Putty maintainer on his attitude towards security and open source | Hacker News Reader

Putty maintainer on his attitude towards security and open source

andrewducker.dreamwidth.org

534 pointsAndrewDucker135 comments

I once used PuTTY as the base for an internal SSH tool. We needed to provide data entry teams with access to a green screen but didn’t want to expose any more servers than what they were authorised to use and a simple interface because a lot of the data entry guys were technologically illiterate.

After spending hours looking for solutions that were purpose built for this kind of thing I gave up took PuTTYs source and made some tweaks to the UI.

The source was so easy to work with and I was so grateful that the license allowed me to do this.

The custom client only ran for a couple of years because the web replaced green screens. And being a *nix guy I don’t get much need for PuTTY in my day to day. But I’ll always be grateful for PuTTY for making that particular job possible (and secure).

I too had to make a custom version of putty and LOVED the code the author wrote and how easy it was.

For me putty is still preferred way to ssh with Windows. Nowadays windows is shipping openssh.exe, so I can run it from cmd and it kinda works for quick simple actions, but clipboard works weirdly, basically I have to use right-click/paste to reliably paste data, shift+insert works in some apps and does not work in others. Putty just works like it worked 10 years ago, it's good old reliable tool.

I use Windows Terminal these days so I have the same copy/paste behaviour in WSL, remote SSH and cmd. Ctrl + C when highlighting text to copy, Ctrl + V to paste.

Have you ever tried mobaxterm? I was a putty person as well until I was put on to moba.

This software limits the user with a maximum of allowed sessions.

The _demo_ limits the user with a maximum of allowed sessions. The unrestricted software has a modest licensing fee. Entirely reasonable considering the target audience.

That’s fine but why not just stick with open source PuTTY instead of switching to some commercial proprietary software.

Mobaxterm comes with a few extra goodies, like having a local xserver to run remote programs locally on windows, and it works out of the box. It also supports VNC, mosh, and others, so its a handy all in one. I purchased once to support, and i flip between putty amd moba for no reason.

correction/clarification: run UI locally (xwindows) not execute.

I really wouldn't know... wasn't advocating anything - just clarifying the deal with that software.

Oh I didn’t know that. I don’t use that feature. Fair point though.

Anybody have a solution to get hostname completion in Powershell?

ssh [letter][tab] gets me a list with my Zsh config. I looked briefly one time and couldn't find what I was looking for.

I have a fairly large SSH config file, and needing to open it to copy and paste hostnames from the file is the main reason I just use WSL.

I don't have a solution but if you want to invest the time, you should have a look at https://docs.microsoft.com/en-us/powershell/module/microsoft...

Whats wrong with using $Env:ComputerName ?

https://gist.github.com/backerman/2c91d31d7a805460f93fe10bdf...

I wonder whether Wallix contributes to Putty development. That's one company I know that relies on Putty to survive.

The new windows terminal allows you to change how copy and paste work.

I recently switched from about 20 years of Putty use (some years more than others, I ran Linux on the desktop for a long time) to Windows Terminal and the windows included openssh. There are pros and cons. The new windows terminal is very nice but there's still a few annoyances. Having an actual ssh config and almost all the capabilities (no ControlMaster/ControlPath because no files as sockets) is very nice.

I probably would have been fine staying with Putty though if pageant hadn't started having reliable (but weird) problems when handling more than a few auths from remote in a short period, making Ansible unusable when running from my work VM with agent forwarding.

You can also save ssh connections as profiles in the new terminal, to easily open a new tab with a SSH connection to some computer. I use it to quickly access my home server.

https://docs.microsoft.com/en-us/windows/terminal/tutorials/...

But does windos terminal provide a phone line to scream in?

I’m using WinSSHTerm instead (it joins putty, pageant, file transfer and multiple configs together into a very nice ui, and its terminal works as expected). It is like an IDE of putty-related tools. Putty may be a default ssh window to the unix world, but it’s ui never felt good to me.

Some screenshots to get the idea of its ui: https://www.google.com/search?q=winsshterm&tbm=isch

I moved off PuTTy to WSL plus the new terminal. It's just easier because you have all the things available like scp etc. That said PuTTy (or rather its derivate Kitty) served me well for years. But it's just so much easier to do key management in Linux via WSL.

