Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PuTTY 0.68 has been released

chiark.greenend.org.uk

Post reply on HN
Print view View original

31–40 of 152 posts

Re: PuTTY 0.68 has been released

#31

Post by anderskaseorg »

niftich wrote: post #24
hughes wrote: post #8

It always makes me sad to see that the PuTTY download page is served over unsecure HTTP.

But the downloads themselves aren't -- those are served out of https://the.earth.li/~sgtatham/putty/0.68/ For later reference, here's some sha512sum excerpts for version 0.68: ea03a52d344699c10e66e4f0424fba2b31d13d00ed24e1822c8ebe80fa589ce862419e5e852d6e1cb986637ea4e04d6cbe5ff3f1171ca403c9e55681877a712d w32/putty.zip 71c98de058e3f3fda9558cea955a5da28f41ae45464cafe9ea0b22ecf8cfeb56b1b047fb4b694b0c8e7c230f631dce9dd5bad…

And obviously a network attacker would never think to modify the insecurely served downloads page to point to a different download URL.

Re: PuTTY 0.68 has been released

#32

Post by Viper007Bond »

SebiH wrote: post #27
jimmcslim wrote: post #4

On Windows 10, with Windows Subsystem for Linux installed, I don't find myself using Putty anymore.

Are you using an insider build or a different shell than Windows' cmd? I find myself using Putty to connect to a Linux subsystem ssh server just to get a decent terminal emulator with full colour support!

The latest Insider builds are a lot better, including full color support.

Re: PuTTY 0.68 has been released

#35

Post by vesinisa »

Viper007Bond wrote: post #32
SebiH wrote: post #27

Earlier quoted context omitted.

Are you using an insider build or a different shell than Windows' cmd? I find myself using Putty to connect to a Linux subsystem ssh server just to get a decent terminal emulator with full colour support!

The latest Insider builds are a lot better, including full color support.

It's apparently coming to stable in April: https://news.ycombinator.com/item?id=13695267

Re: PuTTY 0.68 has been released

#36

Post by niftich »

anderskaseorg wrote: post #31
niftich wrote: post #24

Earlier quoted context omitted.

But the downloads themselves aren't -- those are served out of https://the.earth.li/~sgtatham/putty/0.68/ For later reference, here's some sha512sum excerpts for version 0.68: ea03a52d344699c10e66e4f0424fba2b31d13d00ed24e1822c8ebe80fa589ce862419e5e852d6e1cb986637ea4e04d6cbe5ff3f1171ca403c9e55681877a712d w32/putty.zip 71c98de058e3f3fda9558cea955a5da28f41ae45464cafe9ea0b22ecf8cfeb56b1b047fb4b694b0c8e7c230f631dce9dd5bad…

And obviously a network attacker would never think to modify the insecurely served downloads page to point to a different download URL.

This is a possibility. But downloads have been served out of "the.earth.li/~sgtatham/putty/" for years. Yes, it's owned by someone else and exploding turtles all the way down [1], but now that "the.earth.li/~sgtatham/putty/" is HTTPS, the checksums are properly authentic as attested by the same operator as the one who has supplied PuTTY downloads for years.

I've mirrored the most important checksums here, another HTTPS site, so that if any of them ever differ you know to distrust the files.

[1] https://news.ycombinator.com/item?id=7334269

Re: PuTTY 0.68 has been released

#39

Post by Godel_unicode »

anderskaseorg wrote: post #30
r1ch wrote: post #18

Earlier quoted context omitted.

At least the binaries are authenticode signed now, so checking they are legit is just a right click away.

How is that supposed to help? Even if the legitimate binaries are Authenticode-signed now, a malicious non-Authenticode-signed binary substituted by an attacker MITMing the insecure HTTP connection will appear to the downloader to look just like the legitimate non-Authenticode-signed binaries of previous versions that they’ve been downloading for years.

Because you can add the signing cert to your AppLocker whitelist, and now it will be checked every time it runs. Then you push that out by GPO, and now everyone has that same whitelist protection.

Also, as mentioned other places on the thread, the downloads are over HTTPS.

Edit: see the following https://technet.microsoft.com/en-us/library/dd723683(v=ws.10...

Re: PuTTY 0.68 has been released

#40

Post by sengork »

I wish they would finally implement file transfers via copy/paste mechanism inside an active terminal window. As far as I know this feature would be unique across platforms.

If someone does know of an SSH terminal client that does this, please reply.

Post reply on HN