Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Downloading PuTTY Safely Is Nearly Impossible (2014)

noncombatant.org

Post reply on HN
Print view View original

41–50 of 173 posts

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#41

Post by dsp1234 »

Animats wrote: post #7
ChuckMcM wrote: post #2

This is really just a rant about how poorly PuTTY is distributed. (and a vague implication that it is malware of some sort). I think it is a valid criticism, and I wish the person who wrote PuTTy (an SSH client for windows) would be more open/available/transparent but it is hard to force that on someone.

This is not just a rant. As of two days ago, there is a hostile version of PuTTY in the wild.[1][2] It's on some mirror sites distributing open source software. It steals login credentials. Right now, it's essential to be able to tell the good one from the bad ones, and it's not easy. [1] http://www.symantec.com/connect/blogs/check-your-sources-tro... [2] http://blogs.cisco.com/security/trojanized-putty-software

This really should be a top level comment. I was unaware of this as an issue, and a couple of HN posts on this topic got no traction. Thanks for bringing it up!

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#42

Post by meritt »

mkr-hn wrote: post #37
meritt wrote: post #25

Earlier quoted context omitted.

Windows user for 20+ years. I've never heard of Ninite.

It's a bit like a package manager. You tick all the things you want to install, and it'll install them with sensible defaults and no prompts.

Yeah, it seems like neat software. I guess I've just become so ingrained in my ways that upon getting a new install setup, I install the same ~7 applications and I'm done. Never even thought to seek out a package manager for Windows.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#43

Post by joshstrange »

cturner wrote: post #17
hughes wrote: post #4

Putty is pretty awful anyway. Git for windows installs a shell that is not terrible, includes an ssh client, and is distributed over https. It is my go-to when I have to use a windows machine.

What causes you to say that putty is pretty awful?

One acronym: PPK

Most of the people I know that use putty really use MTPutty [0] nowadays for multiple tabbed terminal windows. I haven't touched windows in years but if I were to go back I would use cygwin or similar before I used putty.

[0] http://ttyplus.com/multi-tabbed-putty/

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#44

Post by c22 »

This really just highlights the fact that Windows ships with no tools to establish any kind of verified trust chain. No md5sum, no authenticated package management, no native ssh client. Being concerned about privacy and security and running Windows may be mutually incompatible.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#45

Post by joshstrange »

meritt wrote: post #25
mkr-hn wrote: post #5

Title should be "Downloading Putty Safely Is Nearly Impossible" Don't most people install stuff in Windows through Ninite when possible these days? I know it has at least one SSH client. And in my experience, the vast majority of good software is at the top of any search query.

Windows user for 20+ years. I've never heard of Ninite.

I haven't touched windows in close to 5 years but it's pretty awesome for when you are rebuilding a machine and want to install a bunch of core utils/programs all in one go.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#46

Post by c22 »

astrodust wrote: post #31
cturner wrote: post #17

Earlier quoted context omitted.

What causes you to say that putty is pretty awful?

How about the fact that it's awful? Can you seriously compare PuTTY with even the most lacklustre terminal available on OS X or Linux? It's an atrocity of UX design straight out of the Windows 95 era. Their home page is also the epitome of not caring about user experience even to the slightest degree. Nearly zero effort: http://www.chiark.greenend.org.uk/~sgtatham/putty/ I've seen people construct more impressive pag…

I think the page is nice. Fast, usable, and seems to contain a ton of content. I don't think anyone was slacking when they put this together.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#47

Post by _lce0 »

stay away from PuTTY!!

Antiviruses detected that their .exe was infected, and they solved it by removing the detection on the antiviruses

> 2015-04-19 PuTTY detected as malware

> We've had several reports recently of anti-virus software reporting PuTTY as malware (under a wide variety of names, often generic). This affects the latest release (0.64) and also the development snapshots (particularly puttygen).

> We believe these are false positives. In those cases where we've been able to contact the vendor (McAfee, Symantec, ClamAV), they have removed the detection.

http://www.chiark.greenend.org.uk/~sgtatham/putty/

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#48

Post by the8472 »

lelandbatey wrote: post #27
[deleted] wrote: post #3

[deleted]

Installing Cygwin gives you an excellent terminal MinTTY as well as normal CLI ssh. It's my preferred way to do ssh on Windows.

My preferred way to do SSH on windows is to just install any linux distro in a virtual box VM with a minimalist window manager, fullscreen a console and mount all windows disks into it as shared drive if I want to scp things.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#49

Post by jimrandomh »

informatimago wrote: post #14

Downloading BINARY software safely is impossible indeed. Downloading SOURCE software poses no security risk. As long as only human read those sources, to check for this software behavior. WHEN the sources have been audited, and cleared for any security or other bugs, you may consider compiling them. That's where the real crux of the problem lies: https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomp... http://…

If you download source code from an insecure web site, then you might get source code that's different from the source code that other people have read, with malicious modifications. So the situation described in the article wouldn'tve been any better if the main download was in the form of source code; you'd have to carefully read the whole thing, rather than trust that other people have read the whole thing, which isn't feasible for more than a few small programs.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#50

Post by pdabbadabba »

joshstrange wrote: post #39
Igglyboo wrote: post #33

Earlier quoted context omitted.

$73/year is not free but calling it "insanely expensive" is pretty unfair.

While I fully understand where you are coming from let's try and remember that putty is 100% free and I'd bet money the author puts in more time/energy/money than he gets back from it. That means that ANY money spent is more money in the hole making $73/yr ($219 all at once b/c you have to pay for 3 years) quite a bit of money.

I suspect that if the Putty dev created a Patreon for code signing, and posted it on HN and Reddit, he'd almost immediately have that $73/yr covered for the foreseeable future.
Post reply on HN