I've added unxutils on every single windows machine I've owned since... almost ever. I can't imagine living without it.

Windows terminal has a lot of weird behavior. I found it impossible to enter vim block mode using ctrl+v, for instance. It kept on doing some combination of insert and paste.

Good to hear - I was using Putty and Pageant before openssh.exe on Windows became available. Works great - with WSL (1 _and_ 2), and with KeeAgent (KeePass Addon for SSH Keys). I enjoyed reading the post from simont, it resonated with my own observations (not that I contributed anything comparable like Putty to the open source movement). It is more that colleages (at university) expect me to fix/improve my oss as soon as they email me, and even get angry when I can't (due to time constraints etc.).

A similar thing happened to me. But instead of tweaking PuTTy I tweaked Poderosa v4 which also has a permissive license

Had*

There was some sort of v4 -> v5 open-source -> commercial switch.

Commercial version: http://www.poderosa-terminal.com/

OSS version homepage: http://poderosa.sourceforge.net/

Source (last change in 2019): https://github.com/poderosaproject/poderosa

Releases (last release also 2019): https://sourceforge.net/projects/poderosa/files/releases/4.4... (also on GitHub too, switch to the "tags" tab)

Seems to be .NET based, and relatively simple in terms of available functionality and featureset.

Thx

> And being a nix guy I don’t get much need for PuTTY in my day to day.

It actually works on unix, which is usually uninteresting but I used it once when I needed a serial console client and wanted a friendly GUI. So it can* be useful:)

I just use screen for that now. Not even minicom any more.

I thought this was such a fantastic response, particularly the sections where he talks about how he responds to companies demanding he reply as if he has a contract with them.

The main point being that, with the log4j issue (and others before that), the thing that's struck me when maintainers complain about not being appreciated or that they are working as hard as they can, unpaid, is that maintainers are under no obligation to respond at all, and that you can't control how other people will react.

As someone who's dealt with anxiety for a long time (and as a former opensource primary maintainer), I can most definitely commiserate with feeling burdened by the expectations of others, but one of the best things I learned from therapy is that you can't control others emotions, you can only attempt to understand why you react as you do in certain situations.

You can’t control others emotions. But setting healthy expectations goes a long way.

One of my takeaways from the log4j issue is that the log4j devs should have never accepted the patches to add LDAP urls in the first place. Or perhaps, they should have removed that feature when it became burdensome. I would have. There’s a pressure to accept whatever patches come your way as an opensource developer, but actually, you’re under no obligation to do any such thing. Open source also means the source is available - so people are free to take your code, mix in their patches and maintain it themselves. And if they can’t be bothered doing that, why should I shoulder that burden?

I think us opensource devs should get more comfortable saying no. “I hear that this feature is important to you but it doesn’t solve a problem I (or anyone else I know) cares about. Please maintain those patches in your own fork.”

Another alternative is to build a stable plug-in API rather than handling such requests in the core product. That way users with particular needs can code their own plug-ins rather than forking the entire code base. Now obviously open source maintainers have no obligation to do that, but purely from an engineering perspective it's an approach worth considering.

You then hit the two problems that everyone with a plugin API hits:

- you can't rearchitecture your software beyond a certain amount without breaking the plugin API

- if a plugin crashes, people will blame the host, no matter how you attempt to deflect this

That's what log4net does, and presumably log4j has a plugin api too.

They didn't add ldap support explicitly though, AFAICT. They added JNDI support, using a fairly small patch the guy who filed the request wrote for them. JNDI is a standard Java thing, so I'd guess they didn't think too deeply about all of the things it could do (not criticizing them, I'd probably have done the same thing).

Reminds me of Signal and Apple M1 support issue. People expect you to accept the PR. As if that wouldn't mean more work for the maintainer in any case.

The best way to respond would be to pretend there was a contract, and that the company was in arrears on its payment obligations. "I cannot act on any changes until you remit past-due payments."

That sends them on a wild goose chase for their copy of the contract, because they cannot admit they don't have it. Eventually they run into the person who tells them there is no contract, there are no delinquent payments, and there is no excuse for pestering the author.

What's to prevent them from responding to this by asking for an invoice?

