PuTTY 0.63 released, fixing four security holes | Hacker News Reader

PuTTY 0.63 released, fixing four security holes

chiark.greenend.org.uk

138 pointsbwblabs84 comments

The security holes are not critical but of course you should upgrade anyways.

3 of the holes have the following notice: We are currently unaware of any way in which this can lead to remote code execution.

4th hole is that putty does not cleanup sensitive memory when it could.

3 better-safe-than-sorry-in-improbably-scenario ones and one that requires an attacker to have physical access to your machine (or just to your memory and a good freezer, if you remember that hack hack :)

Seems like the best time to upgrade is in a few weeks after the crypto community had some time to analyse the changes. Maybe upgrading in a rush is as bad nowadays than not upgrading, with all the ... terrorism?... going on.

Since starting to use Windows 8, I found that the grouping behavior of the taskbar combined with a dozen open PuTTY windows drove me insane. There's a multiple-tabbed PuTTY shell, but it was hard to get used to as well. I finally switched to the Chrome SSH client, which has been much better (though it doesn't have nearly the features of PuTTY, of course).

mRemoteNG gave me my sanity back: http://www.mremoteng.org/

If you right-click the taskbar and select properties you can choose the grouping behavior from Always, When Full or Never. You can also change the size of the taskbar buttons to small if you don't prefer the default.

You can turn off the combining but you can't turn off the grouping. (unless 8 reverted what vista/7 did)

Also annoying is that your only options are 'combine, without text' and 'don't combine, with text'. Why is windows so fond of using one toggle where there should be multiple toggles?

If you've got a dozen open PuTTY windows, you should really look at SecureCRT. Tabbed sessions, tiling, configurable keyboard/mouse shortcuts, password encryption/automatic session login and best of all, scripting support for Perl/Python.

It's $99, but I've easily saved 1000x that amount by being able to quickly script shell interactions that don't easily lend themselves to the regular scripting tools like 'expect'.

I think the best example was where a distributed cache cluster was dirtied during a deployment. Dumping the entire 100TB+ of good data was not an option, it would have taken days to warm back up. The cache admin tool had a menu system and wouldn't buffer input, so I couldn't just dump a buffer of commands into it and wait for it to finish.

I was able to lookup recently accessed DB rows in SSH tab #1, compare them to the cache in tab #2, and invalidate in another in tab #3. Problem solved in <20 minutes. We eventually built an app to invalidate dirty cached results, but that took about a week to do it the right way.

yeah, because managing windows is not the problem a window manager would be responsible for... what then? you have a dozen word documents? and a dozen text files? and a dozen images? ... do you keep changing your tools everytime you pass a window number threshold?

just get rid of windows 8. as troll as this comment may sound...

just get rid of windows 8

I'm not aware of the grouping functionality changing between 7 to 8, at least to the extent that 8 doesn't group more aggressively than 7.

In both operating systems you can customise whether applications are grouped or not.

And although it's not necessarily PuTTY's job to change because of a new feature in the OS (taskbar grouping), I'd note that there is an API for controlling it [1].

[1] http://blogs.msdn.com/b/oldnewthing/archive/2012/08/20/10341...

in win8 if you are using a metro application you can't switch to a specific window right away in all the ways you can with windows 7. at least not in the old build i used.

I can't disagree, but I doubt that if you're using PuTTY you're using Metro.

metro is built in. there is no "not using metro"

Get rid of it for what? This is purely a troll; you offered no solution. I can't even imagine what you're referring to; is OSX or Ubuntu going to make managing my windows any better?

Note: I'm well aware of workspaces, but that can't be what you're referring to, as they are available to Win users, and it's not clear the OP is looking for anything more than tabs, which a WM isn't generally providing.

Linux is bigger than Ubuntu. There are Linux WMs that are FAR beyond what's available in Windows or OSX.

Obviously. Nothing you said is helpful to the OP or helps to support the post I replied to. Not to mention, Windows has numerous windowing or window tiling managers [0]; the Linux elitism is not helpful, especially when grossly misinformed.

[0] http://en.wikipedia.org/wiki/Tiling_window_manager#Microsoft...

Thanks, I didn't know about these. (I am stuck with Windows at work..)

You can run any WM Linux has on Ubuntu. I've heard good things about evilwm and have personally used ratpoison. They're both in the repository I'm sure.

I thought it'd be obvious I was speaking generally; suggesting "any WM" to the OP is still not helpful. Windows has just as many "any WM," so I really don't know your point.

> Windows has just as many "any WM,"

No. It doesn't. Windows has one GUI and various themes for it; Ubuntu has multiple GUIs. That's what a WM is in Linux terms: A whole new GUI that sits on top of very basic graphical primitives which don't determine anything about how a GUI looks or works.

