Why no use Cygwin which includes SSH? (the client maintained by the OpenBSD team, btw, which I'd trust a lot more):
What's so special about putty?
Downloading PuTTY Safely Is Nearly Impossible (2014)
161–170 of 173 posts
Re: Downloading PuTTY Safely Is Nearly Impossible (2014)
#162Earlier quoted context omitted.
A fair point, and I'm actually tempted to do just that. I wonder, though: why on earth would anyone trust code that I have signed? At least the developer has (maybe) built some level of trust. But what's the benefit of signing by some random third party?
Trust is built by things like time and social proof. Whether you're the person who wrote the code doesn't really come into it. Look at how it works on Linux: most people install most software via package managers. Nobody expects the person who wrote the code to be the same as the person who has the knowledge and resources to package stuff for Debian or whatever. The Debian packagers have earned trust over time. You c…
This is fine, but for anyone to be able to actually trust that this person's signed distribution of some piece software is actually safe then you would have to assume that the person has some way of obtaining the source code from a place that they themselves trust. If they don't write the code and have no access to any other signed version this may be difficult.
Re: Downloading PuTTY Safely Is Nearly Impossible (2014)
#163Earlier quoted context omitted.
Trust is built by things like time and social proof. Whether you're the person who wrote the code doesn't really come into it. Look at how it works on Linux: most people install most software via package managers. Nobody expects the person who wrote the code to be the same as the person who has the knowledge and resources to package stuff for Debian or whatever. The Debian packagers have earned trust over time. You c…
This is fine, but for anyone to be able to actually trust that this person's signed distribution of some piece software is actually safe then you would have to assume that the person has some way of obtaining the source code from a place that they themselves trust. If they don't write the code and have no access to any other signed version this may be difficult.
Linux packagers seem to have successfully solved this problem. I imagine it's at least in part because it makes sense for them to put in a bit more effort (e.g. email to the author to make sure they have the right version, if necessary) to save every user having to redo it.
Re: Downloading PuTTY Safely Is Nearly Impossible (2014)
#164None of which would have mattered if Putty.exe was codesigned. Unfortunately it is not. Code signing certificates are insanely expensive. The cheapest one I could find from a CA was $73/year (3 year minimum). I could go on a long rant now about how much CAs are in collusion and how they're making everyone more insecure though their pricing, but that would be redundant as I think "everyone knows that" by now. Let's En…
$73/year is not free but calling it "insanely expensive" is pretty unfair.
There's a non-trivial paperwork requirement too. I'd have no problem paying and getting a cert from the comfort of your chair like you can do with SSL. However for code signing I have to take time out of the day to visit a notary public to verify my identity as part of the process. This is likely also going to cost additional money.
Re: Downloading PuTTY Safely Is Nearly Impossible (2014)
#165The implication that somebody must own a domain and SSL certificate in order to deliver you software for free is just insanely entitled. If you care so much, why don't you pay the author so he can buy all these things?
Re: Downloading PuTTY Safely Is Nearly Impossible (2014)
#166Earlier quoted context omitted.
What causes you to say that putty is pretty awful?
How about the fact that it's awful? Can you seriously compare PuTTY with even the most lacklustre terminal available on OS X or Linux? It's an atrocity of UX design straight out of the Windows 95 era. Their home page is also the epitome of not caring about user experience even to the slightest degree. Nearly zero effort: http://www.chiark.greenend.org.uk/~sgtatham/putty/ I've seen people construct more impressive pag…
>Can you seriously compare PuTTY with even the most lacklustre terminal available on OS X or Linux?
Yes, I can compare. PuTTY is superior than the default xubuntu terminal, whatever it is.
1. I can configure it to connect to specific server automatically, including setting up all required SSH tunnels. On Linux I have to write shell scripts.
2. It allows to automatically set up a SOCKS proxy that sends my traffic through the remote server.
3. Selecting text copies it straight to clipboard. Copying to middle-click buffer is much less convenient, because I often want to replace other selected text with what I selected in terminal.
Re: Downloading PuTTY Safely Is Nearly Impossible (2014)
#167If you are really concerned about security, why would you trust an prebuilt binary of an open source project. The source is available, just grab the source and build it your self. That way you at least know what you have.
I just checked: PuTTY's Windows source code is ~190 files, or ~123145 lines. If you assume you can read a line a second (and you can't), that's more than 34 hours (!).
look at the bright side, it's still a fraction of what you'd get if you were to build your own thing. :)
Re: Downloading PuTTY Safely Is Nearly Impossible (2014)
#168This really just highlights the fact that Windows ships with no tools to establish any kind of verified trust chain. No md5sum, no authenticated package management, no native ssh client. Being concerned about privacy and security and running Windows may be mutually incompatible.
What I do is upload my downloads to VirusTotal. That way I can get assurance it's the same file that's been around for a while. Hopefully if it was Trojaned, someone would have reported it. Certainly won't stop a secretly compromised version, but it's a start.
I do that too, but it's no kind of assurance as any half-competent hacker would test his trojaned versions against various anti-virus software and when it passes all upload it to VirusTotal and similar sites to convince people who rely on such sites. Best thing you can do is to download it from multiple internet connections (via VPN/TOR) and hope that any mitm is closer to your side and not server's side.