All I'm hearing is that Cloudflare allows their customers to configure client facing TLS without enforcing it upstream over the internet, providing a false sense of security. Thanks Cloudflare!
... and I'm pretty sure that their response will be "We are just a proxy, we are not responsible for anything".
... and I'm pretty sure that their response will be "We are just a proxy, we are not responsible for anything".