Brave has superior fingerprint protection, they achieve this by randomizing the browsers fingerprint. Visit EFF's cover your tracks to test your browser.

To achieve the same functionality that brave achieves out of the box with Firefox I need many extensions and then when I profile both browsers, Firefox is more resource intensive. Brave's blocking is native to the browser. I will give Firefox the W because I've read that uBlock is technically more capable. But as a long time Firefox/uBlock user who switched to brave - this has not been noticable.

As for accessibility, I can configure brave to be really aggressive at ad blocking, tracking blocking, fingerprint blocking, and restricting JS even, and all those options I can set from one place instead of in different settings/extensions. When a website breaks, I click on the button next to the URL and immediately have options to granularly dial down the "protection" or add a website to my trusted list. In Firefox I was annoyed to having go through settings for the extension.

Brave plans to continue supporting Manifest V2 after Google kills it. For Ungoogled Chromium, however, it's still undecided, likely depending on whether UG contributors are willing to maintain it.

Brave has superior fingerprint protection, they achieve this by randomizing the browsers fingerprint. Visit EFF's cover your tracks to test your browser.

To achieve the same functionality that brave achieves out of the box with Firefox I need many extensions and then when I profile both browsers, Firefox is more resource intensive. Brave's blocking is native to the browser. I will give Firefox the W because I've read that uBlock is technically more capable. But as a long time Firefox/uBlock user who switched to brave - this has not been noticable.

As for accessibility, I can configure brave to be really aggressive at ad blocking, tracking blocking, fingerprint blocking, and restricting JS even, and all those options I can set from one place instead of in different settings/extensions. When a website breaks, I click on the button next to the URL and immediately have options to granularly dial down the "protection" or add a website to my trusted list. In Firefox I was annoyed to having go through settings for the extension.

Brave plans to continue supporting Manifest V2 after Google kills it. For Ungoogled Chromium, however, it's still undecided, likely depending on whether UG contributors are willing to maintain it.

hmm, I'm not sure I agree - or perhaps I didn't explain myself well previously and caused confusion between us.

Yes I agree with you in your description of how cloudflare encrypts -> decrypts -> encrypts; they are allowing you to ride over their network. If you remove cloudflare from the picture entirely, then you just have the internet facing server.

What I'm saying is, if the client and endpoint (server) talk in an encrypted protocol, then cloudflare cannot MiTM the data, only the IP headers. This is similar if you were to connect to any ol' website over an ISP's network. If your session is not HTTPS, then your application data can be read. You can have encrypted sessions inside of CF tunnel-network-tunnel.

If your services support encryption, great. But you can also expose a wireguard endpoint so you have the following

wg client --(tunnel to CF)--> CF network --(tunnel to your server)--> wireguard server

the real advantage to CF tunnel is hiding your IP from the public internet, not poking any holes in your firewall for ingress traffic, and cloudflare can apply firewall rules to those clients trying to reach your server by DNS hostname.

I apologize, I misread the chain of comments. Your explanation is perfectly adequate for someone who has a basic grasp on networking and VPN and tunnels and encryption.

I would just like to add that if your endpoints communicate via an encrypted transport (HTTPS, SSH, etc) then doesn't matter if cloudflare tries to inspect your packets. There would be 2 layers of encryption while traversing the public web, then 1 layer when traversing CF's network.

And to some, packet inspection is not a downside since they can offer more protection - but that is totally up to your attack vector tollerence