11 ms·

I recently tried to get an old version of Debian up to speed, to bring some old and unique hardware back to life. The lack of support for TLS 1.3 made it impos

I recently tried to get an old version of Debian up to speed, to bring some old and unique hardware back to life. The lack of support for TLS 1.3 made it impossible to download much of anything. It was basically impossible to update or upgrade. Most of the web (and HTTPS APIs) was inaccessible via curl. I imagine similar issues plague retrocomputing with other OSes. Are there any resources for retrocomputing in the TLS 1.2+ era? Maybe something like an HTTPS downgrade proxy that requires manual installation of a new cert and is targeted at retro OS isolation?

ekianjo 6y ago
Cant you install a more recent curl from a non https repository ? EDIT you can also use a more recent OpenSSL backport https://github.com/mezentsev/OpenSSL-Backport https://github.com/mezentsev/OpenSSL-Backport
- nitrogen 6y ago
  I went down the rabbit hole of trying to piecewise update packages, and ran into glibc version differences, other packages absolutely requiring gnutls and some absolutely requiring openssl and conflicting, issues with changed certificate paths in newer versions of Debian that many apps don't know about so TLS was just broken in everything, and after many hours I gave up on that route.
  - stevenicr 6y ago
    I had a similar experience a few months ago - A fresh debian and then stuff needed to run the Matrix/Synapse stuff - then went to do some addons and they balked at one installed thing not having the proper ssl stuff - which led into a rabbit hole of error messages and python stuff with very few search results.. only solution I could find that actually worked was someone posting a thing saying to downgrade the TLS to lower version.. Figured that might fix the main problem at the time, but then create new problems for other things. So I gave up. Will likely do a new box and new install with a different domain name to see if I can get it all working proper with modern tls/ssl stuff (think i saw something about a recent debian update doing some things with ssl and tls) - But no one got back to me on exporting user data from Synapse - of which I really just need usernames, email addys to a fresh install - so I gave up on that too.
kjjjjjjjjjjjjjj 6y ago
You can definitely put a reverse proxy in front which will terminate the connections. We can't compromise security because of legacy hardware.
- brazzy 6y ago
  Wouldn't that be a regular proxy, not a reverse proxy?
  - spacemanmatt 6y ago
    Yes, but only by techie-social convention. Outside of web servers, the party hidden by the proxy is conveyed in context.
    - Wowfunhappy 6y ago
      I think it’s pretty relevant actually? You can’t use HAProxy, it won’t work, because it’s only a reverse proxy. Squid will work.
      - spacemanmatt 6y ago
        I wasn't saying it's irrelevant, I was saying that stipulating reverse (or sometimes 'forward-proxy' if there's a need to disambiguate from a reverse-proxy) is somewhat specific to web proxies or other network protocol proxies. This is in contrast to say, a legal or rhetorical proxy.
tux3 6y ago
Doesn't APT work over http with GPG signatures, by default? Why are you using an old version of curl to update your debian, instead of pulling a new binary (or source) package?
bangonkeyboard 6y ago
> Are there any resources for retrocomputing in the TLS 1.2+ era? Maybe something like an HTTPS downgrade proxy that requires manual installation of a new cert and is targeted at retro OS isolation? I was looking into this last year when Wikipedia cut off access for older cipher suites. mitmproxy worked, but is the wrong tool for the job (too slow for everyday use). I needed something leaner that I could chain into other proxies, but got distracted before I could find a solution.
xvilka 6y ago
I met this problem recently for old Debian containers, I had to use statically built curl. See my repo[1] with these templates. [1] https://github.com/XVilka/debian-oldies https://github.com/XVilka/debian-oldies
Wowfunhappy 6y ago
I put this together for Macs, and have been using it on my own machine. Works very well. https://jonathanalland.com/legacy-mac-proxy.html https://jonathanalland.com/legacy-mac-proxy.html Only thing I can’t seem to get working is PPC support, so you’d have to run the proxy on a secondary Intel Mac.
ploxiln 6y ago
> The lack of support for TLS 1.3 made it impossible to download much of anything. I think you must have lacked support for TLS-1.2? Very few websites/servers require TLS-1.3
- nitrogen 6y ago
  Yes, I believe you are correct.
pabs3 6y ago
Which hardware were you trying to bring back to life?
- nitrogen 6y ago
  My old IoT (but without the cloud) startup's products. I still have a few left over that I wanted to use around my house. I had a crosscompile and flashing process set up that worked well in 2011, fixed it in 2014, but it's broken again. All of the embedded software was designed around a realtime kernel and SysVInit, and SystemD is just one obstacle of a thousand that has to be surmounted to even get the hardware and software to boot in a special snowflake setup on a newer Debian, let alone something reliable and repeatable.
  - pabs3 6y ago
    sysvinit is still available in Debian, it just isn't the default.

