Live data from Hacker News

Putty maintainer on his attitude towards security and open source

andrewducker.dreamwidth.org

71–80 of 140 posts

Re: Putty maintainer on his attitude towards security and open source

#71

Earlier quoted context omitted.

For me putty is still preferred way to ssh with Windows. Nowadays windows is shipping openssh.exe, so I can run it from cmd and it kinda works for quick simple actions, but clipboard works weirdly, basically I have to use right-click/paste to reliably paste data, shift+insert works in some apps and does not work in others. Putty just works like it worked 10 years ago, it's good old reliable tool.

Anybody have a solution to get hostname completion in Powershell? ssh [letter][tab] gets me a list with my Zsh config. I looked briefly one time and couldn't find what I was looking for. I have a fairly large SSH config file, and needing to open it to copy and paste hostnames from the file is the main reason I just use WSL.

https://gist.github.com/backerman/2c91d31d7a805460f93fe10bdf...

Re: Putty maintainer on his attitude towards security and open source

#72
post #23

I also find the opposite true--reminding colleagues that using OSS means we have to own and maintain the software whether the original community/author does or not. There seems to be a hesitance to fork abandoned or slow moving software to update/fix issues

"reminding colleagues that using OSS means we have to own and maintain the software whether the original community/author does or not" No, we do not have to do this. We wouldn't get anything done, if we tried to maintain our full oss stack. Where would you start? In the linux kernel and move your way up to chromium/firefox? Have fun out there. "There seems to be a hesitance to fork abandoned or slow moving software t…

It's much simpler: if you run into a missing bug/feature, report it to the maintainers and ask them to assign it to you.

If each individual licensee is itching their own scratches, then there's a really good chance the entire codebase gets love.

Absolutist approaches are the death of all good things. "Some" is better than "none."

Re: Putty maintainer on his attitude towards security and open source

#73
I am very happy that there are such great dudes. Respect! I don't even use putty (but its fork, kitty).

People forget one simple fact - WHEN YOU ARE PAYED, U ARE NO LONGER FREE.

There is no substitute for passion work, where YOU are the man, and there is 0 chance somebody will influence you.

Re: Putty maintainer on his attitude towards security and open source

#74
Someone I know met Simon one day and thought I’d like his autograph, since I was working in security at the time. I had in fact introduced that team to PuTTY, though this friend didn’t know that.

So I own a postcard that says words to the effect, “nobody has ever asked me for an autograph before”. It is framed.

Re: Putty maintainer on his attitude towards security and open source

#75
post #32

Earlier quoted context omitted.

Gee, thanks :D. I didn't know that at all and the article has no hints about that. I came to that possibility but it was reaaaally out of context and off without prior knowledge. Thanks for confirming it, I really didn't understand what was what. edit: I took a look at the page again and there are no links or mentions of puzzles or something, I knew I wasn't crazy (or that dense) !

The hint is clearly in the sentence you're confused about -- that he has also created some puzzle games is the only plausible explanation.

FWIW, the first explanation I thought of was something like "he replied to people asking for help that he was busy doing some (jigsaw) puzzles and wouldn't answer for now, thus wasting people's time by playing with his puzzles rather than answering". edit: and by puzzle I meant that kind: https://en.wikipedia.org/wiki/Jigsaw_puzzle. Puzzle in my mother tongue is the word used for jigsaw puzzles. Other puzzles are called "brain teasers".

Re: Putty maintainer on his attitude towards security and open source

#76
post #5

Great footnote from the article: > I'm often amused that people compliment me on things like PuTTY by telling me how much of their time it saved, whereas people compliment me on my puzzle game collection by telling me how much of their time it wasted.

If dealing with SSH tooling is itself a kind of puzzle, then I suppose the overall effect is that while people are still spending time solving puzzles, he made the puzzles more enjoyable.

Re: Putty maintainer on his attitude towards security and open source

#77

I thought this was such a fantastic response, particularly the sections where he talks about how he responds to companies demanding he reply as if he has a contract with them. The main point being that, with the log4j issue (and others before that), the thing that's struck me when maintainers complain about not being appreciated or that they are working as hard as they can, unpaid, is that maintainers are under no ob…

You can’t control others emotions. But setting healthy expectations goes a long way.

One of my takeaways from the log4j issue is that the log4j devs should have never accepted the patches to add LDAP urls in the first place. Or perhaps, they should have removed that feature when it became burdensome. I would have. There’s a pressure to accept whatever patches come your way as an opensource developer, but actually, you’re under no obligation to do any such thing. Open source also means the source is available - so people are free to take your code, mix in their patches and maintain it themselves. And if they can’t be bothered doing that, why should I shoulder that burden?

I think us opensource devs should get more comfortable saying no. “I hear that this feature is important to you but it doesn’t solve a problem I (or anyone else I know) cares about. Please maintain those patches in your own fork.”

Re: Putty maintainer on his attitude towards security and open source

#78
This is a nice post from a healthy person who is comfortable with his position, and isn’t overburdened.

However, what would happen if that were not so?

What would happen if he Could not, Would not, or were Unable to work?

It would all fall apart. And that is the inherent fragility in these small critical opensource projects.

Re: Putty maintainer on his attitude towards security and open source

#80
post #77

I thought this was such a fantastic response, particularly the sections where he talks about how he responds to companies demanding he reply as if he has a contract with them. The main point being that, with the log4j issue (and others before that), the thing that's struck me when maintainers complain about not being appreciated or that they are working as hard as they can, unpaid, is that maintainers are under no ob…

You can’t control others emotions. But setting healthy expectations goes a long way. One of my takeaways from the log4j issue is that the log4j devs should have never accepted the patches to add LDAP urls in the first place. Or perhaps, they should have removed that feature when it became burdensome. I would have. There’s a pressure to accept whatever patches come your way as an opensource developer, but actually, yo…

Another alternative is to build a stable plug-in API rather than handling such requests in the core product. That way users with particular needs can code their own plug-ins rather than forking the entire code base. Now obviously open source maintainers have no obligation to do that, but purely from an engineering perspective it's an approach worth considering.
Post reply on HN