No public server required at all

• CF: Yes

• frp: No

DDoS protection, WAF, and automatic SSL

• CF: Yes

• frp: No

Access controls and auth

• CF: built-in Zero Trust

• frp: manual setup of token/OIDC

Managed DNS

• CF: Yes

• frp: No

Built in security tools

• CF: Yes

• frp: No

Just like I said - prevalent reduction of valid arguments for usage of those services.

I prefer to use products and services before inevitable enshittification, not after the curve. Refusing to use them won’t change their fate.

It’s definitely not the same thing. I do understand reservations behind usage free-tier services from Big Bad Corp., but I don’t understand malicious reduction of valid arguments for usage of those services.

Again, attack targets end users, not Cloudflare tunnel operators: It abuses Cloudflare Tunnels as a delivery mechanism for malware payloads, not as a method to compromise or attack people who are self-hosting their own services through Cloudflare Tunnels.

This attack targets end users, not Cloudflare tunnel operators (i.e. self-hosters). It abuses Cloudflare Tunnels as a delivery mechanism for malware payloads, not as a method to compromise or attack people who are self-hosting their own services through Cloudflare Tunnels.