alt Hacker NewsCorrect! :-) It's been a lot of fun!
TLS is always version 1.2, and only the mandatory cypher suites are supported: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 and TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256.
This requires SHA256, AES and two elliptic curves (x25519 and secp256r1).
AES is used in GCM mode, so that's implemented too.
However, the browser doesn't verify the server signature over its certificate. So ECDSA and RSA are not implemented :-)
Getting TLS to work was indeed one of the more frustrating parts. The cryptographic functions are very well documented and there are lots of good test vectors, so that wasn't too hard (just a lot of work). But getting TLS working was very frustrating -- the handshake would complete, I'd switch to encrypting mode, and... the server would just disconnect my client instantly, with no further feedback or a stacktrace or anything.
I ended up debugging that by building openssl with LOTS of printfs all over the place and fixed nonces, talking to a local HTTPS server, and tried to make my client emit exactly the same bytes until I found the issue -- memory corruption, of course :-)
I built on amazing tutorials available online. For example, elliptic curve cryptography and x25519 in particular are SUPER well explained at [1].
JPEG was fun too. Tutorials like [2] gave a great overview of how it works, and the spec [3] is super clear (but includes TONS of optional stuff that can be skipped)
PNG was the easiest, the RFC is very straightforward [4].
(I actually did the PNG decoder before doing fonts, because the TTF format is so crazy that I always decided to using bitmaps fonts loaded via PNGs instead)
It's super satisfying to build ~300 sources in ~2 seconds from scratch using just MSVC, Xcode or Make, and then launching Wikipedia -- no libraries, and it works :-)
[1] https://www.cl.cam.ac.uk/teaching/2122/Crypto/curve25519.pdf
[2] https://www.youtube.com/watch?v=0me3guauqOU
Let me also list some of the big things that are NOT included:
No Javascript :-) React sites are completely blank, like instagram.com.
No GL/DirectX/Vulkan. It's all software rendered and it just blits a pixel array to screen on every frame. Highly portable though!
Font rendering is antialiased but it's not hinted, and small glyphs at low DPI look start looking blurry.
No Wayland support, only X11 because it's the most widely available. I might do a Wayland port later.
All in one process, one thread per tab. No process isolation (also something to do later)
Only HTTP/1.1 and TLS 1.2, no HTTP2 or later. No IPv6, only IPv4.
No SVG, no <canvas>, no form controls (buttons, etc.), no cookies support (for now...)
The CSS support however is bigger than CSS 2.2: there's var(), --custom-properties, @media queries, etc. and I'm planning to do flex and grid layout too (because Wikipedia uses that a lot).