11 ms·

Putty maintainer on his attitude towards security and open source

534 points by AndrewDucker 5y ago

spoonjim 5y ago
That’s great in this one case but it doesn’t solve the open source compensation problem. We need a new set of licenses that allow the general freedoms of free software but also force people making large sums of money with free software to send some of it back to the open source projects they depend on.
CRConrad 5y ago
From one of Simon Tatham's replies on the blog: > In fact, the most recent commercial fork caused us to get a worried email or two – the company's publicity made at least some users worry that the PuTTY team might have been subjected to one of those "buyout and radical change of project direction" scenarios I mention above, and they weren't happy about the idea. [Emphases added -- CRC] So there is a "team" besides mr Tatham. That's good to hear; I always thought it was just he himself.
johnklos 5y ago
What an excellent reminder of how easy and effective it can be to not be a jerk. I think there are plenty of people who could take some advice from this.
- gfnaq 5y ago
  Are you referring to this? "But I've always been able to deal with this by pointedly reminding the most demanding people that I'm not at their beck and call. Most of those companies who mistake me for a contracted vendor are prepared to recognise their mistake once I point it out, and the more self-aware ones even apologise. I've not even found it necessary to be especially rude: a plain statement of the facts of life normally does the job. If one of them is rude to me, then the quintessentially British approach of a faint frown and a tone of mild reproof (or its email analogue) generally gets good results – probably a lot better than mouthing off like a sweary 13-year-old in return." It is easier if you are a native English speaker, because you have a wide range of expressions at your disposal to express disdain or irritation without going nuclear. It is also easier if you are the single author and not fighting with others in the same code base. So I don't think easy in general to react maturely, especially if you have made large contributions to a shared code base and some pushy person comes along and makes demands (sometimes the impolite person is another contributor, which makes things worse). EDIT: Perhaps you meant that the person making requests should not be a jerk, in which case of course I fully agree.
  - guenthert 5y ago
    > It is easier if you are a native English speaker, because you have a wide range of expressions at your disposal to express disdain or irritation without going nuclear. This! I - non-native myself - worked with fellows who learned English late in life and sadly to some share from the wrong sources (action movies and rap music, I'm afraid). Naturally, at times they appeared quite immature. Otoh, I had the good fortune to work with some British fellows, which, at times, was quite educational.
  - kriops 5y ago
    This YouTube-video where a streamer talks about the difference between the communication on EU vs. NA servers always comes to mind when this is discussed. It is quite humorous, and perfectly illustrates your point about native English speakers: https://www.youtube.com/watch?v=8j2iX8Fgq3Q https://www.youtube.com/watch?v=8j2iX8Fgq3Q
wiz21c 5y ago
I genuinely agree with his vision and especially the reason why I can go to sleep sanely.
yjftsjthsd-h 5y ago
How nice it is to see somebody who actually read the license they released their code under and accepts the results:)
- ralph84 5y ago
  Indeed. Though I wonder how many of the “big tech profits from open source and doesn’t pay the maintainers” complaints are from actual maintainers vs. observers with a general axe to grind against big tech.
  - CRConrad 5y ago
    Sure, at least some of it is from observers: I am one of them. But... Are there any rules against that? If something's true, then is it any more or less true depending on who you are or what you do?
- gopher_space 5y ago
  You don't ignore complaints from systems you use for work. This isn't at all a political issue for engineers.
mch82 5y ago
Great footnote from the article: > I'm often amused that people compliment me on things like PuTTY by telling me how much of their time it saved, whereas people compliment me on my puzzle game collection by telling me how much of their time it wasted.
- johnchristopher 5y ago
  I don't understand that sentence. Why would his puzzle game collection waste anybody's time ? How come people know about it or even care ?
  - dsr_ 5y ago
    "SGT Puzzles" or, sometimes, "Simon's Puzzles" is a collection of single player puzzle games that has been ported to many, many platforms. If you can think of a non-card solitaire game, it's probably implemented.
  - bombcar 5y ago
    The point of a puzzle game is a pastime - often considered to be “wasting” time.
    - johnchristopher 5y ago
      But why would his puzzle game collection waste someone else's time ? He's the one collecting the games or doing the puzzles so why would it waste anybody else's time but his ?
      - bombcar 5y ago
        He has a collection of puzzle games you can download and waste time playing.
        johnchristopher 5y ago
        Gee, thanks :D. I didn't know that at all and the article has no hints about that. I came to that possibility but it was reaaaally out of context and off without prior knowledge. Thanks for confirming it, I really didn't understand what was what. edit: I took a look at the page again and there are no links or mentions of puzzles or something, I knew I wasn't crazy (or that dense) !
mfrw 5y ago
Simon is genuinely one of the many folks that are represented by this xkcd [0] aptly. Thank You & and a huge shoutout to you and your software that a lot of us use day-in & day-out. [0]: https://xkcd.com/2347/ https://xkcd.com/2347/
- teraflop 5y ago
  The Putty maintainer is Simon Tatham (the commenter), not Andrew Ducker.
  - mfrw 5y ago
    :( Apologies and corrected. Thank you!
xyzzy_plugh 5y ago
This sort of thing should be required reading by everyone who interacts with open source software. So many folks come in with a chip on their shoulder, missing the forest for the trees. If every developer modeled themselves after Tatham's attitude, we probably wouldn't be having most of these conversations around open source right now. And issue trackers might be a more peaceful place. edit: fixed the author!
- camtarn 5y ago
  Tatham, rather than Ducker - the former wrote a comment on the latter's link blog.
  - AndrewDucker 5y ago
    Indeed, Simon drops by occasionally and leaves a comment if he fancies. This one was so good I thought it was worth sharing more widely.
    - camtarn 5y ago
      It's pretty darn weird realising that Simon is actually a person who knows somebody I've met IRL, rather than a mysterious benevolent entity responsible for manifesting the PuTTY suite fully-formed upon the internet ;)
      - AndrewDucker 5y ago
