18 ms·

PuTTY 0.68 has been released

243 points by based2 10y ago

based2 10y ago
Release Notes: Security fix: an integer overflow bug in the agent forwarding code. See vuln-agent-fwd-overflow. Security fix: the Windows PuTTY binaries should no longer be vulnerable to hijacking by specially named DLLs in the same directory (on versions of Windows where they previously were). See vuln-indirect-dll-hijack. Windows PuTTY no longer sets a restrictive process ACL by default, because this turned out to inconvenience too many legitimate applications such as NVDA and TortoiseGit. You can still manually request a restricted ACL using the command-line option -restrict-acl. The Windows PuTTY tools now come in a 64-bit version. The Windows PuTTY tools now have Windows's ASLR and DEP security features turned on. Support for elliptic-curve cryptography (the NIST curves and 25519), for host keys, user authentication keys, and key exchange. Support for importing and exporting OpenSSH's new private key format. Host key preference policy change: PuTTY prefers host key formats for which it already knows the key. Run-time option (from the system menu / Ctrl-right-click menu) to retrieve other host keys from the same server (which cross-certifies them using the session key established using an already-known key) and add them to the known host-keys database. The Unix GUI PuTTY tools can now be built against GTK 3. There is now a Unix version of Pageant.
- JonRB 10y ago
  This is the information I came to find. Thanks!
  - xs 10y ago
    Why would such a small, simple program need to be 64 bit? Exactly what changes when moving puTTY from 32 bit to 64 bit? It now takes up more memory?
    - rb12345 10y ago
      The most likely reason is ASLR support, since you have more address space available for randomisation. Other than that, you can probably get a slight boost in performance from the differences between x64 and x86, but lose out if the code is particularly pointer-heavy.
    - gfody 10y ago
      We are well beyond moving to 64bit on a needs-only basis. At this point it's about dropping legacy and future proofing. There's also no reason 64bit apps should have a larger memory footprint; the ISA and addressing modes are actually much tidier.
    - executesorder66 10y ago
      Here are the reasons they now provide a 64bit version: http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/win64-binaries.html http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/w...
- Cogito 10y ago
  Thank so much for posting this. Perchance, could you remove the quote formatting as it makes it nearly impossible to read on mobile?
  - 0x0 10y ago
    Or visit the source: http://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html http://www.chiark.greenend.org.uk/~sgtatham/putty/changes.ht...
    - Cogito 10y ago
      Thanks, this is probably a better landing page for HN than the linked release page! I had a quick hunt for it but couldn't see it on the release page.
  - Cyphase 10y ago
    Security fix: an integer overflow bug in the agent forwarding code. See vuln-agent-fwd-overflow. Security fix: the Windows PuTTY binaries should no longer be vulnerable to hijacking by specially named DLLs in the same directory (on versions of Windows where they previously were). See vuln-indirect-dll-hijack. Windows PuTTY no longer sets a restrictive process ACL by default, because this turned out to inconvenience too many legitimate applications such as NVDA and TortoiseGit. You can still manually request a restricted ACL using the command-line option -restrict-acl. The Windows PuTTY tools now come in a 64-bit version. The Windows PuTTY tools now have Windows's ASLR and DEP security features turned on. Support for elliptic-curve cryptography (the NIST curves and 25519), for host keys, user authentication keys, and key exchange. Support for importing and exporting OpenSSH's new private key format. Host key preference policy change: PuTTY prefers host key formats for which it already knows the key. Run-time option (from the system menu / Ctrl-right-click menu) to retrieve other host keys from the same server (which cross-certifies them using the session key established using an already-known key) and add them to the known host-keys database. The Unix GUI PuTTY tools can now be built against GTK 3. There is now a Unix version of Pageant.
    - 10y ago
- MrRadar 10y ago
  This release also adds support for the ChaCha20 AEAD cipher and encrypt-then-MAC modes for non-AEAD ciphers. Not sure why those aren't included in the release notes.
- zer0t3ch 10y ago
  > Support for importing and exporting OpenSSH's new private key format What new private key format is that?
  - jwilk 10y ago
    http://www.tedunangst.com/flak/post/new-openssh-key-format-and-bcrypt-pbkdf http://www.tedunangst.com/flak/post/new-openssh-key-format-a...
- caf 10y ago
  Isn't this "DLL hijacking" thing a bit overblown? The directory an application runs from on Windows has always been considered part of the security perimeter of the application. If you can drop a malicious DLL where putty.exe lives, can't you just drop a malicious putty.exe?
  - __jal 10y ago
    Not a windows person, so I can't speak to how the directory is treated, but I've watched enough people run applications from the Downloads directory to wonder about it.
    - beachstartup 10y ago
      with putty i would be surprised if most didn't run it straight from the desktop. i would be a dirty liar if i said i haven't, countless times.
      - monk_e_boy 10y ago
        This. Without an installer that puts a link into the start menu, everyone I've ever worked with just dumps it on the desktop. I used to throw a symlink into the start menu, but when other devs used my machine they expected it to be on the desktop. Just one of those quirks of using PUTTY
        marvy 10y ago
        But why not just use the installer?
        gasda 10y ago
        I was going to say putty does not have an installer, but TIL putty now has an installer..
        hermitdev 10y ago
        For a long time, there wasn't an installer for putty, so a lot of us became accustomed to just dropping the binary on our desktop or "bin" folder", but there is an installer now. Also, certain corporate environments that preclude the installer from working correctly, but won't mind you "installing" a program to your desktop/local app data.
