Audience recommendation at the end of the Q&A: for a pure TCP-tunneling proxy like PURR, the bytes never need to reach Ruby — the kernel can splice two sockets together and move data between them without a userspace copy. David Halasz says he tried this in the past but it was problematic; worth investigating again.