(Note: If your answer is "well, send them an invoice", the problem is that you'll probably have to contact a lawyer to make sure that the invoice is legal. You don't want to fraudulently imply a preexisting contract or run into some other legal gotcha that you wouldn't even know about.)

You ignore that. The goal is to minimize your own time wasted.

> The best way to respond would be to pretend there was a contract, and that the company was in arrears on its payment obligations.

I favor a response along the lines of "that falls outside the scope of our current maintainer-user relationship, but I'd be happy to discuss a development and support contract that would cover that effort for $X USD".

Be perfectly forthright to cover your costs, including costs of attorney, tax preparer, bookkeeper, first line support (don't forget whether support is best effort or follow the sun, or something in-between), forex conversion rates, money transfer conversion rates, and so on. Do not cave to threats ("I'll tell everyone I know your software sucks", "I'll post everywhere you are a terrible coder!") or inducements ("I have a million YouTube subscribers, I'll plug you!", "I'll make sure you are credited in our awesome game credits scroll!"). Do be nice and professional.

Learn how to say in the nicest, most professional way, "Fuck you. Pay me." [1]

To give yourself a sense of scale, proven coders with a consistent track record of delivering when they say they will, to within an order of magnitude of original delivery (to account for a hobby open source project), for an established codebase that is relied upon by the user in production and would cost them >$300K USD in fully-burdened cost across five years to rip and replace, can justifiably charge $40K USD for an enhancement that takes them a week to code up (including documenting it on both developer and user end) and a week to validate with the client. And I'm sure there are others here who can whip up an IRR spreadsheet to tell me that's charging on the low-end.

Add another $12K to support just that feature for a year after passing validation and open-sourcing it right away. Charge something on the order of $100K per year to support if if they want to own the source patch instead of it open-sourcing but still want you to maintain it; maintaining separate forks doesn't come cheap to commercial customers, the code being open source means no different. Charge for taking back in the source patch later if they want to make it private, want to stop paying support after the first year, then change their minds later. Charge for delaying open-sourcing it. Charge for changes that will take you longer than 15 minutes (including every associated task like documenting and validating) to throw in, charge for more than four of those kinds of changes. Doing anything different than just developing and open-sourcing the new feature costs you time; estimate that time, pad it for mistakes, and quote a fee. Enterprise software generally won't even begin a discussion of a forked change private to a specific client, and conversations of a feature developed for a specific customer will only start at around $1M USD, feature made available when it is finished, and the vendor owns the code.

Don't shortchange yourselves if you really know how to code, code for a specific problem domain and communicate with users in that domain in their lingo, gather requirements, set validation criteria, support technical customers, and can put up with the hassles of running a side business. You lose nothing by "firing" these customers who demand freebies with no compensation, except the Asshole Aggravation Factor in your life. Your IRL is filled to the brim with assholes. There is no need to let your open source hobby get filled with it, too.

I feel the Open Source community would be well-served by a standard boilerplate that comes right alongside the source license for charging fees for services, to set expectations that any participation by maintainers is a precious, unexpected gift at their sole discretion and whimsy. All other interaction first paid by cash.

[1] For those unfamiliar with US/Western pop culture, see https://www.urbandictionary.com/define.php?term=fuck%20you%2...

Someone I know met Simon one day and thought I’d like his autograph, since I was working in security at the time. I had in fact introduced that team to PuTTY, though this friend didn’t know that.

So I own a postcard that says words to the effect, “nobody has ever asked me for an autograph before”. It is framed.

This is a delightful story. Thank you for sharing.

Great footnote from the article:

> I'm often amused that people compliment me on things like PuTTY by telling me how much of their time it saved, whereas people compliment me on my puzzle game collection by telling me how much of their time it wasted.

I don't understand that sentence. Why would his puzzle game collection waste anybody's time ? How come people know about it or even care ?

The point of a puzzle game is a pastime - often considered to be “wasting” time.

But why would his puzzle game collection waste someone else's time ? He's the one collecting the games or doing the puzzles so why would it waste anybody else's time but his ?

He has a collection of puzzle games you can download and waste time playing.

Gee, thanks :D. I didn't know that at all and the article has no hints about that. I came to that possibility but it was reaaaally out of context and off without prior knowledge. Thanks for confirming it, I really didn't understand what was what. edit: I took a look at the page again and there are no links or mentions of puzzles or something, I knew I wasn't crazy (or that dense) !

