Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
AOL 3.0 reverse engineered (g.livejournal.com)
294 points by pbear2k21 on June 5, 2022 | hide | past | favorite | 130 comments


Good for those nostalgics like me. My experience with something similar was Escargot, a similar project but for MSN Messenger[1]:

I created a new account (old accounts do not work), I made my friends to do the same and we used it for a few hours (sharing emoticons, nudges, etc) but then the novely went away. Software alone cannot capture/reproduce the old days, unfortunately.

[1]https://escargot.chat/


That's the thing about nostalgia. We don't miss a thing by itself, but the whole context in that given time.

I don't miss Windows 98. I miss being a child using that, browsing the old internet, the old terrible "web design" and having my friends on the same page


You can never really go home.


As adults, we have the goal of finding a new place to call home. Growing up doesn't have to mean feeling lost or renouncing to be in a warm and nurturing place.

The only difference is that I'm not a child anymore.


If you had a fixed home during your formative years, that is a special place which no longer exists except in your imagination.

Even if you physically visit, one or more of several things are drastically different.

Change is always happening.


you cannot step into the same river twice.


Not until you go to seek your great perhaps.


> I don't miss Windows 98. I miss being a child using that, browsing the old internet, the old terrible "web design" and having my friends on the same page

I do miss it - having a Windows 98 (or Windows 95) VM is so useful for running some old beloved games.


For those interested in doing something similar but with AIM (the messaging client bundled alongside AOL):

1. "Phoenix" a closed-source server reimplementation:

http://iwarg.ddns.net/phoenix/index.php

2. AIM OSCAR protocol project in TypeScript, incomplete but partially working:

https://github.com/DrewML/aim-server


MSN Messenger was the best chat software I ever used. Its abandonment was a huge loss. Thanks for sharing!



After AOL chat waned, MSN Chat was really fun too 2003-2005?. I spent a ton of time on the local chat and I really missed it when it left. I know AOL had that but it was before the great ISP unbundling and was mostly gone by 2002 IIRC. I never found a broad audience on IRC.

Reddit is close to a successor but came much later.

Craigslist personals was a good way to connect to people and of course that’s gone too.

We lost a lot of communities. Instagram, Facebook, dating apps, and just about every other social network evolved while never capturing the original excitement, IMO.


I distinctly remember "AOL Keywords" as a signal that corporations were going to find a way to ruin the internet with their walled gardens.

And while that idea didn't pan out, the general idea seems to be roughly what happened. The internet is now mostly a grouping of separate spaces like Facebook, Apple's store, TikTok, IG, etc.


As a former AOL user, it was truly a walled garden. For hordes of less tech-savvy users like myself, AOL was the internet. Many of us had little concept of an internet "beyond" AOL.

The current situation might be referred to as "windowed gardens". We get to look around and choose the fiefdom we hate the least.

...progress?


Part of the reason AOL was successful was the limitations of dial-up and the inclusion of high quality art assets on AOL CDs, that made it more fun and visually interesting to be on AOL vs the WWW in the mid-90s. Browsers were pretty bad (AOL's own internal browser included), HTML was quite limited, etc. Broadband is what killed AOL. The moderation was pretty loose on the forums and chat rooms, and it felt like a pretty free place to be.


I miss clients like this. It reminds me of a better time when the internet was young and fresh to me.

It does amuse me that this written up on livejournal.


It reminds me of a better time when the internet was young and fresh to me.

I remember when AOL was seen as evil that was going to kill the open internet.

It was the original "walled garden."


It wasn't really a walled garden, though. I remember using the AOL client software to connect to the internet and then opening IE to browse internet sites like yahoo, geocities and slashdot. When the computer owner who let me borrow his computer saw me do this he was stunned. He didn't realize he was connected to the internet this whole time.


> It wasn't really a walled garden, though. I remember using the AOL client software to connect to the internet and then opening IE to browse internet sites like yahoo, geocities and slashdot.

That wasn't always true. At some point internet access was a "feature" that was added to the walled-garden AOL. They famously added Usenet in September 1993. I can't find a date for web access, but I'd guess 1995.


