I’ve been thinking of a reverse proxy into stuff although that doesn’t help me on a fresh install of NT 4.0 with Internet Explorer 2.

The BBS is another option, I put it on VMware to see how it’ll perform. I suppose FTP may be a good fallback to at least get a browser.

I really want a proxy that can connect over Https… Much like how stunnel can bridge that crypto gap for regular TCP.

The problem with that approach is that a man in the middle could spoof being an older browser to prevent HTTPS upgrade, for modern browsers.

I think the real solution is really putting stripping proxies between your old computers and the modern web, if you want to keep them on the modern web.

They do – that’s how the Diginotar breach was detected years ago. However locally installed CAs override the detection to not (completely) break the internet in US enterprises that MitM their own employees.

Yeah I want to package WRP in to a container but for now there is no point, as it simply doesn’t work for most websites due to HTTPS. Unfortunately implementing proxy for this is non trivial as it requires CONNECT method. I’m thinking perhaps I will revert WRP back to a web server rather than a proxy.

To me that is the biggest surprise, that they don’t have their own CA’s along with other fingerprints to at least know when .google.com is being tampered with.

Yet they are doing nothing about so called “security” software that purposely MITMs to inspect HTTPS traffic and completely breaks certificates. The end user has no clue where the host’s certificates are coming from in that case and one can forget about EV certs working that that configuration.

And something to deploy to containers…. ?

I’m working on an update for Web Rendering Proxy that allows obsolete browsers to work with this HTTPS nonsense.