One of the first FlameNet services I wanted back was AIM. Not a clone, the real thing: fire up a 20-year-old client, sign in, and your buddy list comes to life.

How AIM worked

Classic clients speak the OSCAR protocol to a login authorizer and then a BOS (Basic Oscar Service) server for the buddy list, messaging, and presence.

The wire format is two layers deep and quite tidy once you see it. The outer layer is FLAP: a six-byte header of a marker byte, a channel number, a sequence number and a payload length. Channel 1 is the connection handshake, channel 2 carries everything interesting, channel 4 is the disconnect. Inside a channel 2 frame sits a SNAC, which is the actual request or event, addressed by a family and a subtype. Family 0x0001 is generic housekeeping, 0x0002 is user info, 0x0004 is ICBM which is how instant messages travel, and 0x0013 is the server-stored buddy list that let your contacts follow you between machines.

The sign-in is a two-hop dance, and this is the part that makes reimplementation feasible. The client connects to the authorizer, proves who it is, and gets back two things: the address of a BOS server and an opaque authentication cookie. It then disconnects, connects to that BOS address, and presents the cookie in a channel 1 frame. Recreate both halves and a vintage client cannot tell the difference, because from its point of view nothing unusual happened.

The revival

The community has done remarkable work reimplementing OSCAR servers. I run one containerized on FlameNet, point the old client's server setting at it, and that's it, sign-on sound and all. The trick is mostly client config: older AIM builds let you override the login server, which is the hook you need. It is under the connection settings, and the port you want is 5190.

One thing to be clear-eyed about: there is no transport security here. OSCAR from this era is plaintext on the wire, and the older authentication schemes obscure the password with a fixed lookup table rather than encrypting anything. That is not a flaw in the reimplementation, it is what the protocol was. So the service sits behind the same segmentation as the rest of the retro lab, and the advice is the obvious one: use a throwaway password.

Why it matters

There's something uniquely satisfying about dead infrastructure breathing again. These protocols were elegant, and the elegance is legible once you read the frames. Running them today is a small act of digital preservation.

Grab a client, point it at FlameNet, and say hi.