Founder of Proxylity here. I'm happy to answer questions about how this works, why we built it, and where it is (and isn't) a good fit.
oarsinsync•14m ago
You provide a DTLS to clear-text proxy service, for applications where the client supports DTLS, but the server does not (or vice versa)?
Yeah, why did you build this? It's unclear what the value proposition is, paying for a MitM proxy. It effectively means it cannot be used with secrets, without trusting y'all to not be snooping?
mlhpdx•6m ago
Your summary is about right, but the use case is simply not wanting to run always-on servers around the world (we have anycast IPs backed by handlers around the world). So it's convenience and scale first, and wanting to build with event-driven architectures second.
Yes, your point on security is correct. Since our service terminates the DTLS connection we could see the cleartext (just as any gateway service does, like AWS API Gateway, etc.). We don't touch it except as strictly needed to pass it to the configured integrations.
EDIT: FWIW, using a plain UDP handler you could implement DTLS handling that runs in your control, in which case payloads would be opaque to us. That's a bit of an effort, though. We were asked for this, so we built it.
mlhpdx•45m ago
oarsinsync•14m ago
Yeah, why did you build this? It's unclear what the value proposition is, paying for a MitM proxy. It effectively means it cannot be used with secrets, without trusting y'all to not be snooping?
mlhpdx•6m ago
Yes, your point on security is correct. Since our service terminates the DTLS connection we could see the cleartext (just as any gateway service does, like AWS API Gateway, etc.). We don't touch it except as strictly needed to pass it to the configured integrations.
EDIT: FWIW, using a plain UDP handler you could implement DTLS handling that runs in your control, in which case payloads would be opaque to us. That's a bit of an effort, though. We were asked for this, so we built it.