Say, I have a server running on 192.168.1.1. The box is only accessible through its IP address, so I can't get a public certificate for it and therefore can't enable https.
I cannot access the box from a http site due to the new restriction.
I cannot access the box from a https site due to mixed content.
So I cannot access the box anymore at all?
My understanding is that you can access it directly. But you can't embed e.g. images or JavaScript from that server within a website running on a public IP address. I consider that a good thing.
One of the internal web applications I develop (which is hosted over HTTPS itself) has to workaround this by doing the connection from the browser to the local IP address over HTTPS, but upon detecting HTTPS cert errors it opens a popup and walks the user through the process of adding an exception to connect anyways. Once that popup closes, then the AJAX request gets retried and succeeds.
While this works for an internal application, it would be unacceptable for any consumer product.
This was sort of my point - because with the new rules in place, I cannot make an AJAX call from a HTTP site to an internal address either.
Longer-term, it seems clear that it would be valuable to come up with ways in which we can teach browsers how to trust devices on a local network. Thus far, this hasn't been a heavy area of investment. I can imagine it becoming more important if we're able to ship restrictions like the ones described here, as they do make the capability to authenticate and encrypt communication channels to local devices more important.
If you need passive mixed content, I believe it is and will remain supported by browsers for some time.
If you need active mixed content though you probably will need a workaround via passive content instead.