56 ms·

You mean like putty only being served over HTTP until like 2019?

by hsbauauvhabzb 5y ago

cblconfederate 5y ago
incidental, have you donated to putty?
- Chris2048 5y ago
  Are you implying putty devs didn't serve over httpS b/c they couldn't afford to?
  - ori_b 5y ago
    Because they were busy with their paid job.
    - mjw1007 5y ago
      Perhaps more likely: because they were the sort of people that disliked the certificate authority cartel, and preferred to rely on a GPG signature until letsencrypt came along.
    - Chris2048 5y ago
      Then why aren't they too busy to develop putty also? I don't like the idea of security matters being payed extras. Would you make free cupcakes for people, but refuse to wash you hands while doing so unless someone paid you to? "Hey, I'm too busy with paid work to make my cupcakes hygienic; you want clean cupcakes, make your own!"
      - ori_b 5y ago
        If someone made free cupcakes and didn't wash their hands, I wouldn't eat them. I wouldn't get angry that they spent their free time making cupcakes that I didn't really want. And the wonderful thing about open source is that you can take the existing code, fork it, and do things the way you think they should be done. No salary? No obligations.
        Chris2048 5y ago
        > I wouldn't eat them How would you know unless you asked. When someone offers you something for free, do you interrogate them over their process? They aren't paid to answer your questions either. The end result is no one should accept anything that is free. Well done, Microsoft just won. > the wonderful thing about open source is.. Are you writing your own OS, prog-lang and compiler from scratch too? If "you can take the existing code, fork it" is the only way to get secure code, then the real implication is having secure code requires you to "take the existing code, fork it"; This sounds less like the wonderful thing, and more like the terrible thing. > No salary? No obligations. Then why can't people give legal/medical advices without licence? Why can't I see a dying man in the street and choose not to call 999? Why can't I refuse jury duty, or the draft etc etc?
        ori_b 5y ago
        You sound incredibly entitled. "Give me free things done to my specs, or Microsoft won. No, of course you don't deserve a salary for that." > Are you writing your own OS, prog-lang and compiler from scratch too? Yes -- I'm an OpenBSD and 9front committer, and I have built my own language and compiler. My website -- https://orib.dev https://orib.dev -- runs code I can commit to all the way down to the hardware. But that's neither here nor there. I do that because it's fun. You also don't get to demand work from me without paying.
        Chris2048 5y ago
        > You sound.. Is sounds entitled b/c you paraphrased it uncharitably. I didn't ask for "any spec" - there's a big (Hippocratic) difference between dictating what form something comes in, and asking that it do no harm. A poison cupcake, much like a poorly secured software, could wipe out any benefit it brings. Also, I'm not demanding anything: feel free not to produce anything; But if you do, make it reasonably secure, or clearly/explicitly communicate that is it insecure; in the same way websites are (supposed) to seek permissions for cookies rather than assume them. The context of "or Microsoft won" is that MS pushed the idea that FOSS could not be trusted without legal liability - this essentially makes that case. I provided a few example of where people are expected to do things without being paid, do you also refuse to do those things?
- hsbauauvhabzb 5y ago
  No, but i haven’t used it pretty much at all since I moved to linux in 2016. Edit: but I’ve submitted various security vulnerabilities to oss products, real actual issues too, not Nessus output.
jokoon 5y ago
Isn't this like some kind of canary, to warn people that putty might be backdoored?
- hsbauauvhabzb 5y ago
  If you have citations on that I’d be curious, but unencrypted http in a vulnerability which mean nodes in the middle can automate injecting malware into binaries, meaning it’s be a weird place to draw a line in the sand as a canary
  - londons_explore 5y ago
    It's a dangerous thing to do as an adversary. Many organisations will automatically hash and collect all binaries before they execute on any of their machines. Finding a putty.exe that is different to every other putty.exe in the network sure sounds like a red flag worthy of someone uploading to virustotal and then project zero getting their hands on it....
    - l0b0 5y ago
      I don't think GP was talking about replacing all downloads with malware, just key ones, like individual targets.
  - jokoon 5y ago
    It was just a weird idea I had. Not a canary, but a way to say "we cannot guarantee that exe is not compromised because of things we can't talk about, so there is no need to provide https to secure it, so here is just http".
  - l0b0 5y ago
    You wouldn't even need to serve actual malware, just give people an old version of PuTTY with either a known vulnerability or insecure defaults.