        I think I bumped into Simon through a bunch of other Cambridge people I chanced onto via Dreamwidth/Livejournal. I wouldn't say we were even slightly close, but if I was living closer to Cambridge and there wasn't a pandemic he's definitely amongst the people I'd be delighted to say hi to in person.
      - aardvark179 5y ago
        Cambridge is an interesting place. You can be in a pub with pretty much the entire PuTTY team, at least two Debian project leads, a major bind contributor, and a couple of OpenJDK contributors. The conversations can get a little geeky. :-)
hereforphone 5y ago
Next let's do one for the openssh people
aasasd 5y ago
It took me until the footnote to remember that this is Simom Tatham, who indeed also authored a fine no-nonsense collection of little puzzle games, which has been ported to a bunch of platforms. Here they are playable online on Tatham's site: https://www.chiark.greenend.org.uk/~sgtatham/puzzles/ https://www.chiark.greenend.org.uk/~sgtatham/puzzles/ And here's the Android version: https://f-droid.org/en/packages/name.boyle.chris.sgtpuzzles/ https://f-droid.org/en/packages/name.boyle.chris.sgtpuzzles/
- smegsicle 5y ago
  His puzzle game collection is as perfect in its domain as PuTTY is as an ssh client. 'unruly' and 'signposts' are neat little timewasters, but devolve into a lot of counting at larger sizes.. 'flip' with random shapes is a great fidget-style toy 'galaxies' at 'unreasonable difficulty' gets pretty crazy and plenty more, eg 'solo' provides every version of sudoku that you might want
  - djrockstar1 5y ago
    Solo with 3x3 jigsaw + killer at unreasonable difficulty is the most fun I've ever had solving sudokus, requiring some really novel logic. In comparison, the normal 3x3 at unreasonable difficulty is really tedious, often devolving into a series of trial and error decisions.
- Thorrez 5y ago
  I like Mines. It's Minesweeper but you never have to guess.
hn_throwaway_99 5y ago
I thought this was such a fantastic response, particularly the sections where he talks about how he responds to companies demanding he reply as if he has a contract with them. The main point being that, with the log4j issue (and others before that), the thing that's struck me when maintainers complain about not being appreciated or that they are working as hard as they can, unpaid, is that maintainers are under no obligation to respond at all, and that you can't control how other people will react. As someone who's dealt with anxiety for a long time (and as a former opensource primary maintainer), I can most definitely commiserate with feeling burdened by the expectations of others, but one of the best things I learned from therapy is that you can't control others emotions, you can only attempt to understand why you react as you do in certain situations.
- josephg 5y ago
  You can’t control others emotions. But setting healthy expectations goes a long way. One of my takeaways from the log4j issue is that the log4j devs should have never accepted the patches to add LDAP urls in the first place. Or perhaps, they should have removed that feature when it became burdensome. I would have. There’s a pressure to accept whatever patches come your way as an opensource developer, but actually, you’re under no obligation to do any such thing. Open source also means the source is available - so people are free to take your code, mix in their patches and maintain it themselves. And if they can’t be bothered doing that, why should I shoulder that burden? I think us opensource devs should get more comfortable saying no. “I hear that this feature is important to you but it doesn’t solve a problem I (or anyone else I know) cares about. Please maintain those patches in your own fork.”
  - nradov 5y ago
    Another alternative is to build a stable plug-in API rather than handling such requests in the core product. That way users with particular needs can code their own plug-ins rather than forking the entire code base. Now obviously open source maintainers have no obligation to do that, but purely from an engineering perspective it's an approach worth considering.
nijave 5y ago
I also find the opposite true--reminding colleagues that using OSS means we have to own and maintain the software whether the original community/author does or not. There seems to be a hesitance to fork abandoned or slow moving software to update/fix issues
- nerdponx 5y ago
  It's easier to blame a nebulous 3rd party than to take responsibility.
- betwixthewires 5y ago
  I think this is an important point that is often overlooked. When we release code under a free software license, we are giving the software to the user, entirely. If you're using software that you own, not just merely have a license to, it is yours, be prepared to maintain it, and if you're not prepared to maintain it, maybe relying on free-as-in-freedom software is a bad decision for you.
  - thrower123 5y ago
    Code released under MIT and BSD licenses should really be thought of not as free, as in speech, or free, as in beer, but free, as in mattress on the side of the road.
    - antod 5y ago
      One I've heard is "free, as in puppy" ie good, but comes with responsibility
- hutzlibu 5y ago
  "reminding colleagues that using OSS means we have to own and maintain the software whether the original community/author does or not" No, we do not have to do this. We wouldn't get anything done, if we tried to maintain our full oss stack. Where would you start? In the linux kernel and move your way up to chromium/firefox? Have fun out there. "There seems to be a hesitance to fork abandoned or slow moving software to update/fix issues " And it is often easier to reimplement something from scratch, than taking up some underdocumented mess and trying to make sense of it. So I would rephrase that to " using OSS means we can own and maintain the software whether the original community/author does or not."
laumars 5y ago
I once used PuTTY as the base for an internal SSH tool. We needed to provide data entry teams with access to a green screen but didn’t want to expose any more servers than what they were authorised to use and a simple interface because a lot of the data entry guys were technologically illiterate. After spending hours looking for solutions that were purpose built for this kind of thing I gave up took PuTTYs source and made some tweaks to the UI. The source was so easy to work with and I was so grateful that the license allowed me to do this. The custom client only ran for a couple of years because the web replaced green screens. And being a *nix guy I don’t get much need for PuTTY in my day to day. But I’ll always be grateful for PuTTY for making that particular job possible (and secure).
- tonetheman 5y ago
  I too had to make a custom version of putty and LOVED the code the author wrote and how easy it was.
- vbezhenar 5y ago
  For me putty is still preferred way to ssh with Windows. Nowadays windows is shipping openssh.exe, so I can run it from cmd and it kinda works for quick simple actions, but clipboard works weirdly, basically I have to use right-click/paste to reliably paste data, shift+insert works in some apps and does not work in others. Putty just works like it worked 10 years ago, it's good old reliable tool.
