Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Putty maintainer on his attitude towards security and open source

andrewducker.dreamwidth.org

Post reply on HN
Print view View original

131–140 of 140 posts

Re: Putty maintainer on his attitude towards security and open source

#131

Post by johnchristopher »

xapata wrote: post #34
johnchristopher wrote: post #25

Earlier quoted context omitted.

Gee, thanks :D. I didn't know that at all and the article has no hints about that. I came to that possibility but it was reaaaally out of context and off without prior knowledge. Thanks for confirming it, I really didn't understand what was what. edit: I took a look at the page again and there are no links or mentions of puzzles or something, I knew I wasn't crazy (or that dense) !

It was implied. You don't need prior knowledge to deduce it, except the knowledge to ask the questions you wrote in your other comments.

Are you implying I am stupid ? /s

Re: Putty maintainer on his attitude towards security and open source

#132

Post by Brian_K_White »

yjftsjthsd-h wrote: post #86
laumars wrote: post #27

I once used PuTTY as the base for an internal SSH tool. We needed to provide data entry teams with access to a green screen but didn’t want to expose any more servers than what they were authorised to use and a simple interface because a lot of the data entry guys were technologically illiterate. After spending hours looking for solutions that were purpose built for this kind of thing I gave up took PuTTYs source and…

> And being a nix guy I don’t get much need for PuTTY in my day to day. It actually works on unix, which is usually uninteresting but I used it once when I needed a serial console client and wanted a friendly GUI. So it can* be useful:)

I just use screen for that now. Not even minicom any more.

Re: Putty maintainer on his attitude towards security and open source

#133

Post by raxxorrax »

josephg wrote: post #77
hn_throwaway_99 wrote: post #16

I thought this was such a fantastic response, particularly the sections where he talks about how he responds to companies demanding he reply as if he has a contract with them. The main point being that, with the log4j issue (and others before that), the thing that's struck me when maintainers complain about not being appreciated or that they are working as hard as they can, unpaid, is that maintainers are under no ob…

You can’t control others emotions. But setting healthy expectations goes a long way. One of my takeaways from the log4j issue is that the log4j devs should have never accepted the patches to add LDAP urls in the first place. Or perhaps, they should have removed that feature when it became burdensome. I would have. There’s a pressure to accept whatever patches come your way as an opensource developer, but actually, yo…

Reminds me of Signal and Apple M1 support issue. People expect you to accept the PR. As if that wouldn't mean more work for the maintainer in any case.

Re: Putty maintainer on his attitude towards security and open source

#135

Post by tylervigen »

hinkley wrote: post #74

Someone I know met Simon one day and thought I’d like his autograph, since I was working in security at the time. I had in fact introduced that team to PuTTY, though this friend didn’t know that. So I own a postcard that says words to the effect, “nobody has ever asked me for an autograph before”. It is framed.

This is a delightful story. Thank you for sharing.

Re: Putty maintainer on his attitude towards security and open source

#136

Post by petee »

petee wrote: post #90
codetrotter wrote: post #83

Earlier quoted context omitted.

That’s fine but why not just stick with open source PuTTY instead of switching to some commercial proprietary software.

Mobaxterm comes with a few extra goodies, like having a local xserver to run remote programs locally on windows, and it works out of the box. It also supports VNC, mosh, and others, so its a handy all in one. I purchased once to support, and i flip between putty amd moba for no reason.

correction/clarification: run UI locally (xwindows) not execute.

Re: Putty maintainer on his attitude towards security and open source

#137

Post by CRConrad »

From one of Simon Tatham's replies on the blog:

> In fact, the most recent commercial fork caused us to get a worried email or two – the company's publicity made at least some users worry that the PuTTY team might have been subjected to one of those "buyout and radical change of project direction" scenarios I mention above, and they weren't happy about the idea. [Emphases added -- CRC]

So there is a "team" besides mr Tatham. That's good to hear; I always thought it was just he himself.

Re: Putty maintainer on his attitude towards security and open source

#138

Post by collaborative »

exikyut wrote: post #109
collaborative wrote: post #68

Earlier quoted context omitted.

A similar thing happened to me. But instead of tweaking PuTTy I tweaked Poderosa v4 which also has a permissive license

Had* There was some sort of v4 -> v5 open-source -> commercial switch. Commercial version: http://www.poderosa-terminal.com/ OSS version homepage: http://poderosa.sourceforge.net/ Source (last change in 2019): https://github.com/poderosaproject/poderosa Releases (last release also 2019): https://sourceforge.net/projects/poderosa/files/releases/4.4... (also on GitHub too, switch to the "tags" tab) Seems to be .NET bas…

Thx

Re: Putty maintainer on his attitude towards security and open source

#139

Post by CRConrad »

ralph84 wrote: post #35
yjftsjthsd-h wrote: post #4

How nice it is to see somebody who actually read the license they released their code under and accepts the results:)

Indeed. Though I wonder how many of the “big tech profits from open source and doesn’t pay the maintainers” complaints are from actual maintainers vs. observers with a general axe to grind against big tech.

Sure, at least some of it is from observers: I am one of them. But... Are there any rules against that? If something's true, then is it any more or less true depending on who you are or what you do?

Re: Putty maintainer on his attitude towards security and open source

#140

Post by nijave »

hutzlibu wrote: post #66
nijave wrote: post #23

I also find the opposite true--reminding colleagues that using OSS means we have to own and maintain the software whether the original community/author does or not. There seems to be a hesitance to fork abandoned or slow moving software to update/fix issues

"reminding colleagues that using OSS means we have to own and maintain the software whether the original community/author does or not" No, we do not have to do this. We wouldn't get anything done, if we tried to maintain our full oss stack. Where would you start? In the linux kernel and move your way up to chromium/firefox? Have fun out there. "There seems to be a hesitance to fork abandoned or slow moving software t…

>No, we do not have to do this. We wouldn't get anything done, if we tried to maintain our full oss stack. Where would you start? In the linux kernel and move your way up to chromium/firefox? Have fun out there.

People (sysadmins) have been doing this for years--it's nothing new. Software doesn't break that often. You generally start with wherever you're hitting the bug. Maintaining, running, and operating software is significantly different than writing from scratch (and generally less labor intensive)

What do you do when you hit a bug in production caused by some OSS? Throw your hands up and tell management you opened an issue on the issue tracker?

Post reply on HN