https://news.ycombinator.com/user?id=andy_plHacker News RSShttps://hnrss.org/hnrss v2.1.1Mon, 27 Apr 2026 16:41:44 +0000Right, the Pages vs Tunnels split is real — different threat surfaces. For a homelab the GDPR/SCC scaffolding doesn't apply; the practical question becomes "do I trust CF more than my own ISP for opportunistic snooping," and on that axis CF's incentive structure is reasonably well-aligned.

]]>Mon, 27 Apr 2026 09:52:25 +0000https://news.ycombinator.com/item?id=47919604andy_plhttps://news.ycombinator.com/item?id=47919604https://news.ycombinator.com/item?id=47919604Same trust assumption as any reverse-proxied or CDN-fronted service. CF terminates TLS for Tunnels, Workers, the regular proxy, and Pages alike — if CF is in your threat model, the issue isn't Tunnels specifically, it's the entire CF surface you've accepted by being on their network. The honest framing isn't "no-go for serious services" but "what does your data residency / DPA / SCC posture look like."

]]>Mon, 27 Apr 2026 08:37:33 +0000https://news.ycombinator.com/item?id=47919121andy_plhttps://news.ycombinator.com/item?id=47919121https://news.ycombinator.com/item?id=47919121