  - tikkabhuna 5y ago
    I use Windows Terminal these days so I have the same copy/paste behaviour in WSL, remote SSH and cmd. Ctrl + C when highlighting text to copy, Ctrl + V to paste.
  - dgfitz 5y ago
    Have you ever tried mobaxterm? I was a putty person as well until I was put on to moba.
    - 5y ago
rectang 5y ago
> And part of that is making all the necessary security tools available free of charge, because the more money they cost, the more companies will take a cost-benefit decision not to bother with them, neglecting the externalised cost of those knock-on effects of their insecurity on everyone else. Boy if that doesn't ring true. Kudos to PuTTY's author for making it so easy and low cost to do the right thing that those profit-seeking automatons we call "companies" actually will.
- mwcampbell 5y ago
  The same logic applies to other concerns like accessibility, which is one reason why I'm making one of my contributions in that area [1] available as permissively licensed open source. It helps that my current funding source for that project also wants it to be open source. [1]: https://github.com/AccessKit/accesskit https://github.com/AccessKit/accesskit
GekkePrutser 5y ago
Putty is great and I thank him for this work :) I only use it privately now because our work doesn't allow it anymore since openssh was included with Windows. But I still prefer it.
bityard 5y ago
These days, there seems to be (at least) two kinds of open source software developers: 0. Those who release their code under an open source license, in the hope that it will be useful to others in some way. 1. Those who do the same as above, with the additional hope that they will be paid for in some ill-defined way. And when they are not, take to twitter and blogs to proclaim, "somebody should really do something about this!"
- AndrewDucker 5y ago
  I do think there is a real problem whereby very important code that a lot of people and systems depend on is looked after part time (or not at all) and nobody thinks about it until it has a severe bug. But that's almost orthogonal to the issue of whether the original developer should be paid because their code turns out to be useful to lots of people.
  - toast0 5y ago
    It's also orthogonal to whether the code is free or paid, open or closed. Plenty of commercial code is barely looked after, and if it's closed and broken, it's a lot harder to fix.
  - prepend 5y ago
    I think it’s a problem, but don’t think funding is a good solution. If funding was good, then commercial products would serve the purpose. I think a better approach is to encourage more smart developers contributing time. And if companies find an individual or a percent of a person’s time on a project that’s actually funding. But it’s very different from trying to replicate direct funds.
    - Helithumper 5y ago
      > If funding was good, then commercial products would serve the purpose. Not sure that's a solid affirmation, especially given how there are many open source projects receiving funding that often outcompete their commercial counterparts. In particular I would point out the major open source backing foundations such as the CNCF and Linux Foundation who help to fund their own projects. Would you say that these two organizations and their projects are not serving their purpose or are being outcompeted by commercial offerings?
chx 5y ago
> But I'm not sure I don't prefer it this way – a labour of love becomes a chore if you can't temporarily put it down when you're running low on love. That is a very wise comment.
denton-scratch 5y ago
It would be cool if someone would donate to him a domain. Downloading PuTTY involves relying on greenend.org.uk (which isn't obviously connected with PuTTY). You can check your download using the hashes provided on the site; but if the download has been messed with, then the hash is untrustworthy too. https://noncombatant.org/2014/03/03/downloading-software-safely-is-nearly-impossible/ https://noncombatant.org/2014/03/03/downloading-software-saf...
- GoodbyeMrChips 5y ago
  Would the lazy bastards who downvoted parent instead do something useful and post a sensible rely? (Rather then keep turning this place into another Redit). Link and text from the Putty FAQ below. https://www.chiark.greenend.org.uk/~sgtatham/putty/faq.html#faq-domain https://www.chiark.greenend.org.uk/~sgtatham/putty/faq.html#... A.9.2 Would you like me to register you a nicer domain name? No, thank you. Even if you can find one (most of them seem to have been registered already, by people who didn't ask whether we actually wanted it before they applied), we're happy with the PuTTY web site being exactly where it is. It's not hard to find (just type ‘putty’ into google.com and we're the first link returned), and we don't believe the administrative hassle of moving the site would be worth the benefit. In addition, if we did want a custom domain name, we would want to run it ourselves, so we knew for certain that it would continue to point where we wanted it, and wouldn't suddenly change or do strange things. Having it registered for us by a third party who we don't even know is not the best way to achieve this.
- lstodd 5y ago
  Hah, I once ran a PuTTY download mirror for the clients of an ISP I then worked at. It was like 20 years ago. Even then it was obvious that they don't want any fancy domains, just that the work is done and putty.exe delivered where it's needed.
georgeoliver 5y ago
The discussion around open source in the last few days lends weight in my view to the notion that most engineers are apolitical by nature. Unfortunately larger political entities (that is, BigCorp) have no reservations taking advantage of this.
varajelle 5y ago
I've been paid to (help) maintain an open source project by a company that also offer services and support around that project. When someone report a bug on GitHub, then the bug is triaged and prioritized for both paying customer and open source users. But sometimes open source users would just ask questions in the GitHub bug tracker. Then I'd just close the issue and provide a link to the official support channels (sometimes also answering the question if that's easy enough, but not if I have to ask more info or if I have to search for the answer). Same when open source users would just ask questions by email.
ben_w 5y ago
Simon’s a lovely guy. Met him a few times, he was often around in the local Geek pub[0] back before I moved out of Cambridge. [0] Same pub as frequented by the guy who proved Magic The Gathering is Turing complete, because Cambridge is tiny.
majkinetor 5y ago
I am very happy that there are such great dudes. Respect! I don't even use putty (but its fork, kitty). People forget one simple fact - WHEN YOU ARE PAYED, U ARE NO LONGER FREE. There is no substitute for passion work, where YOU are the man, and there is 0 chance somebody will influence you.
hinkley 5y ago
Someone I know met Simon one day and thought I’d like his autograph, since I was working in security at the time. I had in fact introduced that team to PuTTY, though this friend didn’t know that. So I own a postcard that says words to the effect, “nobody has ever asked me for an autograph before”. It is framed.
- tylervigen 5y ago
  This is a delightful story. Thank you for sharing.
arka2147483647 5y ago
This is a nice post from a healthy person who is comfortable with his position, and isn’t overburdened. However, what would happen if that were not so? What would happen if he Could not, Would not, or were Unable to work? It would all fall apart. And that is the inherent fragility in these small critical opensource projects.
- lolc 5y ago
  Putty would keep running even if the maintainer disappeared. You can build it yourself. You can find somebody to maintain it for you. What's fragile about that?
- nradov 5y ago
  Or someone else would fork the code, most users would eventually migrate to the new project, and life goes on.
- aardvark179 5y ago
  I think somebody else would pick it up. Simon is not the only person who works on PuTTY and there are several people who might reasonably pick up the security side of things. The various UI bits might be slightly less well distributed, but I am sure somebody could be found in pretty short order.
  - unixbane 5y ago
    there are between 0 and 1 people in the world who have cohesive understanding of how all the shell, terminal, and stuff between need to interact + the requisite knowledge to know what and what doesn't have security implications DAY OF THE SEAL SOON
demarq 5y ago
gem in the sites comments section > a labour of love becomes a chore if you can't temporarily put it down when you're running low on love. - simon.t
ncmncm 5y ago
The source code for the core of Putty is an astonishing construction, a sort of extreme case of Duff's device spanning many, many pages. At each point where an operation might block, there is a macro that expands to a break and a switch/case clause that enables returning to that point. A colleague said "I love it, and hate myself for loving it". The new "async/await" features appearing in numerous languages encode this pattern -- i.e., result in substantially the same object code -- in a more robust way, but Putty works fine.
synergy20 5y ago
windows 10 has openssh client now, with WSL2 it has many other putty-alike tools, for me, I no longer need putty these days. Thanks for the great ride.
jalino23 5y ago
I used ssh in wsl it works well for me.not sure if I miss anything not using putty?
- raxxorrax 5y ago
  I use putty for serial and socket connections and only rarely for ssh.
Cameri 5y ago
I once wrote a tool in C# that used Putty behind the scenes to connect to routers (and hop through them) and collect interface metrics. Back in 2009 :)
exikyut 5y ago
What I got from this was a tiny wake-up call to realize/remember/not lose sight of: the OSS relationship is the one scalable model we've yet found that lets the problem being solved remain the focal point of the effort, deliberately at the cost of everything else: > Often I feel as if some particular correspondent of mine has simply forgotten that I'm not a paid software vendor who has a multi-million-dollar contract with their employer, and hasn't quite figured out that as a consequence I have no incentive to drop everything and solve their particular problem. [...] > But I've always been able to deal with this by pointedly reminding the most demanding people that I'm not at their beck and call. [...] > And if someone keeps pestering in spite of every clue you try to impart, well, there's always the 'just stop replying' option. [...] > When it comes to companies depending on my stuff, I take the same no-nonsense attitude, because in every free software licence agreement (even the maximally permissive MIT, my usual choice) is that all-important "NO WARRANTY" clause, and it's there for exactly this reason, and I'm happy to push back if people try to ignore that. We're so sensitive to that inversion effect that can happen when some core technical fascination loses ground to the humdrum of always turning up somewhere 5 days a week, rain, hail or shine... always be checking the bugtracker, always be working on the next feature or component, always be maintaining everything and keeping it together. The regularity and predictability of that continuous process can be reassuring... as long as it remains fundamentally interesting. But as soon as the interestingness fades, everything suddenly feels like a scary monster from a nightmare you can't shake off. It seems to be a ratified status quo that everyone is just expected to deal with this. While the description doesn't quite relate to the remunerative relationship of the workplace, I generally describe the above as "club mentality": people start out by gathering together, drawn together by the focus of some shared interest; then after some time the focus switches to "we should definitely get together every fortnight", then on some fortnights noone knows what to talk about... aaand before anyone realises it, the incentivization structure that previously drove everyone to bring their best to the table is gone. Sometimes the meeting-every-fortnight bit happens to further the shared interest - making the process of identifying the switchpoint even harder. But it's always there - there's a point at which everyone kinda gets less interested, but feels compelled to continue the meetings. These turn out to be filled not with awkward pauses; there's somehow always still something to do, something to go on with. But anyone fresh would take one look at the situation and immediately call it busywork - it's not furthering the bigger picture, it's just playing Dodgem cars within the sandbox that's been carved out. The kinetic aspect of that makes it easy to believe that impact is being made, provided you don't look too closely at the bigger picture. The correct but fiendishly difficult response is of course to never lose sight of the bigger picture, and for everyone to be honest with each other about when they've lost interest. Sometimes that's easy, like when a "band" gets together only for everyone to collectively realize music isn't all that fascinating after a couple months. Disappointing retrospective memory? Doesn't matter, the alternative would have been much more depressing. It's sad that the difficulty and complexity of writing software means you pretty much have to live through a multi-month or -year period of hum-drum boringness before getting to a reasonable closure point. The only workaround I've yet found is to frequently switch roles, which doesn't really provide closure unless the roles are extremely small-scale, and always tends to be very abrupt in any case. If you can make it work financially, OSS does indeed provide the most viable scalable solution for this whole problem. Heh. At all costs.
andrew_ 5y ago
I paste this every time the subject is raised: https://liberamanifesto.com/ https://liberamanifesto.com/
mcbishop 5y ago
> If one of them is rude to me, then the quintessentially British approach of a faint frown and a tone of mild reproof (or its email analogue) generally gets good results – probably a lot better than mouthing off like a sweary 13-year-old in return. I love this.

534 points by AndrewDucker 5y ago

That’s great in this one case but it doesn’t solve the open source compensation problem. We need a new set of licenses that allow the general freedoms of free software but also force people making large sums of money with free software to send some of it back to the open source projects they depend on.

CRConrad 5y ago

From one of Simon Tatham's replies on the blog: > In fact, the most recent commercial fork caused us to get a worried email or two – the company's publicity made at least some users worry that the PuTTY team might have been subjected to one of those "buyout and radical change of project direction" scenarios I mention above, and they weren't happy about the idea. [Emphases added -- CRC] So there is a "team" besides mr Tatham. That's good to hear; I always thought it was just he himself.

johnklos 5y ago

What an excellent reminder of how easy and effective it can be to not be a jerk. I think there are plenty of people who could take some advice from this.

gfnaq 5y ago
Are you referring to this? "But I've always been able to deal with this by pointedly reminding the most demanding people that I'm not at their beck and call. Most of those companies who mistake me for a contracted vendor are prepared to recognise their mistake once I point it out, and the more self-aware ones even apologise. I've not even found it necessary to be especially rude: a plain statement of the facts of life normally does the job. If one of them is rude to me, then the quintessentially British approach of a faint frown and a tone of mild reproof (or its email analogue) generally gets good results – probably a lot better than mouthing off like a sweary 13-year-old in return." It is easier if you are a native English speaker, because you have a wide range of expressions at your disposal to express disdain or irritation without going nuclear. It is also easier if you are the single author and not fighting with others in the same code base. So I don't think easy in general to react maturely, especially if you have made large contributions to a shared code base and some pushy person comes along and makes demands (sometimes the impolite person is another contributor, which makes things worse). EDIT: Perhaps you meant that the person making requests should not be a jerk, in which case of course I fully agree.
- guenthert 5y ago
  > It is easier if you are a native English speaker, because you have a wide range of expressions at your disposal to express disdain or irritation without going nuclear. This! I - non-native myself - worked with fellows who learned English late in life and sadly to some share from the wrong sources (action movies and rap music, I'm afraid). Naturally, at times they appeared quite immature. Otoh, I had the good fortune to work with some British fellows, which, at times, was quite educational.
- kriops 5y ago
  This YouTube-video where a streamer talks about the difference between the communication on EU vs. NA servers always comes to mind when this is discussed. It is quite humorous, and perfectly illustrates your point about native English speakers: https://www.youtube.com/watch?v=8j2iX8Fgq3Q https://www.youtube.com/watch?v=8j2iX8Fgq3Q

wiz21c 5y ago

I genuinely agree with his vision and especially the reason why I can go to sleep sanely.

yjftsjthsd-h 5y ago

How nice it is to see somebody who actually read the license they released their code under and accepts the results:)

ralph84 5y ago
Indeed. Though I wonder how many of the “big tech profits from open source and doesn’t pay the maintainers” complaints are from actual maintainers vs. observers with a general axe to grind against big tech.
- CRConrad 5y ago
  Sure, at least some of it is from observers: I am one of them. But... Are there any rules against that? If something's true, then is it any more or less true depending on who you are or what you do?
gopher_space 5y ago
You don't ignore complaints from systems you use for work. This isn't at all a political issue for engineers.

mch82 5y ago

Great footnote from the article: > I'm often amused that people compliment me on things like PuTTY by telling me how much of their time it saved, whereas people compliment me on my puzzle game collection by telling me how much of their time it wasted.

johnchristopher 5y ago
I don't understand that sentence. Why would his puzzle game collection waste anybody's time ? How come people know about it or even care ?
- dsr_ 5y ago
  "SGT Puzzles" or, sometimes, "Simon's Puzzles" is a collection of single player puzzle games that has been ported to many, many platforms. If you can think of a non-card solitaire game, it's probably implemented.
- bombcar 5y ago
  The point of a puzzle game is a pastime - often considered to be “wasting” time.
  - johnchristopher 5y ago
    But why would his puzzle game collection waste someone else's time ? He's the one collecting the games or doing the puzzles so why would it waste anybody else's time but his ?
    - bombcar 5y ago
      He has a collection of puzzle games you can download and waste time playing.
      - johnchristopher 5y ago
        Gee, thanks :D. I didn't know that at all and the article has no hints about that. I came to that possibility but it was reaaaally out of context and off without prior knowledge. Thanks for confirming it, I really didn't understand what was what. edit: I took a look at the page again and there are no links or mentions of puzzles or something, I knew I wasn't crazy (or that dense) !

mfrw 5y ago

Simon is genuinely one of the many folks that are represented by this xkcd [0] aptly. Thank You & and a huge shoutout to you and your software that a lot of us use day-in & day-out. [0]: https://xkcd.com/2347/ https://xkcd.com/2347/

teraflop 5y ago
The Putty maintainer is Simon Tatham (the commenter), not Andrew Ducker.
- mfrw 5y ago
  :( Apologies and corrected. Thank you!

xyzzy_plugh 5y ago

This sort of thing should be required reading by everyone who interacts with open source software. So many folks come in with a chip on their shoulder, missing the forest for the trees. If every developer modeled themselves after Tatham's attitude, we probably wouldn't be having most of these conversations around open source right now. And issue trackers might be a more peaceful place. edit: fixed the author!

