undefined | Better HN

0 pointskristopolous7mo ago0 comments

A couple years ago I made this https://bootstra386.com/ ... it's for a project. This is genuinely 1994 style with 1994 code that will load on 1994 browsers. It doesn't force SSL, this does work. I made sure of it.

The CSS on the page is only to make modern browsers behave like old ones in order to match the rendering.

The guestbook has some javascript if you notice to defeat spam: https://bootstra386.com/guestbook.html but it's the kind of javascript that netscape 2.0 can run without issue.

0 comments

JimDabell7mo ago

> This is genuinely 1994 style with 1994 code that will load on 1994 browsers.

Unfortunately it won’t, at least not when you’re serving it with that configuration.

It uses what used to be called “name-based virtual hosting” (before it became the norm), which looks at the Host request header to determine which site to serve. Internet Explorer 3, released in 1996, was the first version of Internet Explorer to send a Host header. I think Netscape 3, also released in 1996, might’ve been the first version to support it as well. So, for instance, Internet Explorer 2.0, released in 1995, will fail to load that site at that URL. If you test locally with localhost, for instance, then this problem won’t be apparent, because you aren’t using named-based virtual hosting in that situation.

If you need to support early-1996 browsers and older, then your site needs to be available when you request it without any Host header. In most cases, you can test this by using the IP address in your browser location bar instead of the hostname.

Edit:

At one point around 1998, it wasn’t possible to directly install Internet Explorer 4 on Windows NT 4, because it shipped with Internet Explorer 2 and microsoft.com used name-based virtual hosting, or at least their downloads section did. So the method to install Internet Explorer 4 on Windows NT 4 was to use Internet Explorer 2 to download Netscape Navigator 4, and then use Netscape Navigator 4 to download Internet Explorer 4.

JdeBP7mo ago

Using the IP address is a tricky one for something that is supposed to be Internet facing in the 2020s.

In the modern world, one common probe performed by attackers is to see whether a site responds with its own IP address in the Host: header, or the address-to-name lookup result of the IP address in the DNS, or the well-known defaults of some WWW servers.

What they're relying upon, of course, is people/softwares allowing IP addresses and the reverse lookup domain names, but forgetting to install security controls for those as virtual hosts.

Or, equally as bad, the fallback if no Host: header is supplied being a private/internal WWW site of some kind.

kristopolousOP7mo ago

I ran ns2 on this in testing it two years ago. I'll check again this week.

j / k navigate · click thread line to collapse