Sidebar Sidebar
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

Other A proxy to fix HTTPS issues on old versions of OS X

Just noticed, I'm being asked to allow squid incoming connections with every single system restart. Squid is allowed to receive incoming connections yet it would ask me again and again. Haven't rebooted for a while and noticed it just tonight when had to reboot several times. I also noticed that some widgets froze in dashboard. Checked several times and figured that after reboot there's no Dashboard process at all in the Activity Monitor, however after checking out the Dashboard there appear to be six Dashboard processes in there. Thought it might be Little Snitch. Uninstalled it, still no go. Totally confused. Here's what I have in Console -

3/18/21 12:27:12.411 AM DashboardClient[331]: SecOSStatusWith error:[-34018] The operation couldn’t be completed. (OSStatus error -34018 - Remote error : The operation couldn‚Äôt be completed. (OSStatus error -34018 - client has neither application-identifier nor keychain-access-groups entitlements))

3/18/21 12:27:12.411 AM secd[236]: securityd_xpc_dictionary_handler DashboardClient[331] copy_matching The operation couldn’t be completed. (OSStatus error -34018 - client has neither application-identifier nor keychain-access-groups entitlements)
 
wowfunhappy said:

Anyone have a clever name for this package? Trying to improve the overall presentation as I finish up this big update, and the name is vexing me!
Click to expand...

Call it simply, without using "Vintage", "Retro" in its name: it enables the modern TLS protocols and can be used with any macOS up to the latest if desired, so it's not "Retro". I'd prefer something technical, like "TLS Translator Proxy" or "TLS Enabler Proxy" for macOS.
 
Last edited:
otetzone said:
Just noticed, I'm being asked to allow squid incoming connections with every single system restart. Squid is allowed to receive incoming connections yet it would ask me again and again. Haven't rebooted for a while and noticed it just tonight when had to reboot several times. I also noticed that some widgets froze in dashboard. Checked several times and figured that after reboot there's no Dashboard process at all in the Activity Monitor, however after checking out the Dashboard there appear to be six Dashboard processes in there. Thought it might be Little Snitch. Uninstalled it, still no go. Totally confused. Here's what I have in Console -

3/18/21 12:27:12.411 AM DashboardClient[331]: SecOSStatusWith error:[-34018] The operation couldn’t be completed. (OSStatus error -34018 - Remote error : The operation couldn‚Äôt be completed. (OSStatus error -34018 - client has neither application-identifier nor keychain-access-groups entitlements))

3/18/21 12:27:12.411 AM secd[236]: securityd_xpc_dictionary_handler DashboardClient[331] copy_matching The operation couldn’t be completed. (OSStatus error -34018 - client has neither application-identifier nor keychain-access-groups entitlements)
Click to expand...
The Dashboard is almost certainly unrelated. Squid is just a proxy server—it's not a hack, it's not doing anything weird. (The Dictionary fix, by contrast, is absolutely a hack, but it should only affect the Dictionary.)

I assume you have macOS’s built-in firewall turned on, right? Squid does need to be allowed to accept incoming connections (even though it will only allow connections from localhost, ie your own computer). Did it always re-prompt after rebooting, or is that new?

I wonder if updating Squid from 4.12 > 4.14 could have done that. I might need to try code signing Squid (with an ad-hoc signature, I'm not a paid Apple developer).

You might also turn off the firewall. You don’t really want to rely on the firewall of an 8-year-old OS. Instead, block incoming connections in your router. This is usually the default, unless you explicitly open ports.

maverick28 said:
Call it simply, without using "Vintage", "Retro" in its name: it enables the modern TLS protocols and can be used with any macOS up to the latest if desired, so it's not "Retro". I'd prefer something technical, like "TLS Translator Proxy" or "TLS Enabler Proxy" for macOS.
Click to expand...
Thanks, I actually went with "Legacy Mac Proxy", which is much the same thing!
 
Last edited:
Wowfunhappy said:
Did it always re-prompt after rebooting, or is that new?
Click to expand...
It is, in fact, new, as far as I can tell. I don't remember such an issue before. It used to work fine with the firewall enabled. I'll turn it off and let you know if it helped or not
 
Well, obviously turning firewall off has stopped Squid from nagging, however I still have six Dashboard processes in Activity Monitor after checking the Dashboard. I wonder whether it's normal behavior or not. I never paid attention to it before.
 
Dashboard always runs as multiple processes, depending on the number of widgets you have installed. I'll see if I can replicate the firewall problem—as I said, I may just need to give Squid a code signature.
 
  • Like
Reactions: otetzone
I have 5 Dashboard processes and nothing seems to suggest this is a problem. As for the prompts, if you use Little Snitch allow all outgoing and incoming connections through Squid because it now took over the connectivity from the system defaults. I don't use Firewall massively.
 
  • Like
Reactions: otetzone
otetzone said:
Just noticed, I'm being asked to allow squid incoming connections with every single system restart.
Click to expand...
Okay, I can confirm this happens on my own Mac too when I enable the firewall, but it's actually doing this for every process that needs to accept incoming connections! Squid, Syncthing, Chromium, node, and VirtualHere all do it. So it's just an oddity of the macOS firewall.

I will still try code signing the binary the next time I release an update. (But I won't do that until I have something else to change as well.)
 
Wowfunhappy said:
Okay, I can confirm this happens on my own Mac too when I enable the firewall, but it's actually doing this for every process that needs to accept incoming connections! Squid, Syncthing, Chromium, node, and VirtualHere all do it. So it's just an oddity of the macOS firewall.
Click to expand...
10.6.8 here, Firewall always ON, has been ON forever — never had this happen. In this case, Squid asked once again after updating, as it had the first time. OK'ed and haven't heard of it since. Strange that also Chromium should make this kind of request: among all the processes I have Allowed or Blocked since the beginning of time, there's not one single browser.
 