- james_a_craig 10y ago
  Buried in the FAQ and not in the changelog for some reason:- As of 0.68, PuTTY will no longer fall back to SSH-1 if the server doesn't appear to support SSH-2; you must explicitly ask for SSH-1.
gcp 10y ago
Putty used to be the go-to tool for Windows SSH, but nowadays I'm using Bitvise SSH client. It's worth a try.
- kiwijamo 10y ago
  What advantages does it offer over PuTTY?
  - gcp 10y ago
    Easy to open multiple terminals from the same connection, built-in SFTP. Probably better font rendering or something.
    - bananaboy 10y ago
      In PuTTY you can right-click on the title bar and click "Duplicate Session" to open another connection to the same server (if that's what you mean).
      - gcp 10y ago
        I think this opens a new connection rather than opening a second shell in the existing one.
- verbify 10y ago
  Odd, I moved into the opposite direction. But now I'm using git bash.
- jlgaddis 10y ago
  SecureCRT is what I always used on Windows but it's not free.
- el_duderino 10y ago
  Have you ever tried XShell5? https://www.netsarang.com/products/xsh_overview.html https://www.netsarang.com/products/xsh_overview.html It's free for Home/school use. I have tried all Windows SSH clients, and it is by far the best SSH client I have ever used.
jimmcslim 10y ago
On Windows 10, with Windows Subsystem for Linux installed, I don't find myself using Putty anymore.
- coreyp_1 10y ago
  Same here, but I can't figure out how to fix my main annoyance with the WSL: deactivating the bell!!! There is no reason for my computer to be making noises when I'm using tab completion!!!!!!!!!!
  - JoBrad 10y ago
    Have you tried this? To disable beep of the bash you need to uncomment/add set bell-style none in your /etc/inputrc file To disable beep of programs like vim (I've tested only with that) you need to create - if it's not already there - a .bash_profile and add setterm -blength 0 http://stackoverflow.com/a/36726662 http://stackoverflow.com/a/36726662
    - coreyp_1 10y ago
      You are my hero!!! Thanks! It worked perfectly!
    - mszcz 10y ago
      Thanks! Had the same exact problem that annoyed the shit out of me! Turning off the bell in default Putty settings is the first thing I do on a new install.
- JorgeGT 10y ago
  I only miss the right click on the taskbar icon with the stored connections! I would be nice if you could pin aliases in the Ubuntu icon...
- sbuttgereit 10y ago
  I don't use PuTTY either for the same reasons as you, but I do continue to use Pageant. I use a mix of Windows and Linux tools and I only really want to enter my SSH cert credentials at start-up. So I still end up installing it. I also use Bitvise for tunneling on the Windows side as well.
drzaiusapelord 10y ago
Pretty happy with the Kitty fork of putty, which is a lot less spartan with features. https://www.fosshub.com/KiTTY.html https://www.fosshub.com/KiTTY.html
- snksnk 10y ago
  And I would recommend MobaXterm, definitely also worth to try. http://mobaxterm.mobatek.net/ http://mobaxterm.mobatek.net/
  - atomicUpdate 10y ago
    It's definitely very good and has a lot to offer, but I still can't justify $70 for some reason. The free version offers enough functionality to be a very good PuTTY alternative though.
    - petee 10y ago
      I was about to, until I read the fine print and realized it's $70 to buy, but you'll only get updates for a year; after that you buy again or stick with your current version - no bug fixes. Were there a more reasonable price for non-commercial use, I would have no problem buying sooner. On the other hand, its has the only windows Mosh implementation...the best thing since sliced bread and tmux!
      - tokenizerrr 10y ago
        For mosh there's a cygwin build and also https://chrome.google.com/webstore/detail/mosh/ooiklbnjmhbcgemelgfhaeaocllobloj https://chrome.google.com/webstore/detail/mosh/ooiklbnjmhbcg...
  - DogRunner 10y ago
    I just wanted to recommend ZOC (Which may some people still know from the good old Amiga times). It's available for Windows and MacOS. ZOC does have some really incredible features (integrated file transfer, multi-execution, team-directories). It's similar prices as MobaXterm, but doesn't have XWindows support. If you don't need X-Window support, but rich terminal/ssh features, it may be a ($70) try. https://www.emtec.com/zoc/index.html https://www.emtec.com/zoc/index.html
hughes 10y ago
It always makes me sad to see that the PuTTY download page is served over unsecure HTTP.
- agumonkey 10y ago
  I wonder why it's still the case. Lack of resources to enable HTTPS ? lack of manpower ? ..
- r1ch 10y ago
  At least the binaries are authenticode signed now, so checking they are legit is just a right click away.
  - anderskaseorg 10y ago
    How is that supposed to help? Even if the legitimate binaries are Authenticode-signed now, a malicious non-Authenticode-signed binary substituted by an attacker MITMing the insecure HTTP connection will appear to the downloader to look just like the legitimate non-Authenticode-signed binaries of previous versions that they’ve been downloading for years.
    - Godel_unicode 10y ago
      Because you can add the signing cert to your AppLocker whitelist, and now it will be checked every time it runs. Then you push that out by GPO, and now everyone has that same whitelist protection. Also, as mentioned other places on the thread, the downloads are over HTTPS. Edit: see the following https://technet.microsoft.com/en-us/library/dd723683(v=ws.10).aspx https://technet.microsoft.com/en-us/library/dd723683(v=ws.10...
  - morecoffee 10y ago
    Right clicking is one click too many. Wouldn't it be better to get the binary securely in the first place?
- niftich 10y ago