The hint is clearly in the sentence you're confused about -- that he has also created some puzzle games is the only plausible explanation.

FWIW, the first explanation I thought of was something like "he replied to people asking for help that he was busy doing some (jigsaw) puzzles and wouldn't answer for now, thus wasting people's time by playing with his puzzles rather than answering". edit: and by puzzle I meant that kind: https://en.wikipedia.org/wiki/Jigsaw_puzzle. Puzzle in my mother tongue is the word used for jigsaw puzzles. Other puzzles are called "brain teasers".

ooh, that would explain why there was a small but steady stream of people posting jigsaw related stuff in rec.puzzles back in the usenet days!

-- that he has also created some puzzle games is the only plausible explanation.

Nowhere there does he claim authorship, merely possession of a collection. Without knowledge of his webpage or the games, there is more than 1 logical conclusion.

It's in a postscript attached to a sentenced about how giving away software is what helps him sleep at night. I'm not sure how you can reach any other logical conclusion without throwing out data from the article in favor of completely off-topic items.

It was implied. You don't need prior knowledge to deduce it, except the knowledge to ask the questions you wrote in your other comments.

Are you implying I am stupid ? /s

Because his puzzle-games collection are computer games you can play yourself, they can be found here: https://www.chiark.greenend.org.uk/~sgtatham/puzzles/ Or in the appstore/playstore.

My current timewaster is 'patterns',a nonogram puzzle

Interestingly, I JUST finished reading (many years after it was published) The Player of Games written by Iain M. Banks. In it, there is an orbital habitat named Chiark.

I assume that the interest in games and the hostname of his webserver are very much related.

The server is named after that orbital habitat, but not by Simon - it's someone else's webserver.

It's a joke -- it means they enjoyed the puzzle game.

I don't get it, the only way that sentence makes sense is if the backlink ³ Giving useful software means he's also sending people games or something which the article doesn't hint at.

He also has a games collection. https://www.chiark.greenend.org.uk/~sgtatham/puzzles/

That is the hint; that is exactly what the backlink means.

"SGT Puzzles" or, sometimes, "Simon's Puzzles" is a collection of single player puzzle games that has been ported to many, many platforms.

If you can think of a non-card solitaire game, it's probably implemented.

If dealing with SSH tooling is itself a kind of puzzle, then I suppose the overall effect is that while people are still spending time solving puzzles, he made the puzzles more enjoyable.

It took me until the footnote to remember that this is Simom Tatham, who indeed also authored a fine no-nonsense collection of little puzzle games, which has been ported to a bunch of platforms.

Here they are playable online on Tatham's site: https://www.chiark.greenend.org.uk/~sgtatham/puzzles/

And here's the Android version: https://f-droid.org/en/packages/name.boyle.chris.sgtpuzzles/

His puzzle game collection is as perfect in its domain as PuTTY is as an ssh client.

'unruly' and 'signposts' are neat little timewasters, but devolve into a lot of counting at larger sizes..

'flip' with random shapes is a great fidget-style toy

'galaxies' at 'unreasonable difficulty' gets pretty crazy

and plenty more, eg 'solo' provides every version of sudoku that you might want

Solo with 3x3 jigsaw + killer at unreasonable difficulty is the most fun I've ever had solving sudokus, requiring some really novel logic. In comparison, the normal 3x3 at unreasonable difficulty is really tedious, often devolving into a series of trial and error decisions.

I like Mines. It's Minesweeper but you never have to guess.

> And part of that is making all the necessary security tools available free of charge, because the more money they cost, the more companies will take a cost-benefit decision not to bother with them, neglecting the externalised cost of those knock-on effects of their insecurity on everyone else.

Boy if that doesn't ring true. Kudos to PuTTY's author for making it so easy and low cost to do the right thing that those profit-seeking automatons we call "companies" actually will.

The same logic applies to other concerns like accessibility, which is one reason why I'm making one of my contributions in that area [1] available as permissively licensed open source. It helps that my current funding source for that project also wants it to be open source.

[1]: https://github.com/AccessKit/accesskit

These days, there seems to be (at least) two kinds of open source software developers:

0. Those who release their code under an open source license, in the hope that it will be useful to others in some way.

1. Those who do the same as above, with the additional hope that they will be paid for in some ill-defined way. And when they are not, take to twitter and blogs to proclaim, "somebody should really do something about this!"

I do think there is a real problem whereby very important code that a lot of people and systems depend on is looked after part time (or not at all) and nobody thinks about it until it has a severe bug.

But that's almost orthogonal to the issue of whether the original developer should be paid because their code turns out to be useful to lots of people.

I think it’s a problem, but don’t think funding is a good solution. If funding was good, then commercial products would serve the purpose.

I think a better approach is to encourage more smart developers contributing time. And if companies find an individual or a percent of a person’s time on a project that’s actually funding. But it’s very different from trying to replicate direct funds.

> If funding was good, then commercial products would serve the purpose.

Not sure that's a solid affirmation, especially given how there are many open source projects receiving funding that often outcompete their commercial counterparts. In particular I would point out the major open source backing foundations such as the CNCF and Linux Foundation who help to fund their own projects. Would you say that these two organizations and their projects are not serving their purpose or are being outcompeted by commercial offerings?

It's also orthogonal to whether the code is free or paid, open or closed.

Plenty of commercial code is barely looked after, and if it's closed and broken, it's a lot harder to fix.

2. those that start out as 0, but become 1 when it turns out their software they hoped would be useful winds up /costing them/ in some ill-defined way.

Mainly, I gather, when users of their software start demanding support/bug fixes/enhancements.

That's not how it works. You start writing the code thinking it will be easy. You'll be done in a few weeks. You can see it all in your head. But in fact, it's never done. And it takes more and more time. Now you can't justify the effort because it's interfering with the rest of your life. You need relief from time spent doing paid work to keep working on the project.

I also find the opposite true--reminding colleagues that using OSS means we have to own and maintain the software whether the original community/author does or not.

There seems to be a hesitance to fork abandoned or slow moving software to update/fix issues

It's easier to blame a nebulous 3rd party than to take responsibility.

I think this is an important point that is often overlooked.

When we release code under a free software license, we are giving the software to the user, entirely. If you're using software that you own, not just merely have a license to, it is yours, be prepared to maintain it, and if you're not prepared to maintain it, maybe relying on free-as-in-freedom software is a bad decision for you.

Code released under MIT and BSD licenses should really be thought of not as free, as in speech, or free, as in beer, but free, as in mattress on the side of the road.

One I've heard is "free, as in puppy"

ie good, but comes with responsibility

"reminding colleagues that using OSS means we have to own and maintain the software whether the original community/author does or not"

No, we do not have to do this. We wouldn't get anything done, if we tried to maintain our full oss stack. Where would you start? In the linux kernel and move your way up to chromium/firefox? Have fun out there.

"There seems to be a hesitance to fork abandoned or slow moving software to update/fix issues "

And it is often easier to reimplement something from scratch, than taking up some underdocumented mess and trying to make sense of it.

So I would rephrase that to

" using OSS means we can own and maintain the software whether the original community/author does or not."

It's much simpler: if you run into a missing bug/feature, report it to the maintainers and ask them to assign it to you.

If each individual licensee is itching their own scratches, then there's a really good chance the entire codebase gets love.

Absolutist approaches are the death of all good things. "Some" is better than "none."

"Absolutist approaches are the death of all good things"

Agreed. Hence "can" and not "must".

>No, we do not have to do this. We wouldn't get anything done, if we tried to maintain our full oss stack. Where would you start? In the linux kernel and move your way up to chromium/firefox? Have fun out there.

Seems a little disingenuous to assume that GP meant that everyone should fully maintain their own OSS stack, when their comment could be read far more reasonably as a solution for when those processes aren't serving your needs entirely.

" could be read far more reasonably as a solution for when those processes aren't serving your needs entirely"

Yeah, that is why I rephrased it, to with OSS you can own and maintain your full stack.

Op said "must".

Eh, I've submitted patches for everything from the kernel to bash scripts because of bugs I've run into at work that really affected us which we needed to fix ASAP.

Sure I didn't have to but isn't that the point of open source?

