled PMs to the software dev ranks.

Alt view with the old saying - “put all your eggs in one basket … and watch that basket!”

I bet these new tunnels end up being a fraction of a percentage point of their network traffic.

I've migrated many companies off of cloudflare, usually because they end up pissing off companies when a contract renewal comes up and they slam them with massively increased bills and almost useless support if you aren't very high paying enterprise. I don't know how many CF support tickets I've just given up on over the last 15 years, usually related to their admin page, workers or some weird thing their system does that wasn't documented and I just stop getting responses and definitely don't get fixes.

If you ever worked in webhosting the Cloudflare wordpress/etc extensions are everywhere and back when I did work in hosting tons of support tickets were made because of CF. Could be way better now, I don't go near that industry these days.

The casual CF user sticking it in front of a blog they rarely look at and the business forced CF user has a very different experience. I cringe and seriously consider if I'm interviewing for an infra role and they use cloudflare. Usually it's startups that grew into larger businesses.

I'm not trusting any of these corporates any more

“The substrate itself consists of a few systems…”

I doubt that this is how wordy your communication is.

“It consists of a few systems” would be adequate. And if we had prior context about what else exists that surrounds “the substrate” the “substrate itself” distinction would be meaningful, but it’s not, because you are referring to one object, which is the system you built, and I doubt any enzymes act on it, so it’s likely not a substrate.

https://github.com/anderspitman/awesome-tunneling

I have played around with frp, bore and ngrok.

edit: yeah, it says no account creation, neat!

So cloudflare sees your plaintext. Btw: tailscale does not (but ssl errors and warnings are unavoidable)

https://github.com/anderspitman/awesome-tunneling

I've never seen someone fail a static page like this. And from a huge company like Cloudflare too..

We live in an age of monkey-see-monkey-do management.

When Microsoft axed its QA team, it gave permission for everyone else to make the same stupid mistake.

> Free tunnels are meant to be used for testing and development, not for deploying a production website.

[0: https://developers.cloudflare.com/cloudflare-one/networks/co...

[1]: https://developers.cloudflare.com/cloudflare-one/networks/co...

Thought it was very cool

It does the exact same thing, except supported by a global network of volunteers around the world.

Sure, you get some latency, but this is actually ideal for testing. You should know how your service operates in non optimal lightning fast conditions.

The obvious difference (and thus massive advantage) of the cloudfare product is that it is accessible over the normal internet without needing to install a tor client.

I'm sure that works for some subset of the population where all potential users are already comfortable using Tor; but imagine trying to share your PoC website with the designer/client and you are asking them to install Tor browser.

Is different than sharing your work with a client.

I personally wouldnt make it SOP to utilize a complely free service like this to share my work. I'm not saying it's not convient, it definitely is.

But you shouldn't subject a clients product to terms they probably aren't aware of.

My initial thought was desktops generally run 24/7, with laptops running when in use. At least for the customer at the market intersection for this type of product.

I think that rule is more of a "we reserve the right to..." rule, but it makes me sad because I'd rather not open up ports on my router to expose my Jellyfin to my parents.

- find my approximate physical location

- regularly scan ports on my IP and wait for me to accidentally expose a service I didn't mean to

- track me in any access logs they have access to

PS. Just re-watched your matrix LED pendant video. It is so well done, both the project, and the accompanying video!

I used to use a service called ngrok for this, but it's nice that Cloudflare is offering one now.

One caveat - there is an option to inject Javascript into your pages for traffic measurement which is ON BY DEFAULT, you have to go to "Web Analytics" and turn this off if you don't want it!

* https://cmacleod.me.uk & https://newsgrouper.org

Anything from baby stuff, groceries, shopping, planning, wine tracker app, simple/fun/useful data things, etc…

We have Tailscale on our phones and can instantly and privately see without deployment or anything crazy via our secure VPN.

Think shared Claude Artifacts that don’t live @ Anthropic.