> Get rid of it for what? This is purely a troll; you offered no solution. I can't even imagine what you're referring to; is OSX or Ubuntu going to make managing my windows any better?

Try XMonad on Linux. It does allow me to manage my windows better.

I feel like a broken record. The OP uses windows. The comment I replied to insists Windows is garbage and the OP should jump ship, because there's no hope for Windows managing windows. It's ludicrous to suggest Linux to OP, when he simply wants to manage his PuTTY windows differently (Re: his WM technically already manages the windows [grouping], but it's not what he wants); it is made more ludicrous by the fact that there exist tiling window managers for Windows -- see my other comments to SIBLINGS of your's.

Not that a tiling manager is going to be of ANY help in OP's case; I really doubt the auto-scaling and tiling of his windows is what is making him struggle with dozens of PuTTY instances.

if he's using win8 i'm pretty sure his only option is win7...

It more than sounds a troll comment lacking any thought.

That's like saying tabs should not be in Chrome/FF and Windows/OSX/Linux flavor should handle all of your browsing windows just fine.

Things like tmux would also be a bad thing in your world, the window manger should handle this!

GP needs a putty manager (many exist) and will solve his needs. Much like other programs across multiple OS's solve the same need

Regarding the grouping behaviour of Windows, I have long been using 7+ Taskbar Tweaker [0]. I believe it works with Windows 8 as well, but I have never used it on 8.

You can configure it in many ways. I have it always show small icons, but you can have it group icons by program and have them auto expand on mouse hover.

[0] http://rammichael.com/7-taskbar-tweaker

It's been a while since I was stuck on a Windows box, but I found the combination of Console2 (tabbed terminal emulator) with Cygwin[1] was quite nice. Then you can use `ssh', `scp', etc. like you would on a Unix machine. You might want to try this approach if you're willing to go as far as to do this from your browser (which gives me shivers). This was on Windows XP but I imagine it still works.

[1] http://sourceforge.net/projects/console/files/

Console2 looks good.

I played with "Putty Session Manager" for a while before moving entirely to Mintty under Cygwin.

You should have a look at ConEmu[1] as well

[1]: http://code.google.com/p/conemu-maximus5/

There's a fork named ConsoleZ [1] which is more actively developed. It provides a number of features which goes well with newer versions of Windows.

[1] https://github.com/cbucher/console/wiki/Downloads

The Chrome SSH client is close to becoming very useful for me. I stopped using it because IIRC you can only store a handful of connection credentials at a time.

If you have a ton of shell connections open at once, consider trying a "base station" linux machine from which you jump out to other machines, + tmux. This way you ssh to machine1, run tmux, then you can create as many sessions as you want in whatever combination of windows/tabs you like. Bonus: you can disconnect from machine1, and when you reconnect everything is still in place. Worth a try for sure!

My first thought was this sounds a lot like the "screen" command. Which is basically true, but with the added benefit of screen splitting. Also, tmux is distributed under the BSD license (instead of GPL).

http://www.wikivs.com/wiki/Screen_vs_tmux

That article implies that tmux is faster than screen. While it may be the case that it uses fewer resources (which I've not checked), it's exclusively been my experience that tmux is laggy where screen isn't.

That's not been my experience at all - I can't say I've ever seen tmux perform noticeably worse than screen, but under extreme load tmux always seems to cope better. e.g. dumping 250k lines takes screen over a minute, while tmux will be done in under 3 seconds and be more responsive while that's happening. It's nice to be able to ^C something spammy and not have time to go make a cup of tea before it responds.

I have experienced lagginess with tmux, but this has been more down to VTE and/or mosh performing particularly badly with large terminals. A fullscreen 266x188 tmux session on urxvt is massively smoother than with Terminator/gnome-terminal/Terminology/etc, and with remote sessions ssh is similarly massively smoother than mosh. Kind of disheartening given today's ridiculously powerful hardware.

Weird. I've had tmux lock up when too much text gets dumped through it.

I am probably a putty diehard... i love the simplicity of it. I get around this by using screen in just one putty window.

Disable the grouping?

Properties, Taskbar buttons, Never combine.

That doesn't turn off grouping, it turns off combining.

Grouping puts taskbar entries from the same app next to each other.

Combining turns multiple entries for the same app into 1 entry. To select a particular window, you have to hover over or click the combined entry - which causes large thumbnails of each of the combined windows to be displayed, then click the appropriate window thumbnail.

I've used Putty Connection Manager for tabbed management of multiple Putty windows for a few years now. Here's an older article about it:

http://www.thegeekstuff.com/2009/03/putty-extreme-makeover-u...

