5 ms·

This is waaaay off topic, but you've piqued my interest -- what on earth are you still testing with IE3 for?

by jasonjayr 6y ago

forgotmypw17 6y ago
I believe in any browser, and it,s a capable, usable, beautiful browser.
- pbhjpbhj 6y ago
  Do you test on IE for Mac too, not every browser['s rendering] is beautiful to me! Tbh though, back in the day, I used to love jumping through all the hoops to get the idiot cousins in the browsing world rendering a webpage well.
  - forgotmypw17 6y ago
    I don't have an extensive Mac IE testing stable yet, but I have tested in IE5 Mac, which has its own rendering engine called Tasman. However, with every browser I add support for it becomes more and more likely that another one I try will also work, especially if it came later. Netscape 2.0 works, so that covers a good range. Pre-Mosaic, I have not done much testing yet, in part because it's difficult to find them.
  - forgotmypw17 6y ago
    IE3 gave me a bit of a challenge because it likes cookies to only be set a certain way, JUST SO. However, the most adjustment was probably for Mosaic, who treats ">", not "-->" as HTML comment closing, so my JavaScript can't have > characters. For if statements, I flip them, and anytime I need a > character, I get it from the char value. (Almost all my JS is baked into the HTML by the templating engine, because some browsers don't like/support external includes.)
londons_explore 6y ago
Don't use any site he made... Anything compatible with IE3 is incompatible with modern privacy expectations (doesn't support any vaguely secure variant of HTTPS, and any server which supports old variants can't be protected against downgrade attacks, and therefore cannot protect users privacy)
- bawolff 6y ago
  You can't downgrade a modern browser to ssl 3 (the most recent version supported by IE3) because modern browsers dont support sslv3 (prior to dropping support there were also some fixes for downgrade attacks). Dont get me wrong, supporting sslv3 is still a terrible idea. It would be interesting to know though what the most secure possible setup is for servers supporting ie3, both when a modern browser connects and when connecting to ie3, and what the security properties are. I would guess that its at least secure against passive monitoring (e.g. a mass survelience situation), which is a pretty low bar, but also the bar a lot of people care about.
  - londons_explore 6y ago
    Is what you say still true if you also want to support IE4, 5, 6, 7, etc? You'd want functionality for all the browsers, and strong privacy for the latest versions of browsers. I assume if you're supporting ie3 you also want to support every newer version.
    - forgotmypw17 6y ago
      You are correct, I support every known browser, and I test with every browser I can get my hands on. It doesn't mean every single browser will work, but with each tested browser, the chances of that increase. I consider all our communications to be monitored, and put accessibility above so-called privacy. Anyway, I don't believe SSL provides privacy in any reasonable way except against the most basic of attackers. For text-based websites which only provide information for reading and do not deal in commerce, I think making SSL optional is perfectly reasonable, and our SSL obsession has hurt us tremendously in accessibility, while adding a huge attack layer and obfuscating our own communications from ourselves.
  - duskwuff 6y ago
    > I would guess that its at least secure against passive monitoring It isn't. IE3 used 40-bit encryption by default, which is trivially brute-forceable with modern hardware. Some versions supported 128-bit ciphers, but only through an unusual upgrade process [1] which depended upon "Global Server ID" SSL certificates with special extensions which are no longer issued. [1]: https://stuff.mit.edu/afs/sipb/machine/anxiety-closet/apachessl/mod_ssl-2.8.11-1.3.27/README.GlobalID https://stuff.mit.edu/afs/sipb/machine/anxiety-closet/apache... Even if it weren't for that, it's no longer possible to issue a certificate that would be recognized by IE3. All newly issued SSL certificates are required to be signed with SHA256, which wasn't even published until 2001. (The final release of IE3 was in 1997.)

This is waaaay off topic, but you've piqued my interest -- what on earth are you still testing with IE3 for?

forgotmypw17 6y ago

I believe in any browser, and it,s a capable, usable, beautiful browser.

pbhjpbhj 6y ago
Do you test on IE for Mac too, not every browser['s rendering] is beautiful to me! Tbh though, back in the day, I used to love jumping through all the hoops to get the idiot cousins in the browsing world rendering a webpage well.
- forgotmypw17 6y ago
  I don't have an extensive Mac IE testing stable yet, but I have tested in IE5 Mac, which has its own rendering engine called Tasman. However, with every browser I add support for it becomes more and more likely that another one I try will also work, especially if it came later. Netscape 2.0 works, so that covers a good range. Pre-Mosaic, I have not done much testing yet, in part because it's difficult to find them.
- forgotmypw17 6y ago
  IE3 gave me a bit of a challenge because it likes cookies to only be set a certain way, JUST SO. However, the most adjustment was probably for Mosaic, who treats ">", not "-->" as HTML comment closing, so my JavaScript can't have > characters. For if statements, I flip them, and anytime I need a > character, I get it from the char value. (Almost all my JS is baked into the HTML by the templating engine, because some browsers don't like/support external includes.)

londons_explore 6y ago

Don't use any site he made... Anything compatible with IE3 is incompatible with modern privacy expectations (doesn't support any vaguely secure variant of HTTPS, and any server which supports old variants can't be protected against downgrade attacks, and therefore cannot protect users privacy)

bawolff 6y ago
You can't downgrade a modern browser to ssl 3 (the most recent version supported by IE3) because modern browsers dont support sslv3 (prior to dropping support there were also some fixes for downgrade attacks). Dont get me wrong, supporting sslv3 is still a terrible idea. It would be interesting to know though what the most secure possible setup is for servers supporting ie3, both when a modern browser connects and when connecting to ie3, and what the security properties are. I would guess that its at least secure against passive monitoring (e.g. a mass survelience situation), which is a pretty low bar, but also the bar a lot of people care about.
- londons_explore 6y ago
  Is what you say still true if you also want to support IE4, 5, 6, 7, etc? You'd want functionality for all the browsers, and strong privacy for the latest versions of browsers. I assume if you're supporting ie3 you also want to support every newer version.
  - forgotmypw17 6y ago
    You are correct, I support every known browser, and I test with every browser I can get my hands on. It doesn't mean every single browser will work, but with each tested browser, the chances of that increase. I consider all our communications to be monitored, and put accessibility above so-called privacy. Anyway, I don't believe SSL provides privacy in any reasonable way except against the most basic of attackers. For text-based websites which only provide information for reading and do not deal in commerce, I think making SSL optional is perfectly reasonable, and our SSL obsession has hurt us tremendously in accessibility, while adding a huge attack layer and obfuscating our own communications from ourselves.
- duskwuff 6y ago
  > I would guess that its at least secure against passive monitoring It isn't. IE3 used 40-bit encryption by default, which is trivially brute-forceable with modern hardware. Some versions supported 128-bit ciphers, but only through an unusual upgrade process [1] which depended upon "Global Server ID" SSL certificates with special extensions which are no longer issued. [1]: https://stuff.mit.edu/afs/sipb/machine/anxiety-closet/apachessl/mod_ssl-2.8.11-1.3.27/README.GlobalID https://stuff.mit.edu/afs/sipb/machine/anxiety-closet/apache... Even if it weren't for that, it's no longer possible to issue a certificate that would be recognized by IE3. All newly issued SSL certificates are required to be signed with SHA256, which wasn't even published until 2001. (The final release of IE3 was in 1997.)