GFWList supplies 4,484 lines of rules and no proxy runtime
GFWList is a data source for a proxy client you already operate. At commit c192925, list.txt contained 4,484 lines and identified its syntax as AutoProxy 0.2.9. Rules include domains, exact URLs, regular expressions, comments, and direct-connection exceptions. The repository does not tunnel traffic or configure a device. Arrive expecting a downloadable VPN and you have the wrong project.
The repository keeps a readable source file and a Base64 subscription file. Its GitHub Actions workflow copies scripts from the gfwlist/apollyon submodule, checks that list.txt is ASCII with Unix line endings, refreshes the checksum, then generates gfwlist.txt with OpenSSL. The decoded subscription at commit c192925 carries a September 26, 2026 timestamp. You can inspect the source before distributing the generated rules.
A 6-hour expiry header does not promise real-time additions
The generated list advertises a 6-hour expiry, yet the English README says submitted URLs are not updated in real time. Maintainers test availability before adding an address. That delay is reasonable for a file that changes traffic routes, though it makes GFWList a poor match for incident response. A domain reported this morning may remain absent while it is checked.
Recent issue handling shows that the delay is not neglect. Requests for linux.sb, write.as, and several August domains were closed within hours or days. A September 26 request was still open when we fetched the repository. GitHub reported 2 open issues and pull requests, including the long-standing posting-guidelines issue. The master branch had changed the same day.
What happened when we ran it
The lab marked commit c192925 as not run because its scanner found no supported language ecosystem and no Dockerfile. The sandbox allocation was 3 CPUs and 8 GB of RAM, but there was no supported install, build, or test command. The primary deliverable is a text subscription, while conversion happens in GitHub Actions. This result says nothing about whether a particular proxy client accepts every rule.
There are no lab timings, package counts, test results, or vulnerability results for this project. The repository has one CI workflow, which installs file, Git, OpenSSL, and Perl before validating and encoding the list. That workflow documents publication mechanics. It does not test client compatibility or network reachability.
Three CDN links solve delivery only if your client supports the format
The README recommends 3 jsDelivr URLs because raw GitHub content may be difficult to reach in parts of China. It also lists GitLab and Repo.or.cz mirrors, warning that they may be slow or out of sync. No credentials are needed. A production setup should choose one source, set a refresh policy, and retain a known file when that source fails.
The file header names AutoProxy 0.2.9, while modern V2Ray and Clash-family setups often use other rule databases or generated formats. GFWList does not document client-by-client import steps. If a client cannot consume the subscription directly, conversion becomes your responsibility, including preservation of exceptions and regular expressions. A successful HTTP download says nothing about whether the client parsed the result.
The list itself says it cannot describe every deployed rule
The source header says GFWList is unlikely to contain the full set of rules deployed inside the Great Firewall. Static community reports can miss new blocks, regional differences, short-lived behavior, and domains that later become reachable. Direct-connection exceptions matter too. Sending every matching hostname through a remote route without review can produce breakage or needless exposure.
Use GFWList as one input to a routing policy. Pin the file you distribute, review diffs, and test important services from the networks your users occupy. The September 26 source change added one domain, while the automated follow-up regenerated 1,573 changed Base64 lines because encoding and metadata shifted. The plain one-line source diff is more useful than reading that churn as 1,573 policy changes.
Chinese documentation leads, with an English copy for delivery basics
The main README is in Simplified Chinese, and README-EN.md supplies an English version. Both cover subscription URLs, TinyList, Apollyon, and encrypted reporting. The English file was updated on September 5, 2026. It is enough to locate the list, though it does not explain the rule grammar or show a complete configuration for a named client.
A URL submission may reveal what a person is trying to reach. The README offers 2 encrypted email routes, requires OpenPGP for one, and warns against sending reports to personal maintainer accounts. Public GitHub issues remain visible. If a report is sensitive, read the submission rules before posting rather than copying an example from the issue queue.
Same-day changes matter more here than the missing release page
GitHub showed 25,628 stars, 3,986 forks, and a last push on September 26, 2026. The project has no GitHub release entry, but that is a weak signal for a continuously updated subscription. Same-day source and generated-file commits, plus recently closed URL requests, show that the list is maintained. Its history since 2015 also predates newer geosite formats.
Choose GFWList for an AutoProxy-compatible client when you want visible changes and an active submission queue. Choose gfwlist/tinylist for common sites, v2fly/domain-list-community for categorized V2Ray geosite data, or Loyalsoldier/v2ray-rules-dat for prebuilt files spanning several clients. The deciding detail is the format your client reads, because a well-maintained rule file is useless after a silent import failure.