5 ms·

Hijacking Trust? Bitvise Under Fire for Controlling Domain of FOSS Project PuTTY

76 points by ColinWright 1y ago

andreareina 1y ago
Related: https://news.ycombinator.com/item?id=44558328 https://news.ycombinator.com/item?id=44558328 "putty.org is not run by PuTTY developers"
greatgib 1y ago
Here they think that what is doing Bitvise is legal but I think that it might not be the case in the law of a number of countries and even possibly in domain names "regulation"? This is parasitism, or deceptive practice to hold the domain name of a competitor claiming your are to be associated with the other project.
- lmz 1y ago
  Certainly it's one basis for dispute (but only if it is trademarked): https://www.wipo.int/amc/en/domains/ https://www.wipo.int/amc/en/domains/
- mieses 1y ago
  extremely subjective. the damage of allowing schoolmarm types to determine laws based on what they think is parasitic or deceptive is more dangerous than the unambiguous and coherent concept of property. PuTTY owns https://www.chiark.greenend.org.uk/~sgtatham/putty/ https://www.chiark.greenend.org.uk/~sgtatham/putty/ There are a number of strings in this domain that cause me great distress. Should I be allowed to seize their property?
  - brabel 1y ago
    What a ridiculous argument. Every project and company that has a trademark should be allowed to protect that, including by claiming domains clearly intended to appear associated with their trademark. Being offended by strings has nothing to do with that and it’s childish to try to derail the conversation like that.
- fanf2 1y ago
  Bitvise are “passing off” which is a tort in English law https://harperjames.co.uk/article/passing-off/ https://harperjames.co.uk/article/passing-off/
charcircuit 1y ago
Under fire from who? That "journalist"? It's best to just ignore them instead of trying to play their games.
udev4096 1y ago
[flagged]
- thyristan 1y ago
  Yes, but an outdated and broken version usually. You'd have to install mingw or cygwin for a proper one, or use a Linux VM like w4lv2.
- msgodel 1y ago
  Putty isn't just ssh, it's also the VTE and serial terminal. Also it has its own keys/configs/shortcuts people are almost certainly used to. I don't think there's even an easy way to migrate putty shortcuts (I can't remember what they're called) to OpenSSH.
  - udev4096 1y ago
    I forgot. Windows users are so inefficient that they require a GUI for doing just about anything. Have fun being inefficient!
    - msgodel 1y ago
      It's a different paradigm. I think just like they do sometimes we get lost in our own world. They had CUA and portable apps before malware became a big deal and got really used to that. I think people should respect that try harder to meet users where they are.
      - udev4096 1y ago
        Modern malware tries to infect all the systems. Long gone are the days where linux or macos malware didn't exist. Stop bringing up utterly useless arguments just so you can justify your usage of winblows
- 112233 1y ago
  I use putty on linux. now what?
mnaimd 1y ago
> “The difference is not one of profit, it is one of philosophy. You believe software can be managed by a committee. I believe software requires an owner, otherwise it is dead.” This justification is even worse than the domain squatting itself. Some of the most influential software in history (Linux, Git, GCC, and yes, PuTTY) thrived under community-driven development. The idea that software "dies" without a single corporate owner is not just false, it’s insulting to the open-source ecosystem. If Bitvise truly believes in their philosophy, they wouldn’t need to borrow PuTTY’s reputation by holding putty.org. Maybe they should spend less time on branding and more time studying how successful open-source projects actually work.
- TrevorStepnikkk 1y ago
  I see where you're coming from, but I think your examples actually prove the opposite point. I've always seen Linux and Git not as projects run by a committee, but as projects guided by a single, trusted leader. Linus Torvalds is the owner of the kernel's vision. He has the final say. That isn't community consensus; it's benevolent dictatorship. So while the putty.org situation is shady, I believe the core idea is right: great software needs a final arbiter with a clear vision, not just a crowd.
  - goku12 1y ago
    I seriously doubt that they're talking about leadership when they say ownership. Otherwise it would make little sense because few foss projects are democracies anyway.
  - arp242 1y ago
    The thing is that this was his "answer" to what was really the quite reasonable question of "do you think this is ethical?" To start talking about this sort of thing is completely disconnected from the actual question. Of course you can have discussion about these aspects of the open source ecosystem; this is a long-running discussion where many people have discussed and disagreed in good faith. I don't entirely agree with your take personally, but I also don't entirely disagree and can see where you're coming from, and it's of course an interesting thing to discus. However, in this context, as an "answer" to that question, it's hard to see it as anything other than just self-serving post-hoc rationalisation for being a selfish wanker. This is classic nihilism where the abuse of everything and everyone is justified as long as you can get away with it. Everything that moves the needle and you can get away with is morally justified because it moves the needle and you can get away with it.
msgodel 1y ago
I don't think Bitvise is even doing anything wrong here? There's nothing wrong with running what is essentially a fan site and promoting your own things on it.
- SpaceNugget 1y ago
  It's a company who bought the domain of the exact name of the largest open source project that they directly compete with and then advertise themselves on it? This is at the very least unethical. You can't just use a competitors exact name to run a website that tries to snipe users looking for your competitor and call it a "fan site". The comments on this submission are pretty strange. What are the chances that a bunch of non-sockpuppet HN type of people are in support of this kind of garbage? Generally with sort of abysmal behaviour like the email communication in the article, there's people going to bat against actually defensible actions purely in the name of civility on HN. These bitvise people seem bad from both angles and yet the of early comments are either ignoring the issue and redirecting (e.g. "who even uses putty") or outright defending their shitty behaviour?