I remember the usenet and gopher features that were part of the AOL client. I remember the hype I had heard as a kid on AOL back in those days. When I found them and tried to use them (I was about 12 years old) I didn't find them very helpful or easy to use like the main forms in AOL but after a few years after leaving AOL I got way more out of IRC and usenet than I had in my time there. What AOL did for me at that time was present an internet that was good enough because it was easy enough to use.


Eternal September, aaahhh


I certainly remember the culture clash when AOL opened the Internet to "newbies," starting with Usenet and then everything else. I think part of it was just that being able to connect no longer made you part of a special club.

I was one of those newbies. When my spouse and I were living in different towns after grad school, AOL allowed us to communicate using local phone numbers in our respective locations, using a single account. Later on, they reconfigured their software so that it was running on top of a regular TCP/IP client, and you'd use it by logging in with the AOL software and then switching over to Netscape and an e-mail program that recognized AOL's protocol.

I ran my first side business from an AOL e-mail address.

AOL was the closest thing to "it just works" in the business for quite a while. Plus, their nationwide reach meant that you could access it anywhere without paying for long distance phone service. It took a few more years for the Internet to work that well for everybody.

I predicted to my friends that pretty soon everybody would have access to the Internet! Today we look back on the early Internet with nostalgia.

Eternal September... yeah, bring it on.


It was for a long time. At some point which I believe was 1994, AOL made a Winsock.DLL available, which could route TCP/IP packets over your AOLnet connection, and present itself as a standard winsock interface. This allowed any other Winsock program (Netscape, IE, Forte Agent, FTP, etc) to run while dialed into AOL.

Prior to that, no, you couldn't do that. Being dialed into AOL meant you were only connected to AOL. The email did have an internet gateway (since 1992), you could email people at other internet hosts, but you couldn't use regular internet software until that DLL came out.


Around 1995, AOL client itself could use winsock and work over tcp. So you could dial into your local ISP , select Winsock or tcp or some option like that on the main login page and be in AOL, while still have the ability to launch other apps like Netscape or irc client. You didn't have to dial into AOL's number. I use to use AOL on the school network to chat with family or friends that hadn't discovered the wider internet yet.


right but that wasn't what AOL was trying to build; it's what happened in spite of their efforts, not because of them. Notice the prominent "channels" and "what's hot" buttons in the second screen shot? They're given a higher position in the ui hierarchy than "internet" for a reason. They were trying to create an experience where all of the content came from AOL itself. "Channels" were their content pipelines, they were hypermedia but everything within the content network of channels was created by AOL itself. It would be like someone hearing about the web and thinking that the way to "win" the web would be to "own all of the web pages".


> It wasn't really a walled garden, though

It effectively was for millions of users who did not venture outside the AOL client.


fwiw...AOL also introduced a web browser within their client and provided its users with 2mb of web hosting space. I hosted a bunch of my first web sites using it and learned about FTP.


That’s a great story to hear and lessons my negative views of AOL. Thanks for sharing it!


One might argue before that was CompuServ. Text only, dialup, massive BBS basically. Messaging, shopping, airline reservations and other connections.

I wish someone could rescue the whole thing from tape and host it.


I wish someone could rescue the whole thing from tape and host it...

on a PDP-10


I liked the Three Line Novel thing on AOL.


Every time I listen to "The Chronic" by Dr Dre I'm reminded of how impressed I was by the "AOHell" installer. It was the perfect mix of BBS/demoscene culture and an introduction to larger online communities of hackers.

edit: Also, I'm very pleased to hear someone else talking about "rainman" ;)


My favorite feature in AOHell was the chatroom text spoofing .where you could make it appear as if someone else had typed something. Later when I got access to the VB source for AOhell , I found out how it was done. The dev had figured out a clever trick to exploit the way the chatroom window did line wrapping. Also who can forget the ASCII middle finger that one could scroll across the chatroom. Those were fun days. I had a decent local dial isp. But still logged onto AOL for the 'warez'. It seemed like AOL provided unlimited email attachment storage. So warez files were traded over email in AOL via multipart RAR file attachments.


