4 ms·

There's a lot said about the benefits of competing implementations: browsers, web frameworks, what-have-you. There are certain categories of security-critical

There's a lot said about the benefits of competing implementations: browsers, web frameworks, what-have-you. There are certain categories of security-critical software where I feel like it's only increasing surface area for bugs. The idea that PuTTY has bugs that aren't originating from the openssh project is really bothersome to me. All that work to reimplement, for what?

Wowfunhappy 6y ago
On the other hand, this bug only affects PuTTY users instead of all openssh users, which means it’s that much less of an appealing target for Hackers.
- Xylakant 6y ago
  This bug actually affects OpenSSH, too. See https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-2-ausnutzung-eines-informationslecks-fuer-gezielte-mitm-angriffe-auf-ssh-clients/ https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-2...
  - asveikau 6y ago
    Very surprised to see a bug get patched in putty but says OpenSSH won't fix. Anyone reading this with the kind of background who can comment on that?
    - Xylakant 6y ago
      If I read the report correctly, this is a protocol level issue. The report lists a potential client side fix, but it’s not without problems and includes the following sentence regarding openssh: “ The developers of OpenSSH are not planning to change the behavior of OpenSSH regarding this issue, because of the aforementioned drawbacks. ”
james412 6y ago
PuTTY was written back in a time when SSH was proprietary software. It predates the first release of OpenSSH, which I believe was BSD-only at the time, by almost a year. That aside, the official SSH implementation has never been any princess either. The PuTTY implementation is superior in many ways, not least in terms of modularity, although evidently just as prone to security problems as OpenSSH. I'm all for new alternative implementations of important pieces of our stack, but please God no more security-critical C.
reificator 6y ago
> The idea that PuTTY has bugs that aren't originating from the openssh project is really bothersome to me. All that work to reimplement, for what? Agreed. OpenSSH wasted a lot of needless effort reimplementing PuTTY. Except now that you know the timeline is reversed I expect your opinion on reimplementation to suddenly 180 as well. > PuTTY Initial Release: January 8, 1999 > OpenSSH Initial Release: 1 December 1999 Via Wikipedia
- saltcured 6y ago
  Note, OpenSSH wasn't brand new code on its first release. It was forked from the original SSH software from a version before it went commercial. I can't remember the whole history of that earlier open source project, but I can remember that I installed it on a university workstation in mid 1996.

Wowfunhappy 6y ago

On the other hand, this bug only affects PuTTY users instead of all openssh users, which means it’s that much less of an appealing target for Hackers.

Xylakant 6y ago
This bug actually affects OpenSSH, too. See https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-2-ausnutzung-eines-informationslecks-fuer-gezielte-mitm-angriffe-auf-ssh-clients/ https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-2...
- asveikau 6y ago
  Very surprised to see a bug get patched in putty but says OpenSSH won't fix. Anyone reading this with the kind of background who can comment on that?
  - Xylakant 6y ago
    If I read the report correctly, this is a protocol level issue. The report lists a potential client side fix, but it’s not without problems and includes the following sentence regarding openssh: “ The developers of OpenSSH are not planning to change the behavior of OpenSSH regarding this issue, because of the aforementioned drawbacks. ”

james412 6y ago

PuTTY was written back in a time when SSH was proprietary software. It predates the first release of OpenSSH, which I believe was BSD-only at the time, by almost a year. That aside, the official SSH implementation has never been any princess either. The PuTTY implementation is superior in many ways, not least in terms of modularity, although evidently just as prone to security problems as OpenSSH. I'm all for new alternative implementations of important pieces of our stack, but please God no more security-critical C.

reificator 6y ago

> The idea that PuTTY has bugs that aren't originating from the openssh project is really bothersome to me. All that work to reimplement, for what? Agreed. OpenSSH wasted a lot of needless effort reimplementing PuTTY. Except now that you know the timeline is reversed I expect your opinion on reimplementation to suddenly 180 as well. > PuTTY Initial Release: January 8, 1999 > OpenSSH Initial Release: 1 December 1999 Via Wikipedia

saltcured 6y ago
Note, OpenSSH wasn't brand new code on its first release. It was forked from the original SSH software from a version before it went commercial. I can't remember the whole history of that earlier open source project, but I can remember that I installed it on a university workstation in mid 1996.