  But the downloads themselves aren't -- those are served out of https://the.earth.li/~sgtatham/putty/0.68/ https://the.earth.li/~sgtatham/putty/0.68/ For later reference, here's some sha512sum excerpts for version 0.68: ea03a52d344699c10e66e4f0424fba2b31d13d00ed24e1822c8ebe80fa589ce862419e5e852d6e1cb986637ea4e04d6cbe5ff3f1171ca403c9e55681877a712d w32/putty.zip 71c98de058e3f3fda9558cea955a5da28f41ae45464cafe9ea0b22ecf8cfeb56b1b047fb4b694b0c8e7c230f631dce9dd5bad26d70240b07b64ba27c3500d1fb w32/putty.exe 2b6b1acc51fc9cfe8a08e17afc4ac7d962af4575d55806456aa1a42c563f14457cc81d7e625191fd856b4be9a0e885cef78da4018d542010eba18718bb73fecd w32/putty-0.68-installer.msi debceaa83bb48e7adcc99d03bf152f599477bf960da8c7ea3924925ac5322a9470c4254285d6ff403ad5da78c4c19c25ea5b0c1da45c61d9f0b306b16d0d28f7 w64/putty.zip 29d47c1f5a51e9d59720ccea8eacc317f4b8b839c71f957db713e62d2a9526502fefc01855be97e9e8020d1f343a6a14346a21f4843c12d93ee038a8f9810966 w64/putty.exe 8262c133e3569dcc188e5ac2360ebd3cc09d9edd2f78d6eaaf0e2762fba511de07ce614ba4fedf5f62fe64dd17d5a626dc63a579ee1fc1ef90f45e9e1f0c3d06 w64/putty-64bit-0.68-installer.msi aacd9ec017e3cf56924d75d69f1610512662630c699ee09b4d9012f4e34e608b5b335444cf2529bcfe9c4edbded1c7247338d859385108544b27eeeb74d505c6 putty-src.zip
antidaily 10y ago
Pfft... not touching it until they get to a version 1.0 beta.
- marvy 10y ago
  This thing's been stable for over a decade :)
- Pharylon 10y ago
  Lol. I wonder why they're still sub-1.0.
  - Aloha 10y ago
    Vanity version numbering is a thing.
- mixologic 10y ago
  Their git repo goes back 18 years to 'beta-0.43'. :/
bobsgame 10y ago
I've got 4 instances open right now. Thanks, Simon and co!
geoffmcc 10y ago
Now if only I could click a link and have it open in a browser.
- Viper007Bond 10y ago
  https://puttytray.goeswhere.com https://puttytray.goeswhere.com
- dannysu 10y ago
  I'm currently using a PuTTY fork called KiTTY and it has that feature as well: https://www.9bis.net/kitty/?page=URL%20hyperlinks https://www.9bis.net/kitty/?page=URL%20hyperlinks
INTPenis 10y ago
Since I switched to cygwin for ssh on windows I haven't looked back, putty is awful for someone coming from Linux normally and only forced to use Windows for certain things.
- aao 10y ago
  Yeah. I use a modified mintty-solarized-dark theme for cygwin, and symlinked my windows home dir into the cygwin one. I never got around on writing a blag about how to do this, but I like it a lot
  - INTPenis 10y ago
    Exactly the same for me, mintty with solarized theme because I use solarized on all my other terminals in Fedora for example.
Raticide 10y ago
I've stopped using PuTTY and now use MinTTY with the Ubuntu subsystem and the regular old Ubuntu SSH client. Specifically this thing: https://github.com/mintty/wsltty https://github.com/mintty/wsltty It's real nice and even supports 24bit colour if you're into that.
- ReverseCold 10y ago
  Another option: SSH inside WSL in windows 10.
  - Raticide 10y ago
    The default terminal was a bit limited for me, but I hear they're making big improvements to it in later builds.
    - bubblethink 10y ago
      I tried that briefly too, and I couldn't launch screen. It seems to trigger some old bug in screen. How far is the WSL terminal from the usual fanfare (screen, tmux, proper colors in the terminal and text editors, and other edge cases for scrollback etc.) ?
- lma21 10y ago
  Can tmux start within the WSL?
  - my123 10y ago
    Yes. ;-)
    - lma21 10y ago
      that's amazing, I will definitely try it
- lma21 10y ago
  Can tmux start within the WSL?
sengork 10y ago
I wish they would finally implement file transfers via copy/paste mechanism inside an active terminal window. As far as I know this feature would be unique across platforms. If someone does know of an SSH terminal client that does this, please reply.
- xs 10y ago
  How about dragging to the terminal? This is a feature of mobaxterm. Upon ssh'ing to a system, a sftp session is automatically opened as well.
  - sengork 10y ago
    Thanks that's the form of the function I was referring to. Indeed as previously mentioned there are xmodem/uuencode alternatives but none of them would be as efficient and reliable as native SFTP/SCP.
- toast0 10y ago
  EDIT: Realized you wanted to paste a file, instead of drop a file. I'm not really aware of anything that manages that. This page[1] says SecureCRT can do it, and I saw some things referencing that Konsole can too. I searched for 'drag and drop zmodem' to get started. [1] https://www.vandyke.com/support/tips/dragdropft.html https://www.vandyke.com/support/tips/dragdropft.html
- ianmcgowan 10y ago
  Reminds me of the bad old days of kermit and x/y/zmodem. http://www.extraputty.com/features/xmodem.html http://www.extraputty.com/features/xmodem.html looks like a throwback to those days, over an ssh session. I wonder what you have to run on the server side for it to work? Does uuencode or base64 work for you? I use it a lot to move stuff (aka my toolkit) to systems where I'm connected via citrix -> rdp -> ssh -> ssh. Amazingly, it works fine, though it can be slow. $uuencode sheet1.xml sheet1.xml | pbcopy (switch to remote session) $uudecode (paste, which varies depending on how I'm connected) $ls -l sheet1.xml Ta-da!
  - 10y ago
wtbob 10y ago
When I started my career nearly 20 years ago, back before one could convince a Fortune-100 company to let its peons use Linux on our desktops and Apple hadn't yet had its renascence, PuTTY was a veritable godsend: it did what was needed, and did it remarkably well. It's been years since I was allowed to add a Linux box, and years since I switched to Linux full-time, and now I honestly think that I'd reject a job offer which required Windows (and maybe even one which required macOS) — but for all those years of Just Working™, thanks PuTTY!
jjcm 10y ago
Loved putty for years, but these days I've been using mosh over ssh. Having persistent sessions and text prediction means no more dropped connections, no more waiting a couple seconds if the wifi is buggy for whatever reason. Personally I use chrome's mosh extension: https://chrome.google.com/webstore/detail/mosh/ooiklbnjmhbcgemelgfhaeaocllobloj?hl=en https://chrome.google.com/webstore/detail/mosh/ooiklbnjmhbcg... Works great and I can pin it to my taskbar. Relevant recent discussion on mosh: https://news.ycombinator.com/item?id=11572146 https://news.ycombinator.com/item?id=11572146
- JdeBP 10y ago
  The State Synchronization Protocol still does not have specification doco, as far as I am aware.
xeeeeeeeeeeenu 10y ago
Lack of of Ed25519 support is a deal-breaker for me. It's one of the reasons why I'm using SecureCRT instead.
