Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Downloading PuTTY Safely Is Nearly Impossible (2014)

noncombatant.org

Post reply on HN
Print view View original

141–150 of 173 posts

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#141

Post by Aloha »

astrodust wrote: post #135
Aloha wrote: post #97

Earlier quoted context omitted.

It's a well designed win32 application, designed to the portable as far as windows applications go. I just don't get the hate on PuTTY.

It's a functional application. It's not well designed. It's not "portable". The hate is because it is so mediocre it's insulting to anyone who uses Windows and has to suffer through it. If you prefer it, that's fine, but some people expect a bit more from their tools than merely being "functional" no matter how ugly.

It runs on various unixes (without wine), it ran on win32 Alpha (another meaning of the word portable) - I'll give you ugly, but its fully functioned, and arguably much easier to use than the command line openssh-client.

Well designed can refer to more than just the interface. It meets historical windows human interface guidelines too.

I'd also suggest that its an open source project, and could be forked, with a new UI wrapped around the existing pretty good terminal emulation.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#142

Post by Symbiote »

joshstrange wrote: post #94
pdabbadabba wrote: post #50

Earlier quoted context omitted.

I suspect that if the Putty dev created a Patreon for code signing, and posted it on HN and Reddit, he'd almost immediately have that $73/yr covered for the foreseeable future.

No doubt but we all need to remember that sometimes accepting money is more trouble than it's worth. I know that sounds crazy but people taking donations have to declare that on their taxes and some people don't want to deal with that. Also while crowdfunding platforms have gotten really easy they still take effort and sometimes some sort of verification process. It's obvious the putty dev is not a designer (I don't…

I think cash gifts are tax-free in the UK, with the possible exception of large sums given shortly before someone dies (which would become subject to inheritance tax).

The FAQ gives an address for Paypal donations / beer money: http://www.chiark.greenend.org.uk/~sgtatham/putty/faq.html#f...

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#143

Post by Aloha »

ptaffs wrote: post #137
Aloha wrote: post #97

Earlier quoted context omitted.

It's a well designed win32 application, designed to the portable as far as windows applications go. I just don't get the hate on PuTTY.

I support the love. PuTTY serves well as an SSH client, many complaints here are about other issues like security, https, trusting binaries, GUIs, and really it's not fair to Simon and team who kindly released the program for us all to use. Nowadays I only use it when I'm unfortunate enough to need to do work on a Windows machine. Thanks guys for releasing this free software.

Agreed.

I don't see the rush of elephants to fork it, or write a replacement either, just a bunch of passive complaining.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#144

Post by Symbiote »

Kluny wrote: post #60
pdabbadabba wrote: post #50

Earlier quoted context omitted.

I suspect that if the Putty dev created a Patreon for code signing, and posted it on HN and Reddit, he'd almost immediately have that $73/yr covered for the foreseeable future.

And then some - I don't see a donate link anywhere on putty.org or the linked sites, but who wouldn't donate 5 bucks to putty, when they use it for free basically every day? I've paid 5 bucks for less useful programs.

I remember reading the statement about beer and curry some years ago, so I knew there was a link somewhere: http://www.chiark.greenend.org.uk/~sgtatham/putty/faq.html#f...

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#145

Post by jaredsohn »

astrodust wrote: post #135
Aloha wrote: post #97

Earlier quoted context omitted.

It's a well designed win32 application, designed to the portable as far as windows applications go. I just don't get the hate on PuTTY.

It's a functional application. It's not well designed. It's not "portable". The hate is because it is so mediocre it's insulting to anyone who uses Windows and has to suffer through it. If you prefer it, that's fine, but some people expect a bit more from their tools than merely being "functional" no matter how ugly.

I am pretty sure that putty is portable.

I think portable here is referring to being able to run software from a USB drive without running an installer or just being able to download a file into a temporary folder and removing trace of it by deleting the folder when done. I feel a lot of the initial love for putty was the fact that it was portable (and it also helped back in the day that the download was so small, too.)

It is possible as far as I know that it doesn't meet the formal definition in some way, but since you used the term in air quotes and didn't qualify it (like 'but it stores settings in the registry' or similar), I think you may be interpreting the term differently (i.e. I don't think the term is being used to suggest that you can use the same executable across operating systems.)

