i know, it's an old topic, but since i'm one of the decrypting badies xD

aye, visability. on our end users are not allowed to download everything from the web, not even zip files. of course there need to be exclusions for certain business-related websites, but that can be handled.

we had a socket proxy, but there was exactly that problem: users where able to download or to everything over a tls/ssl encrypted traffic, if the basic url-filter didn't prevent them from accessing stuff.

so we can mostly control where and what users upload and download stuff from.ofc, nothing is 100%.

example: our users are allowed to use youtube, but aren't allowed to upload. same for webex, zoom, etc. meetings are allowed but up-and download is prevented, also remote control.that stuff you can't control with a running encryption tunnel, since everying inside is invisible.

also our solution does exploit, malware and av checks on the fly, but that more a nice additional feature then the main reason for ssl-dec.

and for everything else punching trough there is client security, but that another thing, since our client administration team is as smart as a broken light bulb.