- krallja 10y ago
  Isn't Ed25519 support added in this release?
  - xeeeeeeeeeeenu 10y ago
    Oops, indeed, I somehow missed that.
scandox 10y ago
Has much changed since this? https://noncombatant.org/2014/03/03/downloading-software-safely-is-nearly-impossible/ https://noncombatant.org/2014/03/03/downloading-software-saf... Related comments: https://news.ycombinator.com/item?id=9577861 https://news.ycombinator.com/item?id=9577861
ulkesh 10y ago
Putty is great and has been for a very long time. Always glad to see it still in active development. Though, for Windows, once I found MobaXterm I never looked back. Of course on the Linux side nothing to me beats tmux or terminator.
- mkj 10y ago
  And the SSH part of MobaXterm is based on PuTTY
  - ulkesh 10y ago
    I honestly didn't know that. Very cool!
  - BrandoElFollito 10y ago
    Yes, and unfortunately you have to use the version in there (you can't upgrade nor use another client). Otherwise I love mobaxterm and bought a few licenses.
chrissnell 10y ago
Putty is fantastically fast on Linux! I wish there was a way to use it as an xterm replacement without having to SSH to localhost. Has anybody figured out how to do this?
- morecoffee 10y ago
  Putty is actually quite slow, due to not implementing AES with the Intel intrinsics. Trying to transfer files using pscp, or WinSCP (which uses putty) over a local network link runs into a CPU bottleneck.
wst_ 10y ago
Years ago, when I worked on Windows, putty was a great soft. Since that time I switched to MacOS/Linux with Fish shell at work and running just a simple ssh command from terminal is a bliss. I still have Windows machine at home and I am missing terminal every time I must click though to login to my remote machine. Putty is no fun anymore... User interface has not been improved for years and, sadly, it's not working for me anymore.
- dingo_bat 10y ago
  Try WSL, I think it is a good putty substitute.
mpoloton 10y ago
PuTTY is a good example where the author resisted to turn it into bloatware. It is minimal and does the thing it is supposed to do.
- sumedh 10y ago
  That may or may not be a good thing. Personally I cannot live without tabs and bookmarks so I use mRemoteNG.
  - lma21 10y ago
    I use PuTTY and connect to a tmux server afterwards.. tabs / sessions / programmable interactions with the terminal are a life saver that tmux provides. Give it a try.
ClayFerguson 10y ago
PuTTY has been a sort of industry standard for decades and they're still afraid to put a "Version 1.0" label on it!? Can that be right? I guess Google is still in the "beta" version of their little "Search Engine Thingy" too perhaps. Maybe somebody should invent negative or even "imaginary numbers" for versions, and then it would suffice for this shyness about integers. I don't know. We need Steve Jobs to come back and tell is what to do. (I'm waiting for the ass-holes who will take exception with term "decades". Come on guys. let me have it. Don't i deserve a good HackerNews smacking?)
deleted 10y ago
[deleted]
arca_vorago 10y ago
Putty always served me well when stuck on a windows boxen, so it's good to know it hasn't been forgotten. Two things for those of you who use putty I think would be mosh (chromium if you have to, cygwin my preffered), and winscp.
mytec 10y ago
Long time user of Putty, like many here. I liked this quote from their FAQ (A.3.3 What's the point of the Unix port? Unix has OpenSSH): "There were development advantages as well; porting PuTTY to Unix was a valuable path-finding effort for other future ports, and also allowed us to use the excellent Linux tool Valgrind to help with debugging, which has already improved PuTTY's stability on all platforms."
- bch 10y ago
  This sort of development is often illuminating. I develop on *BSD, Linux, Solaris (SPARC), and MacOS X when I can, and even though they're "all UNIX", interesting insights abound, and dealing w different endianess (SPARC == big, Intel == small), and library differences, etc is rarely more trouble than it's worth.
bananaboy 10y ago
PuTTY is one of the first things I install when setting up a new Windows machine!
jwatte 10y ago
I'd like the putty download to be over https and the installer to be signed. Or, at least, sha512 hashes available on the https download site. As it is, the download source for putty is one of the weakest chains in internet security!
- Sunset 10y ago
  The downloaded binary is served over https, it's signed.
nkkollaw 10y ago
Amazing, I used to use it many, many years ago when I started developing, and it's still a 0.x release... Is there a reason to not call it 1.0?
- lma21 10y ago
  You moved to another platform or another terminal?
  - nkkollaw 10y ago
    Another platform, used to use Windows, then Linux, then Mac.
CyberMuz 10y ago
The default colour scheme on Putty is not very good in my opinion. know I can change it manually but it would be nice if the default for new connections was better.
moftz 10y ago
When is PuTTY going to support URL highlighting? Even plain old xterm can do it. Someone made a patch for it once but I'd rather have the support built in.
account1984 10y ago
I used to use PuTTY as my go-to windows SSH client. After some time I decided to integrate a piece of software with Pageant and I decided to open up the source to PuTTY. The poor quality of the source code terrified me, it seemed sort of "all over the place" and there seemed to be little to no concern for security and defensive programming. Secure software design and development is what I do for a living, so perhaps I am a bit more paranoid than the casual user - but this is one of the most widely deployed security tools in an enterprise, this shouldn't be "okay". Some defensive efforts are just common sense and are recommended by your compiler (eg. don't use sprintf and strcpy when you can snprintf and strncpy). Also, it doesn't hurt to check error conditions consistently. PS. To echo what a lot of folks have already said, how on earth can the author implement cryptographic algorithms and simultaneously think there is any value in publishing a hash of the binary "for security". Using a hash as a means of integrity validation in the context of security raises huge red flags about the authors mindset.