Yes, Remote Automated INformation MANager... my sort of introduction to "programming" as it was. Almost two decades later, my co-worker at a startup was one of the original engineers at AOL (after the name change) and worked on RAINMAN among other things. Anytime someone brings it up, I have fond memories.


And here I only remember AOHell's Nine Inch Nails references...


I wouldn't want to mess with outdated software that communicates over a network, especially not from AOL given their record with AOL Instant Messenger.

Did you know that the original way that AOL checked that you were using a genuine version of AIM was to send a buffer overflow attack to you? It would then execute some code that checked process memory for signs that it was the genuine AIM executable.


AOL was like "The Matrix". The system was full of casual, blissfully ignorant users... meanwhile there was an underground set of hackers and script kiddies having a blast while being chased down by moderators.

Ah yes, I remember the first time I got my family's account shutdown for "punting" a moderator and crashing a bunch of servers. My dad was like "what?" when AOL _called us_.


Dude, we got banned from AOL for life after I popped into a mod chat room and started pretending I was one of them. Stupid! But I wanted to play a dangerous game...




I’m sorry for your loss. I enjoyed reading this even though I am probably 15 years older, I have a similar story with the predecessors to AOL (BBS systems).


TY for the kind words. The end of this post took place in 1997 and while the effect still lingers, I can only be grateful that my outlet was productive.

Funny enough, AOL was the gateway drug. I found things like usenet, irc, and bbs's and graduated to these things. My early teens were spent in those neighborhoods before moving on to LAMP stacks and more productive programming.


I am also old school AOLer who's curiosity in programming sparked by making 'progs'.

I also had the Mad Dog McCree CD-Rom as a kid on my Gateway 2000 Pentium 60mhz. Shooting up that stagecoach!


There might have been a lot of hydro/0's but your handle is very familiar. If you hung out in vb/4 in the 90s I am sure we crossed paths.


I had the privilege of dining with an ex-CEO of AOL around 2017 or so (long after his retirement). I was prepared to rail him for taking advantage of Americans, but he was such a humble and fascinating guy… no.


Thank you for sharing your story.


Nothing as elaborate as yours but my parents got that call too. I can't imagine an ISP calling anyone in 2022. Good guys, AOL


Nowadays they send letters. Also being on the father end of it instead of the son is actually much worse, even though young me never would have believed that.


I’ll add here that my mother also received a call from AOL.


Yep! I downloaded my first copy of Photoshop, along with the MacOS 8 beta from #macwarez/#macfilez. Around that time they got busted up and had to change to #zelifcam.

It was amazing. You'd just subscribe to some bot in the chat room and after that all the pirated software you could imagine would just continuously appear in your inbox.


I remember making 2500$ spamming porn links


I was not an AOL user. In the 90s my colleagues and friends used "AOL User" as a slight on folks who didn't understand tech. My dad was an AOL user and I had to show him how to use it. Often. I raged at its expensive walled garden (especially when I needed to show him how to access an actual website) but he liked it. Regardless, I love this project.


Similar experiences and attitudes for me. Looking back, we were harsh on them. I’m sorry for my disdain especially after reading how many children went into programming or an IT career because of various AOL hacks.


If anyone wants to check it out or take a deeper technical dive our discord is https://discord.gg/reaol


I'm interested, but not interested enough to join Discord.


You could join their AOL chat rooms instead.


I would except they've also put the setup instructions inside their Discord server as well.


PCLink has entered the chat


Yeah, such things really should at least have a matrix bridge IMO.


Can't even open that link on iOS without being redirected to download Discord. Pass


[flagged]


Strictly speaking, it's because Discord goes out of their way to block mobile browsers.


I've noticed this trend more and more with apps, reddit starting doing it too recently.

There are times when walled gardens work, when they make sense. This is not that time.


Why can't you just publish the open source on Github or something?


That's planned. Would be blasphemy not to.


After all these years we can finally hack aol to get unlimited hours.