camtarn 5y ago
Tatham, rather than Ducker - the former wrote a comment on the latter's link blog.
- AndrewDucker 5y ago
  Indeed, Simon drops by occasionally and leaves a comment if he fancies. This one was so good I thought it was worth sharing more widely.
  - camtarn 5y ago
    It's pretty darn weird realising that Simon is actually a person who knows somebody I've met IRL, rather than a mysterious benevolent entity responsible for manifesting the PuTTY suite fully-formed upon the internet ;)
    - AndrewDucker 5y ago
      I think I bumped into Simon through a bunch of other Cambridge people I chanced onto via Dreamwidth/Livejournal. I wouldn't say we were even slightly close, but if I was living closer to Cambridge and there wasn't a pandemic he's definitely amongst the people I'd be delighted to say hi to in person.
    - aardvark179 5y ago
      Cambridge is an interesting place. You can be in a pub with pretty much the entire PuTTY team, at least two Debian project leads, a major bind contributor, and a couple of OpenJDK contributors. The conversations can get a little geeky. :-)

hereforphone 5y ago

Next let's do one for the openssh people

aasasd 5y ago

It took me until the footnote to remember that this is Simom Tatham, who indeed also authored a fine no-nonsense collection of little puzzle games, which has been ported to a bunch of platforms. Here they are playable online on Tatham's site: https://www.chiark.greenend.org.uk/~sgtatham/puzzles/ https://www.chiark.greenend.org.uk/~sgtatham/puzzles/ And here's the Android version: https://f-droid.org/en/packages/name.boyle.chris.sgtpuzzles/ https://f-droid.org/en/packages/name.boyle.chris.sgtpuzzles/

smegsicle 5y ago
His puzzle game collection is as perfect in its domain as PuTTY is as an ssh client. 'unruly' and 'signposts' are neat little timewasters, but devolve into a lot of counting at larger sizes.. 'flip' with random shapes is a great fidget-style toy 'galaxies' at 'unreasonable difficulty' gets pretty crazy and plenty more, eg 'solo' provides every version of sudoku that you might want
- djrockstar1 5y ago
  Solo with 3x3 jigsaw + killer at unreasonable difficulty is the most fun I've ever had solving sudokus, requiring some really novel logic. In comparison, the normal 3x3 at unreasonable difficulty is really tedious, often devolving into a series of trial and error decisions.
Thorrez 5y ago
I like Mines. It's Minesweeper but you never have to guess.

hn_throwaway_99 5y ago

I thought this was such a fantastic response, particularly the sections where he talks about how he responds to companies demanding he reply as if he has a contract with them. The main point being that, with the log4j issue (and others before that), the thing that's struck me when maintainers complain about not being appreciated or that they are working as hard as they can, unpaid, is that maintainers are under no obligation to respond at all, and that you can't control how other people will react. As someone who's dealt with anxiety for a long time (and as a former opensource primary maintainer), I can most definitely commiserate with feeling burdened by the expectations of others, but one of the best things I learned from therapy is that you can't control others emotions, you can only attempt to understand why you react as you do in certain situations.

josephg 5y ago
You can’t control others emotions. But setting healthy expectations goes a long way. One of my takeaways from the log4j issue is that the log4j devs should have never accepted the patches to add LDAP urls in the first place. Or perhaps, they should have removed that feature when it became burdensome. I would have. There’s a pressure to accept whatever patches come your way as an opensource developer, but actually, you’re under no obligation to do any such thing. Open source also means the source is available - so people are free to take your code, mix in their patches and maintain it themselves. And if they can’t be bothered doing that, why should I shoulder that burden? I think us opensource devs should get more comfortable saying no. “I hear that this feature is important to you but it doesn’t solve a problem I (or anyone else I know) cares about. Please maintain those patches in your own fork.”
- nradov 5y ago
  Another alternative is to build a stable plug-in API rather than handling such requests in the core product. That way users with particular needs can code their own plug-ins rather than forking the entire code base. Now obviously open source maintainers have no obligation to do that, but purely from an engineering perspective it's an approach worth considering.

nijave 5y ago

I also find the opposite true--reminding colleagues that using OSS means we have to own and maintain the software whether the original community/author does or not. There seems to be a hesitance to fork abandoned or slow moving software to update/fix issues

nerdponx 5y ago
It's easier to blame a nebulous 3rd party than to take responsibility.
betwixthewires 5y ago
I think this is an important point that is often overlooked. When we release code under a free software license, we are giving the software to the user, entirely. If you're using software that you own, not just merely have a license to, it is yours, be prepared to maintain it, and if you're not prepared to maintain it, maybe relying on free-as-in-freedom software is a bad decision for you.
- thrower123 5y ago
  Code released under MIT and BSD licenses should really be thought of not as free, as in speech, or free, as in beer, but free, as in mattress on the side of the road.
  - antod 5y ago
    One I've heard is "free, as in puppy" ie good, but comes with responsibility
hutzlibu 5y ago
"reminding colleagues that using OSS means we have to own and maintain the software whether the original community/author does or not" No, we do not have to do this. We wouldn't get anything done, if we tried to maintain our full oss stack. Where would you start? In the linux kernel and move your way up to chromium/firefox? Have fun out there. "There seems to be a hesitance to fork abandoned or slow moving software to update/fix issues " And it is often easier to reimplement something from scratch, than taking up some underdocumented mess and trying to make sense of it. So I would rephrase that to " using OSS means we can own and maintain the software whether the original community/author does or not."

laumars 5y ago

I once used PuTTY as the base for an internal SSH tool. We needed to provide data entry teams with access to a green screen but didn’t want to expose any more servers than what they were authorised to use and a simple interface because a lot of the data entry guys were technologically illiterate. After spending hours looking for solutions that were purpose built for this kind of thing I gave up took PuTTYs source and made some tweaks to the UI. The source was so easy to work with and I was so grateful that the license allowed me to do this. The custom client only ran for a couple of years because the web replaced green screens. And being a *nix guy I don’t get much need for PuTTY in my day to day. But I’ll always be grateful for PuTTY for making that particular job possible (and secure).

