@siria
It can take an hour to test all certificates in a browser. Look for successful connections and report 'Certificate Signature Algorithm' from 'Certificate Viewer' with hostname. It will help to find incompatible code and to re-write it for old operating systems and CPUs. If NSS3 fails for any reason, delete cache folder and start with next certificate.

Most sites should show this:

PKCS #1 SHA-256 With RSA Encryption

@RoyTam1
This preference setting is missing in XUL.dll:

network.http.accept-encoding.secure

Quote
anonymous
@siria
It can take an hour to test all certificates in a browser. Look for successful connections and report 'Certificate Signature Algorithm' from 'Certificate Viewer' with hostname. It will help to find incompatible code and to re-write it for old operating systems and CPUs. If NSS3 fails for any reason, delete cache folder and start with next certificate.

Most sites should show this:

PKCS #1 SHA-256 With RSA Encryption

@RoyTam1
This preference setting is missing in XUL.dll:

network.http.accept-encoding.secure

network.http.accept-encoding.secure

exists since Firefox 44, and how can Firefox 24 / Goanna 2.2 have it?

@RoyTam1
Goanna 2.0 had a br module in 2015, but you are right, it wasn't used for headers in release versions. At that time it was available in Firefox Nightly.

Quote
siria

Quote
roytam1
for history, try this kplugin:
http://o.rthost.win/gpc/files1.rt/KM74-g22-kplugin-history.7z

Thank you, tried it. So far no luck:
popup-message "Could not load Mozilla history!"

Strange, Dependency Walker reports for history.dll 2 "missing files", xul.dll and mozalloc.dll, although they are in root folder.

Quote
siria

Quote
siria

Quote
roytam1
for history, try this kplugin:
http://o.rthost.win/gpc/files1.rt/KM74-g22-kplugin-history.7z

Thank you, tried it. So far no luck:
popup-message "Could not load Mozilla history!"

Strange, Dependency Walker reports for history.dll 2 "missing files", xul.dll and mozalloc.dll, although they are in root folder.

thats normal, depends.exe won't load upper directory dlls unless you add it in %PATH%

updated test binary of K-Meleon 74 with Goanna 2.2(palemoon-26.5) that works in Win2000:
http://o.rthost.win/gpc/files1.rt/KM74-g22-20180516.win2000.7z

Goanna engine Changes since last build:
- JSCompartment: disable compiling with optimization, check pointers to avoid crash (6bc036e1f)
- cherry-picked upstream changes (via tbb-esr24): bug811122, bug922603 (2fa0b15ad)
- cherry-picked upstream commit: James Kolb - Bug 889693 - Implement MaskSurface in DrawTargetCairo. r=Bas (d9e56150b)
- Restore Win2000 support code (4/x) nsLocalFileWin::CopySingleFile: reverting part of logic to esr10 to avoid CopyFileExW() failing with ERROR_INVALID_PARAMETER in win2000 (81d6870c3)
- cherry-picked upstream commit: Bug 895964 - "Could not create service for entry Disk Space Watcher Service" r=bent (d08e200dd)
- aboutDialog: remove (Atom/WinXP) tag (9d991aed5)
- sqlite: don't use malloc_usable_size() in debug build, which cause unresolved symbol on linking (39900b646)
- sqlite: downgrade to esr24-bundled version (3.7.11) for better old OS compatibility softoken: don't use SQLITE_FCNTL_TEMPFILENAME for old sqlite compatibility (8e13ffdc1)
- storage: don't use sqlite3_mutex_held()and sqlite3_mutex_notheld() even on debug build, which cause unresolved symbol in vc8 on linking (c7cc15602)
- aboutDialog: add back #expand directive (f293e24e2)
* Custom changes:
- Added user agent overrides from browser\branding\official\pref\firefox-branding.js to GRE's modules\libpref\src\init\all.js (XULRunner build only)

* Notice: the changelog above may not always applicable to XULRunner code which K-Meleon uses.



Edited 1 time(s). Last edit at 05/16/2018 02:45PM by roytam1.

Thank you for the updates
Looks like this new version fixed a start-crash-prob for the Favorites plugin - great!

Did more testing with useragents stuff etc., looks good but long subject, will post later.