Whats your mailing address, I have a bunch of KiloBytes I'd like to send you FREE on CD-Roms. [Microplastics]


Not to be a negative nancy, but in all likelihood there’s serious vulnerabilities in the AOL client. If you connect to this, anyone else connected to it can probably pwn you. So maybe run it in a VM or something.


The official AOL client at one point relied on an RCE vulnerability in the client <-> server communication to thwart MSN's compatibility [1]. The client would be exploited by the server and sent new code to execute, making it impossible for most competing clients to be compatible with its protocol.

If that's the programming style that was deemed acceptable for release, I can almost guarantee you that the old, unmaintained client will definitely have some other vulnerabilities left over in its protocol.

[1]: https://www.geoffchappell.com/notes/security/aim/index.htm


You are confused, AOL and AIM are two totally different pieces of software, which use different protocols and serve different purposes. The exploit in question has literally nothing to do with AOL, it's for AOL Instant Messenger. MSN never tried to access AOL's service network, but certainly AIM's.


I think it's pretty likely that the AOL client and AIM could have shared some code for instant messages.


They did not, at least not until much later, many years after AOL waned in popularity -- possibly in part due to lack of money to pay enough engineers.

Initially AOL's was done (GUI and non-GUI functionality) via their client API called FDO and sent assembled packets out like everything else. AIM on the other hand was a classic simple GUI app using a different protocol and used none of AOL's FDO stuff.

Much later AOL used some OSCAR (AIM) libraries to piggy back the AOL client on-to AIM for buddies and IMs, but even so these were not a part of the exploits that kept popping up for AIM, and long after AIM's drop in popularity as well.


There were rumors that AOL ran scanners looking for mailing addresses to send disks to. I think its possible but perhaps it wouldn't have been an "official" effort: they had some employees that would pay for address lists without concern for their provenance or suitability.


[flagged]


Maybe the parent post was edited since, but your response seems entirely disproportionate here. Running old proprietary software which connects to untrusted servers in a secure environment like a VM is very good advice.

Saying you shouldn't do it because hacking is a crime is even worse than saying you shouldn't lock your doors because stealing is a crime. I say worse because in that case at least your point about deadly force could possibly apply - you can physically stop a robber if you happen to be home. Good luck beating up a 12 year old script kiddie stealing your e-banking creds through a Tor reverse shell you aren't even aware is installed on your computer because you ran what is essentially a web browser from before sandboxing was invented on your primary computer.


>Maybe the parent post was edited since, but your response seems entirely disproportionate here.

Maybe it was, I don't know. What law in PA requires a proportionate response?

If you don't like the laws of PA, register to vote and work to change them.

>Running old proprietary software which connects to untrusted servers in a secure environment like a VM is very good advice.

Yes, but the problem is most people don't know how to do that, so it's not useful to the types of people who have the freedom and time to experiment... the newbies... who are often quite young.

>Saying you shouldn't do it because hacking is a crime is even worse than saying you shouldn't lock your doors because stealing is a crime.

There's a difference between "lock your doors" and "lock your doors, get bars on your windows, set up an alarm, live on the third floor with no elevator, and keep a phone and a weapon next to a bed behindn a locked door" (which seems to be the level of "reasonable" security some folks here seem to want, to draw analogies from the physical world.

>Good luck beating up a 12 year old script kiddie stealing your e-banking creds through a Tor reverse shell you aren't even aware is installed on your computer because you ran what is essentially a web browser from before sandboxing was invented on your primary computer.

I'll just get a new credit card number or report the ach as fraudulent. I have MFA on my bank accounts plus code words. (I changed to a different one for each entity after a tour Dachau.)

It sounds like in the scenario you describe, we should give that 12 year old a job, rather than invent ever creative ways to punish them for not wanting to be a low level minimum wage customer service representative because from ages 12 to 18ish they responded to adults like an adult would, while they weren't thankful the kid only acted out electronically in cheeky, playful ways.


> Maybe it was, I don't know. What law in PA requires a proportionate response?

Nobody said it was illegal, but a disproportionate response is not likely to go over well with other people here. Whether that is a problem depends on whether you are trying to get along with other people, so will leave that for you to decide.