There is a big cost of context switch. If you are such a genious, that you can just jump around in entirely different codebases fixing entirely different set of problems, in a way that actually improves things, than hats of to you, because I can't. I am not bored and I am fully occupied maintaining my own OSS codebase and I doubt some random dude could just come and fix a problem there (unless it is a really trivial one).

People (sysadmins) have been doing this for years--it's nothing new. Software doesn't break that often. You generally start with wherever you're hitting the bug. Maintaining, running, and operating software is significantly different than writing from scratch (and generally less labor intensive)

What do you do when you hit a bug in production caused by some OSS? Throw your hands up and tell management you opened an issue on the issue tracker?

This sort of thing should be required reading by everyone who interacts with open source software.

So many folks come in with a chip on their shoulder, missing the forest for the trees. If every developer modeled themselves after Tatham's attitude, we probably wouldn't be having most of these conversations around open source right now. And issue trackers might be a more peaceful place.

edit: fixed the author!

Tatham, rather than Ducker - the former wrote a comment on the latter's link blog.

Indeed, Simon drops by occasionally and leaves a comment if he fancies. This one was so good I thought it was worth sharing more widely.

It's pretty darn weird realising that Simon is actually a person who knows somebody I've met IRL, rather than a mysterious benevolent entity responsible for manifesting the PuTTY suite fully-formed upon the internet ;)

I think I bumped into Simon through a bunch of other Cambridge people I chanced onto via Dreamwidth/Livejournal. I wouldn't say we were even slightly close, but if I was living closer to Cambridge and there wasn't a pandemic he's definitely amongst the people I'd be delighted to say hi to in person.

Cambridge is an interesting place. You can be in a pub with pretty much the entire PuTTY team, at least two Debian project leads, a major bind contributor, and a couple of OpenJDK contributors.

The conversations can get a little geeky. :-)

What an excellent reminder of how easy and effective it can be to not be a jerk. I think there are plenty of people who could take some advice from this.

Are you referring to this?

"But I've always been able to deal with this by pointedly reminding the most demanding people that I'm not at their beck and call. Most of those companies who mistake me for a contracted vendor are prepared to recognise their mistake once I point it out, and the more self-aware ones even apologise. I've not even found it necessary to be especially rude: a plain statement of the facts of life normally does the job. If one of them is rude to me, then the quintessentially British approach of a faint frown and a tone of mild reproof (or its email analogue) generally gets good results – probably a lot better than mouthing off like a sweary 13-year-old in return."

It is easier if you are a native English speaker, because you have a wide range of expressions at your disposal to express disdain or irritation without going nuclear.

It is also easier if you are the single author and not fighting with others in the same code base.

So I don't think easy in general to react maturely, especially if you have made large contributions to a shared code base and some pushy person comes along and makes demands (sometimes the impolite person is another contributor, which makes things worse).

EDIT: Perhaps you meant that the person making requests should not be a jerk, in which case of course I fully agree.

> It is easier if you are a native English speaker, because you have a wide range of expressions at your disposal to express disdain or irritation without going nuclear.

This! I - non-native myself - worked with fellows who learned English late in life and sadly to some share from the wrong sources (action movies and rap music, I'm afraid). Naturally, at times they appeared quite immature. Otoh, I had the good fortune to work with some British fellows, which, at times, was quite educational.

This YouTube-video where a streamer talks about the difference between the communication on EU vs. NA servers always comes to mind when this is discussed. It is quite humorous, and perfectly illustrates your point about native English speakers: https://www.youtube.com/watch?v=8j2iX8Fgq3Q

> But I'm not sure I don't prefer it this way – a labour of love becomes a chore if you can't temporarily put it down when you're running low on love.

That is a very wise comment.

The source code for the core of Putty is an astonishing construction, a sort of extreme case of Duff's device spanning many, many pages. At each point where an operation might block, there is a macro that expands to a break and a switch/case clause that enables returning to that point.

A colleague said "I love it, and hate myself for loving it".

The new "async/await" features appearing in numerous languages encode this pattern -- i.e., result in substantially the same object code -- in a more robust way, but Putty works fine.

How nice it is to see somebody who actually read the license they released their code under and accepts the results:)

Indeed. Though I wonder how many of the “big tech profits from open source and doesn’t pay the maintainers” complaints are from actual maintainers vs. observers with a general axe to grind against big tech.

