Hacker News Reader

Is it worth to spend 90kEUR on putty, considering windows nowadays has openssh?

Is it worth spending money on Drupal considering we nowadays have anything else?

The answer is yes. The value of these bug bounty programs is directly tied to the amount of use the software gets (and most of these get used a ton, including Putty, regardless of alternatives).

Do people using these oldish softwares update them, though?

Funding bug bounty programs kind of fail its objectives if they don't.

You're not wrong, but those are still separate issues. In the context of benefit for the government itself, you'd certainly hope so…

Regardless of whether they get updated, these are still a net benefit for new installs.

Oh indeed, I'm not trying to say they should not fund these programs, this is awesome and welcome. I'm just warning about a possible pitfall for them to keep an eye on :)

Most places are not running the latest version of Windows. And even if their SOE is Windows 10 I guarantee you that their VDI isn't. And since Putty doesn't need an installer it's easy for users to install themselves even when the machines are locked down.

So given that pretty much every government/company probably has some incidental security exposure to Putty it is a smart investment to make sure it's bug free.

Reply on news.ycombinator.com