I take it you must be aware that the threat of a felony means next to nothing when it comes to computer hacking, right? If it did people and companies wouldn’t be getting owned left and right, and the security industry wouldn’t be so huge. It’s very good and realistic advice. Ignore it at your own risk I suppose, just don’t be surprised when the obvious happens.


>I take it you must be aware that the threat of a felony means next to nothing when it comes to computer hacking, right?

I literally just warned you that's not the case. Even if the FBI doesn't prosecute, you can respond physically[0], but I was more speaking in the context of someone hacking wifi, where they're in close physical proximity, not the other parent's example of a remote attack.

(That's why you hack... because you can do it remotely.)

For context, I had a neighbor literally hack a speaker I was using to do personal, private calls, protected by PA's 2 party consent state.

I don't like when people invade my privacy, repeatedly, then do a shocked Pikachu[1] when the result is to respond like an Appalachian with multiple degrees and ten years of policy experience paired with the skills of a woodsman trained by the Boy Scouts just before they went bankrupt.

[0] https://www.ft.com/content/307ece16-38cb-11e4-9526-00144feab...

[1] https://knowyourmeme.com/memes/surprised-pikachu


No no no. You cannot respond to a hacker with deadly force, except in a special circumstance where you reasonably fear imminent death or serious bodily injury. I’m not going to sit here and argue with your other misguided points, but that is dangerously wrong.


Which part of the GP are you saying falls under the CFAA?


Someone hacking someone who installed the software in the OP.

Was that part not clear?


> P.S. My Screen Name is "God" so don't forget to add me to your Buddy List and send me an IM

So if you ever wanted to talk to god via AOL, here is the chance. ;)


Well, people used to use me for the same thing.

I had "Christ"


Maybe this is a silly question, but: Does this support the GeoWorks version of AOL?


I never used AOL, but as a kid, receiving the 3.5" floppy in the mail was really nice. Saved me having to buy one!


I forget. Did they remove the little plastic square thing to make it read-only?

For youngins, 3.5" floppies had a "write protect" switch. If it was a solid plastic bit, you could write, but if the switch showed a hole, it would be treated as read only. Here's the first Google result I found: https://electronicstechnician.tpub.com/14091/css/Write-Prote...


I'm not 100% sure I remember correctly, but I believe the AOL disks were standard in every way except that they never inserted the plastic slider. A bit of tape fixed that problem. Scotch tape worked fine, as pointed out by another poster. I typically just used a portion on an unused floppy label and wrapped it around the edge. I wasn't much concerned with write protection usually, so keeping it permanently writable was fine by me.


You could just cover the hole with a piece of scotch tape and voila, writeable!


Scotch tape, huh? I would have figured electrical tape, for opacity. I don't think I ever had to do this though.


All the floppy drives I've ever seen had a little mechanical arm attached to a microswitch that detected the presence or absence of the write protect notch. VHS cassettes worked similarly.


Audio cassettes had this also. A little tab you could break off that would prevent recording. If you later changed your mind and wanted to record over the tape, you would just tape over the hole.


No need. It was just pushing something inside the drive. A little piece of paper jammed in the hole worked fine too.

You also drilled a hole on the other side to make the disk double density.


None of the ones I got ever did. They were immediately repurposed (along with all those free Computer City floppies).

Reusing the CDs was a little harder. ;)


AOL CDs made great coasters.


> I never used AOL, but as a kid, receiving the 3.5" floppy in the mail was really nice. Saved me having to buy one!

Those were sooo ubiquitous. But I never saved any, and now I wish I had some.

Luckily, the Smithsonian is on the job: https://www.si.edu/object/nmah_1395721


This makes me really happy. I think one of my first internet experiences was in an AOL chatroom, and someone told me to do Alt + F4 to fix something, and I was really mad that they tricked me when I realized what it did, but I think it's hilarious now.


This is great. Now I can finally pursue my true life's calling: making AOL proggies.


Never used AOL, but I wish “the internet” had such a structured 90’s user interface.


I agree. This was the era when buttons look like button instead of plaintext or text on rectangle, contents are shown in grids instead of cards, and different areas of the interface are separated by visual dividers rather than white margins.


