Earlier quoted context omitted.
The first time I ever saw it, the text already looked better than cmd.exe via conhost.
https://imgur.com/a/qA1fr71 Something wrong with my eyes? Doesn't cmd.exe look smoother in this screenshot?
cmd looks pixelated.
PuTTY has a new website
141–150 of 304 posts
Re: PuTTY has a new website
#142Earlier quoted context omitted.
How would the average person know that?
Average person aware of trust on social network / internet - because https://hachyderm.io/@simontatham has a validated link to the author's homepage. Others - they don't understand the trust anyway, so there prerequisite steps missing before the main question anyway.
It was bad enough that we had to tell developers to trust some rando website to download a tool that we'd use to potentially plug in sensitive production usernames + credentials.
A link that looks like this:
https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.ht...
And now they've gone and made it worse by posting some new site and confirming the new link is real on their weird "hachyderm" social media post thing. Yeah, talk about a grey-beard get-off-my-lawn developer screaming at the wind and wanting to make it worse for themselves and their "brand".
Re: PuTTY has a new website
#143Ever since Windows gained Terminal and OpenSSH, my usage of Putty has almost entirely ceased except for serial for embedded systems work. Then I realised Putty ships with a CLI version which I now use in Terminal for accessing serial.
I don't trust Windows with my SSH keys. Since about 2 years, I am actively preparing my final migration to Linux. There's some Windows software left that I need to replace before this move is possible, but I am close.
If Windows were to steal your SSH keys (lol), would you really think using a third-party program would protect you? The evil code could just read the key you configured in PuTTY.
Re: PuTTY has a new website
#144Earlier quoted context omitted.
Unfortunately the person who owns putty.org started to use it to spread misinformation about vaccines and the pandemic, as you can see on the site today. This recently [1][2] got a lot of attention on the web and here on HN, along with a post on Mastodon from the author [3] I imagine trying to disincentivize this and provide another shorter more official looking link is the hope here. [1] https://www.theregister.com/…
This seems similar to the Notepad++ team using their platform to promote political viewpoints. The same thing happened with Facebook "pages", when they became a personal "soap box" by the owner of the page. It was downhill from there... You might as well turn the whole web into FB/Twitter/X/Insta promotional spam at that point.
It's one thing to say "stand with Ukraine", and an entirely different thing to spread vaccine misinformation...
Re: PuTTY has a new website
#145Earlier quoted context omitted.
Unfortunately the person who owns putty.org started to use it to spread misinformation about vaccines and the pandemic, as you can see on the site today. This recently [1][2] got a lot of attention on the web and here on HN, along with a post on Mastodon from the author [3] I imagine trying to disincentivize this and provide another shorter more official looking link is the hope here. [1] https://www.theregister.com/…
This seems similar to the Notepad++ team using their platform to promote political viewpoints. The same thing happened with Facebook "pages", when they became a personal "soap box" by the owner of the page. It was downhill from there... You might as well turn the whole web into FB/Twitter/X/Insta promotional spam at that point.
It's not at all similar, and that doesn't have anything to do with the quality or lack thereof of the viewpoints.
The Notepad++ site is run by the authors and reflects their stance. Putty.org is run by an outside party who hijacks the reputation of the PuTTY project to push their agenda.
Re: PuTTY has a new website
#146From the PuTTY FAQ: https://www.chiark.greenend.org.uk/~sgtatham/putty/faq.html#... Would you like me to register you a nicer domain name? No, thank you. Even if you can find one (most of them seem to have been registered already, by people who didn't ask whether we actually wanted it before they applied), we're happy with the PuTTY web site being exactly where it is. It's not hard to find (just type ‘putty’ into goo…
Unfortunately the person who owns putty.org started to use it to spread misinformation about vaccines and the pandemic, as you can see on the site today. This recently [1][2] got a lot of attention on the web and here on HN, along with a post on Mastodon from the author [3] I imagine trying to disincentivize this and provide another shorter more official looking link is the hope here. [1] https://www.theregister.com/…
[flagged]
Re: PuTTY has a new website
#147Not sure what all the negative comments are trying to accomplish. It's a perfect and simple little landing page. Simon has finally done what everyone has been asking for, so why are some people still complaining and harping about "trust" ? Get a grip.
[flagged]
It is. The very first news item on the original page mentions it. It's plain as 1993.
Re: PuTTY has a new website
#148Earlier quoted context omitted.
Nobody claimed it validates the identity in any way. It validates that the person at the other website confirms it's their social account and the social account matches the other direction. The real identity is not involved here in any way and never was. You're disagreeing with someone nobody here raises. But the link validation confirms that if you believed that the original download site belongs to the author, then…
Yes, your caveat at the end there is exactly why this method shouldn't be trusted, as it's indistinguishable from an attacker with access to embed a single link. So it doesn't confirm the account belongs to the author, it confirms the site has a specific link and nothing more.
A regular link won't do, since it requires the rel="me" attribute, which is intended for this purpose: https://developer.mozilla.org/en-US/docs/Web/HTML/Reference/...
Adding a tag or creating a page with certain content are already used even for more impactful verification, like getting issued a certificate for that domain.
If an attacker does have broad access to edit the HTML of your website, I feel that's already the issue and Mastodon verifying that "this person controls this website" isn't even really wrong.
Re: PuTTY has a new website
#149Hi that sad. I remember years ago sitting with a colleague and we had to download putty. Then we found the usual page. There is always the concern if it is legit or a fake site with malware. But I remember my colleague saying "it has to be genuine, only a computer scientist could make such a primitive web site"
Re: PuTTY has a new website
#150Ever since Windows gained Terminal and OpenSSH, my usage of Putty has almost entirely ceased except for serial for embedded systems work. Then I realised Putty ships with a CLI version which I now use in Terminal for accessing serial.
I don't trust Windows with my SSH keys. Since about 2 years, I am actively preparing my final migration to Linux. There's some Windows software left that I need to replace before this move is possible, but I am close.
I agree with you and just wanted to add that for what it's worth one can optionally limit where ssh keys are useful by adding network restrictions on the public key / server side. e.g.
grep AuthorizedKeysFile /etc/ssh/sshd_config
AuthorizedKeysFile /etc/ssh/keys/%u
cat /etc/ssh/keys/bender
from="[192.redacted]/24,[redacted]/20" ssh-ed25519 AAAAC[snip...] comment
Example use case would be that lets say a contractor from Microsoft tries one of your keys. Your restriction limits the key validity to 24.0.0.0/8 and they are coming from 207.0.0.0/8. They will be denied Authentication refused and you now have log entries that can be shared with their fraud department, the world, whomever. Obviously the tighter the restrictions the better, at the risk of requiring a static IPv4 or IPv6 address if too tight. One can always have lighter restrictions on a fall-back account that requires additional hoops to sudo / doas / su.