3 ms·

Windows XP... I cannot tell if you are trolling or not. It hasn't received patches in 10 years, so having it connected to the internet at all is a bigger probl

Windows XP... I cannot tell if you are trolling or not. It hasn't received patches in 10 years, so having it connected to the internet at all is a bigger problem than it's lack of tls1.3 support.

selfhoster11 5y ago
I'm absolutely not trolling. I regularly have to use an old XP machine for various tasks, and as long as it's firewalled properly (preferably only allows traffic to a pre-set list of servers) and the security surface is reduced by removing unused services, it shouldn't be too risky to use for special-purpose tasks. General-purpose browsing is a whole different matter. I wouldn't advise anyone to do that unless on a patched, up to date and supported machine.
- roywashere 5y ago
  If you go on using a pre-set list of servers, you also would be able to do reverse HTTP proxies. Using a pre-set list of servers with many sites is not easy, because they'd use CDNs and such. So basically you can only use it for your 'own' websites and then you can control crypto on server side.
  - selfhoster11 5y ago
    It's definitely possible, and it's what I would do if I was doing this for commercial purposes. I am merely a hobbyist in these things, so the effort isn't justified.
  - anderspitman 5y ago
    Wouldn't a forward proxy that speaks XP's level of crypto be easier?
- soperj 5y ago
  Can I ask what the various tasks are? There's gotta be a way to do these things on a modern operating system no?
  - selfhoster11 5y ago
    Old software speaking to other old software or hardware. The only solution to get the entire thing to work without spending lots of time on it, is to replicate a "period-correct" environment inside a VM. Modern OSes may support a subset of the functionality, but definitely not all of it.
- gsich 5y ago
  There is a Firefox version that works I guess.
- Karrot_Kream 5y ago
  I take it that it may be difficult to build for Windows, but that's what stunnel [1] is for. If you can do that and proxy your outbound traffic you should at least be able to communicate with modern crypto. Opening up an old XP install to the general internet though... is an endeavor one should probably be very careful about. [1]: https://www.stunnel.org/ https://www.stunnel.org/
  - selfhoster11 5y ago
    I did come across this solution eventually, and it's what I used. It's not ideal by any stretch, but it worked for me. A working MITM TLS stripping proxy deployed on a trusted server would be a better solution, but such options were complicated to deploy.
- lucideer 5y ago
  Setting up a firewall with a small strict set of servers to allow traffic to seems a lot more restrictive and complicated to set up than simply installing Firefox or some other solution that supports modern TLS. Either way though, I do personally think it's fairly reasonable for server admins to maintain webservers that target "General-purpose browsing" without also having to include support for odd individual long-tail edge-cases of people running restrictively firewalled instances of outdated insecure OSes.
  - selfhoster11 5y ago
    Firefox is no longer updated on such older OSes, and besides the client application you're using may be abandonware - after all, not only browsers use TLS but also email clients and so on. The only option is to retrofit a newer TLS engine onto a proprietary OS (ha ha), or strip the encryption entirely via a trusted MITM to allow the application to connect at all. > I do personally think it's fairly reasonable for server admins to maintain webservers that target "General-purpose browsing" without also having to include support for odd individual long-tail edge-cases That's a good point
0des 5y ago
Don't ever go into manufacturing.
forgotmypw17 5y ago
If it is behind a NAT and only browsing trusted sites over trusted ISP, the risk of using even plain HTTP is pretty low. Many enjoy and find comforting the older OSes they're used to. Research even shows that reliving sensory experiences from a younger age can have a measurable positive effect on a person's physiology and health. I think the general trend of sacrificing everything to so-called security, which in reality just means being owned by the root certificate holders, all several hundred of them, and all their employees and affiliates, even for low-risk and low value targets, like someone who wants to blog with IE3, is overrated and stupid and will be disposed off once we feel more sure of the security of our underlying network...

Windows XP... I cannot tell if you are trolling or not. It hasn't received patches in 10 years, so having it connected to the internet at all is a bigger problem than it's lack of tls1.3 support.

selfhoster11 5y ago

I'm absolutely not trolling. I regularly have to use an old XP machine for various tasks, and as long as it's firewalled properly (preferably only allows traffic to a pre-set list of servers) and the security surface is reduced by removing unused services, it shouldn't be too risky to use for special-purpose tasks. General-purpose browsing is a whole different matter. I wouldn't advise anyone to do that unless on a patched, up to date and supported machine.

roywashere 5y ago
If you go on using a pre-set list of servers, you also would be able to do reverse HTTP proxies. Using a pre-set list of servers with many sites is not easy, because they'd use CDNs and such. So basically you can only use it for your 'own' websites and then you can control crypto on server side.
- selfhoster11 5y ago
  It's definitely possible, and it's what I would do if I was doing this for commercial purposes. I am merely a hobbyist in these things, so the effort isn't justified.
- anderspitman 5y ago
  Wouldn't a forward proxy that speaks XP's level of crypto be easier?
soperj 5y ago
Can I ask what the various tasks are? There's gotta be a way to do these things on a modern operating system no?
- selfhoster11 5y ago
  Old software speaking to other old software or hardware. The only solution to get the entire thing to work without spending lots of time on it, is to replicate a "period-correct" environment inside a VM. Modern OSes may support a subset of the functionality, but definitely not all of it.
gsich 5y ago
There is a Firefox version that works I guess.
Karrot_Kream 5y ago
I take it that it may be difficult to build for Windows, but that's what stunnel [1] is for. If you can do that and proxy your outbound traffic you should at least be able to communicate with modern crypto. Opening up an old XP install to the general internet though... is an endeavor one should probably be very careful about. [1]: https://www.stunnel.org/ https://www.stunnel.org/
- selfhoster11 5y ago
  I did come across this solution eventually, and it's what I used. It's not ideal by any stretch, but it worked for me. A working MITM TLS stripping proxy deployed on a trusted server would be a better solution, but such options were complicated to deploy.
lucideer 5y ago
Setting up a firewall with a small strict set of servers to allow traffic to seems a lot more restrictive and complicated to set up than simply installing Firefox or some other solution that supports modern TLS. Either way though, I do personally think it's fairly reasonable for server admins to maintain webservers that target "General-purpose browsing" without also having to include support for odd individual long-tail edge-cases of people running restrictively firewalled instances of outdated insecure OSes.
- selfhoster11 5y ago
  Firefox is no longer updated on such older OSes, and besides the client application you're using may be abandonware - after all, not only browsers use TLS but also email clients and so on. The only option is to retrofit a newer TLS engine onto a proprietary OS (ha ha), or strip the encryption entirely via a trusted MITM to allow the application to connect at all. > I do personally think it's fairly reasonable for server admins to maintain webservers that target "General-purpose browsing" without also having to include support for odd individual long-tail edge-cases That's a good point

0des 5y ago

Don't ever go into manufacturing.

forgotmypw17 5y ago

If it is behind a NAT and only browsing trusted sites over trusted ISP, the risk of using even plain HTTP is pretty low. Many enjoy and find comforting the older OSes they're used to. Research even shows that reliving sensory experiences from a younger age can have a measurable positive effect on a person's physiology and health. I think the general trend of sacrificing everything to so-called security, which in reality just means being owned by the root certificate holders, all several hundred of them, and all their employees and affiliates, even for low-risk and low value targets, like someone who wants to blog with IE3, is overrated and stupid and will be disposed off once we feel more sure of the security of our underlying network...