Tried to first do this with Cloudflare Tunnels (because I love Cloudflare), but between the broken dashboard side of Zero Trust and nightmare of Warp… it was basically impossible to setup. I guess that’s all super enterprise, which seems to be very anti-Cloudflare philosophically to not be able to self do things.

Will check out Quick Tunnels but I think it’s missing the bigger integration offerings Tailscale has/does still.

You can also use Tailscale serve to get a HTTPS url like Cloudflared but it's only visible to your tailnet. Be careful using Cloudflare tunnels because they are public and bots start poking around immediately.

Is this primarily for multi-user scenarios or complex setups?

Beyond that, compared to a typical hub-and-spoke WireGuard setup, the main advantage is peer-to-peer connectivity. Clients connect directly to each other when possible, which lowers latency by bypassing a central relay.

AFAIK, they also have different origins:

Pangolin started as an internet-facing reverse proxy (Traefik) combined with a WireGuard server for backend nodes. It has gradually added VPN-like features, including client device access and an internal HTTPS proxy similar to Tailscale Serve.

NetBird is a self-hostable Tailscale alternative that started as a mesh VPN focused on P2P traffic. It recently added its own reverse proxy features (Traefik-based, coincidentally), also similar to Tailscale Serve.

Pangolin is centered on endpoint and ingress management, while NetBird focuses on mesh networking, though their feature sets are increasingly converging.

For public access, similar to these cloudflare tunnels, there's Tailscale Funnel.

https://tailscale.com/docs/features/tailscale-funnel

Here's `tailscale funnel status` on my machine:

    $ tailscale funnel status
    
    # Funnel on:
    #     - https://my-machine.tailXXXX.ts.net
    
    https://my-machine.tailXXXX.ts.net (Funnel on)
    |-- /            proxy http://localhost:3000
    |-- /foo         proxy http://localhost:3001
    |-- /bar         proxy http://localhost:3002
    |-- /baz         proxy http://localhost:4004

[0]: https://tailscale.com/blog/docker-tailscale-guide

The CLI doesn't let you do as much as the go library does.

The only always-on TS service on my phone is Immich for photo backup, and I don't take enough photos for that to matter much.

My endpoint is a pretty stable (though technically dynamic) IPv4 on one end, but the other might be a cell phone with CGNAT, some random WiFi, blah blah etc. TS does that. If you don't want to use it, cool. Don't. I'm willing to make the tradeoffs to use TS for now. That could change in the future.

EDIT:good call, though.

> Anything from baby stuff, groceries, shopping, planning, wine tracker app, simple/fun/useful data things, etc…

Can you elaborate on this? Sounds really cool!

The core is chat+audio/video call server running locally on my m3 Mac Studio. Centrifugo has handled the chat concerns very well. LiveKit was a really nice foundation for video and audio calls. There are a few different options for local STT if you want that.

I used RN via expo for the client and have my friends and family on TestFlight as beta testers. Utility over polish.

With messages and call transcripts on my own box, I can prompt Claude code or Codex to operate on any message or transcript content. And follow up in chat with a message. I do most of that from Claude or ChatGPT mobile apps via remote control to my sessions running in the box.

From there, if I give enough of a specc, anything that happens in chat or call transcripts can become an additional custom workspace in the main app. I think GP calls these mini apps. But they’re essentially rich clients under the main app umbrella. There’s other details, but yeah it’s a strange new world. Check my profile and reach out directly if you want.

Until I had tailscale serve generating valid certs, I had a good reason to use Cloudflare tunnels.

But in general I don't want to put everything on the internet side of things.

Mostly, I don't want something open, but more like a "share with" for people who are in the same office (virtually over tailnet, not physically on the same LAN).

This still works great for a demo instead of a product pitch, to send an link out to see something.

I'd still use a real host over a laptop for those.

Getting it to do what I wanted with a traefik front router with cloudflared talking to arbitrary subdomain that is spun up and broadcast from the other project side was very painful in a "this could be more friendly" way.

