4 ms·

Are there any version of Mosaic that are able to handle modern HTTPS?

by exitb 4y ago

josteink 4y ago
Probably if using a local HTTP proxy to relay the actual traffic?
II2II 4y ago
I don't know about Mosaic[1], but there are many alternatives out there. I frequently use elinks as a text only browser since it makes an attempt to layout pages (most pages have some form of layout to handle navigation elemnts these days). There are also browsers that handle graphics, but not scripting or CSS, if that is what you want. [1] I have heard of people trying to get Mosaic to work on modern machines, but I think the efforts were restricted to rebuilding the software rather than adding features.
forgotmypw17 4y ago
Still plenty of websites which run on HTTP. I know mine certainly do. Security isn't everything, there's also accessibility to think about. HTTPS breaks in many circumstances when it's not needed, including on current browsers. You can also use a stripping proxy. Bigger issues I've encountered with actually using Mosaic is that a) it does not support the Host header, so you must have a dedicated IP address, and b) it doesn't like semicolons in then Content-Type header, which most of today's servers include.
- imiric 4y ago
  > Security isn't everything, there's also accessibility to think about. TLS is not just about security. It also protects the authenticity of your content, ensures privacy and even accessibility for your visitors. Without it, any node between your visitor and your server could inject content and JavaScript to do all sorts of nefarious tracking and profiling. These days there's really no excuse for using plain HTTP on public facing sites. Please rethink your decision.
  - forgotmypw17 4y ago
    Actually, there is a very good excuse: I want to access the content I need with the browser and configuration I currently have, and without the ability to alter it. While the threat of MITM is technically true, thanks to being on a relatively safe networks segment, I have yet to encounter it happening in the real world, except in cases of captive portals, when I actually want it to happen. I think it is largely an over-stated threat for most read-only applications. The impact on accessibility, on the other hand, is real and huge.
    - neurostimulant 4y ago
      You must be lucky. My cellphone carrier used to injects scripts and ads on plain http requests. Imagine seeing ads on wikipedia. Now that https is everywhere, this behavior is largely stop.
      - forgotmypw17 4y ago
        I know that ads sometimes get injected for some people, but it has not been an issue for me. I see loud and intrusive ads on Wikipedia already, and it's why I've started using wikiless instead.
        neurostimulant 4y ago
        Are you sure about seeing ads Wikipedia? AFAIK Wikipedia itself doesn't run any ads [1] (except occasional call for donation), so the ads must've come from other source (e.g malicious extensions, malwares that install mitm proxy to inject ads, etc). [1] https://en.wikipedia.org/wiki/Wikipedia:Funding_Wikipedia_through_advertisements https://en.wikipedia.org/wiki/Wikipedia:Funding_Wikipedia_th...
    - myfonj 4y ago
      There was similar discussion about "provide un-encrypted access to your pages for accessibility" few months ago here at HN under "Consider disabling HTTPS auto redirects" post [1]. [1] https://news.ycombinator.com/item?id=31895148 https://news.ycombinator.com/item?id=31895148
danjoredd 4y ago
Honestly thinking on making a Mosaic clone. Without CSS or Javascript, I imagine it won't be terribly difficult to put together
- lupire 4y ago
  Why not start by disabling JS and CSS in an existing browser?
  - danjoredd 4y ago
    Im just saying I think making a new Mosaic would be a fun project. Been watching Andreas Kling do his browser hacking lately and it looks like a lot of fun
    - asddubs 4y ago
      you mean andreas kling
      - danjoredd 4y ago
        Right. I love his livestreams but I struggle with his name a lot. Apologies
- mhd 4y ago
  I’ve been quite impressed by the Gemini browser LaGrange[1]. Does it’s own antialiased text rendering straight to SDL. Automatic site coloring as an option. Would be neat to see something like this with basic HTML 3-ish support (basic tables, lists etc) [1]: https://gmi.skyjake.fi/lagrange/ https://gmi.skyjake.fi/lagrange/
- forgotmypw17 4y ago
  I think it's a great idea! Go for it! Web 2.5 is a thing.
classichasclass 4y ago
Bolt it on! Here's XMosaic 2.7b5 with TLS 1.3 on my own SPARC. (Disclosure: my project.) https://oldvcr.blogspot.com/2022/07/crypto-ancienne-20-now-brings-tls-13-to.html https://oldvcr.blogspot.com/2022/07/crypto-ancienne-20-now-b...