Unfortunately the URL for the download is down at the moment. I know, inspiring, but here it is:

http://puttycm.free.fr/

It can be found on the Putty "links" page under "Multiple connection" here (along with some other options):

http://www.chiark.greenend.org.uk/~sgtatham/putty/links.html

I used to use SecureCRT until I got tired of their weird format for private keys (not sure if that's still an issue since I stopped using it a few years ago).

Anyways, for what I was looking for Putty Connection Manager worked fine. Open many connections and cycle through the tabs with CTRL+TAB.

I like MTPuTTY - http://ttyplus.com/multi-tabbed-putty/ - and I'm curious if you used this or another version.

You can disable grouping, change the size of task bar, etc. I guess nowadays "hackers" prefer to bash Windows on HN, rather than learn how to use it effectively ...

Since putty.exe is so small you could make a bunch of copies. Launch putty1.exe for the first session, etc.

Duplicating the PuTTY binary for each session makes about as much sense as having a separate MS Office installation for each and every Word document.

Except Word is huge and probably can't handle multiple installations. I admit its a hack.

It's not Word that would handle the multiple installations, it would be your HDD - since all that matters is the storage space you have available.

But that's moot as you'ed missed my point. I'm talking about how you only need one install of Word to open up multiple unique word documents. Just as you only need one copy of PuTTY to run multiple unique SSH sessions. duplicating the exe isn't a hack; it's just an unnecessary waste of disk space since you gain literally nothing (all the different exe's will point to the same registry keys for their profiles and all the exe's can run multiple instances).

And this is why I made my Word analogy - because what you're advising is worse than useless.

Little late to the party, but I did not find a way to paste from clipboard when using windows and Apple keyboard. Insert key is not working, so ctrl/shift+ins won't work. In putty pasting is done via right mouse click.

Some other projects who depend on PuTTY like FileZilla have new builds too: https://filezilla-project.org/

Is there a client that has UTF8 as default and something different than the courier font?

It's two clicks after you install putty.

select Default, go change those two options (recommend the Mensch font, but that's purely personal). Go back to the sessions screen, save this as default.

done. now every session you create will have UTF8 and a decent font by default.

I also suggest you change scroll back to 999 or 9999. And change the color of bold blue to something readable.

Those are actually more than two clicks and sadly enough to frustrate me every time.

There must be a fork with sane defaults out there somewhere.

You could probably export a Registry file that has all your settings and then import on a new machine.

if you are a putty user, do this. its very time consuming to set up putty especially colors but its easy to keep all your settings in a reg file.

The last time I used windows a bit (I think it was around the Planetside 2 launch...), I noted down this:

# set up for putty: # From: http://mshnitzer.wordpress.com/2009/10/09/export-putty-setti... comment:

reg export HKCU\Software\SimonTatham putty.reg reg import putty.reg

I'm not sure what's the standard now, but I also always set "use ssh protocol v2 only" -- and you probably should too (on the off chance that you have some ancient device that doesn't handle version 2, you should probably make an exception in that profile).

The fork I'm just about to patch is FuTTY - https://github.com/FireEgl/FuTTY which includes save-settings-to-file. The screen resizing behaviour (as a result of Screen's +flow command) might drive you crazy though.

PuTTY beta 0.63 defaults to UTF-8 encoding and 2000 lines of scrollback (rather than ISO 8859-1 and 200).

UTF-8 is the default as of v0.63 [1].

[1] http://www.chiark.greenend.org.uk/~sgtatham/putty/changes.ht...

As an alternative to PuTTY, MinGW with the OpenSSH package has been great.

I was using Putty Connection Manager (puttycm) to allow for tabbed browsing of multiple windows, and after upgrading Putty I now get issues. Loads nothing but a grey screen.

I'm working my way through it, but just wanted to pop in to see if anyone else had an issue.

Circling back. Here's the solution:

=> open Putty Connection Manager

=> select Tools > Options

=> select Plugins > Putty

=> select "Enable additional timing for PuTTY capture (ms): set to 300ms

=> select Apply & OK

I wonder if the diff will apply cleanly to Futty/PuTTYTray - they're still based on a 2012 build of 0.62.

Edit: Blergh, SVN.

PuTTY's pretty much relegated to the emergency usb key these days. Runs on pretty much any Windows and without installing, but not really ideal for heavy use imho.

Cygwin + urxvt + clusterssh is the choice of Windows-mandated champions.

If anyone is looking for a Putty alternative, check out ZOC. It's great but it costs money.

It's 2013. Why the fuck is anyone still using Windows?

Because most of the world's work is still done on Windows.

just out of curiosity: what are you using?

Because Linux is good only when used from the command line, and Mac OS doesn't run on commodity hardware. That leaves only Windows as a viable option for most people.

