@Cloudflare is back on its localhost meet the Internet tour.
One command. Instant
trycloudflare.com URL. No account. No DNS. JSON for the agents. People are posting it like they invented remote access.
Here is what that command actually does.
Your laptop dials Cloudflare. TLS dies at their edge. They get to see the request. Then they send it down their tunnel to cloudflared, which often talks to your app over plain HTTP on 127.0.0.1. You did not punch a hole in NAT. You handed a CDN the plaintext and asked it to be nice.
The cute parts they leave out:
Quick tunnels cap at 200 concurrent requests and choke on SSE. Kill the process and the hostname dies with it. Google already indexes
trycloudflare.com. Devs are searching site:
trycloudflare.com and peeking at other people's live localhost apps. Random words in a URL are not a lock. And because malware crews already burned that domain, half the corporate networks just block it outright. Your share this with anyone link dies in the first office Wi-Fi it hits.
Named tunnels do not fix the architecture. Now they own the DNS, the cert, the access policy, and whether the box even exists today. Their outage or their account flag and every service behind that tunnel goes dark. Including the one sitting next to you.
If you are demoing a toy page for five minutes, whatever. If that port has webhooks, secrets, SSH, a dashboard, photos, a game server, Docker, anything you would not paste into a support ticket, stop renting a spyglass so you can share localhost.
Holesail does the job without the hostage situation.
holesail --live 8000
You get an hs:// key. Other side runs holesail hs://... and you are on the same port from anywhere. Discovery is HyperDHT. NAT gets holepunched. After that the bytes go peer to peer. Noise handshake. Encrypted stream. No relay tasting the traffic. No account. TCP and UDP. Bandwidth is whatever your ISP already sold you.
Cloudflare is great at being a giant reverse proxy. That is the product. They will keep making the one-liner smoother because agents need a public URL and Cloudflare wants to own the pipe.
You do not need their pipe.
One key. Two machines. Direct. Encrypted. Nobody in the middle protecting you by reading it.
holesail.io
github.com/holesail/holesail