That’s correct, but what I was getting at besides the UI style is that I wish most of the UI was in the client (browser) rather than in the content (web site).


Did use AOL, and think it was way ahead of its time. One portal where you could access email, chat, IM, news, stocks, etc. Worked fast and rather seemlessly, especially for dialup.

Portals today are still not as slick or functional. See MS or Google's attempts.

Really wish someone would create something similar in Electron or something.


And no obtrusive ads, especially video!


Pad keeping AOL and apparently LJ alive, nice! This has been a dream side project of mine for a long time just to bring back the golden years of the Internet so happy to see it’s been done.


i once worked on a team that was working closely with aol to develop an aol set top box. as an integration engineer i interfaced with aol quite a bit and on occasion, i'd get sent fascinating threads from their ops teams. all sorts of weird and scary sounding things like "access rotors" that were probably developed custom in the early 90s.


I would love to read more about your experiences. I grew up with AOL and learning about its internals years later is fascinating.


sadly that's about all that i remember. that and all the aol ops people used aol screennames. i'm sure that there are some old school aol ops staff who hang out on here, no?


And Microsoft's answer - Project Blackbird - fortunately sanity prevailed and Microsoft "embraced" the WWW



Yeah, and they gave us IE6.


Now now and also XMLHttpRequest no thanks to the OWA (Outlook Web) team.


People like to crap on iE'- but XMLHttpRequest gave rise to the whole Ajax trend around 2005.


It was a little earlier than that… IIRC I was using it in 2001 but it certainly was not called Ajax yet. But then IE just stagnated.


Faking AOL is what started my interest in hacking with the absurd pricing of internet access in germany at the time.


Back when AOL was what the cool kids used. I never did and was stuck with the internet during the 90s.


Too bad the journal entry doesn't have more details (and I'm too lazy to do further digging on my own).

Is this a RE based on actual server binaries that somebody managed to get copies of? Or is it a RE of the client end of the protocol, just being fed new data?


I recall the backend ran on some odd hardware for the time ???.


At least for awhile, it was Stratus VOS. This was true for its ancestors QuantumLink and PlayNET as well.


Oh I remember that - they were in competition with Tandem Non Stop systems using MIPS processors.

I used to program for those machines for a bank using TAL (Tandem Application Language) running their Guardian OS.


Can you make it simulate the modem handshake sounds on sign on?


Yes. That was done with an internal test build.


“Please allow ads on our site or create an account. Looks like you're using an ad blocker. We rely on advertising to help fund our site.”

Ah, LJ, how far you’ve fallen. My lifetime membership lies fallow after you ended up sold to a Russian company that eventually made any mention of The Gay illegal. Once you promised you’d never have ads. But here we are with a pop up begging me to turn off my and blocker.

I miss what LJ was. Perhaps I mostly just miss all my friends having the time in their lives to create longer, thoughtful posts.


There’s a back button hijacker too, I couldn’t get back out of the link.


The website hijacked my mobile Firefox browser and did not allow me to go back no matter how many times I pressed back.


"I can't press the back button... hmm, might as well register for an account and become a loyal user."


Hold the back button, you'll get a list of previous URLs to jump back to. Works similar to right-clicking the back button on desktop. Still pretty annoying, though.


A Livejournal link? Feels like the 90s in here today!


[flagged]


>Please don't complain about tangential annoyances—things like article or website formats, name collisions, or back-button breakage. They're too common to be interesting.

https://news.ycombinator.com/newsguidelines.html


Yeah livejournal is pretty bad. I only use it because of the 1 character username "g" I cracked 20+ years ago. It's an ad trap.


haha <3 this response.

Ah man I wish I still had all my old 3chr screen names...'pot' 'gat' 'xtc'

Not to mention the endless <><


I wonder if any legal difficulties will arise from this. Since Yahoo owns AOL/AIM, and this violates their IP/copyright I presume. Though I'm very happy that this was created.


Since none of the server software exists anymore, this is effectively all clean-room reverse engineering. Writing the entire backend from scratch and guesswork based on what the client software wants




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: