The cname is just a normal domain. That DNS entry is a real entry. The CNAME is real. You can go directly to that address too. If someone else knows the cname destination they could go to it or cname their own domain to it literally like any other domain.
The only specially handling is cloud flare has a mapping from subdomain to your private network via it's agent and that's it.
I don't get what's the wrong or complicated about this.
I gave you the benefit of the doubt for a moment, but as far as I can tell, you are incorrect for practical purposes. I went ahead and re-checked everything to make sure. Let's see:
1. I have a cloudflare domain with a working tunnel (managed through Access). In DNS Records, it shows as a CNAME to [redacted].cfargotunnel.com. But:
and no records are returned. Interestingly, it's an empty result, no NXDOMAIN.
2. I have multiple subdomains that appear to be CNAMEs to the same [redacted].cfargotunnel.net. And yet they are entirely different sites that just happen to share an instance of cloudflared at the origin. The sites aren't even served at the same origin address!
They are different "Published Application Routes". They don't even have the same protocol!
2. The tunnel above is on a domain with "Full (strict)" TLS. But traffic to the origin emerges from cloudflared in cleartext.
This whole configuration schema is nonsense. What should happen if a CNAME points at a tunnel that doesn't have a route for that application? What if a tunnel has a route for an application that is CNAMEd somewhere else?
I imagine that what's going on is that Cloudflare internally has a rule that traffic with a cfargotunnel.com origin goes out their Tunnel infrastructure instead of out to the normal Internet. And Cloudflare applies the same JWT that it would apply if the request went out via the normal Internet, and cloudflared verifies that JWT if "Enforce Access JSON Web Token (JWT) validation" is on (maybe the request is literally TLS wrapped inside the cloudflared tunnel? I've never tried to inspect what's going on inside). And then cloudflared unwraps everything? And if you configure cloudflared wrong, then it's totally insecure?
Apparently I was wrong about that part. Only the part about cents still being legal tender was correct. So you can pay the exact amount, but not demand the exact change.
> It feels like screenshots have become the de facto common denominator in our mobile computing era,
Google/Apple have taken notice. Both have recently redone their full-screen post-screenshot UI to include AI insights / automatic product searches / direct chat with Gemini/LLM / etc.
Its true everyone uses screenshots to save things they are interested in or want to look up / search more of / save for reason and this UI is the perfect place to insert themselves.
Unless you are buying the absolute cheapest package of cheese slices it will still be real cheese. I'm not even sure if I've ever even seen a Kraft or Valveeta sliced cheese product, only lesser no-name brands. I've been am American all my life and do not buy process cheese product as it does take like plastic, but actual American cheese is delicious on burgers and grilled cheeses and a few other select meals.
What's crazy is Europe allowing 5% non-milk-fat/vegetable fat products to be called "ice cream". Thankfully in America it has to be 10% milkfat at least.
You are looking at the wrong product. This one[0] does say "American cheese" as a single phrase. And the slices are not individually wrapped, as they don't need to be.
Kraft Singles and their Velveeta equivalent are what is available abroad, not the Kraft Deli Deluxe. 40 percent of American households in 2019 bought Kraft Singles.
You may not like it, but it is the public face of American cheese.
There’s no data to suggest that actual fancier American cheese sells more than heavily marketed slices, especially since a huge chunk of the remaining population, and I would say most, is not consuming either “American cheese” or “American cheese product” with sodium citrate.
The only specially handling is cloud flare has a mapping from subdomain to your private network via it's agent and that's it.
I don't get what's the wrong or complicated about this.