243 points by based2 10y ago

Release Notes: Security fix: an integer overflow bug in the agent forwarding code. See vuln-agent-fwd-overflow. Security fix: the Windows PuTTY binaries should no longer be vulnerable to hijacking by specially named DLLs in the same directory (on versions of Windows where they previously were). See vuln-indirect-dll-hijack. Windows PuTTY no longer sets a restrictive process ACL by default, because this turned out to inconvenience too many legitimate applications such as NVDA and TortoiseGit. You can still manually request a restricted ACL using the command-line option -restrict-acl. The Windows PuTTY tools now come in a 64-bit version. The Windows PuTTY tools now have Windows's ASLR and DEP security features turned on. Support for elliptic-curve cryptography (the NIST curves and 25519), for host keys, user authentication keys, and key exchange. Support for importing and exporting OpenSSH's new private key format. Host key preference policy change: PuTTY prefers host key formats for which it already knows the key. Run-time option (from the system menu / Ctrl-right-click menu) to retrieve other host keys from the same server (which cross-certifies them using the session key established using an already-known key) and add them to the known host-keys database. The Unix GUI PuTTY tools can now be built against GTK 3. There is now a Unix version of Pageant.

JonRB 10y ago
This is the information I came to find. Thanks!
- xs 10y ago
  Why would such a small, simple program need to be 64 bit? Exactly what changes when moving puTTY from 32 bit to 64 bit? It now takes up more memory?
  - rb12345 10y ago
    The most likely reason is ASLR support, since you have more address space available for randomisation. Other than that, you can probably get a slight boost in performance from the differences between x64 and x86, but lose out if the code is particularly pointer-heavy.
  - gfody 10y ago
    We are well beyond moving to 64bit on a needs-only basis. At this point it's about dropping legacy and future proofing. There's also no reason 64bit apps should have a larger memory footprint; the ISA and addressing modes are actually much tidier.
  - executesorder66 10y ago
    Here are the reasons they now provide a 64bit version: http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/win64-binaries.html http://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/w...
Cogito 10y ago
Thank so much for posting this. Perchance, could you remove the quote formatting as it makes it nearly impossible to read on mobile?
- 0x0 10y ago
  Or visit the source: http://www.chiark.greenend.org.uk/~sgtatham/putty/changes.html http://www.chiark.greenend.org.uk/~sgtatham/putty/changes.ht...
  - Cogito 10y ago
    Thanks, this is probably a better landing page for HN than the linked release page! I had a quick hunt for it but couldn't see it on the release page.
- Cyphase 10y ago
  Security fix: an integer overflow bug in the agent forwarding code. See vuln-agent-fwd-overflow. Security fix: the Windows PuTTY binaries should no longer be vulnerable to hijacking by specially named DLLs in the same directory (on versions of Windows where they previously were). See vuln-indirect-dll-hijack. Windows PuTTY no longer sets a restrictive process ACL by default, because this turned out to inconvenience too many legitimate applications such as NVDA and TortoiseGit. You can still manually request a restricted ACL using the command-line option -restrict-acl. The Windows PuTTY tools now come in a 64-bit version. The Windows PuTTY tools now have Windows's ASLR and DEP security features turned on. Support for elliptic-curve cryptography (the NIST curves and 25519), for host keys, user authentication keys, and key exchange. Support for importing and exporting OpenSSH's new private key format. Host key preference policy change: PuTTY prefers host key formats for which it already knows the key. Run-time option (from the system menu / Ctrl-right-click menu) to retrieve other host keys from the same server (which cross-certifies them using the session key established using an already-known key) and add them to the known host-keys database. The Unix GUI PuTTY tools can now be built against GTK 3. There is now a Unix version of Pageant.
  - 10y ago
MrRadar 10y ago
This release also adds support for the ChaCha20 AEAD cipher and encrypt-then-MAC modes for non-AEAD ciphers. Not sure why those aren't included in the release notes.
zer0t3ch 10y ago
> Support for importing and exporting OpenSSH's new private key format What new private key format is that?
- jwilk 10y ago
  http://www.tedunangst.com/flak/post/new-openssh-key-format-and-bcrypt-pbkdf http://www.tedunangst.com/flak/post/new-openssh-key-format-a...
caf 10y ago
Isn't this "DLL hijacking" thing a bit overblown? The directory an application runs from on Windows has always been considered part of the security perimeter of the application. If you can drop a malicious DLL where putty.exe lives, can't you just drop a malicious putty.exe?
- __jal 10y ago
  Not a windows person, so I can't speak to how the directory is treated, but I've watched enough people run applications from the Downloads directory to wonder about it.
  - beachstartup 10y ago
    with putty i would be surprised if most didn't run it straight from the desktop. i would be a dirty liar if i said i haven't, countless times.
    - monk_e_boy 10y ago
      This. Without an installer that puts a link into the start menu, everyone I've ever worked with just dumps it on the desktop. I used to throw a symlink into the start menu, but when other devs used my machine they expected it to be on the desktop. Just one of those quirks of using PUTTY
      - marvy 10y ago
        But why not just use the installer?
        gasda 10y ago
        I was going to say putty does not have an installer, but TIL putty now has an installer..
        hermitdev 10y ago
        For a long time, there wasn't an installer for putty, so a lot of us became accustomed to just dropping the binary on our desktop or "bin" folder", but there is an installer now. Also, certain corporate environments that preclude the installer from working correctly, but won't mind you "installing" a program to your desktop/local app data.
james_a_craig 10y ago
Buried in the FAQ and not in the changelog for some reason:- As of 0.68, PuTTY will no longer fall back to SSH-1 if the server doesn't appear to support SSH-2; you must explicitly ask for SSH-1.

gcp 10y ago

Putty used to be the go-to tool for Windows SSH, but nowadays I'm using Bitvise SSH client. It's worth a try.

