71–80 of 173 posts
Title should be "Downloading Putty Safely Is Nearly Impossible" Don't most people install stuff in Windows through Ninite when possible these days? I know it has at least one SSH client. And in my experience, the vast majority of good software is at the top of any search query.
I do use chocolatey as much as possible for all windows installations.
Earlier quoted context omitted.
While I fully understand where you are coming from let's try and remember that putty is 100% free and I'd bet money the author puts in more time/energy/money than he gets back from it. That means that ANY money spent is more money in the hole making $73/yr ($219 all at once b/c you have to pay for 3 years) quite a bit of money.
I suspect that if the Putty dev created a Patreon for code signing, and posted it on HN and Reddit, he'd almost immediately have that $73/yr covered for the foreseeable future.
This is silly, Chris. :) PuTTY is MIT licensed. The primary author of PuTTY is unserious about traceable code, which is a shame, because as your essay implies, PuTTY is one of the motivating cases for traceable code. It's an actual lucrative real-world target for surreptitious replacement. Clearly, the world cannot rely on PuTTY's author to provide a traceable download. Someone else needs to step in and do that. That…
From yesterday: "Trojanized PuTTY"
http://www.symantec.com/connect/fr/blogs/check-your-sources-...
This really just highlights the fact that Windows ships with no tools to establish any kind of verified trust chain. No md5sum, no authenticated package management, no native ssh client. Being concerned about privacy and security and running Windows may be mutually incompatible.
Earlier quoted context omitted.
What causes you to say that putty is pretty awful?
How about the fact that it's awful? Can you seriously compare PuTTY with even the most lacklustre terminal available on OS X or Linux? It's an atrocity of UX design straight out of the Windows 95 era. Their home page is also the epitome of not caring about user experience even to the slightest degree. Nearly zero effort: http://www.chiark.greenend.org.uk/~sgtatham/putty/ I've seen people construct more impressive pag…
There's not a single thing wrong with PuTTY's UX either. The terminal area is just a terminal area that does what it's supposed to and behaves exactly like any other terminal emulator, and the options are clearly organized. There is literally no meaningful change you could make to improve its UX because it's already optimal.
My freshman intro to engineering computing class has ~500 freshman download PuTTY from the non-https site every year. I'll email the instructor this article - is the problem that it could be infected, or is it known to be infected with undesirable software? Quality of PuTTY aside, could someone just host the most common download on an https site?
Downloading it from a place that serves it from a secured endpoint isn't really useful if the source didn't download it securely.
Earlier quoted context omitted.
What causes you to say that putty is pretty awful?
How about the fact that it's awful? Can you seriously compare PuTTY with even the most lacklustre terminal available on OS X or Linux? It's an atrocity of UX design straight out of the Windows 95 era. Their home page is also the epitome of not caring about user experience even to the slightest degree. Nearly zero effort: http://www.chiark.greenend.org.uk/~sgtatham/putty/ I've seen people construct more impressive pag…
> How about the fact that it's awful?
Is this really what passes today for a decent reply? It's an atrocity of attempted logic straight of the Windows 95 era.
The logic used is also the epitome of not caring about putting up a decent argument even to the slightest degree. Nearly zero effort.
I've seen people construct more impressive arguments given only a kindergarten education. I'm not even kidding.
I'm not saying everything has to be lengthy and grammatically correct, but there's such a thing called pride in logic, and astrodust has none of that. It's just sad.
None of which would have mattered if Putty.exe was codesigned. Unfortunately it is not. Code signing certificates are insanely expensive. The cheapest one I could find from a CA was $73/year (3 year minimum). I could go on a long rant now about how much CAs are in collusion and how they're making everyone more insecure though their pricing, but that would be redundant as I think "everyone knows that" by now. Let's En…
If SSL is free and easy (especially if it's automatable) to generate through Let's Encrypt, the use case for wildcards mostly goes away.
Earlier quoted context omitted.
I switched to mobaxterm [ http://mobaxterm.mobatek.net ] a few weeks ago. I am so happy with the program. It has some cool bells and whistles but it has built in X server. So it does X Forwarding out of the box.
Moba feels slow sometimes; I don't like its custom UI; I don't understand how it's FOSS /and/ has a pro-only version. Its built-in SSH server is great for moving files to and from my workstation quickly when I need it.
Best One Liner about commercial Open Source software : The only kind of profit strategy that is incompatible with Open Source is monopoly-based sales, also known as "royalties". [] http://opensource.org/faq#profit