Live data from Hacker News

PuTTY 0.64 released, fixing a security hole

chiark.greenend.org.uk

11–20 of 43 posts

Re: PuTTY 0.64 released, fixing a security hole

#11

Another security hole of PuTTY is downloads being served over non-SSL. I should know better and check the sigs using PGP and checksums, but on Windows this is such a drag that I just end up whispering hallelujah praise the Lord, and hoping for the best. I know it's my fault, but I'd still like SSL :(

> I should know better and check the sigs using PGP and checksums Kind of pointless. If the download has been compromised so have the checksums

Not if they have been signed with PGP.

Re: PuTTY 0.64 released, fixing a security hole

#12
post #9

Another security hole of PuTTY is downloads being served over non-SSL. I should know better and check the sigs using PGP and checksums, but on Windows this is such a drag that I just end up whispering hallelujah praise the Lord, and hoping for the best. I know it's my fault, but I'd still like SSL :(

> but on Windows this is such a drag that Get the keybase.io client, it sets up your GPG pretty nicely. I was able to confirm the downloads on Windows using the standard ``gpg --verify putty.DSA.asc`` and it just worked(tm) in a cmd.exe window. Using the keybase client does not, however, as the signing key for the putty binaries is not on keybase. Not saying anything about how much sense it makes to verify the downlo…

Thank you for the howto, I'll give this a try next time. Looks much more approachable than I feared.

Re: PuTTY 0.64 released, fixing a security hole

#14

Earlier quoted context omitted.

> I should know better and check the sigs using PGP and checksums Kind of pointless. If the download has been compromised so have the checksums

Not if they have been signed with PGP.

I have to ask: how are the PGP keys verified?

Re: PuTTY 0.64 released, fixing a security hole

#16
post #3

I used to be a huge PuTTY (or derative) user, but recently, I've switched to just using the normal OpenSSH command-line client within Cygwin and ConEmu. While PuTTY is nice, it lacks some features, like proxycommands and stuff which are standard in ~/.ssh/config. Things which can be taken along in a simple & portable fashion. No disrespect to PuTTY, but I just found myself not really needing it anymore.

You can get SSH natively in the DOS command prompt by installing http://www.mls-software.com/opensshd.html

I found it very useful for connecting to vagrant boxes.

Re: PuTTY 0.64 released, fixing a security hole

#17
post #3

I used to be a huge PuTTY (or derative) user, but recently, I've switched to just using the normal OpenSSH command-line client within Cygwin and ConEmu. While PuTTY is nice, it lacks some features, like proxycommands and stuff which are standard in ~/.ssh/config. Things which can be taken along in a simple & portable fashion. No disrespect to PuTTY, but I just found myself not really needing it anymore.

[deleted]

Re: PuTTY 0.64 released, fixing a security hole

#18
post #16
post #3

I used to be a huge PuTTY (or derative) user, but recently, I've switched to just using the normal OpenSSH command-line client within Cygwin and ConEmu. While PuTTY is nice, it lacks some features, like proxycommands and stuff which are standard in ~/.ssh/config. Things which can be taken along in a simple & portable fashion. No disrespect to PuTTY, but I just found myself not really needing it anymore.

You can get SSH natively in the DOS command prompt by installing http://www.mls-software.com/opensshd.html I found it very useful for connecting to vagrant boxes.

This bundles a version of cygwin.

Re: PuTTY 0.64 released, fixing a security hole

#20
post #3

I used to be a huge PuTTY (or derative) user, but recently, I've switched to just using the normal OpenSSH command-line client within Cygwin and ConEmu. While PuTTY is nice, it lacks some features, like proxycommands and stuff which are standard in ~/.ssh/config. Things which can be taken along in a simple & portable fashion. No disrespect to PuTTY, but I just found myself not really needing it anymore.

I prefer XShell5.

http://www.netsarang.com/products/xsh_overview.html

Post reply on HN