kiwijamo 10y ago
What advantages does it offer over PuTTY?
- gcp 10y ago
  Easy to open multiple terminals from the same connection, built-in SFTP. Probably better font rendering or something.
  - bananaboy 10y ago
    In PuTTY you can right-click on the title bar and click "Duplicate Session" to open another connection to the same server (if that's what you mean).
    - gcp 10y ago
      I think this opens a new connection rather than opening a second shell in the existing one.
verbify 10y ago
Odd, I moved into the opposite direction. But now I'm using git bash.
jlgaddis 10y ago
SecureCRT is what I always used on Windows but it's not free.
el_duderino 10y ago
Have you ever tried XShell5? https://www.netsarang.com/products/xsh_overview.html https://www.netsarang.com/products/xsh_overview.html It's free for Home/school use. I have tried all Windows SSH clients, and it is by far the best SSH client I have ever used.

jimmcslim 10y ago

On Windows 10, with Windows Subsystem for Linux installed, I don't find myself using Putty anymore.

coreyp_1 10y ago
Same here, but I can't figure out how to fix my main annoyance with the WSL: deactivating the bell!!! There is no reason for my computer to be making noises when I'm using tab completion!!!!!!!!!!
- JoBrad 10y ago
  Have you tried this? To disable beep of the bash you need to uncomment/add set bell-style none in your /etc/inputrc file To disable beep of programs like vim (I've tested only with that) you need to create - if it's not already there - a .bash_profile and add setterm -blength 0 http://stackoverflow.com/a/36726662 http://stackoverflow.com/a/36726662
  - coreyp_1 10y ago
    You are my hero!!! Thanks! It worked perfectly!
  - mszcz 10y ago
    Thanks! Had the same exact problem that annoyed the shit out of me! Turning off the bell in default Putty settings is the first thing I do on a new install.
JorgeGT 10y ago
I only miss the right click on the taskbar icon with the stored connections! I would be nice if you could pin aliases in the Ubuntu icon...
sbuttgereit 10y ago
I don't use PuTTY either for the same reasons as you, but I do continue to use Pageant. I use a mix of Windows and Linux tools and I only really want to enter my SSH cert credentials at start-up. So I still end up installing it. I also use Bitvise for tunneling on the Windows side as well.

drzaiusapelord 10y ago

Pretty happy with the Kitty fork of putty, which is a lot less spartan with features. https://www.fosshub.com/KiTTY.html https://www.fosshub.com/KiTTY.html

snksnk 10y ago
And I would recommend MobaXterm, definitely also worth to try. http://mobaxterm.mobatek.net/ http://mobaxterm.mobatek.net/
- atomicUpdate 10y ago
  It's definitely very good and has a lot to offer, but I still can't justify $70 for some reason. The free version offers enough functionality to be a very good PuTTY alternative though.
  - petee 10y ago
    I was about to, until I read the fine print and realized it's $70 to buy, but you'll only get updates for a year; after that you buy again or stick with your current version - no bug fixes. Were there a more reasonable price for non-commercial use, I would have no problem buying sooner. On the other hand, its has the only windows Mosh implementation...the best thing since sliced bread and tmux!
    - tokenizerrr 10y ago
      For mosh there's a cygwin build and also https://chrome.google.com/webstore/detail/mosh/ooiklbnjmhbcgemelgfhaeaocllobloj https://chrome.google.com/webstore/detail/mosh/ooiklbnjmhbcg...
- DogRunner 10y ago
  I just wanted to recommend ZOC (Which may some people still know from the good old Amiga times). It's available for Windows and MacOS. ZOC does have some really incredible features (integrated file transfer, multi-execution, team-directories). It's similar prices as MobaXterm, but doesn't have XWindows support. If you don't need X-Window support, but rich terminal/ssh features, it may be a ($70) try. https://www.emtec.com/zoc/index.html https://www.emtec.com/zoc/index.html

hughes 10y ago

It always makes me sad to see that the PuTTY download page is served over unsecure HTTP.

agumonkey 10y ago
I wonder why it's still the case. Lack of resources to enable HTTPS ? lack of manpower ? ..
r1ch 10y ago
At least the binaries are authenticode signed now, so checking they are legit is just a right click away.
- anderskaseorg 10y ago
  How is that supposed to help? Even if the legitimate binaries are Authenticode-signed now, a malicious non-Authenticode-signed binary substituted by an attacker MITMing the insecure HTTP connection will appear to the downloader to look just like the legitimate non-Authenticode-signed binaries of previous versions that they’ve been downloading for years.
  - Godel_unicode 10y ago
    Because you can add the signing cert to your AppLocker whitelist, and now it will be checked every time it runs. Then you push that out by GPO, and now everyone has that same whitelist protection. Also, as mentioned other places on the thread, the downloads are over HTTPS. Edit: see the following https://technet.microsoft.com/en-us/library/dd723683(v=ws.10).aspx https://technet.microsoft.com/en-us/library/dd723683(v=ws.10...
- morecoffee 10y ago
  Right clicking is one click too many. Wouldn't it be better to get the binary securely in the first place?
niftich 10y ago
But the downloads themselves aren't -- those are served out of https://the.earth.li/~sgtatham/putty/0.68/ https://the.earth.li/~sgtatham/putty/0.68/ For later reference, here's some sha512sum excerpts for version 0.68: ea03a52d344699c10e66e4f0424fba2b31d13d00ed24e1822c8ebe80fa589ce862419e5e852d6e1cb986637ea4e04d6cbe5ff3f1171ca403c9e55681877a712d w32/putty.zip 71c98de058e3f3fda9558cea955a5da28f41ae45464cafe9ea0b22ecf8cfeb56b1b047fb4b694b0c8e7c230f631dce9dd5bad26d70240b07b64ba27c3500d1fb w32/putty.exe 2b6b1acc51fc9cfe8a08e17afc4ac7d962af4575d55806456aa1a42c563f14457cc81d7e625191fd856b4be9a0e885cef78da4018d542010eba18718bb73fecd w32/putty-0.68-installer.msi debceaa83bb48e7adcc99d03bf152f599477bf960da8c7ea3924925ac5322a9470c4254285d6ff403ad5da78c4c19c25ea5b0c1da45c61d9f0b306b16d0d28f7 w64/putty.zip 29d47c1f5a51e9d59720ccea8eacc317f4b8b839c71f957db713e62d2a9526502fefc01855be97e9e8020d1f343a6a14346a21f4843c12d93ee038a8f9810966 w64/putty.exe 8262c133e3569dcc188e5ac2360ebd3cc09d9edd2f78d6eaaf0e2762fba511de07ce614ba4fedf5f62fe64dd17d5a626dc63a579ee1fc1ef90f45e9e1f0c3d06 w64/putty-64bit-0.68-installer.msi aacd9ec017e3cf56924d75d69f1610512662630c699ee09b4d9012f4e34e608b5b335444cf2529bcfe9c4edbded1c7247338d859385108544b27eeeb74d505c6 putty-src.zip

