Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Downloading PuTTY Safely Is Nearly Impossible (2014)

noncombatant.org

Post reply on HN
Print view View original

121–130 of 173 posts

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#121

Post by TheLoneWolfling »

PascLeRasc wrote: post #58

My freshman intro to engineering computing class has ~500 freshman download PuTTY from the non-https site every year. I'll email the instructor this article - is the problem that it could be infected, or is it known to be infected with undesirable software? Quality of PuTTY aside, could someone just host the most common download on an https site?

There are version(s?) floating around that are infected.

Not (normally) on the source site - but there's no guarantee that someone doesn't MITM you and inject something.

Someone could host the download on an https site, and yes, it'd be an improvement, but that just moves who to trust to the site owner (and everyone on the certificate/hosting chain for the site).

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#122

Post by dezgeg »

jimmaswell wrote: post #75
astrodust wrote: post #31

Earlier quoted context omitted.

How about the fact that it's awful? Can you seriously compare PuTTY with even the most lacklustre terminal available on OS X or Linux? It's an atrocity of UX design straight out of the Windows 95 era. Their home page is also the epitome of not caring about user experience even to the slightest degree. Nearly zero effort: http://www.chiark.greenend.org.uk/~sgtatham/putty/ I've seen people construct more impressive pag…

The home page is clearly organized and readable, only having some text and links. What more do you want from a website that only exists to distribute one program? There's a link to the download page right on top. It's more than good enough. Do you need flashy CSS animations and a Konami Code to find a website cool enough for you? There's not a single thing wrong with PuTTY's UX either. The terminal area is just a ter…

IMHO PuTTY's default behaviour of pasting the clipboard's contents on right click is really annoying and unexplainable; neither native Windows apps or Unix xterms work like that. At our university we use IRC (via SSH+Screen+irssi mostly) for communication and every year I see over a dozen of people tripping into that.

Also, the default encoding was changed to UTF-8 only quite recently - IMO that should have been done much earlier.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#123

Post by seanp2k2 »

tptacek wrote: post #61

This is silly, Chris. :) PuTTY is MIT licensed. The primary author of PuTTY is unserious about traceable code, which is a shame, because as your essay implies, PuTTY is one of the motivating cases for traceable code. It's an actual lucrative real-world target for surreptitious replacement. Clearly, the world cannot rely on PuTTY's author to provide a traceable download. Someone else needs to step in and do that. That…

Maybe https://github.com/bliker/cmder could be that alternative? Not sure on the traceability status, but I used to use PuTTY a ton for work, and not because I liked it, just....there was nothing else which worked as well, even though it sucked (no tabs etc).

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#125

Post by belak »

na85 wrote: post #124

Serious question: What's the point of safely downloading any binary to run on your closed-source operating system? None of that code can be verified. Do people actually believe Windows is secure?

Windows is definitely still a closed source operating system, but the code for putty is definitely available on the same page as the downloads. I assume it has the same security concerns, but at least you can look at the code.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#126

Post by drzaiusapelord »

_wldu wrote: post #110
Someone1234 wrote: post #6

None of which would have mattered if Putty.exe was codesigned. Unfortunately it is not. Code signing certificates are insanely expensive. The cheapest one I could find from a CA was $73/year (3 year minimum). I could go on a long rant now about how much CAs are in collusion and how they're making everyone more insecure though their pricing, but that would be redundant as I think "everyone knows that" by now. Let's En…

"None of which would have mattered if Putty.exe was codesigned. Unfortunately it is not." You mean Autenticode on Windows? I once had an Authenticode code signing cert that I used to sign Windows executables. Mostly, I signed hobby projects with it. I wrote a proof of concept keystroke logger for Windows, then Authenticode signed it and made it available along with source code for others to experiment with and review…

Signing verifies identity, nothing more. That keylogger was yours. In this case, signing putty tells us that it comes from the putty maintainer. The content, what it actually does, whether its not malware inside, etc doesn't matter.

Putty should be signed, imo.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#127

Post by zwp »

Animats wrote: post #7
ChuckMcM wrote: post #2

This is really just a rant about how poorly PuTTY is distributed. (and a vague implication that it is malware of some sort). I think it is a valid criticism, and I wish the person who wrote PuTTy (an SSH client for windows) would be more open/available/transparent but it is hard to force that on someone.

This is not just a rant. As of two days ago, there is a hostile version of PuTTY in the wild.[1][2] It's on some mirror sites distributing open source software. It steals login credentials. Right now, it's essential to be able to tell the good one from the bad ones, and it's not easy. [1] http://www.symantec.com/connect/blogs/check-your-sources-tro... [2] http://blogs.cisco.com/security/trojanized-putty-software

> As of two days ago, there is a hostile version of PuTTY

A small correction -- from the symantec blog post:

"this file has been in the wild since late 2013 and it was first seen in Virus Total around the same time. However, we have only seen this sample broadly distributed recently. Distribution in 2013 was minimal, and we saw a gap of a year and a half before it reappeared again."

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#128

Post by brudgers »

The reliance on PuTTY exists because Microsoft does not ship basic SSH capabilities as part of Windows. Similarly Microsoft does not provide read write capability for Linux file systems. In this way Microsoft creates impedence for Linux and other *nix adoption in places running Windows desktops. It's just that little bit extra friction that makes using Linux a bit more of a PITA than it needs to be.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#129

Post by worklogin »

baldfat wrote: post #80
worklogin wrote: post #64

Earlier quoted context omitted.

Moba feels slow sometimes; I don't like its custom UI; I don't understand how it's FOSS /and/ has a pro-only version. Its built-in SSH server is great for moving files to and from my workstation quickly when I need it.

Many FOSS projects have Pro versions (Redhat Linux / Cent OS Linux) Best One Liner about commercial Open Source software : The only kind of profit strategy that is incompatible with Open Source is monopoly-based sales, also known as "royalties". [] http://opensource.org/faq#profit

But Moba isn't selling support. They're giving out crippleware and charging money for a professional version based on the core. How are the modifications that make the pro version not required to be open source?

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#130

Post by jpalomaki »

Someone1234 wrote: post #6

None of which would have mattered if Putty.exe was codesigned. Unfortunately it is not. Code signing certificates are insanely expensive. The cheapest one I could find from a CA was $73/year (3 year minimum). I could go on a long rant now about how much CAs are in collusion and how they're making everyone more insecure though their pricing, but that would be redundant as I think "everyone knows that" by now. Let's En…

With code signing there remains the problem that how do I figure out who to trust. I don't remember the exact details for the author of PuTTY.
Post reply on HN