  - msgodel 1y ago
    You can buy domain names with competitors names in them. People do this all the time. If you don't want people doing that you need to register the names yourself.
    - ColinWright 1y ago
      So someone who has written something and made it available for the common good, and makes no money from it, should now go and buy every possible domain that people might use in a deceptive manner. This is a great example of what drives people away from providing anything for free.
      - msgodel 1y ago
        It's a namespace problem. You can't just ban people from registering anything that might be confusing like that. If we followed your idea the internet wouldn't work. EDIT: They're not deceiving users though? The first section on the index page links directly to the real putty site. They're very clear about all of it. EDIT2: Nope. We really don't want DNS "moderators." All of us have seen what happens with forum moderators. Like I said if that were done the internet would not work. It's not about the cost it's about being unable to clearly define what should be banned. If you want to see a great example of how moderation like that both stops legitimate use and fails to stop malware go look at smartphone app stores. The result is borderline unusable garbage.
asimops 1y ago
I don't get it. The putty website has always been https://www.chiark.greenend.org.uk/~sgtatham/putty/ https://www.chiark.greenend.org.uk/~sgtatham/putty/ This has never changed. Just because someone likes to use short circuit routing in their head doesn't make putty.org the official site for putty. That is the same attitude as telling the Keepass folks that https://keepass.info/ https://keepass.info/ is wrong... edit: Maybe also have a look at the putty FAQ, especially 9.3 https://www.chiark.greenend.org.uk/~sgtatham/putty/faq.html#faq-admin https://www.chiark.greenend.org.uk/~sgtatham/putty/faq.html#...
- TonyTrapp 1y ago
  How does your example relate? keepass.info is the official Keepass website, owned by the Keepass developer.
  - asimops 1y ago
    As is https://www.chiark.greenend.org.uk/~sgtatham/putty/ https://www.chiark.greenend.org.uk/~sgtatham/putty/ to Putty. Still there were multiple requests to the Keepass project to change that domain to "a proper" domain like keepass.com
    - stavros 1y ago
      I, too, took your comment to mean that keepass.info is to KeePass as putty.org is to PuTTY.
      - asimops 1y ago
        Well, classic sender receiver mismatch I guess :D Is my intent more clear with that second try to explain? If not, I'm more then welcome to talk about a better way to phrase it :)
        mtlynch 1y ago
        I was confused as well and panicked that I'd been installing KeePass from a fake site all these years. But keepass.info is indeed the official site. Suggest: That is the same attitude as critics telling the Keepass maintainer to migrate the (official) keepass.info domain to a .com...
bstsb 1y ago
both sides are at fault here (the "journalist" and Bitvise - the PuTTY maintainers have nothing to do with this). the Bitvise owner shouldn't have responded so unprofessionally, and their views on open source software are strange - but they're correct that the domain was never "historically associated with PuTTY", it just uses its name. additionally, the usage of unformatted markdown in each "journalist" email makes me think this story was at least partially assisted by an LLM (https://putty.org/20250713-MiraiF-Emails.txt https://putty.org/20250713-MiraiF-Emails.txt) in short this is a nothing story
- tojumpship 1y ago
  LLM written, spurring up controversy, holding a private company accountable like they are the government. If they - PuTTY - is bothered enough, they are allowed to sue or request a takedown, and if legal grounds are not viable I don't think Google would mind ranking the correct website up after request. This "issue" has been present for years and this journalist picks up on it, presses on the guy as if he was in the Panama Papers or something and writes the article with newgen LLM no less. Disgraceful.
ptx 1y ago
> The domain, long associated by users with PuTTY [...] a domain name that clearly and historically signals the PuTTY project This seems a bit misleading. The domain has never, as far as I know, belonged to the project, so it can only have been "long associated" in the minds of users mistakenly trying to guess the URL and "historically" navigating to the wrong website. > “The PuTTY project never had this domain” Right. > Search engines treat domain names like putty.org as authoritative. Do they? Domain names "like" putty.org in what sense? Which search engines, by what mechanism?
fifteen1506 1y ago
Look, I understand. Excess of information leads people to start skimming all text. But look: "Below suggestions are independent of PuTTY. They are not endorsements by the PuTTY project." Above of this is a direct link to PuTTY's website. I'm afraid this is a non-issue. Sure, you are free to rant, and I appreciate the good intentions behind it, but count me out on raging. www.putty.org SHOULD be the correct address. Failing that, LINKING to the correct website is an acceptable measure, specially when such linking is on top. Want to blame someone? Blame SEO, where a decent 2000 website with no issues whatsoever is pushed down the results.
HourOrTwo 1y ago
[dead]
TRiG_Ireland 1y ago
Has the putty.org website changed in the few hours since this was posted? I see nothing there about any kind of software at all. It appears to be about someone called Mike Yeadon, and scandals in the pharmaceutical industry. That's not what anyone else here is describing.
- kappuchino 1y ago
  well, if you read about the exchange beween the author and owners ... add "schwurbeln" (german) to the list of whats weird about the domain.
- advisedwang 1y ago
  On the wayback machine it does appear that putty.org recently changed. If you go to www.putty.org you can see the page everyone is talking about still present.
  - TRiG_Ireland 1y ago
    How odd. Having different content on the main domain and the www subdomain is so unusual that it's hard to believe it was done on purpose.

