PuTTY 0.68 has been released • Hacker News Board

Re: PuTTY 0.68 has been released

#21

Post by marvy » Tue, Feb 21, 2017, 11:06 PM UTC

antidaily wrote: post #10

Pfft... not touching it until they get to a version 1.0 beta.

This thing's been stable for over a decade :)

Re: PuTTY 0.68 has been released

#22

Post by Cogito » Tue, Feb 21, 2017, 11:09 PM UTC

0x0 wrote: post #11

Cogito wrote: post #7

Earlier quoted context omitted.

Thank so much for posting this. Perchance, could you remove the quote formatting as it makes it nearly impossible to read on mobile?

Or visit the source: http://www.chiark.greenend.org.uk/~sgtatham/putty/changes.ht...

Thanks, this is probably a better landing page for HN than the linked release page!

I had a quick hunt for it but couldn't see it on the release page.

Re: PuTTY 0.68 has been released

#23

Post by Cogito » Tue, Feb 21, 2017, 11:11 PM UTC

Cyphase wrote: post #12

Cogito wrote: post #7

Earlier quoted context omitted.

Thank so much for posting this. Perchance, could you remove the quote formatting as it makes it nearly impossible to read on mobile?

Security fix: an integer overflow bug in the agent forwarding code. See vuln-agent-fwd-overflow. Security fix: the Windows PuTTY binaries should no longer be vulnerable to hijacking by specially named DLLs in the same directory (on versions of Windows where they previously were). See vuln-indirect-dll-hijack. Windows PuTTY no longer sets a restrictive process ACL by default, because this turned out to inconvenience t…

Cheers. A couple of nice features here, might even start using the 64 bit version though I doubt it will have much impact.

Re: PuTTY 0.68 has been released

#24

Post by niftich » Tue, Feb 21, 2017, 11:13 PM UTC

hughes wrote: post #8

It always makes me sad to see that the PuTTY download page is served over unsecure HTTP.

But the downloads themselves aren't -- those are served out of https://the.earth.li/~sgtatham/putty/0.68/

For later reference, here's some sha512sum excerpts for version 0.68:

ea03a52d344699c10e66e4f0424fba2b31d13d00ed24e1822c8ebe80fa589ce862419e5e852d6e1cb986637ea4e04d6cbe5ff3f1171ca403c9e55681877a712d w32/putty.zip

71c98de058e3f3fda9558cea955a5da28f41ae45464cafe9ea0b22ecf8cfeb56b1b047fb4b694b0c8e7c230f631dce9dd5bad26d70240b07b64ba27c3500d1fb w32/putty.exe

2b6b1acc51fc9cfe8a08e17afc4ac7d962af4575d55806456aa1a42c563f14457cc81d7e625191fd856b4be9a0e885cef78da4018d542010eba18718bb73fecd w32/putty-0.68-installer.msi

debceaa83bb48e7adcc99d03bf152f599477bf960da8c7ea3924925ac5322a9470c4254285d6ff403ad5da78c4c19c25ea5b0c1da45c61d9f0b306b16d0d28f7 w64/putty.zip

29d47c1f5a51e9d59720ccea8eacc317f4b8b839c71f957db713e62d2a9526502fefc01855be97e9e8020d1f343a6a14346a21f4843c12d93ee038a8f9810966 w64/putty.exe

8262c133e3569dcc188e5ac2360ebd3cc09d9edd2f78d6eaaf0e2762fba511de07ce614ba4fedf5f62fe64dd17d5a626dc63a579ee1fc1ef90f45e9e1f0c3d06 w64/putty-64bit-0.68-installer.msi

aacd9ec017e3cf56924d75d69f1610512662630c699ee09b4d9012f4e34e608b5b335444cf2529bcfe9c4edbded1c7247338d859385108544b27eeeb74d505c6 putty-src.zip

Re: PuTTY 0.68 has been released

#25

Post by verbify » Tue, Feb 21, 2017, 11:17 PM UTC

gcp wrote: post #3

Putty used to be the go-to tool for Windows SSH, but nowadays I'm using Bitvise SSH client. It's worth a try.

Odd, I moved into the opposite direction. But now I'm using git bash.

Re: PuTTY 0.68 has been released

#26

Post by epalm » Tue, Feb 21, 2017, 11:18 PM UTC

hughes wrote: post #8

It always makes me sad to see that the PuTTY download page is served over unsecure HTTP.

At this point it's totally inexcusable. Just buy the SSL cert already, or get a free one from Let's Encrypt.

Re: PuTTY 0.68 has been released

#27

Post by SebiH » Tue, Feb 21, 2017, 11:18 PM UTC

jimmcslim wrote: post #4

On Windows 10, with Windows Subsystem for Linux installed, I don't find myself using Putty anymore.

Are you using an insider build or a different shell than Windows' cmd? I find myself using Putty to connect to a Linux subsystem ssh server just to get a decent terminal emulator with full colour support!

Re: PuTTY 0.68 has been released

#28

Post by Aloha » Tue, Feb 21, 2017, 11:18 PM UTC

jimmcslim wrote: post #4

On Windows 10, with Windows Subsystem for Linux installed, I don't find myself using Putty anymore.

I'd love to try it, but I'm not in an environment where the build of windows I'm using is new enough yet.

Re: PuTTY 0.68 has been released

#29

Post by MrRadar » Tue, Feb 21, 2017, 11:21 PM UTC

based2 wrote: post #2

Release Notes: Security fix: an integer overflow bug in the agent forwarding code. See vuln-agent-fwd-overflow. Security fix: the Windows PuTTY binaries should no longer be vulnerable to hijacking by specially named DLLs in the same directory (on versions of Windows where they previously were). See vuln-indirect-dll-hijack. Windows PuTTY no longer sets a restrictive process ACL by default, because this turned out to…

This release also adds support for the ChaCha20 AEAD cipher and encrypt-then-MAC modes for non-AEAD ciphers. Not sure why those aren't included in the release notes.

Re: PuTTY 0.68 has been released

#30

Post by anderskaseorg » Tue, Feb 21, 2017, 11:21 PM UTC

r1ch wrote: post #18

hughes wrote: post #8

It always makes me sad to see that the PuTTY download page is served over unsecure HTTP.

At least the binaries are authenticode signed now, so checking they are legit is just a right click away.

How is that supposed to help? Even if the legitimate binaries are Authenticode-signed now, a malicious non-Authenticode-signed binary substituted by an attacker MITMing the insecure HTTP connection will appear to the downloader to look just like the legitimate non-Authenticode-signed binaries of previous versions that they’ve been downloading for years.