tonetheman 5y ago
I too had to make a custom version of putty and LOVED the code the author wrote and how easy it was.
vbezhenar 5y ago
For me putty is still preferred way to ssh with Windows. Nowadays windows is shipping openssh.exe, so I can run it from cmd and it kinda works for quick simple actions, but clipboard works weirdly, basically I have to use right-click/paste to reliably paste data, shift+insert works in some apps and does not work in others. Putty just works like it worked 10 years ago, it's good old reliable tool.
- tikkabhuna 5y ago
  I use Windows Terminal these days so I have the same copy/paste behaviour in WSL, remote SSH and cmd. Ctrl + C when highlighting text to copy, Ctrl + V to paste.
- dgfitz 5y ago
  Have you ever tried mobaxterm? I was a putty person as well until I was put on to moba.
  - 5y ago

rectang 5y ago

> And part of that is making all the necessary security tools available free of charge, because the more money they cost, the more companies will take a cost-benefit decision not to bother with them, neglecting the externalised cost of those knock-on effects of their insecurity on everyone else. Boy if that doesn't ring true. Kudos to PuTTY's author for making it so easy and low cost to do the right thing that those profit-seeking automatons we call "companies" actually will.

mwcampbell 5y ago
The same logic applies to other concerns like accessibility, which is one reason why I'm making one of my contributions in that area [1] available as permissively licensed open source. It helps that my current funding source for that project also wants it to be open source. [1]: https://github.com/AccessKit/accesskit https://github.com/AccessKit/accesskit

GekkePrutser 5y ago

Putty is great and I thank him for this work :) I only use it privately now because our work doesn't allow it anymore since openssh was included with Windows. But I still prefer it.

bityard 5y ago

These days, there seems to be (at least) two kinds of open source software developers: 0. Those who release their code under an open source license, in the hope that it will be useful to others in some way. 1. Those who do the same as above, with the additional hope that they will be paid for in some ill-defined way. And when they are not, take to twitter and blogs to proclaim, "somebody should really do something about this!"

AndrewDucker 5y ago
I do think there is a real problem whereby very important code that a lot of people and systems depend on is looked after part time (or not at all) and nobody thinks about it until it has a severe bug. But that's almost orthogonal to the issue of whether the original developer should be paid because their code turns out to be useful to lots of people.
- toast0 5y ago
  It's also orthogonal to whether the code is free or paid, open or closed. Plenty of commercial code is barely looked after, and if it's closed and broken, it's a lot harder to fix.
- prepend 5y ago
  I think it’s a problem, but don’t think funding is a good solution. If funding was good, then commercial products would serve the purpose. I think a better approach is to encourage more smart developers contributing time. And if companies find an individual or a percent of a person’s time on a project that’s actually funding. But it’s very different from trying to replicate direct funds.
  - Helithumper 5y ago
    > If funding was good, then commercial products would serve the purpose. Not sure that's a solid affirmation, especially given how there are many open source projects receiving funding that often outcompete their commercial counterparts. In particular I would point out the major open source backing foundations such as the CNCF and Linux Foundation who help to fund their own projects. Would you say that these two organizations and their projects are not serving their purpose or are being outcompeted by commercial offerings?

chx 5y ago

> But I'm not sure I don't prefer it this way – a labour of love becomes a chore if you can't temporarily put it down when you're running low on love. That is a very wise comment.

denton-scratch 5y ago

It would be cool if someone would donate to him a domain. Downloading PuTTY involves relying on greenend.org.uk (which isn't obviously connected with PuTTY). You can check your download using the hashes provided on the site; but if the download has been messed with, then the hash is untrustworthy too. https://noncombatant.org/2014/03/03/downloading-software-safely-is-nearly-impossible/ https://noncombatant.org/2014/03/03/downloading-software-saf...

GoodbyeMrChips 5y ago
Would the lazy bastards who downvoted parent instead do something useful and post a sensible rely? (Rather then keep turning this place into another Redit). Link and text from the Putty FAQ below. https://www.chiark.greenend.org.uk/~sgtatham/putty/faq.html#faq-domain https://www.chiark.greenend.org.uk/~sgtatham/putty/faq.html#... A.9.2 Would you like me to register you a nicer domain name? No, thank you. Even if you can find one (most of them seem to have been registered already, by people who didn't ask whether we actually wanted it before they applied), we're happy with the PuTTY web site being exactly where it is. It's not hard to find (just type ‘putty’ into google.com and we're the first link returned), and we don't believe the administrative hassle of moving the site would be worth the benefit. In addition, if we did want a custom domain name, we would want to run it ourselves, so we knew for certain that it would continue to point where we wanted it, and wouldn't suddenly change or do strange things. Having it registered for us by a third party who we don't even know is not the best way to achieve this.
lstodd 5y ago
Hah, I once ran a PuTTY download mirror for the clients of an ISP I then worked at. It was like 20 years ago. Even then it was obvious that they don't want any fancy domains, just that the work is done and putty.exe delivered where it's needed.

georgeoliver 5y ago

The discussion around open source in the last few days lends weight in my view to the notion that most engineers are apolitical by nature. Unfortunately larger political entities (that is, BigCorp) have no reservations taking advantage of this.

varajelle 5y ago

I've been paid to (help) maintain an open source project by a company that also offer services and support around that project. When someone report a bug on GitHub, then the bug is triaged and prioritized for both paying customer and open source users. But sometimes open source users would just ask questions in the GitHub bug tracker. Then I'd just close the issue and provide a link to the official support channels (sometimes also answering the question if that's easy enough, but not if I have to ask more info or if I have to search for the answer). Same when open source users would just ask questions by email.

ben_w 5y ago

Simon’s a lovely guy. Met him a few times, he was often around in the local Geek pub[0] back before I moved out of Cambridge. [0] Same pub as frequented by the guy who proved Magic The Gathering is Turing complete, because Cambridge is tiny.

majkinetor 5y ago

I am very happy that there are such great dudes. Respect! I don't even use putty (but its fork, kitty). People forget one simple fact - WHEN YOU ARE PAYED, U ARE NO LONGER FREE. There is no substitute for passion work, where YOU are the man, and there is 0 chance somebody will influence you.

