google is, ironically, one of the few remaining "major" sites which support http.

i'm a bit of a browser historian, so i regularly browse the web in everything from mosaic, to ie3 and netscape, firefox 3.x, and all the modern-day favorites such as links and w3m.

so i started building my own websites with all the oldies in mind. it takes some tweaking, but not that much, and i enjoy strolling^Wsurfing down memory lane, looking at that gorgeous ie3 menubar, which was replaced with a flat gray in ie4, or writing something in opera 12.x.

Nice trip down the memory lane :D. Works great on POP_OS (didn't uninstall my desktop).

Yes, do as I say!

With the Web Rendering Proxy (https://github.com/tenox7/wrp) you can also visit bing.com :)

What're the most recent tls features IE5 supports? Does it even work with non-sha1 certs?

Google looks at your user agent and doesn't redirect to https if it's an old browser.

Isn't this a security vulnerability?

For IE5, there's two distinct obstacles to serving https.

1) It's unlikely to accept any x.509 certificates you can get issued under today's CA/B guidelines; and I'm also not sure how many CAs from then are still valid, either because they had too small of keys or they expired

2) I'm not sure if ie5 supports TLS 1.0 and if it does, it's probably not by default, because that how things were back then.

Given these conditions an https handshake is highly likely to fail, and as the server operator there's no way to provide useful information to the user in that case. If they go to your http site and you redirect them to a handshake error that you know they were going to see... That's not useful. You could be secure and not provide service... but then again, your redirect could be MITMed cause http. Or you could provide a useful service with no security.

This is a choice, not a vulnerability.

This doesn't open up any new way to attack a modern client. Modern clients would have google.com HSTS preloaded and not use http at all. But even if that's not available, a MITM that fiddles with the User-Agent to avoid getting a redirect could have fetched the search results via https and proxied them back via http, as long as the client made an http request.

Edit to add: if you could get a cert IE5 would accept, it likely wouldn't be acceptable by modern clients, so you'd need to distinguish clients from the TLS handshake (although, I guess it really is an SSL handshake for ie5?). There's no client identifier in there, but you can certainly tell the difference between modern and ancient; it gets trickier to tell the difference between ancient and pretty old or pretty old and trying to do a fallback handshake.

When working at Transmeta as a QA engineer, I remember finding a software bug in the Crusoe processor that prevented IE 5.5 from working with SSL.

https://en.wikipedia.org/wiki/Transmeta_Crusoe

Perhaps, but all the vulnerability is in using IE5; there's nothing the site can do to make an IE5-compatible connection secure.

In modern browsers, google.com is in the HSTS preload list, so the browser won't even make an initial request over HTTP.

Only www.google.com and other subdomains are preloaded unfortunately.. I’m having trouble quickly googling the reason (is that irony?) but from memory a Googler said that they had a lot of internal stuff hosted above google.com they couldn’t make https (HVAC controllers and such?)

You can see the full HSTS list here I believe: https://source.chromium.org/chromium/chromium/src/+/master:n...

For who? For Google? Or for the client? The server's security shouldn't be dependent on https

Both. If you can stop a https redirect by rewriting the user agent header, it can be used to track the Google searches for example. HSTS would help if the browser did connect to the https website recently, but it looks like a security vulnerability to me.

I just realized after writing this comment that if you can rewrite http headers, you can also stop the redirect so perhaps it doesn't matter.

It wouldn't be surprising if they did that so people could download a newer browser (such as Chrome...) which would itself be signed anyway.

Using their own outdated, unsupported browser? Why should they develop websites against a 22 year old browser version?

On the one hand, it’s a sign of technical prowess to be able to accommodate browsers going that far back.

On the other, it’s kind of embarrassing not to have a barebones version of your website load in case an old browser is detected. IE5 had Ajax after all, what more does a search box really need? The answer? Endless tracking and cookies and phoning home. God forbid someone uses a browser we can’t use to collect infinite metrics.

Makes me wonder, does bing work with lynx?

Lynx is not outdated. It’s actively maintained and updated. Last release is a couple months old.

Lynx doesn't support JavaScript like every other modern browser.

It is outdated.

In tech, we call this "opinionated".

I realize that it probably doesn’t pay, but it wouldn’t be that difficult to implement just a form to type queries and a basic html result page that works without javascript.

Welcome to my Friday nightmare. Some update broke dropdowns on IE9 because, apparently plain form select HTML is no longer a viable thing because we can't beautify it. Why my erp to UPS connector needed beautification I don't know. I call, they know, everybody using IE (as required by this connector) is down. Great. Patch rolls in the morning and suddenly looks like chrome is supported.

Sigh

It certainly wouldn’t. Forms have been with us for a very long time and I’ve done it more times than I can remember.

Yes, it says that they are moving forward and not targeting browsers that are EOL.

What volumes does it speak about microsoft?

I think it's ironic. Microsoft since the dawn of time has been known for backwards compatibility in Windows. They would go out of their way to ensure random 16 bit apps with bugs and major issues continued to work through years of major upgrades to Windows. Raymond Chen has written countless stories of the hacks upon hacks they had to keep running through the years: http://ptgmedia.pearsoncmg.com/images/9780321440303/samplech... So now to see it all abandoned as Microsoft is pulled into the age of web applications is kind of amusing.

And just recently on here I was talking about how MS is known for backwards compat but we actually observe Linux doing it better

While breaking backwards compatibility with user space apps is frowned upon, I can’t imagine Linus approving adding old bugs so that buggy programs can still work.