antidaily 10y ago

Pfft... not touching it until they get to a version 1.0 beta.

marvy 10y ago
This thing's been stable for over a decade :)
Pharylon 10y ago
Lol. I wonder why they're still sub-1.0.
- Aloha 10y ago
  Vanity version numbering is a thing.
mixologic 10y ago
Their git repo goes back 18 years to 'beta-0.43'. :/

bobsgame 10y ago

I've got 4 instances open right now. Thanks, Simon and co!

geoffmcc 10y ago

Now if only I could click a link and have it open in a browser.

Viper007Bond 10y ago
https://puttytray.goeswhere.com https://puttytray.goeswhere.com
dannysu 10y ago
I'm currently using a PuTTY fork called KiTTY and it has that feature as well: https://www.9bis.net/kitty/?page=URL%20hyperlinks https://www.9bis.net/kitty/?page=URL%20hyperlinks

INTPenis 10y ago

Since I switched to cygwin for ssh on windows I haven't looked back, putty is awful for someone coming from Linux normally and only forced to use Windows for certain things.

aao 10y ago
Yeah. I use a modified mintty-solarized-dark theme for cygwin, and symlinked my windows home dir into the cygwin one. I never got around on writing a blag about how to do this, but I like it a lot
- INTPenis 10y ago
  Exactly the same for me, mintty with solarized theme because I use solarized on all my other terminals in Fedora for example.

Raticide 10y ago

I've stopped using PuTTY and now use MinTTY with the Ubuntu subsystem and the regular old Ubuntu SSH client. Specifically this thing: https://github.com/mintty/wsltty https://github.com/mintty/wsltty It's real nice and even supports 24bit colour if you're into that.

ReverseCold 10y ago
Another option: SSH inside WSL in windows 10.
- Raticide 10y ago
  The default terminal was a bit limited for me, but I hear they're making big improvements to it in later builds.
  - bubblethink 10y ago
    I tried that briefly too, and I couldn't launch screen. It seems to trigger some old bug in screen. How far is the WSL terminal from the usual fanfare (screen, tmux, proper colors in the terminal and text editors, and other edge cases for scrollback etc.) ?
lma21 10y ago
Can tmux start within the WSL?
- my123 10y ago
  Yes. ;-)
  - lma21 10y ago
    that's amazing, I will definitely try it
lma21 10y ago
Can tmux start within the WSL?

sengork 10y ago

I wish they would finally implement file transfers via copy/paste mechanism inside an active terminal window. As far as I know this feature would be unique across platforms. If someone does know of an SSH terminal client that does this, please reply.

xs 10y ago
How about dragging to the terminal? This is a feature of mobaxterm. Upon ssh'ing to a system, a sftp session is automatically opened as well.
- sengork 10y ago
  Thanks that's the form of the function I was referring to. Indeed as previously mentioned there are xmodem/uuencode alternatives but none of them would be as efficient and reliable as native SFTP/SCP.
toast0 10y ago
EDIT: Realized you wanted to paste a file, instead of drop a file. I'm not really aware of anything that manages that. This page[1] says SecureCRT can do it, and I saw some things referencing that Konsole can too. I searched for 'drag and drop zmodem' to get started. [1] https://www.vandyke.com/support/tips/dragdropft.html https://www.vandyke.com/support/tips/dragdropft.html
ianmcgowan 10y ago
Reminds me of the bad old days of kermit and x/y/zmodem. http://www.extraputty.com/features/xmodem.html http://www.extraputty.com/features/xmodem.html looks like a throwback to those days, over an ssh session. I wonder what you have to run on the server side for it to work? Does uuencode or base64 work for you? I use it a lot to move stuff (aka my toolkit) to systems where I'm connected via citrix -> rdp -> ssh -> ssh. Amazingly, it works fine, though it can be slow. $uuencode sheet1.xml sheet1.xml | pbcopy (switch to remote session) $uudecode (paste, which varies depending on how I'm connected) $ls -l sheet1.xml Ta-da!
- 10y ago

wtbob 10y ago

When I started my career nearly 20 years ago, back before one could convince a Fortune-100 company to let its peons use Linux on our desktops and Apple hadn't yet had its renascence, PuTTY was a veritable godsend: it did what was needed, and did it remarkably well. It's been years since I was allowed to add a Linux box, and years since I switched to Linux full-time, and now I honestly think that I'd reject a job offer which required Windows (and maybe even one which required macOS) — but for all those years of Just Working™, thanks PuTTY!

jjcm 10y ago

Loved putty for years, but these days I've been using mosh over ssh. Having persistent sessions and text prediction means no more dropped connections, no more waiting a couple seconds if the wifi is buggy for whatever reason. Personally I use chrome's mosh extension: https://chrome.google.com/webstore/detail/mosh/ooiklbnjmhbcgemelgfhaeaocllobloj?hl=en https://chrome.google.com/webstore/detail/mosh/ooiklbnjmhbcg... Works great and I can pin it to my taskbar. Relevant recent discussion on mosh: https://news.ycombinator.com/item?id=11572146 https://news.ycombinator.com/item?id=11572146