Have some little offtopic wishes ;-)
The MSFN-Forum is often badly displayed on old systems (and blocking scripts doesn't help either). Especially it has a very weird crossposting method: that only shows an empty rectangle. No link, no text, no nothing. If you post "normal" links they would be visible and accessible...

A second prob there, often "changelog" type postings there kill half the page in old browsers (FF3.5/KM1.6), between header and some hickup lower in a posting. That missing stuff is not even contained in the source code anymore Oops, what I meant: not even visible when stylesheets are killed, what usually reveals 80% of invisible stuff.
Reason is a stupid typo on their page code. Newer browsers ignore it always, older ones try to, but seem to trip if a posting contains "--" (my guess) Meanwhile I have a macro as pseudo-fix, but no idea what other people do. Until the owners fix this (if ever), perhaps you could consider replacing "--" inside postings with anything else? Example for a half lost page:
https://msfn.org/board/topic/177125-my-build-of-new-moon-temp-name-aka-pale-moon-for-xp/?page=52



Edited 1 time(s). Last edit at 05/18/2018 11:03PM by siria.

KM74-Goanna CERTS+CIPHERS (Cypher):

In some cases even KM74-Goanna throws such an awful
"Error code: ssl_error_no_cypher_overlap"
Right now here:
https://developer.mozilla.org/en-US/docs/Web/Security/HTTP_strict_transport_security

Mozilla is one of those 'random' sites which mostly work but not always. It even has happened in 2-3 cases so far, that a page was cypher-broken in a newer browser (Opera orRetroZ so far) and then actually did work in ancient KM1.6

This current example above now worked in retrozilla-FF2.
Clicking on the lock icon in RZ it pops up lots of page properties (didn't know, looks cool!). Can't find a specific certificate, but as with a previous problem-site the issuer is again Amazon. And something with OU=Server CA 1B

============ CERTS+CIPHERS =============

https://www.howsmyssl.com/

BAD: 12 / 37
Your client supports cipher suites that are known to be insecure:

SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA: This cipher suite was meant to die with SSL 3.0 and is of unknown safety.
TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA: This cipher suite uses 3DES which is vulnerable to the Sweet32 attack but was not configured as a fallback in the ciphersuite order.
TLS_ECDHE_ECDSA_WITH_RC4_128_SHA: This cipher suite uses RC4 which has insecure biases in its output.
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA: This cipher suite uses 3DES which is vulnerable to the Sweet32 attack but was not configured as a fallback in the ciphersuite order.
TLS_ECDHE_RSA_WITH_RC4_128_SHA: This cipher suite uses RC4 which has insecure biases in its output.
TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA: This cipher suite uses 3DES which is vulnerable to the Sweet32 attack but was not configured as a fallback in the ciphersuite order.
TLS_ECDH_ECDSA_WITH_RC4_128_SHA: This cipher suite uses RC4 which has insecure biases in its output.
TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA: This cipher suite uses 3DES which is vulnerable to the Sweet32 attack but was not configured as a fallback in the ciphersuite order.
TLS_ECDH_RSA_WITH_RC4_128_SHA: This cipher suite uses RC4 which has insecure biases in its output.
TLS_RSA_WITH_3DES_EDE_CBC_SHA: This cipher suite uses 3DES which is vulnerable to the Sweet32 attack but was not configured as a fallback in the ciphersuite order.
TLS_RSA_WITH_RC4_128_MD5: This cipher suite uses RC4 which has insecure biases in its output.
TLS_RSA_WITH_RC4_128_SHA: This cipher suite uses RC4 which has insecure biases in its output.