Sure, at least some of it is from observers: I am one of them. But... Are there any rules against that? If something's true, then is it any more or less true depending on who you are or what you do?

You don't ignore complaints from systems you use for work. This isn't at all a political issue for engineers.

It would be cool if someone would donate to him a domain. Downloading PuTTY involves relying on greenend.org.uk (which isn't obviously connected with PuTTY). You can check your download using the hashes provided on the site; but if the download has been messed with, then the hash is untrustworthy too.

https://noncombatant.org/2014/03/03/downloading-software-saf...

Would the lazy bastards who downvoted parent instead do something useful and post a sensible rely? (Rather then keep turning this place into another Redit).

Link and text from the Putty FAQ below.

https://www.chiark.greenend.org.uk/~sgtatham/putty/faq.html#...

A.9.2 Would you like me to register you a nicer domain name?

No, thank you. Even if you can find one (most of them seem to have been registered already, by people who didn't ask whether we actually wanted it before they applied), we're happy with the PuTTY web site being exactly where it is. It's not hard to find (just type ‘putty’ into google.com and we're the first link returned), and we don't believe the administrative hassle of moving the site would be worth the benefit.

In addition, if we did want a custom domain name, we would want to run it ourselves, so we knew for certain that it would continue to point where we wanted it, and wouldn't suddenly change or do strange things. Having it registered for us by a third party who we don't even know is not the best way to achieve this.

Hah, I once ran a PuTTY download mirror for the clients of an ISP I then worked at.

It was like 20 years ago. Even then it was obvious that they don't want any fancy domains, just that the work is done and putty.exe delivered where it's needed.

I am very happy that there are such great dudes. Respect! I don't even use putty (but its fork, kitty).

People forget one simple fact - WHEN YOU ARE PAYED, U ARE NO LONGER FREE.

There is no substitute for passion work, where YOU are the man, and there is 0 chance somebody will influence you.

I've been paid to (help) maintain an open source project by a company that also offer services and support around that project. When someone report a bug on GitHub, then the bug is triaged and prioritized for both paying customer and open source users. But sometimes open source users would just ask questions in the GitHub bug tracker. Then I'd just close the issue and provide a link to the official support channels (sometimes also answering the question if that's easy enough, but not if I have to ask more info or if I have to search for the answer). Same when open source users would just ask questions by email.

From one of Simon Tatham's replies on the blog:

> In fact, the most recent commercial fork caused us to get a worried email or two – the company's publicity made at least some users worry that the PuTTY team might have been subjected to one of those "buyout and radical change of project direction" scenarios I mention above, and they weren't happy about the idea. [Emphases added -- CRC]

So there is a "team" besides mr Tatham. That's good to hear; I always thought it was just he himself.

gem in the sites comments section

> a labour of love becomes a chore if you can't temporarily put it down when you're running low on love. - simon.t

I paste this every time the subject is raised:

https://liberamanifesto.com/

That’s great in this one case but it doesn’t solve the open source compensation problem. We need a new set of licenses that allow the general freedoms of free software but also force people making large sums of money with free software to send some of it back to the open source projects they depend on.

Simon is genuinely one of the many folks that are represented by this xkcd [0] aptly. Thank You & and a huge shoutout to you and your software that a lot of us use day-in & day-out.

[0]: https://xkcd.com/2347/

The Putty maintainer is Simon Tatham (the commenter), not Andrew Ducker.

:( Apologies and corrected. Thank you!

> If one of them is rude to me, then the quintessentially British approach of a faint frown and a tone of mild reproof (or its email analogue) generally gets good results – probably a lot better than mouthing off like a sweary 13-year-old in return.

I love this.

The discussion around open source in the last few days lends weight in my view to the notion that most engineers are apolitical by nature. Unfortunately larger political entities (that is, BigCorp) have no reservations taking advantage of this.

I genuinely agree with his vision and especially the reason why I can go to sleep sanely.

Simon’s a lovely guy. Met him a few times, he was often around in the local Geek pub[0] back before I moved out of Cambridge.

[0] Same pub as frequented by the guy who proved Magic The Gathering is Turing complete, because Cambridge is tiny.

Putty is great and I thank him for this work :)

I only use it privately now because our work doesn't allow it anymore since openssh was included with Windows. But I still prefer it.