ekianjo 6y ago

Cant you install a more recent curl from a non https repository ? EDIT you can also use a more recent OpenSSL backport https://github.com/mezentsev/OpenSSL-Backport https://github.com/mezentsev/OpenSSL-Backport

nitrogen 6y ago
I went down the rabbit hole of trying to piecewise update packages, and ran into glibc version differences, other packages absolutely requiring gnutls and some absolutely requiring openssl and conflicting, issues with changed certificate paths in newer versions of Debian that many apps don't know about so TLS was just broken in everything, and after many hours I gave up on that route.
- stevenicr 6y ago
  I had a similar experience a few months ago - A fresh debian and then stuff needed to run the Matrix/Synapse stuff - then went to do some addons and they balked at one installed thing not having the proper ssl stuff - which led into a rabbit hole of error messages and python stuff with very few search results.. only solution I could find that actually worked was someone posting a thing saying to downgrade the TLS to lower version.. Figured that might fix the main problem at the time, but then create new problems for other things. So I gave up. Will likely do a new box and new install with a different domain name to see if I can get it all working proper with modern tls/ssl stuff (think i saw something about a recent debian update doing some things with ssl and tls) - But no one got back to me on exporting user data from Synapse - of which I really just need usernames, email addys to a fresh install - so I gave up on that too.

kjjjjjjjjjjjjjj 6y ago

You can definitely put a reverse proxy in front which will terminate the connections. We can't compromise security because of legacy hardware.

brazzy 6y ago
Wouldn't that be a regular proxy, not a reverse proxy?
- spacemanmatt 6y ago
  Yes, but only by techie-social convention. Outside of web servers, the party hidden by the proxy is conveyed in context.
  - Wowfunhappy 6y ago
    I think it’s pretty relevant actually? You can’t use HAProxy, it won’t work, because it’s only a reverse proxy. Squid will work.
    - spacemanmatt 6y ago
      I wasn't saying it's irrelevant, I was saying that stipulating reverse (or sometimes 'forward-proxy' if there's a need to disambiguate from a reverse-proxy) is somewhat specific to web proxies or other network protocol proxies. This is in contrast to say, a legal or rhetorical proxy.

tux3 6y ago

Doesn't APT work over http with GPG signatures, by default? Why are you using an old version of curl to update your debian, instead of pulling a new binary (or source) package?

bangonkeyboard 6y ago

> Are there any resources for retrocomputing in the TLS 1.2+ era? Maybe something like an HTTPS downgrade proxy that requires manual installation of a new cert and is targeted at retro OS isolation? I was looking into this last year when Wikipedia cut off access for older cipher suites. mitmproxy worked, but is the wrong tool for the job (too slow for everyday use). I needed something leaner that I could chain into other proxies, but got distracted before I could find a solution.

xvilka 6y ago

I met this problem recently for old Debian containers, I had to use statically built curl. See my repo[1] with these templates. [1] https://github.com/XVilka/debian-oldies https://github.com/XVilka/debian-oldies

Wowfunhappy 6y ago

I put this together for Macs, and have been using it on my own machine. Works very well. https://jonathanalland.com/legacy-mac-proxy.html https://jonathanalland.com/legacy-mac-proxy.html Only thing I can’t seem to get working is PPC support, so you’d have to run the proxy on a secondary Intel Mac.

ploxiln 6y ago

> The lack of support for TLS 1.3 made it impossible to download much of anything. I think you must have lacked support for TLS-1.2? Very few websites/servers require TLS-1.3

nitrogen 6y ago
Yes, I believe you are correct.

pabs3 6y ago

Which hardware were you trying to bring back to life?

nitrogen 6y ago
My old IoT (but without the cloud) startup's products. I still have a few left over that I wanted to use around my house. I had a crosscompile and flashing process set up that worked well in 2011, fixed it in 2014, but it's broken again. All of the embedded software was designed around a realtime kernel and SysVInit, and SystemD is just one obstacle of a thousand that has to be surmounted to even get the hardware and software to boot in a special snowflake setup on a newer Debian, let alone something reliable and repeatable.
- pabs3 6y ago
  sysvinit is still available in Debian, it just isn't the default.