It works !. Fantastic victory. If you manage to defeat these gangsters on Youyube, I'm going to celebrate it in a big way
 

Attachments

  • Captura de pantalla 2021-03-22 a la(s) 08.14.41.jpg
    Captura de pantalla 2021-03-22 a la(s) 08.14.41.jpg
    603.4 KB · Views: 241
  • Like
Reactions: Amethyst1
@davigarma You use Firefox for that. They made YouTube incompatible with Safari 9 2 years ago and now every time you go to youtube.com the Web-process driving the loading of youtube content in its tabs crashes. However, Squid did manage to make BitChute connectable in Safari. Still, major sites dropped their support for Safari 9 which is the newest Safari offered by Apple for Mavericks.
 
Last edited:
  • Like
Reactions: Amethyst1 and davigarma
As much as I like Safari, using it on anything older than Mojave is just a bad idea. I removed it entirely on my own machine. There are better browsers for old OS's.

I created this proxy to use Apple Mail, Dashboard, NetNewsWire, QuickTime, and (later) the Dictionary app on Mavericks, in more-or-less that order. I suspect it has silently prevented other apps I use from breaking as well, without me even realizing it, but since I keep the proxy turned on I wouldn't know.
 
Last edited:
Of course using youtube is dangerous. Yesterday, in Mojave with another modern browser, I was watching a Japanese video for an hour and the counter of access attempts by third parties to serve content and take information totaled 146. That's why I call them gangsters. But Safari 9 is incredibly fast and I still dare to go into some online newspapers that accept reading it. Although, it seems incredible, Netflix lets me see all its content. I have never had problems reading emails with apple mail in Mavericks, I download them with images just like other more modern systems. I only had problems with wiki. I've been surfing for 25 years and have never had any "safety" issues 😁. Thanks
 
@davigarma The main acquisition for me is that you can read Wikipedia in Dictionary again: this is considering I never liked it but as the first stop of knowledge it's passable. And Safari 9 is faster on my machine than its modern descendants. The problem with it is that its cache gets overflowed quickly growing to astronomic numbers of MB and loading speed drops dramatically, so you have to be watchful and clean it out regularly. Also, in terms of security the fact you don't surf with Safari has no effect either because if you use Web-Kit-based services baked into the OS you still offer attack surface for wrongdoers. If they're so smart to exploit vulnerabilities of Safari then nothing can stop them from doing that by compromising Wikipedia servers and using Dashboard widgets that connect to the outside world as a backdoor. That's why there's no sense worrying too much about that. Also, Squid seems to offer the newest cypher suits and encryption methods creating another security wall just like Apple security updates would if Apple continued supporting Mavericks.
 
Last edited:
I am having this "Mail[338]: CFNetwork SSLHandshake failed (-9806)" issue on 10.10. Yosemite.

I tried this fix but it didn't work.
 
MacFrisco said:
I am having this "Mail[338]: CFNetwork SSLHandshake failed (-9806)" issue on 10.10. Yosemite.

I tried this fix but it didn't work.
Click to expand...
It should work! I'll need more info. Did the installer finish successfully? Did you set up the proxy in System Preferences as instructed? Is "squid" running according to Activity Monitor?
 
OMG, It totally started working after I rebooted for the second time after installation. Awesome!
 
Glad it worked! Little miffed you had to reboot. I want users to be able to keep the last page of the installer open while setting everything up for the first time.

I'll need to look into alternate methods of starting the LaunchAgent.
 
The proxy has been updated:

  • Updated Squid to 4.15
  • Removed PPC version that didn't actually work.
  • On OS X 10.9 and below, the package will automatically set the environment variable HTTPS_PROXY to localhost:3128 in /etc/launchd.conf.
  • Squid is now code signed (via an ad-hoc certificate). This might fix some weirdness with OS X's built-in firewall and/or Little Snitch.
  • Use a different method for loading LaunchAgents on OS X 10.10+.
If you install this over a previous version, remember to delete the old Squid certificate from keychain access first, and to reboot after installing.
 
Last edited:
  • Like
Reactions: otetzone, maverick28 and Amethyst1
Wonderful news! While installing it can I safely leave the Wikipedia fix unaffected by the installation? So far it flies and many system services (Help, iTunes) connect instantly and trouble-free.
 
great this is fixed, too little too late since I can access any website I want much faster with interweb with FoxPEP. Also, seamonkey works, tenfourfox of course works, and Arctic Fox works. At this point, who needs LWK ? Just my 2 cents - however, Wikipedia is not the end all of web browsing on LWK. Now, can Squid hosted by 10.9 or 10.6 allow OS 9 to access websites ?? That is what I am after.
 
maverick28 said:
Wonderful news! While installing it can I safely leave the Wikipedia fix unaffected by the installation?
Click to expand...
Yep! Although, if it's already been installed than it shouldn't actually do anything regardless of whether you check the box. (I'm pretty darn sure I didn't mess anything up this time! 🤞)

------

@Macbookprodude I did not make this for LWK, I made it for other apps like Dashboard, Dictionary, QuickTime, etc. Actually, every time someone tells me they’re using this proxy in order to run an outdated web browser (including LWK, last updated in 2018), I feel a little uncomfortable, because I’m concerned about security. (But, it’s your computer and not mine, so make your own choices; I don't particularly want to get into a discussion about this.)

As for OS9—yes it can, but please figure it out yourself. I've already done my absolute best to explain it to you in the PPC section, and I cannot do it any more.
 
Last edited:
You must log in or register to reply here.
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.
Top Bottom
Back