Well, OSX does run on commodity hardware (often with little to no modification). It just isn't sold on non-Apple hardware and the EULA "forbids" it

I know this is a troll statement, but I feel Windows does a lot of things well.

* For large organizations, domain controls make managing a large number of desktops much easier.

* I feel MS Office on windows is a better product than the mac version (if you do a lot of document work).

* Gaming. Windows is still dominant for desktop games.

* Windows isn't the walled garden that Mac is going towards.

* Backwards compatibility. Software written 10+ years ago for Windows still has a good chance of working on Windows 8.

* Familiar. People are used to it. I'm not going to force my parents to learn a Mac and all the weird behaviors that go with it.

* Isn't tied to hardware only made by Microsoft (which makes hardware a commodity).

I'm sure there are a number of other points I'm missing, but it's the ones that I like. But there are a number of things I really dislike about it:

* It's not unix based. So the filesystem layout differs, I can't share perl/bash scripts as easily across them. / vs \ for filesystem paths. EOL characters in ascii files.

* It took too long to get a good command line. Powershell is nice, but just too different than what I'm used to with Bash that I get on OSX and Linux.

* Many developer tools today are becoming OSX focused. Windows has a lot of great software still, but many of the smaller nitch tools that I discover are OSX or Linux focused.

> * I feel MS Office on windows is a better product than the mac version (if you do a lot of document work).

Absolutely. I wonder if the MS Office for OSX team ever tried using it, or exchanging documents between Windows and OSX. The different epoch startdate in Excel on both platforms... bleurgh.

The crappiness of Office for Mac is 50% of the reason I have a VMWare Windows box (the other 50%? Testing websites on IE9)

Would you mind explaining what domain controls offer? I've never worked with a large windows desktop install base, so I have no idea what domain controls do exactly.

A "Domain Controller" is basically a server that has authority for a domain. A domain in Active Directory is really the same thing as a "normal" internet domain (in fact is uses DNS) in that it can have sub domains where authority can be delegated to other DCs etc.

Each domain can have a collection of resources such as other servers and printers/storage etc. So once you authenticate against the domain controller (usually by logging into a computer using a pattern like \\Domain\Username rather than just username) you get a secure signed "token" back from the DC.

This token can be sent to other computers on the network that are members of the domain (or sent to web apps via a cookie) and it will identify the user as a member of that domain and also provide information as to what levels of access should be allowed without having to authenticate separately with each system.

That's kind of hand wavey though and Active Directory provides too many features to be enumerated here.

http://en.wikipedia.org/wiki/Active_Directory

I'm a nix guy, but I believe it's for dealing with setting/managing authentication, authorization, permissions, etc.

The big win is Group Policy. You can centrally control every single option, including many applications, for every single Windows system on the domain. It's like puppet on steroids and HGH.

> For large organizations, domain controls make managing a large number of desktops much easier.

The Unix way of putting the resources on the network, and synchronizing /etc works quite well. I've never seen anybody actually claim that AD is better than it. Most people complaining that the unixes don't have administration tools just want them to work like Windows.

Windows is a hell to administer, you can't just clone machines and you can't centralize your resources. You must do what AD allows you, and beg that this time something won't break, because you can't really test anything.

Many of the world's largest companies still run Windows and are heavily invested in it. Also, many admin tools (even for Unix-based services) are written for Windows, because IT admins have to straddle both worlds.

Also, for all its ills, Windows is not a bad platform for most lay users. Yes, of course we've all been bitten by it, but if all you need to do is normal office work, it's not bad.

Pro audio and now, with the direction Apple is going with the Apple Pro/Final Cut, pro video.

IMHO - it has the best windowing system. Trivial perhaps, but it's the one huge thing that continuously bothers me about Ubuntu and OSX.

Give KDE (maybe on Kubuntu) a try. It's pretty easy to make it look and behave a lot like Windows, and alt-right-drag to resize and alt-left-drag to move windows have saved me like a couple thousand hours in fiddly work.

I'd recommend Linux Mint with Cinnamon for the same reasons.

If it's only about the windowing system, you might want to try out a few X Window Managers on Linux. There's more than what comes out of the box with Ubuntu.

(I like tiling window managers like XMonad for example.)

What does that have to do with anything? PuTTY is not windows-exclusive.

What are the benefits of using PuTTY over plain ssh in a *NIX environment?

Putty has nice nethack support.

You can also run nethack under 'cp437' (https://github.com/keaston/cp437) to use the IBMGraphics option on a UTF-8 terminal like gnome-terminal.

Putty on linux has been very useful to me several times, when preparing screenshots for documentation for windows users.

Its 2013. Why the fuck do you care what other people use? I'm suprised you didn't break out the 'Micro$haft Winblows!!', or are you saving that for later?

Sent from OS/2

Reply on news.ycombinator.com