It has been truly bulletproof though since then so that's almost enough to make me go reread all the docs.

EDIT you don't mean running on your actual phone lol, you mean in the web browser at Claude.ai. Anyway, if you use mcp-proxy for a stdio mcp, or if it's an http mcp alone, then you would need a public endpoint for Claude.ai to connect to. Tailscale will only help you if you use Funnel, but this cloudflare thing is exactly what you need (w/o Tailscale).

https://github.com/dalberto/mcp-ferry

I also use CF managed auth to make auth easier.

Terraform has worked decently well especially since there's a few random settings here and there that aren't exposed anywhere in the UI (facepalm)

Shameless plug, I've built a self-hosted capability here with things like live collaboration for humans and agents. There is a native cloudflare deplyoment and integration with Cloudflare Artifacts. PR for tunnel would be appreciated.

https://github.com/plannotator/artifact-server

For the few services I host that require SSL (eg; WebUSB), I serve the dark service via a standard domain (example.com) so I can still get a LetsEncrypt cert, but public access to that domain resolves to a static page; "Plz connect to OpenZiti & try again". This allows me to have SSL on required dark services without requiring to install a private CA for each client.

Sad to read. Do people in China also love CCP and the Great Firewall? I know CF is more than just that MITM proxy as a service but that's their main product.

ssh -p 443 -R0:localhost:9051 free.pinggy.io

(Free for 1h each session)

- Co-founder of Pinggy.

ssh -R 0.0.0.0:80:localhost:9051 myserver

Make sure server sshd config has: GatewayPorts yes

The product is falsely advertised as is:

"Cloudflare Quick Tunnels"

This is on one (or two) particular domain(s) where setting up wildcard DNS should be relatively trivial, if they actually cared enough about the UX of this product to make a special case in their code.

I don't understand how people can launch stuff like this.

It's "free". That's all you need to understand.

While testing it locally Codex by itself suggests using CF Tunnels but what's more interesting it actually used the Quick Tunnels.

Coming from days where I get warnings of vibe-coded generated code using deprecated code or older APIs, I must say using something so fresh is quite impressive.

> Free, secure tunnel for everything you are building.

> Preview and ship ideas globally in seconds with Quick Tunnels. Deploy your local application to the Internet with a single command.

Clicking through Explore Cloudflare Tunnel leads us to:

> Looking to expose public applications? This documentation covers Cloudflare Tunnel use cases for private networking and Zero Trust, like VPN replacement and private network access. For publishing public web applications, APIs, and services to the Internet through Cloudflare refer to ...

Edit: Well, they just re-vibed it. Went from the most generic Claude 4.6 era to today’s models, quality wise. I wish I had saved a copy of the original, because it would have taken me actual solid effort to make a page that generic out of an LLM.

(idk if it's really declining or I simply haven't noticed it in a while)

The vps runs a custom image that is 2.54 Megabytes. It has a custom kernel with almost everything but networking and wireguard disabled, a fixed-size fs with pre-allocated blocks and inodes to hold the vps wireguard key, and a single pid 1 binary that calls the kernel directly to set up the routing rules, generate a new wireguard key on first boot and save it to the fs, print out the wireguard public key to the console, and loops reap. Updating involves building and uploading a new image, assigning the vps to use it, reboot, wait for the public key in the console then set it on the nas so they can talk.

This type of quality downgrade is scary, and it's everywhere now.

existing (slow) tunnels you can create once you've set up your own domain for cloudflare to manage its DNS, installing cloudflare software, logging in to your account, and running a similar command.

edit: my bad, quick ones aren't new at all

https://blog.cloudflare.com/quick-tunnels-anytime-anywhere/

ssh -p 443 -R0:localhost:443 [email protected]

Disclosure: Co-founder of pinggy.io here.

Edit: I meant TCP tunnels, UDP tunnels, or also TLS tunnels for end-to-end encryption.

You can get the address with an API call.. but we charge for convenience. Pays the infra bills.