GOOD: 25 / 37


OFFERED BY BROWSER: 37
The cipher suites your client said it supports, in the order it sent them, are:

TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_CAMELLIA_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_CAMELLIA_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
TLS_ECDHE_RSA_WITH_RC4_128_SHA
TLS_DHE_RSA_WITH_AES_128_CBC_SHA
TLS_DHE_DSS_WITH_AES_128_CBC_SHA
TLS_DHE_RSA_WITH_CAMELLIA_128_CBC_SHA
TLS_DHE_DSS_WITH_CAMELLIA_128_CBC_SHA
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_DHE_DSS_WITH_AES_256_CBC_SHA
TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA
TLS_DHE_DSS_WITH_CAMELLIA_256_CBC_SHA
TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
TLS_ECDH_ECDSA_WITH_RC4_128_SHA
TLS_ECDH_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_CAMELLIA_128_CBC_SHA
TLS_RSA_WITH_AES_256_CBC_SHA
TLS_RSA_WITH_CAMELLIA_256_CBC_SHA
TLS_RSA_WITH_SEED_CBC_SHA
SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_3DES_EDE_CBC_SHA
TLS_RSA_WITH_RC4_128_SHA
TLS_RSA_WITH_RC4_128_MD5

---

KM74-Goanna on win98, noted yesterday:

http://mybrowserinfo.com/

That site seems to have a httpS version too, but can only connect to http.
httpS only does the usual jumping back and forth in the statusbar, showing "Connecting... / Connected... / Connecting... / Connected... "

(This is still with the 3 COPIED db-files from another profile, due to messed Kex)

@siria
The msfn.org problem is not related to posted content. Gecko 1.9.1 accepts comments in comments limited to INTERNET_MAX_URL_LENGTH. This limit removes half of the page. Colors of errors and comments can match background color in source viewer, but it includes everything.

'Certificate Signature Algorithm' is listed in details tab of certificate viewer.

offtopic MSFN-forum (should probably be split to own topic)

Quote
anonymous
The msfn.org problem is not related to posted content. Gecko 1.9.1 accepts comments in comments limited to INTERNET_MAX_URL_LENGTH. This limit removes half of the page. Colors of errors and comments can match background color in source viewer, but it includes everything.

Sorry, have confused it. Actually meant: it gets not even visible when stylesheets are killed, what usually reveals 80% of invisible stuff.

Whether in FF3.5/KM1.6 the MSFN-forum eats up half the page or not, depends partly from the posted content too, or it would happen always on all pages. But only happens on some. On the example link above it crops all this, due to those signs: <!-- xxx < xxx -- xxx >

<!-- Forum H<div align= (..half a page..) (fbeee7692)<br /> - Move --enable-tests out of Python configure and flip the default. (927868e8b)<br />

Only the admin can fix it.
The posters can avoid this quite easily too.
But readers with old browsers have no chance at all, unless they figure out a userscript and can inject it.

Quote
anonymous
'Certificate Signature Algorithm' is listed in details tab of certificate viewer.

How exactly? Where? When a page gives that "no_cypher_overlap" error, clicking the Lock icon only produces a little alert "Not transferred over secure connection". And when it works in another browser, it gives a bunch of cert infos, but (to me) that looks like other stuff. See attached screenshot

@siria

Example:
<!-- comment1 <!-- comment2 -->

Comments are not visible in browsers. Gecko 1.9.1 reads open tag and close tag of comment2, although it is just text in comment1. It doesn't find a matching close tag for comment1 and uses maximum size for comments for comment1. Gecko 38 ignores open tag of comment2 and uses close tag of comment2 to close comment1.

@siria
Look for 'Certificate Signature Algorithm' in certificate viewer if a site loads without warning. That screenshot looks as if no connection was established. If developer.mozilla.org never loads, stop trying. MC removed insecure certificates and added some rarities, but things have changed.

Report any crash on connect to secure sites.

Libraries are listed at bottom of about:support and they can be updated. Keep a small list of sites that show 'no_cypher_overlap' for testing, but don't waste time configuring security preferences now. RoyTam1 will add what is needed to connect.

Quote
anonymous
Look for 'Certificate Signature Algorithm' in certificate viewer if a site loads without warning. That screenshot looks as if no connection was established.

