Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Downloading PuTTY Safely Is Nearly Impossible (2014)

noncombatant.org

Post reply on HN
Print view View original

91–100 of 173 posts

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#91

Post by rblatz »

informatimago wrote: post #14

Downloading BINARY software safely is impossible indeed. Downloading SOURCE software poses no security risk. As long as only human read those sources, to check for this software behavior. WHEN the sources have been audited, and cleared for any security or other bugs, you may consider compiling them. That's where the real crux of the problem lies: https://www.ece.cmu.edu/~ganger/712.fall02/papers/p761-thomp... http://…

Security isn't a binary system. You can be compromised by the NSA and still be effectively safe. In the case of putty, you are trying to prevent yourself from downloading a compromised binary that steals credentials and send them on to black hats, script kiddies, bot-net farmers, people that do other illegal stuff and want to cover their traces.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#92

Post by c22 »

pionar wrote: post #85
c22 wrote: post #44

This really just highlights the fact that Windows ships with no tools to establish any kind of verified trust chain. No md5sum, no authenticated package management, no native ssh client. Being concerned about privacy and security and running Windows may be mutually incompatible.

Linux doesn't technically come with those either; they're all separate programs that distributions happen to include. Windows has an SSH-like framework for PowerShell[1]. One could argue that Linux doesn't ship with tools for connecting to non-Linux hosts, so why should Windows ship with tools for connecting to Linux hosts? It will have package management in Windows 10 [2]. Powershell can get the hash of a file in ma…

> Linux doesn't technically come with those either; they're all separate programs that distributions happen to include.

But isn't Windows more like "a distribution of Linux" than "the bare Linux kernel"? When I choose to trust a distribution of Linux (or a BSD or any other complete operating system) I extend that trust to the ecosystem's package manager which usually includes mechanisms for verification. Downloading putty is not a case of trying to connect to a Linux host, though, and SSH is not a linux-only (or even linux originated) protocol.

I was just looking at OneGet and it seems like a huge boon to the Windows ecosystem. From my limited research Windows 10 looks pretty nice and is the first version since XP that I may be interested in using.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#93

Post by RaleyField »

c22 wrote: post #44

This really just highlights the fact that Windows ships with no tools to establish any kind of verified trust chain. No md5sum, no authenticated package management, no native ssh client. Being concerned about privacy and security and running Windows may be mutually incompatible.

Windows 8 ships with a version of Powershell that has builtin Get-FileHash command which can do SHA1, SHA2 (256/384/512), MACTripleDES, MD5 and RIPEMD160.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#94

Post by joshstrange »

pdabbadabba wrote: post #50
joshstrange wrote: post #39

Earlier quoted context omitted.

While I fully understand where you are coming from let's try and remember that putty is 100% free and I'd bet money the author puts in more time/energy/money than he gets back from it. That means that ANY money spent is more money in the hole making $73/yr ($219 all at once b/c you have to pay for 3 years) quite a bit of money.

I suspect that if the Putty dev created a Patreon for code signing, and posted it on HN and Reddit, he'd almost immediately have that $73/yr covered for the foreseeable future.

No doubt but we all need to remember that sometimes accepting money is more trouble than it's worth. I know that sounds crazy but people taking donations have to declare that on their taxes and some people don't want to deal with that. Also while crowdfunding platforms have gotten really easy they still take effort and sometimes some sort of verification process. It's obvious the putty dev is not a designer (I don't say that to be mean) so I'm sure there would be people here on HN that would be all like "Ugh, this guy is asking for money and he can't take 2 minutes to make his funding site look halfway decent???" (Those people would be clarified as douches but that wouldn't stop them from making the comment nor the dev potentially reading them).

Lastly let's say he gets the money and takes care of the taxes and all of that. Now he has to get a code signing cert (not a fast or easy process I would assume) and add that to the list of things he needs to do for each release. We are talking about a non-trivial amount of work over a month or more all so that people will stop bitching about the FREE and OPEN SOURCE product he is producing...

If you find code signing/HTTPS to be so important I suggest you do it yourself, the code is freely available and since it's under an MIT licence you can even SELL access to your code-signed and https-protected putty version. I'm not saying that either of these things are not important (they both are) but let's not jump down the dev's throat because they aren't giving up even more of their time on something they seen no return on.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#95

Post by ikeboy »

From http://www.chiark.greenend.org.uk/~sgtatham/putty/keys.html

>We have uploaded our various keys to public keyservers, so that even if you don't know any of the people who have signed our keys, you can still be reasonably confident that an attacker would find it hard to substitute fake keys on all the public keyservers at once.

Anyone want to be less lazy than me and find out which ones the keys are in?

