Shadowsocks
Shadowsocks dates back to 2012 and approaches the problem differently from later protocols. It imitates nothing: no pretend visit to a site, no borrowed certificate, no mimicked handshake. Its stream is simply encrypted data with no headers, versions or recognisable sequences — random-looking bytes. The idea is that there is nothing to fingerprint, because the traffic has no structure to grab onto. Modern versions use AEAD encryption, where every chunk is authenticated; that closed an old weakness in early implementations, where the server replied differently to valid and forged packets and could be located by that difference.
In short
Shadowsocks remains a good fit where simplicity and low overhead matter: it is lighter than TLS-based protocols and needs neither a domain nor a certificate. Its weak spot is the flip side of its strength — a stream with no features is itself a feature, because ordinary traffic does not look like that. Where analysis looks at connection statistics rather than content, that shows.
Frequently asked
How does Shadowsocks differ from VLESS with Reality?
In how it hides. Reality makes the connection resemble a visit to a real, popular site, down to that site genuine certificate. Shadowsocks imitates nothing: it removes features instead of substituting them. The first approach wins where handshake content is inspected, the second where simplicity and speed matter more.
Are old and new Shadowsocks the same thing?
No, and the difference matters. Before AEAD a server could be identified by active probing: send it a modified packet and watch the reaction. AEAD authenticates every chunk, so a forged packet is dropped silently with no distinguishable response. Only AEAD versions are worth using.