Also, the _main_ use case of `cloudflared` tunneling is using it as a long-term way to host production websites on your own hostname. the ability to create ad-hoc tunnels is more of a gimmick / advertising opportunity.

0: https://github.com/judge2020/cloudflare-connectivity-test/wi...

Also the lifetime I need the connection open. For something quick, ssh tunnel. For something normies use, reverse proxy. Ain’t trying to teach my parents about IP addresses and port numbers.

EDIT: Found a workaround. Double-click the URL and paste it with middle-click.

It’s interesting that 10 (more?) years later the product has not evolved and, apparently, hasn’t found a way to finance itself without removing the pure free tunneling option.

something like - "We help you put localhost on the Internet."

What could possibly go wrong?

Also, the “0 ports opened” marketing is misleading. It still binds to a port and then also lets people access your resources over it.

I dislike that Cloudflare Engineering has become more… marketingy as of late. Also with their Cloudflare OS misnomer. Their products used to make more sense, what happened?

Misleading communication is what I am describing, that is a subset of all communications.

The other use case for webhooks is ok, but is exactly what ngrok already does since forever with a pretty high free quota.

Can someone chime in here?

Hmm, Tailscale is too convenient and that traffic is going dark from Cloudflare's all seeing eye.

Mullvad themselves already turned off port forwarding because people were using it to host child pornography. This is like Mullvad's port forwarding, but free.

and they also provide web hosting..

Sigh... HN littered with it these days.

we removed anonymous usage of our product many years ago because it was far and away the largest source of abuse on our entire platform.

i believe at this point that that anonymous, account-less tunneling services like this are net negative for the security of the internet

happy to answer any questions from the community

Don't pass -d, your tunnel URL prints in the console and you can download dirs as tarball.

then just use Cloudflare tunnels to connect to the laptop.

It was pretty easy to setup… but I cheated, and use Dokploy which handled most of it AFAICT

vibe coded app with may be no security and now available from the internet for anyone to RCE into my laptop?

Is a new vibe-coded landing page for a 5-year old product really worthy of being on the front page nowadays? There should at least be a [2021] in the title.

Yeah, I just checked the page >can connect their server to the Internet with Argo Tunnel for free

1. the blinking "now with JSON output for coding agents". It loves to create these blinking badges

2. "Some text, and then <Text in a different color>"

Then further along the page, the "Your agent needs a URL, not a laptop" has a lot of tells of just being a straight Claude (design) output

- The small all-caps "built for the agent era" eyebrow. Once you start noticing this it's EVERYWHERE

- The 01 02 03 list

If you have access to Claude you should try have it generate a landing page for a tech product. It will almost always look like this.

"Your laptop stays private. The URL goes everywhere."

A URL ... goes, does it?

I've seen it pointed out (& have noticed) that anthorpomorphising like this is an LLM smell.

In this case, although "URL goes" can be valid, it's just awkward here.

For example, the hero is fairly impressive in mobile but it's broken in desktop. And then you scroll down to the next section and there's overflowing text.

IOW, the skill level is inconsistent.

I also think it seems cloudflare enter into a stage keep adding products and make the portal looks like a maze to get more advanced features configured

Do you still remember cloudflare mesh and use and stick to it?

Originally didn't want to share but here it is https://github.com/reddec/tunnel-me

UI: fully LLM assisted (not vibe coded, but guided with a lot of iterations). Backend: hand written, but before release polished via LLM. Docs: me - input, LLM - output.

The things I am proud:

- it very reliable

- its single binary with reasonable defaults and low memory usage

- SSO out of the box (cause I am using pocketid in my homelab)

- very simple backend

They are providing this for free up to a point, I wonder if all developers are aware of this amazing offering?

It uses basic auth at the edge to protect the endpoint being used by anyone. The technical advantage to self hosting is bandwidth throughput. For instance, If your using a css framework that is bulky on dev, but then minimized for prod, you will often find the ngrok/cloudflare tunnels too slow to load the local host assets.