I once wrote a tool in C# that used Putty behind the scenes to connect to routers (and hop through them) and collect interface metrics. Back in 2009 :)

Next let's do one for the openssh people

I used ssh in wsl it works well for me.not sure if I miss anything not using putty?

I use putty for serial and socket connections and only rarely for ssh.

windows 10 has openssh client now, with WSL2 it has many other putty-alike tools, for me, I no longer need putty these days. Thanks for the great ride.

What I got from this was a tiny wake-up call to realize/remember/not lose sight of: the OSS relationship is the one scalable model we've yet found that lets the problem being solved remain the focal point of the effort, deliberately at the cost of everything else:

> Often I feel as if some particular correspondent of mine has simply forgotten that I'm not a paid software vendor who has a multi-million-dollar contract with their employer, and hasn't quite figured out that as a consequence I have no incentive to drop everything and solve their particular problem. [...]

> But I've always been able to deal with this by pointedly reminding the most demanding people that I'm not at their beck and call. [...]

> And if someone keeps pestering in spite of every clue you try to impart, well, there's always the 'just stop replying' option. [...]

> When it comes to companies depending on my stuff, I take the same no-nonsense attitude, because in every free software licence agreement (even the maximally permissive MIT, my usual choice) is that all-important "NO WARRANTY" clause, and it's there for exactly this reason, and I'm happy to push back if people try to ignore that.

We're so sensitive to that inversion effect that can happen when some core technical fascination loses ground to the humdrum of always turning up somewhere 5 days a week, rain, hail or shine... always be checking the bugtracker, always be working on the next feature or component, always be maintaining everything and keeping it together. The regularity and predictability of that continuous process can be reassuring... as long as it remains fundamentally interesting. But as soon as the interestingness fades, everything suddenly feels like a scary monster from a nightmare you can't shake off. It seems to be a ratified status quo that everyone is just expected to deal with this.

While the description doesn't quite relate to the remunerative relationship of the workplace, I generally describe the above as "club mentality": people start out by gathering together, drawn together by the focus of some shared interest; then after some time the focus switches to "we should definitely get together every fortnight", then on some fortnights noone knows what to talk about... aaand before anyone realises it, the incentivization structure that previously drove everyone to bring their best to the table is gone.

Sometimes the meeting-every-fortnight bit happens to further the shared interest - making the process of identifying the switchpoint even harder.

But it's always there - there's a point at which everyone kinda gets less interested, but feels compelled to continue the meetings. These turn out to be filled not with awkward pauses; there's somehow always still something to do, something to go on with. But anyone fresh would take one look at the situation and immediately call it busywork - it's not furthering the bigger picture, it's just playing Dodgem cars within the sandbox that's been carved out. The kinetic aspect of that makes it easy to believe that impact is being made, provided you don't look too closely at the bigger picture.

The correct but fiendishly difficult response is of course to never lose sight of the bigger picture, and for everyone to be honest with each other about when they've lost interest.

Sometimes that's easy, like when a "band" gets together only for everyone to collectively realize music isn't all that fascinating after a couple months. Disappointing retrospective memory? Doesn't matter, the alternative would have been much more depressing.

It's sad that the difficulty and complexity of writing software means you pretty much have to live through a multi-month or -year period of hum-drum boringness before getting to a reasonable closure point. The only workaround I've yet found is to frequently switch roles, which doesn't really provide closure unless the roles are extremely small-scale, and always tends to be very abrupt in any case.

If you can make it work financially, OSS does indeed provide the most viable scalable solution for this whole problem. Heh. At all costs.

This is a nice post from a healthy person who is comfortable with his position, and isn’t overburdened.

However, what would happen if that were not so?

What would happen if he Could not, Would not, or were Unable to work?

It would all fall apart. And that is the inherent fragility in these small critical opensource projects.

Putty would keep running even if the maintainer disappeared. You can build it yourself. You can find somebody to maintain it for you. What's fragile about that?

Or someone else would fork the code, most users would eventually migrate to the new project, and life goes on.

I think somebody else would pick it up. Simon is not the only person who works on PuTTY and there are several people who might reasonably pick up the security side of things. The various UI bits might be slightly less well distributed, but I am sure somebody could be found in pretty short order.

Reply on news.ycombinator.com