JdeBP 10y ago
The State Synchronization Protocol still does not have specification doco, as far as I am aware.

xeeeeeeeeeeenu 10y ago

Lack of of Ed25519 support is a deal-breaker for me. It's one of the reasons why I'm using SecureCRT instead.

krallja 10y ago
Isn't Ed25519 support added in this release?
- xeeeeeeeeeeenu 10y ago
  Oops, indeed, I somehow missed that.

scandox 10y ago

Has much changed since this? https://noncombatant.org/2014/03/03/downloading-software-safely-is-nearly-impossible/ https://noncombatant.org/2014/03/03/downloading-software-saf... Related comments: https://news.ycombinator.com/item?id=9577861 https://news.ycombinator.com/item?id=9577861

ulkesh 10y ago

Putty is great and has been for a very long time. Always glad to see it still in active development. Though, for Windows, once I found MobaXterm I never looked back. Of course on the Linux side nothing to me beats tmux or terminator.

mkj 10y ago
And the SSH part of MobaXterm is based on PuTTY
- ulkesh 10y ago
  I honestly didn't know that. Very cool!
- BrandoElFollito 10y ago
  Yes, and unfortunately you have to use the version in there (you can't upgrade nor use another client). Otherwise I love mobaxterm and bought a few licenses.

chrissnell 10y ago

Putty is fantastically fast on Linux! I wish there was a way to use it as an xterm replacement without having to SSH to localhost. Has anybody figured out how to do this?

morecoffee 10y ago
Putty is actually quite slow, due to not implementing AES with the Intel intrinsics. Trying to transfer files using pscp, or WinSCP (which uses putty) over a local network link runs into a CPU bottleneck.

wst_ 10y ago

Years ago, when I worked on Windows, putty was a great soft. Since that time I switched to MacOS/Linux with Fish shell at work and running just a simple ssh command from terminal is a bliss. I still have Windows machine at home and I am missing terminal every time I must click though to login to my remote machine. Putty is no fun anymore... User interface has not been improved for years and, sadly, it's not working for me anymore.

dingo_bat 10y ago
Try WSL, I think it is a good putty substitute.

mpoloton 10y ago

PuTTY is a good example where the author resisted to turn it into bloatware. It is minimal and does the thing it is supposed to do.

sumedh 10y ago
That may or may not be a good thing. Personally I cannot live without tabs and bookmarks so I use mRemoteNG.
- lma21 10y ago
  I use PuTTY and connect to a tmux server afterwards.. tabs / sessions / programmable interactions with the terminal are a life saver that tmux provides. Give it a try.

ClayFerguson 10y ago

PuTTY has been a sort of industry standard for decades and they're still afraid to put a "Version 1.0" label on it!? Can that be right? I guess Google is still in the "beta" version of their little "Search Engine Thingy" too perhaps. Maybe somebody should invent negative or even "imaginary numbers" for versions, and then it would suffice for this shyness about integers. I don't know. We need Steve Jobs to come back and tell is what to do. (I'm waiting for the ass-holes who will take exception with term "decades". Come on guys. let me have it. Don't i deserve a good HackerNews smacking?)

deleted 10y ago

[deleted]

arca_vorago 10y ago

Putty always served me well when stuck on a windows boxen, so it's good to know it hasn't been forgotten. Two things for those of you who use putty I think would be mosh (chromium if you have to, cygwin my preffered), and winscp.

mytec 10y ago

Long time user of Putty, like many here. I liked this quote from their FAQ (A.3.3 What's the point of the Unix port? Unix has OpenSSH): "There were development advantages as well; porting PuTTY to Unix was a valuable path-finding effort for other future ports, and also allowed us to use the excellent Linux tool Valgrind to help with debugging, which has already improved PuTTY's stability on all platforms."

bch 10y ago
This sort of development is often illuminating. I develop on *BSD, Linux, Solaris (SPARC), and MacOS X when I can, and even though they're "all UNIX", interesting insights abound, and dealing w different endianess (SPARC == big, Intel == small), and library differences, etc is rarely more trouble than it's worth.

bananaboy 10y ago

PuTTY is one of the first things I install when setting up a new Windows machine!

jwatte 10y ago

I'd like the putty download to be over https and the installer to be signed. Or, at least, sha512 hashes available on the https download site. As it is, the download source for putty is one of the weakest chains in internet security!

Sunset 10y ago
The downloaded binary is served over https, it's signed.

nkkollaw 10y ago

Amazing, I used to use it many, many years ago when I started developing, and it's still a 0.x release... Is there a reason to not call it 1.0?

lma21 10y ago
You moved to another platform or another terminal?
- nkkollaw 10y ago
  Another platform, used to use Windows, then Linux, then Mac.

CyberMuz 10y ago

The default colour scheme on Putty is not very good in my opinion. know I can change it manually but it would be nice if the default for new connections was better.

moftz 10y ago

When is PuTTY going to support URL highlighting? Even plain old xterm can do it. Someone made a patch for it once but I'd rather have the support built in.

account1984 10y ago

I used to use PuTTY as my go-to windows SSH client. After some time I decided to integrate a piece of software with Pageant and I decided to open up the source to PuTTY. The poor quality of the source code terrified me, it seemed sort of "all over the place" and there seemed to be little to no concern for security and defensive programming. Secure software design and development is what I do for a living, so perhaps I am a bit more paranoid than the casual user - but this is one of the most widely deployed security tools in an enterprise, this shouldn't be "okay". Some defensive efforts are just common sense and are recommended by your compiler (eg. don't use sprintf and strcpy when you can snprintf and strncpy). Also, it doesn't hurt to check error conditions consistently. PS. To echo what a lot of folks have already said, how on earth can the author implement cryptographic algorithms and simultaneously think there is any value in publishing a hash of the binary "for security". Using a hash as a means of integrity validation in the context of security raises huge red flags about the authors mindset.