Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Downloading PuTTY Safely Is Nearly Impossible (2014)

noncombatant.org

Post reply on HN
Print view View original

51–60 of 173 posts

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#51

Post by troels »

_lce0 wrote: post #47

stay away from PuTTY!! Antiviruses detected that their .exe was infected, and they solved it by removing the detection on the antiviruses > 2015-04-19 PuTTY detected as malware > We've had several reports recently of anti-virus software reporting PuTTY as malware (under a wide variety of names, often generic). This affects the latest release (0.64) and also the development snapshots ( particularly puttygen ). > We be…

I read that as "the av vendors have removed the false positive". E.g. they fixed their wrong.

What lead you to a different interpretation?

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#52

Post by michaelt »

Maarten88 wrote: post #21
mkr-hn wrote: post #5

Title should be "Downloading Putty Safely Is Nearly Impossible" Don't most people install stuff in Windows through Ninite when possible these days? I know it has at least one SSH client. And in my experience, the vast majority of good software is at the top of any search query.

There is also the Windows Store. It has several SSH clients, free or cheap, one that is called Metro PuTTY. I don't know if those are any good, but they are safe to install and run. In Windows 10 they will even run in a Window with your other desktop apps :-)

Yeah, nothing says trustworthy like someone unaffiliated with the author reselling open source software.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#53

Post by asherkin »

_lce0 wrote: post #47

stay away from PuTTY!! Antiviruses detected that their .exe was infected, and they solved it by removing the detection on the antiviruses > 2015-04-19 PuTTY detected as malware > We've had several reports recently of anti-virus software reporting PuTTY as malware (under a wide variety of names, often generic). This affects the latest release (0.64) and also the development snapshots ( particularly puttygen ). > We be…

What were they meant to do? The AV vendor only corrects the detection after verifying that it is a false-positive themselves presumably.

We've had false-positive AV detections a few times in the last couple years affect an open-source project I'm involved in, it is a massive support burden.

What would you suggest a developer do other than contact the AV vendor to get it sorted out, since they caused the false detection?

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#54

Post by jahewson »

informatimago wrote: post #14

Downloading BINARY software safely is impossible indeed. Downloading SOURCE software poses no security risk. As long as only human read those sources, to check for this software behavior. WHEN the sources have been audited, and cleared for any security or other bugs, you may consider compiling them. That's where the real crux of the problem lies: https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomp... http://…

But nobody could possibly read all the source. There's 15 million lines in the Linux kernel alone and it changes frequently. Even a group of people couldn't manage it. Gentoo isn't "more trustworthy" because nobody has actually read all of its source. Its users simply trust the upstream source repository. That's no better than trusting apt/yum.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#55

Post by stcredzero »

brians wrote: post #23
Someone1234 wrote: post #6

None of which would have mattered if Putty.exe was codesigned. Unfortunately it is not. Code signing certificates are insanely expensive. The cheapest one I could find from a CA was $73/year (3 year minimum). I could go on a long rant now about how much CAs are in collusion and how they're making everyone more insecure though their pricing, but that would be redundant as I think "everyone knows that" by now. Let's En…

The "browser" half of the CAB forum is happy to accept new CAs that meet their standards. Non-profits and disruptive startups are finding that difficult, as they should—it's hard to run a CA safely. It's not hard like curing cancer is hard, or even like heart surgery is hard. It's hard like avoiding iatrogenic infection is hard: it requires constant and diligent adherence to rules in the presence of no visible threat…

The "browser" half of the CAB forum is happy to accept new CAs that meet their standards. Non-profits and disruptive startups are finding that difficult, as they should—it's hard to run a CA safely.

This is something that Google should do.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#56

Post by jaredsohn »

One thing that seems ignored in some of the threads where people mention alternatives is that one of the historical advantages for putty (compared to cygwin, git's tools, etc.) has been that it is portable in that it does not require running an installer. This has been useful if you are on somebody else's machine and you don't want to have to remember to uninstall it afterwards and can also be useful if you are logged in as a user without many permissions.

That said, I haven't used Windows for awhile so maybe those reasons don't exist any more (perhaps it isn't a problem to install a Windows 8/10 app on someone else's machine or within a restricted corporate environment) or maybe there are some good browser-based alternatives.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#57

Post by teh_klev »

baldfat wrote: post #26
hughes wrote: post #4

Putty is pretty awful anyway. Git for windows installs a shell that is not terrible, includes an ssh client, and is distributed over https. It is my go-to when I have to use a windows machine.

I switched to mobaxterm [ http://mobaxterm.mobatek.net ] a few weeks ago. I am so happy with the program. It has some cool bells and whistles but it has built in X server. So it does X Forwarding out of the box.

I've been running mobaxterm for around three years now, the "just works" X server was the killer feature for me. Never looked back. I even paid for the "pro" edition to support their work on it.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#58

Post by PascLeRasc »

My freshman intro to engineering computing class has ~500 freshman download PuTTY from the non-https site every year. I'll email the instructor this article - is the problem that it could be infected, or is it known to be infected with undesirable software? Quality of PuTTY aside, could someone just host the most common download on an https site?

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#59

Post by wolf550e »

wildpeaks wrote: post #34

Another reason to prefer the unix-like tools (that are included with Git for Windows ( http://git-scm.com/downloads ) but are also available separately) over PuTTY is Vagrant, it can't run "vagrant ssh" on Windows otherwise. Also, you'd always need dedicated key files because PuTTY uses PPK instead of regular OpenSSH ones.

putty can convert to and from openssh key files.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#60

Post by Kluny »

pdabbadabba wrote: post #50
joshstrange wrote: post #39

Earlier quoted context omitted.

While I fully understand where you are coming from let's try and remember that putty is 100% free and I'd bet money the author puts in more time/energy/money than he gets back from it. That means that ANY money spent is more money in the hole making $73/yr ($219 all at once b/c you have to pay for 3 years) quite a bit of money.

I suspect that if the Putty dev created a Patreon for code signing, and posted it on HN and Reddit, he'd almost immediately have that $73/yr covered for the foreseeable future.

And then some - I don't see a donate link anywhere on putty.org or the linked sites, but who wouldn't donate 5 bucks to putty, when they use it for free basically every day? I've paid 5 bucks for less useful programs.
Post reply on HN