Still find no "algorithm" fied, see screenshot above.
The sites have loaded anyway, if that viewer shows up at all.
Overall can't quite understand all this httpS stuff yet. For example: shall I report only broken sites in KM74goanna, or also broken ones in KM1.6? Guess the latter wouldn't make much sense, but not sure.

offtopic / MSFN cropping pages in old browsers <!-- comment1 <!-- comment2 -->

And again, this time page 55:
https://msfn.org/board/topic/177125-my-build-of-new-moon-temp-name-aka-pale-moon-for-xp/?page=55

Again a double "--" kills the first postings, then the following line shows up visible again, as first one below the forum header:

Quote

- Bug 1371991 - don't link against crmf when building with --> - Bug 1314968
- Explicitly specify the AccessPoint interface name. r=kanru (713d6adc6)

---

ON topic: An error "Failed to initialize" for the whole app, not just the security components, I get only with wrong KernelEx setting for k-meleon.exe. Or rather none at all. Usually that happens when renaming an app folder, this breaks the stored path in the KernelEx-list.
PS: please consider adding the link the newest KM74-version to its own thread at MSFN too. So far it seems there only in the NewMoon thread.



Edited 2 time(s). Last edit at 05/19/2018 11:39AM by siria.

@siria
There is no reason to report crashes or broken connections now. If Gecko creates no db-files in profile, that has priority. If only K-Meleon 1.5.4 creates db-files, something important is different in Gecko. Are there any details in K-Meleon 1.6 certificate viewer?

@siria
You are right. It is "--" and next ">".
It ignores a comment if it has no closing tag.

Bug 1371991 and Bug 1314968 are for platform Linux.

because firefox is quite strict in older versions:
https://bugzilla.mozilla.org/show_bug.cgi?format=default&id=220361

Quote
anonymous
If only K-Meleon 1.5.4 creates db-files, something important is different in Gecko.

No I guess the browsers are innocent, it's rather some system stuff at the moment. All my KM versions, old and new, cannot create a key3.db anymore, neither FF9, FF10 etc. The only exception seems to be retrozilla-FF2.
First suspect is that KernelEx Update and my following chaotic struggles to get old apps working again or get newer ones running better. Rather futile so far.
But perhaps it's also something else, wouldn't have noticed for awhile, am usually not creating so many new profiles ;-)

Am curiously waiting for reports from other users, there seem to be 1-2 at MSFN.

Does it make a difference whether I copy a key3.db from FF2 or from KM1.6, or perhaps FF9? Would rather not from FF10+KM74 because of that mysterious cookie-mess.

Oh... MSFN starts to become very interesting now:

https://msfn.org/board/topic/177751-backporting-newer-browsers-to-windows-9x/?page=2

Mecury's tests show his version is full of Spy/Adware (?) stuff, writing endlessly to disk, is excruciatingly slow even on perfectly harmless, simple pages...

On one hand this could finally give a trace to what's making the native version so slow on most simple link pages (Bug in KM74 shell? Goanna-engine or settings? The bunch of embedded extensions? OS probs? KernelEx Probs?), on the other hand the very first thing I wonder is:

Which VERSION is he really testing there??
1) roytams first version? (IIRC the update was never announced in that thread)
2) roytams newest version? (20180516)
3) the modified version of Aiko, posted on ufile.io? (domain-JS is not enough -> NoThanks)
4) the version from Aiko's Blog, with download links to a (paying?) link service, linkshrink.net?

This blog makes me wonder in general... Probably other readers too, if they're familiar with the original forums where all that stuff is taken from, without any hints about those origins, with twisted semi-truths and different download links:

https://retrosystemsrevival.blogspot.de/2018/05/k-meleon-74-windows-9x-edition.html

Quote
AikoChan blog
K-Meleon 74 Windows 9x Edition!
Thank you roytam1! A modern web browser has finally come onto Windows 9x! K-Meleon 74 contains a modern Goanna 2.2 engine to render web pages, much more modern than Opera 10.63! K-Meleon is giant step forward of eight years!
Download from:
http://linkshrink.net/7qfUDq

This ultrashort description is a joke:
As usual of course no originating hints, except the name of the dev. But that seems a big exception on this blog. Then it sounds like this is a fully finished, stable browser for Win98, when in reality it's just the first test versions. Also the last browser versions running well in Kex-Win98 are not Opera10.63, but Opera12.02 (Aug.2012) and Firefox9 (Dec 2011). And "modern web browser", step of 8 years? For Win98 it's sure a giant step forward, but goanna2.2 engine from PaleMoon 26.5 is from Sep.2016, and based on even older Gecko engine.
2012 - 2016 = 8 years??
Sorry, all of this makes me very, very suspicious of all the other apps posted on this blog too.
And his explanation for Mercury's extreme background traffic/diskwrite probs above?
"a modern web browser on low-end Windows XP, Vista, or 7 machines (1GB laptop-era) today would prove problematic" - ?? U hu, sure... KM74 on Win7...

