I’ve been experimenting with a new transport layer called Velocity, built to explore how much performance we can unlock if we stop inheriting the historical weight of TLS and HTTPS.

Velocity’s goal is simple: build a clean, modern protocol that’s resistant to quantum attacks, supports hybrid key exchange, and minimizes handshake latency to near zero. The numbers have been surprising. In controlled bare-metal tests, Velocity’s pqq-supported handshake runs about 12,100× faster than TLS 1.3, while the fallback QUIC mode still performs several thousand times faster. Even the most security-hardened configuration (Velocity Fortress) stays well ahead of HTTPS in total handshake throughput.

The system is designed for active and passive threat resistance. Against passive surveillance, Velocity shortens ticket lifetimes and encrypts transcripts. For active MITM attempts, it binds handshakes to profiles, validates PQ signatures, and enforces ALPN consistency. Malicious clients that flood or replay requests are handled through retry tokens, proof-of-work hooks, and replay window tracking. Even in a scenario where a CA is compromised, Velocity cross-checks PQ extensions, logs certificate transparency events, and plans for mandatory PQ validation policies.

At the moment, Velocity terminates only its post-quantum UDP transport. Legacy HTTPS fallback still runs through a standard web server such as Caddy or Nginx. The roadmap aims to integrate first-class HTTPS and ACME automation directly into Velocity, making it a single binary that can serve static assets or reverse-proxy traffic across multiple domains, with automatic certificates and hot reloads.

Future stages focus on:

Unified TCP/UDP stack supporting HTTP/1.1, HTTP/2, and HTTP/3 alongside Velocity QUIC.

Built-in ACME automation for certificates and OCSP stapling.

Multi-tenant routing with host and path mapping in JSON, YAML, or TOML.

Observability and CLI parity with tools like Caddy — structured logs, metrics, safe defaults, and graceful reloads.

You can read the current docs here: https://projectvelocity.org

I’d appreciate thoughts from people running high-performance or self-hosted systems. The next step is integrating HTTPS support directly into the runtime so operators can deploy Velocity like they do Caddy or Nginx, without separate configuration or reverse proxies.

What parts of the HTTPS ecosystem do you think are worth keeping, and which should be rethought entirely if we were starting from scratch today?

Mutiny Motors Announces SendPai -open-Source Kei Truck EV Built in Detroit-Video

They Don't Have the Money: OpenAI Edition

Can Self-Flying Planes Transform the Skies?

Reuse pavilions and equipment, Osaka Expo organizer urges

How to tame a user interface using a spreadsheet

Americans have become more pessimistic about AI. Why?

Experimental TypeScript fork with operator overloading and overload dispatch

TikTok removing posts for violating the "joy of TikTok"

The eccentric investment strategy that beats the rest

The fight to take the chemicals out of Champagne

Programming in the Sun: A Year with the Daylight Computer

I Built Claude Code for CUDA Using Python

Show HN: Velocity is a post-quantum transport protocol

The people rescuing forgotten knowledge trapped on old floppy disks

There will soon be AI agents working on our behalf

Marc Benioff Says Trump Should Send Guard Troops to San Francisco

Beyond the AI Hype: Guido van Rossum on Python's Philosophy, Simplicity, and Th

Do any pathways exist for Voyager to become publicly maintained?

Vision Statement: To bring sustainable tyranny to the galaxy

Google boasts 1.3 quadrillion tokens each month

Show HN: Album of love songs told through scientific/technical analogies [video]

Crypto Sees More Than $6B in Liquidations

Crypto world, buckle up for the rug-pull of all time

Trump says he'll impose new 100% tariff on China 'over and above' current rates

NixOS dotfiles repo will blow your mind

2024

The people rescuing forgotten knowledge trapped on old floppy disks

In a post-truth world truth-seeking is more important

Artificial intelligence in research and development

Comparing Coplay and Unity MCP

Mutiny Motors Announces SendPai -open-Source Kei Truck EV Built in Detroit-Video

They Don't Have the Money: OpenAI Edition

Can Self-Flying Planes Transform the Skies?

Reuse pavilions and equipment, Osaka Expo organizer urges

How to tame a user interface using a spreadsheet

Americans have become more pessimistic about AI. Why?

Experimental TypeScript fork with operator overloading and overload dispatch

TikTok removing posts for violating the "joy of TikTok"

The eccentric investment strategy that beats the rest

The fight to take the chemicals out of Champagne

Programming in the Sun: A Year with the Daylight Computer

I Built Claude Code for CUDA Using Python

Show HN: Velocity is a post-quantum transport protocol

The people rescuing forgotten knowledge trapped on old floppy disks

There will soon be AI agents working on our behalf

Marc Benioff Says Trump Should Send Guard Troops to San Francisco

Beyond the AI Hype: Guido van Rossum on Python's Philosophy, Simplicity, and Th

Do any pathways exist for Voyager to become publicly maintained?

Vision Statement: To bring sustainable tyranny to the galaxy

Google boasts 1.3 quadrillion tokens each month

Show HN: Album of love songs told through scientific/technical analogies [video]

Crypto Sees More Than $6B in Liquidations

Crypto world, buckle up for the rug-pull of all time

Trump says he'll impose new 100% tariff on China 'over and above' current rates

NixOS dotfiles repo will blow your mind

2024

The people rescuing forgotten knowledge trapped on old floppy disks

In a post-truth world truth-seeking is more important

Artificial intelligence in research and development

Comparing Coplay and Unity MCP

Show HN: Install Cursor rules and Claude agents like NPM packages