Josh Huang's Engineering Notes
Why VLESS+REALITY, Not Just Another VPN Protocol
The actual engineering reasoning behind picking a specific proxy protocol stack for personal infrastructure — and why the choice was about detection resistance, not encryption strength.
This article is also available in Traditional Chinese: 中文版 — same content, just a language difference.
"Just use a VPN" undersells the actual engineering problem for a category of personal proxy infrastructure that has to survive active, automated probing by a network operator that's specifically looking for it — not just passive traffic analysis. Encryption strength was never the weak point of the older protocol generation in this space. Detectability was. This is the reasoning that led to running VLESS with REALITY instead of the more familiar alternatives, and what actually changed as a result.
The threat model, stated precisely
Encrypted proxy protocols in this space aren't trying to defeat cryptanalysis — modern TLS is already effectively unbreakable by brute force. What they're actually trying to survive is active probing: a network operator's automated systems connecting to a suspected proxy server themselves, and checking whether it behaves like the real service it's pretending to be. A proxy that responds differently to a real client vs. a probe — wrong TLS handshake fingerprint, wrong certificate chain, a protocol quirk a genuine web server would never exhibit — gets fingerprinted and blocked, encryption strength notwithstanding.
Unlock this article to keep reading, or subscribe for unlimited access to everything. See Pricing for details.