76 points by ColinWright 1y ago

Related: https://news.ycombinator.com/item?id=44558328 https://news.ycombinator.com/item?id=44558328 "putty.org is not run by PuTTY developers"

greatgib 1y ago

Here they think that what is doing Bitvise is legal but I think that it might not be the case in the law of a number of countries and even possibly in domain names "regulation"? This is parasitism, or deceptive practice to hold the domain name of a competitor claiming your are to be associated with the other project.

lmz 1y ago
Certainly it's one basis for dispute (but only if it is trademarked): https://www.wipo.int/amc/en/domains/ https://www.wipo.int/amc/en/domains/
mieses 1y ago
extremely subjective. the damage of allowing schoolmarm types to determine laws based on what they think is parasitic or deceptive is more dangerous than the unambiguous and coherent concept of property. PuTTY owns https://www.chiark.greenend.org.uk/~sgtatham/putty/ https://www.chiark.greenend.org.uk/~sgtatham/putty/ There are a number of strings in this domain that cause me great distress. Should I be allowed to seize their property?
- brabel 1y ago
  What a ridiculous argument. Every project and company that has a trademark should be allowed to protect that, including by claiming domains clearly intended to appear associated with their trademark. Being offended by strings has nothing to do with that and it’s childish to try to derail the conversation like that.
fanf2 1y ago
Bitvise are “passing off” which is a tort in English law https://harperjames.co.uk/article/passing-off/ https://harperjames.co.uk/article/passing-off/

charcircuit 1y ago

Under fire from who? That "journalist"? It's best to just ignore them instead of trying to play their games.

udev4096 1y ago

[flagged]

thyristan 1y ago
Yes, but an outdated and broken version usually. You'd have to install mingw or cygwin for a proper one, or use a Linux VM like w4lv2.
msgodel 1y ago
Putty isn't just ssh, it's also the VTE and serial terminal. Also it has its own keys/configs/shortcuts people are almost certainly used to. I don't think there's even an easy way to migrate putty shortcuts (I can't remember what they're called) to OpenSSH.
- udev4096 1y ago
  I forgot. Windows users are so inefficient that they require a GUI for doing just about anything. Have fun being inefficient!
  - msgodel 1y ago
    It's a different paradigm. I think just like they do sometimes we get lost in our own world. They had CUA and portable apps before malware became a big deal and got really used to that. I think people should respect that try harder to meet users where they are.
    - udev4096 1y ago
      Modern malware tries to infect all the systems. Long gone are the days where linux or macos malware didn't exist. Stop bringing up utterly useless arguments just so you can justify your usage of winblows
112233 1y ago
I use putty on linux. now what?

mnaimd 1y ago

> “The difference is not one of profit, it is one of philosophy. You believe software can be managed by a committee. I believe software requires an owner, otherwise it is dead.” This justification is even worse than the domain squatting itself. Some of the most influential software in history (Linux, Git, GCC, and yes, PuTTY) thrived under community-driven development. The idea that software "dies" without a single corporate owner is not just false, it’s insulting to the open-source ecosystem. If Bitvise truly believes in their philosophy, they wouldn’t need to borrow PuTTY’s reputation by holding putty.org. Maybe they should spend less time on branding and more time studying how successful open-source projects actually work.

TrevorStepnikkk 1y ago
I see where you're coming from, but I think your examples actually prove the opposite point. I've always seen Linux and Git not as projects run by a committee, but as projects guided by a single, trusted leader. Linus Torvalds is the owner of the kernel's vision. He has the final say. That isn't community consensus; it's benevolent dictatorship. So while the putty.org situation is shady, I believe the core idea is right: great software needs a final arbiter with a clear vision, not just a crowd.
- goku12 1y ago
  I seriously doubt that they're talking about leadership when they say ownership. Otherwise it would make little sense because few foss projects are democracies anyway.
- arp242 1y ago
  The thing is that this was his "answer" to what was really the quite reasonable question of "do you think this is ethical?" To start talking about this sort of thing is completely disconnected from the actual question. Of course you can have discussion about these aspects of the open source ecosystem; this is a long-running discussion where many people have discussed and disagreed in good faith. I don't entirely agree with your take personally, but I also don't entirely disagree and can see where you're coming from, and it's of course an interesting thing to discus. However, in this context, as an "answer" to that question, it's hard to see it as anything other than just self-serving post-hoc rationalisation for being a selfish wanker. This is classic nihilism where the abuse of everything and everyone is justified as long as you can get away with it. Everything that moves the needle and you can get away with is morally justified because it moves the needle and you can get away with it.

msgodel 1y ago

I don't think Bitvise is even doing anything wrong here? There's nothing wrong with running what is essentially a fan site and promoting your own things on it.

SpaceNugget 1y ago
It's a company who bought the domain of the exact name of the largest open source project that they directly compete with and then advertise themselves on it? This is at the very least unethical. You can't just use a competitors exact name to run a website that tries to snipe users looking for your competitor and call it a "fan site". The comments on this submission are pretty strange. What are the chances that a bunch of non-sockpuppet HN type of people are in support of this kind of garbage? Generally with sort of abysmal behaviour like the email communication in the article, there's people going to bat against actually defensible actions purely in the name of civility on HN. These bitvise people seem bad from both angles and yet the of early comments are either ignoring the issue and redirecting (e.g. "who even uses putty") or outright defending their shitty behaviour?
- msgodel 1y ago
  You can buy domain names with competitors names in them. People do this all the time. If you don't want people doing that you need to register the names yourself.
  - ColinWright 1y ago
    So someone who has written something and made it available for the common good, and makes no money from it, should now go and buy every possible domain that people might use in a deceptive manner. This is a great example of what drives people away from providing anything for free.
    - msgodel 1y ago
      It's a namespace problem. You can't just ban people from registering anything that might be confusing like that. If we followed your idea the internet wouldn't work. EDIT: They're not deceiving users though? The first section on the index page links directly to the real putty site. They're very clear about all of it. EDIT2: Nope. We really don't want DNS "moderators." All of us have seen what happens with forum moderators. Like I said if that were done the internet would not work. It's not about the cost it's about being unable to clearly define what should be banned. If you want to see a great example of how moderation like that both stops legitimate use and fails to stop malware go look at smartphone app stores. The result is borderline unusable garbage.

asimops 1y ago

I don't get it. The putty website has always been https://www.chiark.greenend.org.uk/~sgtatham/putty/ https://www.chiark.greenend.org.uk/~sgtatham/putty/ This has never changed. Just because someone likes to use short circuit routing in their head doesn't make putty.org the official site for putty. That is the same attitude as telling the Keepass folks that https://keepass.info/ https://keepass.info/ is wrong... edit: Maybe also have a look at the putty FAQ, especially 9.3 https://www.chiark.greenend.org.uk/~sgtatham/putty/faq.html#faq-admin https://www.chiark.greenend.org.uk/~sgtatham/putty/faq.html#...

TonyTrapp 1y ago
How does your example relate? keepass.info is the official Keepass website, owned by the Keepass developer.
- asimops 1y ago
  As is https://www.chiark.greenend.org.uk/~sgtatham/putty/ https://www.chiark.greenend.org.uk/~sgtatham/putty/ to Putty. Still there were multiple requests to the Keepass project to change that domain to "a proper" domain like keepass.com
  - stavros 1y ago
    I, too, took your comment to mean that keepass.info is to KeePass as putty.org is to PuTTY.
    - asimops 1y ago
      Well, classic sender receiver mismatch I guess :D Is my intent more clear with that second try to explain? If not, I'm more then welcome to talk about a better way to phrase it :)
      - mtlynch 1y ago
        I was confused as well and panicked that I'd been installing KeePass from a fake site all these years. But keepass.info is indeed the official site. Suggest: That is the same attitude as critics telling the Keepass maintainer to migrate the (official) keepass.info domain to a .com...

bstsb 1y ago

both sides are at fault here (the "journalist" and Bitvise - the PuTTY maintainers have nothing to do with this). the Bitvise owner shouldn't have responded so unprofessionally, and their views on open source software are strange - but they're correct that the domain was never "historically associated with PuTTY", it just uses its name. additionally, the usage of unformatted markdown in each "journalist" email makes me think this story was at least partially assisted by an LLM (https://putty.org/20250713-MiraiF-Emails.txt https://putty.org/20250713-MiraiF-Emails.txt) in short this is a nothing story

tojumpship 1y ago
LLM written, spurring up controversy, holding a private company accountable like they are the government. If they - PuTTY - is bothered enough, they are allowed to sue or request a takedown, and if legal grounds are not viable I don't think Google would mind ranking the correct website up after request. This "issue" has been present for years and this journalist picks up on it, presses on the guy as if he was in the Panama Papers or something and writes the article with newgen LLM no less. Disgraceful.

ptx 1y ago

> The domain, long associated by users with PuTTY [...] a domain name that clearly and historically signals the PuTTY project This seems a bit misleading. The domain has never, as far as I know, belonged to the project, so it can only have been "long associated" in the minds of users mistakenly trying to guess the URL and "historically" navigating to the wrong website. > “The PuTTY project never had this domain” Right. > Search engines treat domain names like putty.org as authoritative. Do they? Domain names "like" putty.org in what sense? Which search engines, by what mechanism?

fifteen1506 1y ago

Look, I understand. Excess of information leads people to start skimming all text. But look: "Below suggestions are independent of PuTTY. They are not endorsements by the PuTTY project." Above of this is a direct link to PuTTY's website. I'm afraid this is a non-issue. Sure, you are free to rant, and I appreciate the good intentions behind it, but count me out on raging. www.putty.org SHOULD be the correct address. Failing that, LINKING to the correct website is an acceptable measure, specially when such linking is on top. Want to blame someone? Blame SEO, where a decent 2000 website with no issues whatsoever is pushed down the results.

HourOrTwo 1y ago

[dead]

TRiG_Ireland 1y ago

Has the putty.org website changed in the few hours since this was posted? I see nothing there about any kind of software at all. It appears to be about someone called Mike Yeadon, and scandals in the pharmaceutical industry. That's not what anyone else here is describing.

kappuchino 1y ago
well, if you read about the exchange beween the author and owners ... add "schwurbeln" (german) to the list of whats weird about the domain.
advisedwang 1y ago
On the wayback machine it does appear that putty.org recently changed. If you go to www.putty.org you can see the page everyone is talking about still present.
- TRiG_Ireland 1y ago
  How odd. Having different content on the main domain and the www subdomain is so unusual that it's hard to believe it was done on purpose.