Downloading PuTTY Safely Is Nearly Impossible (2014) • Hacker News Board

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#81

Post by c22 » Wed, May 20, 2015, 7:05 PM UTC

WorldWideWayne wrote: post #63

c22 wrote: post #44

This really just highlights the fact that Windows ships with no tools to establish any kind of verified trust chain. No md5sum, no authenticated package management, no native ssh client. Being concerned about privacy and security and running Windows may be mutually incompatible.

Windows does come with tools to establish a verified trust chain...it's just not using ssh. I'm not sure what you mean by authenticated package management, but Windows does authenticate packages that have certificates and you can manage certificates that you trust. What else do you want to do? And I'm fairly certain that Windows comes with even more robust tools out of the box for network trust management than Linux…

Fair points. I haven't used Windows since XP so my information is a bit dated but it does look like they've made some progress in this arena. Putty is from a time where most windows software was installed from random .exes on the internet, though. I suspect due to the age of the win32 ecosystem much software still is installed this way in Windows environments.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#82

Post by ubercow13 » Wed, May 20, 2015, 7:07 PM UTC

hughes wrote: post #4

Putty is pretty awful anyway. Git for windows installs a shell that is not terrible, includes an ssh client, and is distributed over https. It is my go-to when I have to use a windows machine.

that's mintty....which is just a slightly modified putty

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#83

Post by mkr-hn » Wed, May 20, 2015, 7:09 PM UTC

outworlder wrote: post #71

mkr-hn wrote: post #5

Title should be "Downloading Putty Safely Is Nearly Impossible" Don't most people install stuff in Windows through Ninite when possible these days? I know it has at least one SSH client. And in my experience, the vast majority of good software is at the top of any search query.

It's the first time I've heard about Ninite. I do use chocolatey as much as possible for all windows installations.

This is the first I've heard of chocolatey. Seems to offer a lot more stuff, so I'll check it out.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#84

Post by Someone1234 » Wed, May 20, 2015, 7:11 PM UTC

c22 wrote: post #44

This really just highlights the fact that Windows ships with no tools to establish any kind of verified trust chain. No md5sum, no authenticated package management, no native ssh client. Being concerned about privacy and security and running Windows may be mutually incompatible.

> This really just highlights the fact that Windows ships with no tools to establish any kind of verified trust chain.

It has HTTPS and FTPS support natively. It also supports generating hashes in SHA1, SHA256, SHA384, SHA512, MACTripleDES, MD5, and RIPEMD160 using the aptly named Get-FileHash cmdlet.

> no authenticated package management

MSI installers can (and should) be signed, and well as many other Windows installers and other binaries. Windows 10 supports "real" package management, but security is unimpacted directly.

> Being concerned about privacy and security and running Windows may be mutually incompatible.

You've given zero plausible reasons for believing so. All you've demonstrated here is that you know little about Windows and what the term "verified trust chain" means.

Just Windows supporting HTTPS alone more or less ruins your point.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#85

Post by pionar » Wed, May 20, 2015, 7:13 PM UTC

c22 wrote: post #44

This really just highlights the fact that Windows ships with no tools to establish any kind of verified trust chain. No md5sum, no authenticated package management, no native ssh client. Being concerned about privacy and security and running Windows may be mutually incompatible.

Linux doesn't technically come with those either; they're all separate programs that distributions happen to include.

Windows has an SSH-like framework for PowerShell[1]. One could argue that Linux doesn't ship with tools for connecting to non-Linux hosts, so why should Windows ship with tools for connecting to Linux hosts?

It will have package management in Windows 10 [2].

Powershell can get the hash of a file in many different algorithms.

[1] https://technet.microsoft.com/en-us/magazine/ff700227.aspx [2] https://github.com/OneGet/oneget

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#86

Post by Orangeair » Wed, May 20, 2015, 7:18 PM UTC

One variant of PuTTY that I use -- PuTTYTray, a portable version of PuTTY with some other features -- is at least delivered over https, although you still have to trust the developer.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#87

Post by mattstreet » Wed, May 20, 2015, 7:21 PM UTC

wildpeaks wrote: post #34

Another reason to prefer the unix-like tools (that are included with Git for Windows ( http://git-scm.com/downloads ) but are also available separately) over PuTTY is Vagrant, it can't run "vagrant ssh" on Windows otherwise. Also, you'd always need dedicated key files because PuTTY uses PPK instead of regular OpenSSH ones.

I just started using Vagrant on Windows and I'm really liking using it through Cygwin.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#88

Post by kyberias » Wed, May 20, 2015, 7:25 PM UTC

Cacti wrote: post #68

astrodust wrote: post #31

Earlier quoted context omitted.

How about the fact that it's awful? Can you seriously compare PuTTY with even the most lacklustre terminal available on OS X or Linux? It's an atrocity of UX design straight out of the Windows 95 era. Their home page is also the epitome of not caring about user experience even to the slightest degree. Nearly zero effort: http://www.chiark.greenend.org.uk/~sgtatham/putty/ I've seen people construct more impressive pag…

Wait... you think a terminal emulator, which by definition has almost no graphical UI at its heart, is crap because of its UI? Really? You think the entire program is crap because, what, you don't like how the Preferences panel is laid out?

To be fair, the only piece of UI in Putty that one needs besides the actual shell, namely adding and managing hosts that you connect, is absolutely broken beyond imagination. It has always been like that and it probably will be. Of course if one never ever uses the UI, then it's ok, but putty more or less forces one to use it.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#89

Post by ceejayoz » Wed, May 20, 2015, 7:28 PM UTC

Phlarp wrote: post #79

ceejayoz wrote: post #18

Earlier quoted context omitted.

If SSL is free and easy (especially if it's automatable) to generate through Let's Encrypt, the use case for wildcards mostly goes away.

Excuse me for being a pedant, but wouldn't Let's Encrypt end up being just another potential attack surface?

No more than the existing for-pay SSL providers, I'd imagine. What sort of attacks are you proposing?

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#90

Post by click170 » Wed, May 20, 2015, 7:30 PM UTC

ChuckMcM wrote: post #2

This is really just a rant about how poorly PuTTY is distributed. (and a vague implication that it is malware of some sort). I think it is a valid criticism, and I wish the person who wrote PuTTy (an SSH client for windows) would be more open/available/transparent but it is hard to force that on someone.

I would argue this is a problem because of the lack of an actual package manager for the distros putty is used on.

If there was a formal package management system in place for these OSs this would have been less of a problem from the beginning, but they're only getting around to it now as I understand it.