You mean like putty only being served over HTTP until like 2019?

cblconfederate 5y ago

incidental, have you donated to putty?

Chris2048 5y ago
Are you implying putty devs didn't serve over httpS b/c they couldn't afford to?
- ori_b 5y ago
  Because they were busy with their paid job.
  - mjw1007 5y ago
    Perhaps more likely: because they were the sort of people that disliked the certificate authority cartel, and preferred to rely on a GPG signature until letsencrypt came along.
  - Chris2048 5y ago
    Then why aren't they too busy to develop putty also? I don't like the idea of security matters being payed extras. Would you make free cupcakes for people, but refuse to wash you hands while doing so unless someone paid you to? "Hey, I'm too busy with paid work to make my cupcakes hygienic; you want clean cupcakes, make your own!"
    - ori_b 5y ago
      If someone made free cupcakes and didn't wash their hands, I wouldn't eat them. I wouldn't get angry that they spent their free time making cupcakes that I didn't really want. And the wonderful thing about open source is that you can take the existing code, fork it, and do things the way you think they should be done. No salary? No obligations.
      - Chris2048 5y ago
        > I wouldn't eat them How would you know unless you asked. When someone offers you something for free, do you interrogate them over their process? They aren't paid to answer your questions either. The end result is no one should accept anything that is free. Well done, Microsoft just won. > the wonderful thing about open source is.. Are you writing your own OS, prog-lang and compiler from scratch too? If "you can take the existing code, fork it" is the only way to get secure code, then the real implication is having secure code requires you to "take the existing code, fork it"; This sounds less like the wonderful thing, and more like the terrible thing. > No salary? No obligations. Then why can't people give legal/medical advices without licence? Why can't I see a dying man in the street and choose not to call 999? Why can't I refuse jury duty, or the draft etc etc?
        ori_b 5y ago
        You sound incredibly entitled. "Give me free things done to my specs, or Microsoft won. No, of course you don't deserve a salary for that." > Are you writing your own OS, prog-lang and compiler from scratch too? Yes -- I'm an OpenBSD and 9front committer, and I have built my own language and compiler. My website -- https://orib.dev https://orib.dev -- runs code I can commit to all the way down to the hardware. But that's neither here nor there. I do that because it's fun. You also don't get to demand work from me without paying.
        Chris2048 5y ago
        > You sound.. Is sounds entitled b/c you paraphrased it uncharitably. I didn't ask for "any spec" - there's a big (Hippocratic) difference between dictating what form something comes in, and asking that it do no harm. A poison cupcake, much like a poorly secured software, could wipe out any benefit it brings. Also, I'm not demanding anything: feel free not to produce anything; But if you do, make it reasonably secure, or clearly/explicitly communicate that is it insecure; in the same way websites are (supposed) to seek permissions for cookies rather than assume them. The context of "or Microsoft won" is that MS pushed the idea that FOSS could not be trusted without legal liability - this essentially makes that case. I provided a few example of where people are expected to do things without being paid, do you also refuse to do those things?
hsbauauvhabzb 5y ago
No, but i haven’t used it pretty much at all since I moved to linux in 2016. Edit: but I’ve submitted various security vulnerabilities to oss products, real actual issues too, not Nessus output.

jokoon 5y ago

Isn't this like some kind of canary, to warn people that putty might be backdoored?

hsbauauvhabzb 5y ago
If you have citations on that I’d be curious, but unencrypted http in a vulnerability which mean nodes in the middle can automate injecting malware into binaries, meaning it’s be a weird place to draw a line in the sand as a canary
- londons_explore 5y ago
  It's a dangerous thing to do as an adversary. Many organisations will automatically hash and collect all binaries before they execute on any of their machines. Finding a putty.exe that is different to every other putty.exe in the network sure sounds like a red flag worthy of someone uploading to virustotal and then project zero getting their hands on it....
  - l0b0 5y ago
    I don't think GP was talking about replacing all downloads with malware, just key ones, like individual targets.
- jokoon 5y ago
  It was just a weird idea I had. Not a canary, but a way to say "we cannot guarantee that exe is not compromised because of things we can't talk about, so there is no need to provide https to secure it, so here is just http".
- l0b0 5y ago
  You wouldn't even need to serve actual malware, just give people an old version of PuTTY with either a known vulnerability or insecure defaults.