Update: have googled for Akamai, what causes most of his extreme background traffic. Looks like this is some legitimate service for updates of all sorts for all apps, incl MS Win10



Edited 1 time(s). Last edit at 05/20/2018 07:51PM by siria.

@siria
Gecko 24 always creates db files on browser start if missing.
Gecko 1.9.1 creates db files on HTTPS connect if missing.
There is a popup if db files are write protected.

Quote
anonymous
Gecko 24 always creates db files on browser start if missing.
Gecko 1.9.1 creates db files on HTTPS connect if missing.

That's exactly my prob currently: they 'should', but almost all my browsers can't seem to create a new key3.db anymore.

@siria
Restore system and KernelEx to allow Gecko 1.8.1 creating db files again. If that works, RoyTam1 can enable NSPR logging in a test version to see what fails or you can use Sysinternals "FileMon" from 2001 to look for db write problems. Important: 9x version not the NT version.

@sira

If you have any questions, you are free to ask
My blog is a simple all-in-one collection of freeware from MSFN over the years. I recently realized no other site has done this, so I took the matter into my own hands.

You are wondering about which build the 9x-compatible version of K-Meleon I've used; I used roytam1's build of Windows 2000 and dictionary files with the provided files on his MSFN topic. If possible, I may or may not include db files from Firefox later and maybe include U-Block if possible.

I apologize if my site appears shady, just install adblock if the ads bother you

Thank you for the feedback, I will try to improve the site!

Hi Roytam1. I've seen this internet site: https://retrosystemsrevival.blogspot.com/search/label/Windows%209x?max-results=20&m=1.
You're a genious but I've to ask you if K-Meleon 74 is updated at 2018 on Windows 98 with your patch. If yes has it automatic updates or no?

Quote
Windows 98
Hi Roytam1. I've seen this internet site: https://retrosystemsrevival.blogspot.com/search/label/Windows%209x?max-results=20&m=1.
You're a genious but I've to ask you if K-Meleon 74 is updated at 2018 on Windows 98 with your patch. If yes has it automatic updates or no?

no auto-update from me as usual. (I don't like the concept of auto-updating which may break whole thing without notifying users)

This web browser is pretty overkill on 9x


Although it faces a couple issues
-Accessing the toolbar options will immediately cause a crash
-No youtube

Quote
Aiko
This web browser is pretty overkill on 9x

Although it faces a couple issues
-Accessing the toolbar options will immediately cause a crash
-No youtube

for youtube, it may be broken in the porting progress. I wonder if I can find the root of issue and fix it.

Quote
roytam1

Quote
Aiko
This web browser is pretty overkill on 9x

Although it faces a couple issues
-Accessing the toolbar options will immediately cause a crash
-No youtube

for youtube, it may be broken in the porting progress. I wonder if I can find the root of issue and fix it.

The browser also has issues with more "modern" pages which are more demanding. A demanding page freezes up the browser.

I think disabling javascript makes the browser a less crash happy, but it makes a lot of sites inaccessible.

I'm a newbie when it comes to the built-in user agent. Tried spoofing to firefox without success. Maybe spoofing the browser to mobile could help rendering?

Quote
Aiko

Quote
roytam1

Quote
Aiko
This web browser is pretty overkill on 9x

Although it faces a couple issues
-Accessing the toolbar options will immediately cause a crash
-No youtube

for youtube, it may be broken in the porting progress. I wonder if I can find the root of issue and fix it.

The browser also has issues with more "modern" pages which are more demanding. A demanding page freezes up the browser.

I think disabling javascript makes the browser a less crash happy, but it makes a lot of sites inaccessible.

I'm a newbie when it comes to the built-in user agent. Tried spoofing to firefox without success. Maybe spoofing the browser to mobile could help rendering?

More likely that Your system CPU and RAM is not good for demanding pages.

You can switch off some Java Script features.

And Yes. Maybe try spoofing mobile may give You less demanding content.