Are there any version of Mosaic that are able to handle modern HTTPS?

by exitb 4y ago

Are there any version of Mosaic that are able to handle modern HTTPS?

josteink 4y ago

Probably if using a local HTTP proxy to relay the actual traffic?

II2II 4y ago

I don't know about Mosaic[1], but there are many alternatives out there. I frequently use elinks as a text only browser since it makes an attempt to layout pages (most pages have some form of layout to handle navigation elemnts these days). There are also browsers that handle graphics, but not scripting or CSS, if that is what you want. [1] I have heard of people trying to get Mosaic to work on modern machines, but I think the efforts were restricted to rebuilding the software rather than adding features.

forgotmypw17 4y ago

Still plenty of websites which run on HTTP. I know mine certainly do. Security isn't everything, there's also accessibility to think about. HTTPS breaks in many circumstances when it's not needed, including on current browsers. You can also use a stripping proxy. Bigger issues I've encountered with actually using Mosaic is that a) it does not support the Host header, so you must have a dedicated IP address, and b) it doesn't like semicolons in then Content-Type header, which most of today's servers include.

imiric 4y ago
> Security isn't everything, there's also accessibility to think about. TLS is not just about security. It also protects the authenticity of your content, ensures privacy and even accessibility for your visitors. Without it, any node between your visitor and your server could inject content and JavaScript to do all sorts of nefarious tracking and profiling. These days there's really no excuse for using plain HTTP on public facing sites. Please rethink your decision.
- forgotmypw17 4y ago
  Actually, there is a very good excuse: I want to access the content I need with the browser and configuration I currently have, and without the ability to alter it. While the threat of MITM is technically true, thanks to being on a relatively safe networks segment, I have yet to encounter it happening in the real world, except in cases of captive portals, when I actually want it to happen. I think it is largely an over-stated threat for most read-only applications. The impact on accessibility, on the other hand, is real and huge.
  - neurostimulant 4y ago
    You must be lucky. My cellphone carrier used to injects scripts and ads on plain http requests. Imagine seeing ads on wikipedia. Now that https is everywhere, this behavior is largely stop.
    - forgotmypw17 4y ago
      I know that ads sometimes get injected for some people, but it has not been an issue for me. I see loud and intrusive ads on Wikipedia already, and it's why I've started using wikiless instead.
      - neurostimulant 4y ago
        Are you sure about seeing ads Wikipedia? AFAIK Wikipedia itself doesn't run any ads [1] (except occasional call for donation), so the ads must've come from other source (e.g malicious extensions, malwares that install mitm proxy to inject ads, etc). [1] https://en.wikipedia.org/wiki/Wikipedia:Funding_Wikipedia_through_advertisements https://en.wikipedia.org/wiki/Wikipedia:Funding_Wikipedia_th...
  - myfonj 4y ago
    There was similar discussion about "provide un-encrypted access to your pages for accessibility" few months ago here at HN under "Consider disabling HTTPS auto redirects" post [1]. [1] https://news.ycombinator.com/item?id=31895148 https://news.ycombinator.com/item?id=31895148

danjoredd 4y ago

Honestly thinking on making a Mosaic clone. Without CSS or Javascript, I imagine it won't be terribly difficult to put together

lupire 4y ago
Why not start by disabling JS and CSS in an existing browser?
- danjoredd 4y ago
  Im just saying I think making a new Mosaic would be a fun project. Been watching Andreas Kling do his browser hacking lately and it looks like a lot of fun
  - asddubs 4y ago
    you mean andreas kling
    - danjoredd 4y ago
      Right. I love his livestreams but I struggle with his name a lot. Apologies
mhd 4y ago
I’ve been quite impressed by the Gemini browser LaGrange[1]. Does it’s own antialiased text rendering straight to SDL. Automatic site coloring as an option. Would be neat to see something like this with basic HTML 3-ish support (basic tables, lists etc) [1]: https://gmi.skyjake.fi/lagrange/ https://gmi.skyjake.fi/lagrange/
forgotmypw17 4y ago
I think it's a great idea! Go for it! Web 2.5 is a thing.

classichasclass 4y ago

Bolt it on! Here's XMosaic 2.7b5 with TLS 1.3 on my own SPARC. (Disclosure: my project.) https://oldvcr.blogspot.com/2022/07/crypto-ancienne-20-now-brings-tls-13-to.html https://oldvcr.blogspot.com/2022/07/crypto-ancienne-20-now-b...