Also, the first thing I'd do is download a Ubuntu ISO over https, install Ubuntu, after which I'd have an authenticated way of installing software (apt-get). putty is available through that, so I'm fine.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#96

Post by toyg »

pionar wrote: post #85
c22 wrote: post #44

This really just highlights the fact that Windows ships with no tools to establish any kind of verified trust chain. No md5sum, no authenticated package management, no native ssh client. Being concerned about privacy and security and running Windows may be mutually incompatible.

Linux doesn't technically come with those either; they're all separate programs that distributions happen to include. Windows has an SSH-like framework for PowerShell[1]. One could argue that Linux doesn't ship with tools for connecting to non-Linux hosts, so why should Windows ship with tools for connecting to Linux hosts? It will have package management in Windows 10 [2]. Powershell can get the hash of a file in ma…

> One could argue that Linux doesn't ship with tools for connecting to non-Linux hosts

Except it does, to the extent that vendors make it possible: any repository will have at least one RDP client of sort (probably half-baked, because the protocol is what it is), and Samba is standard fare. Almost any other OS supports SSH, so yeah, Linux in fact does ship with tools to connect to non-Linux hosts, and plenty of them. (Btw, connecting Windows to NFS shares out of the box is much harder than connecting Linux oob to SMB shares...)

If there is one thing that would help Microsoft immensely, in their attempts at gaining some traction "in the cloud", is out-of-the-box SSH support. Powershell might be nice but it will never work on anything that is not Windows, so it's fundamentally useless for remote work.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#97

Post by Aloha »

jimmaswell wrote: post #75
astrodust wrote: post #31

Earlier quoted context omitted.

How about the fact that it's awful? Can you seriously compare PuTTY with even the most lacklustre terminal available on OS X or Linux? It's an atrocity of UX design straight out of the Windows 95 era. Their home page is also the epitome of not caring about user experience even to the slightest degree. Nearly zero effort: http://www.chiark.greenend.org.uk/~sgtatham/putty/ I've seen people construct more impressive pag…

The home page is clearly organized and readable, only having some text and links. What more do you want from a website that only exists to distribute one program? There's a link to the download page right on top. It's more than good enough. Do you need flashy CSS animations and a Konami Code to find a website cool enough for you? There's not a single thing wrong with PuTTY's UX either. The terminal area is just a ter…

It's a well designed win32 application, designed to the portable as far as windows applications go. I just don't get the hate on PuTTY.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#98

Post by kainsavage »

Someone1234 wrote: post #6

None of which would have mattered if Putty.exe was codesigned. Unfortunately it is not. Code signing certificates are insanely expensive. The cheapest one I could find from a CA was $73/year (3 year minimum). I could go on a long rant now about how much CAs are in collusion and how they're making everyone more insecure though their pricing, but that would be redundant as I think "everyone knows that" by now. Let's En…

TIL: $73/year is "insanely expensive".

Literally cheaper than sponsoring an African child or paying Sarah McLachlan to stop using commercials to make me cry.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#99

Post by acqq »

c22 wrote: post #44

This really just highlights the fact that Windows ships with no tools to establish any kind of verified trust chain. No md5sum, no authenticated package management, no native ssh client. Being concerned about privacy and security and running Windows may be mutually incompatible.

> no tools to establish any kind of verified trust chain

You're wrong, there is a code signature verification built-in in Windows, if the EXE is signed, from the GUI you just have to right click on the file, select "Digital Signatures" and click twice on the signature.

Putty however isn't signed. Maybe it would be good to motivate Simon Tatham to start doing this. He should be somehow supported for that.

The signature doesn't solve too much (e.g. imagine Putty is signed by Acme Inc -- how do we know that Simon actually worked for Acme Inc at the moment he signed, that is, how do we know we should expect Putty to be signed by Acme Inc, and what if it's signed by Acme LLC, is that the same company etc -- we still need some channels to spread the right information, and when we have them, spreading the right checksums of the binaries would also be enough) but it is probably better than nothing.

Re: Downloading PuTTY Safely Is Nearly Impossible (2014)

#100

Post by rsync »

astrodust wrote: post #31
cturner wrote: post #17

Earlier quoted context omitted.

What causes you to say that putty is pretty awful?

How about the fact that it's awful? Can you seriously compare PuTTY with even the most lacklustre terminal available on OS X or Linux? It's an atrocity of UX design straight out of the Windows 95 era. Their home page is also the epitome of not caring about user experience even to the slightest degree. Nearly zero effort: http://www.chiark.greenend.org.uk/~sgtatham/putty/ I've seen people construct more impressive pag…

"Their home page is also the epitome of not caring about user experience even to the slightest degree. Nearly zero effort"

I wish more websites were functional and clean like that.

Post reply on HN