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#146

Post by vacri »

jimmaswell wrote: post #75
astrodust wrote: post #31

Earlier quoted context omitted.

How about the fact that it's awful? Can you seriously compare PuTTY with even the most lacklustre terminal available on OS X or Linux? It's an atrocity of UX design straight out of the Windows 95 era. Their home page is also the epitome of not caring about user experience even to the slightest degree. Nearly zero effort: http://www.chiark.greenend.org.uk/~sgtatham/putty/ I've seen people construct more impressive pag…

The home page is clearly organized and readable, only having some text and links. What more do you want from a website that only exists to distribute one program? There's a link to the download page right on top. It's more than good enough. Do you need flashy CSS animations and a Konami Code to find a website cool enough for you? There's not a single thing wrong with PuTTY's UX either. The terminal area is just a ter…

> There's not a single thing wrong with PuTTY's UX either.

Yes, there is. It garbles some characters. Ncurses-based applications sometimes look like a hot mess.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#147

Post by vacri »

dezgeg wrote: post #122
jimmaswell wrote: post #75

Earlier quoted context omitted.

The home page is clearly organized and readable, only having some text and links. What more do you want from a website that only exists to distribute one program? There's a link to the download page right on top. It's more than good enough. Do you need flashy CSS animations and a Konami Code to find a website cool enough for you? There's not a single thing wrong with PuTTY's UX either. The terminal area is just a ter…

IMHO PuTTY's default behaviour of pasting the clipboard's contents on right click is really annoying and unexplainable; neither native Windows apps or Unix xterms work like that. At our university we use IRC (via SSH+Screen+irssi mostly) for communication and every year I see over a dozen of people tripping into that. Also, the default encoding was changed to UTF-8 only quite recently - IMO that should have been done…

> neither native Windows apps or Unix xterms work like that

That's because it's middle-click instead of right-click in X. But windows traditionally did not have 3-button mouses, so right-click it is. I use middle-click to paste several times per hour.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#148

Post by ksrm »

dang wrote: post #9
mkr-hn wrote: post #5

Title should be "Downloading Putty Safely Is Nearly Impossible" Don't most people install stuff in Windows through Ninite when possible these days? I know it has at least one SSH client. And in my experience, the vast majority of good software is at the top of any search query.

Ok, we changed the title. If anyone suggests a better title we can change it again.

It would be nice, when you do this, to know what the original title is, to know what the issue with the original title was.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#149

Post by mekael »

Navarr wrote: post #78
astrodust wrote: post #31

Earlier quoted context omitted.

How about the fact that it's awful? Can you seriously compare PuTTY with even the most lacklustre terminal available on OS X or Linux? It's an atrocity of UX design straight out of the Windows 95 era. Their home page is also the epitome of not caring about user experience even to the slightest degree. Nearly zero effort: http://www.chiark.greenend.org.uk/~sgtatham/putty/ I've seen people construct more impressive pag…

> What causes you to say that it's awful? > How about the fact that it's awful? Is this really what passes today for a decent reply? It's an atrocity of attempted logic straight of the Windows 95 era. The logic used is also the epitome of not caring about putting up a decent argument even to the slightest degree. Nearly zero effort. I've seen people construct more impressive arguments given only a kindergarten educat…

Best response or bestest response? Me thinks it's the bestest.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#150

Post by Someone1234 »

_wldu wrote: post #110
Someone1234 wrote: post #6

None of which would have mattered if Putty.exe was codesigned. Unfortunately it is not. Code signing certificates are insanely expensive. The cheapest one I could find from a CA was $73/year (3 year minimum). I could go on a long rant now about how much CAs are in collusion and how they're making everyone more insecure though their pricing, but that would be redundant as I think "everyone knows that" by now. Let's En…

"None of which would have mattered if Putty.exe was codesigned. Unfortunately it is not." You mean Autenticode on Windows? I once had an Authenticode code signing cert that I used to sign Windows executables. Mostly, I signed hobby projects with it. I wrote a proof of concept keystroke logger for Windows, then Authenticode signed it and made it available along with source code for others to experiment with and review…

I was merely suggesting it as a way to verify who created that binary of Putty. Nothing more, nothing less. If you ignore who signed the binary completely, yes, it could be open to abuse.
Post reply on HN