4 ms·

I'm absolutely not trolling. I regularly have to use an old XP machine for various tasks, and as long as it's firewalled properly (preferably only allows traffi

I'm absolutely not trolling. I regularly have to use an old XP machine for various tasks, and as long as it's firewalled properly (preferably only allows traffic to a pre-set list of servers) and the security surface is reduced by removing unused services, it shouldn't be too risky to use for special-purpose tasks. General-purpose browsing is a whole different matter. I wouldn't advise anyone to do that unless on a patched, up to date and supported machine.

roywashere 5y ago
If you go on using a pre-set list of servers, you also would be able to do reverse HTTP proxies. Using a pre-set list of servers with many sites is not easy, because they'd use CDNs and such. So basically you can only use it for your 'own' websites and then you can control crypto on server side.
- selfhoster11 5y ago
  It's definitely possible, and it's what I would do if I was doing this for commercial purposes. I am merely a hobbyist in these things, so the effort isn't justified.
- anderspitman 5y ago
  Wouldn't a forward proxy that speaks XP's level of crypto be easier?
soperj 5y ago
Can I ask what the various tasks are? There's gotta be a way to do these things on a modern operating system no?
- selfhoster11 5y ago
  Old software speaking to other old software or hardware. The only solution to get the entire thing to work without spending lots of time on it, is to replicate a "period-correct" environment inside a VM. Modern OSes may support a subset of the functionality, but definitely not all of it.
gsich 5y ago
There is a Firefox version that works I guess.
Karrot_Kream 5y ago
I take it that it may be difficult to build for Windows, but that's what stunnel [1] is for. If you can do that and proxy your outbound traffic you should at least be able to communicate with modern crypto. Opening up an old XP install to the general internet though... is an endeavor one should probably be very careful about. [1]: https://www.stunnel.org/ https://www.stunnel.org/
- selfhoster11 5y ago
  I did come across this solution eventually, and it's what I used. It's not ideal by any stretch, but it worked for me. A working MITM TLS stripping proxy deployed on a trusted server would be a better solution, but such options were complicated to deploy.
lucideer 5y ago
Setting up a firewall with a small strict set of servers to allow traffic to seems a lot more restrictive and complicated to set up than simply installing Firefox or some other solution that supports modern TLS. Either way though, I do personally think it's fairly reasonable for server admins to maintain webservers that target "General-purpose browsing" without also having to include support for odd individual long-tail edge-cases of people running restrictively firewalled instances of outdated insecure OSes.
- selfhoster11 5y ago
  Firefox is no longer updated on such older OSes, and besides the client application you're using may be abandonware - after all, not only browsers use TLS but also email clients and so on. The only option is to retrofit a newer TLS engine onto a proprietary OS (ha ha), or strip the encryption entirely via a trusted MITM to allow the application to connect at all. > I do personally think it's fairly reasonable for server admins to maintain webservers that target "General-purpose browsing" without also having to include support for odd individual long-tail edge-cases That's a good point

roywashere 5y ago

If you go on using a pre-set list of servers, you also would be able to do reverse HTTP proxies. Using a pre-set list of servers with many sites is not easy, because they'd use CDNs and such. So basically you can only use it for your 'own' websites and then you can control crypto on server side.

selfhoster11 5y ago
It's definitely possible, and it's what I would do if I was doing this for commercial purposes. I am merely a hobbyist in these things, so the effort isn't justified.
anderspitman 5y ago
Wouldn't a forward proxy that speaks XP's level of crypto be easier?

soperj 5y ago

Can I ask what the various tasks are? There's gotta be a way to do these things on a modern operating system no?

selfhoster11 5y ago
Old software speaking to other old software or hardware. The only solution to get the entire thing to work without spending lots of time on it, is to replicate a "period-correct" environment inside a VM. Modern OSes may support a subset of the functionality, but definitely not all of it.

gsich 5y ago

There is a Firefox version that works I guess.

Karrot_Kream 5y ago

I take it that it may be difficult to build for Windows, but that's what stunnel [1] is for. If you can do that and proxy your outbound traffic you should at least be able to communicate with modern crypto. Opening up an old XP install to the general internet though... is an endeavor one should probably be very careful about. [1]: https://www.stunnel.org/ https://www.stunnel.org/

selfhoster11 5y ago
I did come across this solution eventually, and it's what I used. It's not ideal by any stretch, but it worked for me. A working MITM TLS stripping proxy deployed on a trusted server would be a better solution, but such options were complicated to deploy.

lucideer 5y ago

Setting up a firewall with a small strict set of servers to allow traffic to seems a lot more restrictive and complicated to set up than simply installing Firefox or some other solution that supports modern TLS. Either way though, I do personally think it's fairly reasonable for server admins to maintain webservers that target "General-purpose browsing" without also having to include support for odd individual long-tail edge-cases of people running restrictively firewalled instances of outdated insecure OSes.

selfhoster11 5y ago
Firefox is no longer updated on such older OSes, and besides the client application you're using may be abandonware - after all, not only browsers use TLS but also email clients and so on. The only option is to retrofit a newer TLS engine onto a proprietary OS (ha ha), or strip the encryption entirely via a trusted MITM to allow the application to connect at all. > I do personally think it's fairly reasonable for server admins to maintain webservers that target "General-purpose browsing" without also having to include support for odd individual long-tail edge-cases That's a good point