hinkley 5y ago

Someone I know met Simon one day and thought I’d like his autograph, since I was working in security at the time. I had in fact introduced that team to PuTTY, though this friend didn’t know that. So I own a postcard that says words to the effect, “nobody has ever asked me for an autograph before”. It is framed.

tylervigen 5y ago
This is a delightful story. Thank you for sharing.

arka2147483647 5y ago

This is a nice post from a healthy person who is comfortable with his position, and isn’t overburdened. However, what would happen if that were not so? What would happen if he Could not, Would not, or were Unable to work? It would all fall apart. And that is the inherent fragility in these small critical opensource projects.

lolc 5y ago
Putty would keep running even if the maintainer disappeared. You can build it yourself. You can find somebody to maintain it for you. What's fragile about that?
nradov 5y ago
Or someone else would fork the code, most users would eventually migrate to the new project, and life goes on.
aardvark179 5y ago
I think somebody else would pick it up. Simon is not the only person who works on PuTTY and there are several people who might reasonably pick up the security side of things. The various UI bits might be slightly less well distributed, but I am sure somebody could be found in pretty short order.
- unixbane 5y ago
  there are between 0 and 1 people in the world who have cohesive understanding of how all the shell, terminal, and stuff between need to interact + the requisite knowledge to know what and what doesn't have security implications DAY OF THE SEAL SOON

demarq 5y ago

gem in the sites comments section > a labour of love becomes a chore if you can't temporarily put it down when you're running low on love. - simon.t

ncmncm 5y ago

The source code for the core of Putty is an astonishing construction, a sort of extreme case of Duff's device spanning many, many pages. At each point where an operation might block, there is a macro that expands to a break and a switch/case clause that enables returning to that point. A colleague said "I love it, and hate myself for loving it". The new "async/await" features appearing in numerous languages encode this pattern -- i.e., result in substantially the same object code -- in a more robust way, but Putty works fine.

synergy20 5y ago

windows 10 has openssh client now, with WSL2 it has many other putty-alike tools, for me, I no longer need putty these days. Thanks for the great ride.

jalino23 5y ago

I used ssh in wsl it works well for me.not sure if I miss anything not using putty?

raxxorrax 5y ago
I use putty for serial and socket connections and only rarely for ssh.

Cameri 5y ago

I once wrote a tool in C# that used Putty behind the scenes to connect to routers (and hop through them) and collect interface metrics. Back in 2009 :)

exikyut 5y ago

What I got from this was a tiny wake-up call to realize/remember/not lose sight of: the OSS relationship is the one scalable model we've yet found that lets the problem being solved remain the focal point of the effort, deliberately at the cost of everything else: > Often I feel as if some particular correspondent of mine has simply forgotten that I'm not a paid software vendor who has a multi-million-dollar contract with their employer, and hasn't quite figured out that as a consequence I have no incentive to drop everything and solve their particular problem. [...] > But I've always been able to deal with this by pointedly reminding the most demanding people that I'm not at their beck and call. [...] > And if someone keeps pestering in spite of every clue you try to impart, well, there's always the 'just stop replying' option. [...] > When it comes to companies depending on my stuff, I take the same no-nonsense attitude, because in every free software licence agreement (even the maximally permissive MIT, my usual choice) is that all-important "NO WARRANTY" clause, and it's there for exactly this reason, and I'm happy to push back if people try to ignore that. We're so sensitive to that inversion effect that can happen when some core technical fascination loses ground to the humdrum of always turning up somewhere 5 days a week, rain, hail or shine... always be checking the bugtracker, always be working on the next feature or component, always be maintaining everything and keeping it together. The regularity and predictability of that continuous process can be reassuring... as long as it remains fundamentally interesting. But as soon as the interestingness fades, everything suddenly feels like a scary monster from a nightmare you can't shake off. It seems to be a ratified status quo that everyone is just expected to deal with this. While the description doesn't quite relate to the remunerative relationship of the workplace, I generally describe the above as "club mentality": people start out by gathering together, drawn together by the focus of some shared interest; then after some time the focus switches to "we should definitely get together every fortnight", then on some fortnights noone knows what to talk about... aaand before anyone realises it, the incentivization structure that previously drove everyone to bring their best to the table is gone. Sometimes the meeting-every-fortnight bit happens to further the shared interest - making the process of identifying the switchpoint even harder. But it's always there - there's a point at which everyone kinda gets less interested, but feels compelled to continue the meetings. These turn out to be filled not with awkward pauses; there's somehow always still something to do, something to go on with. But anyone fresh would take one look at the situation and immediately call it busywork - it's not furthering the bigger picture, it's just playing Dodgem cars within the sandbox that's been carved out. The kinetic aspect of that makes it easy to believe that impact is being made, provided you don't look too closely at the bigger picture. The correct but fiendishly difficult response is of course to never lose sight of the bigger picture, and for everyone to be honest with each other about when they've lost interest. Sometimes that's easy, like when a "band" gets together only for everyone to collectively realize music isn't all that fascinating after a couple months. Disappointing retrospective memory? Doesn't matter, the alternative would have been much more depressing. It's sad that the difficulty and complexity of writing software means you pretty much have to live through a multi-month or -year period of hum-drum boringness before getting to a reasonable closure point. The only workaround I've yet found is to frequently switch roles, which doesn't really provide closure unless the roles are extremely small-scale, and always tends to be very abrupt in any case. If you can make it work financially, OSS does indeed provide the most viable scalable solution for this whole problem. Heh. At all costs.

andrew_ 5y ago

I paste this every time the subject is raised: https://liberamanifesto.com/ https://liberamanifesto.com/

mcbishop 5y ago

> If one of them is rude to me, then the quintessentially British approach of a faint frown and a tone of mild reproof (or its email analogue) generally gets good results – probably a lot better than mouthing off like a sweary 13-year-old in return. I love this.