Kerberos, actually, not NTLM. And it is used in macOS (a *nix-like) and works great, either via WPAD (DNS), directly configured PAC file, or directly configured

Kerberos, actually, not NTLM. And it is used in macOS (a *nix-like) and works great, either via WPAD (DNS), directly configured PAC file, or directly configured proxy server. It's Linux end user devices, specifically Ubuntu, that gives us headaches, mostly because there just isn't a system-wide HTTP library that handles it all which apps can depend on. So yeah, the prompting you describe is exactly the problem. (Not that macOS doesn't have it's own proxy problems... Configured on a per adapter/service basis only? With no easy way to get new NICs a proxy setting via some sort of system-default template? WTF?)