4 ms·

The man himself also posted about it on his social media https://hachyderm.io/@simontatham/115025974777386803 https://hachyderm.io/@simontatham/1150259747773868

The man himself also posted about it on his social media https://hachyderm.io/@simontatham/115025974777386803 https://hachyderm.io/@simontatham/115025974777386803

throaway920181 1y ago
Cool, but hachyderm.io also is not a trusted/recognizable domain for me. Trust issues all the way down!
- andrewflnr 1y ago
  It's definitionally the correct domain for Simon Tatham's social media. What are you expecting here?
  - closewith 1y ago
    How would the average person know that?
    - viraptor 1y ago
      Average person aware of trust on social network / internet - because https://hachyderm.io/@simontatham https://hachyderm.io/@simontatham has a validated link to the author's homepage. Others - they don't understand the trust anyway, so there prerequisite steps missing before the main question anyway.
      - jstanley 1y ago
        hachyderm.io says it has a validated link to his homepage, but if you don't already trust hachyderm.io that means nothing.
        viraptor 1y ago
        It means a lot - you need to check the other side's meta to confirm yourself. https://fedi.tips/how-do-i-verify-my-account/ https://fedi.tips/how-do-i-verify-my-account/
        mjmas 1y ago
        For example, at https://www.chiark.greenend.org.uk/~sgtatham/ https://www.chiark.greenend.org.uk/~sgtatham/ : (the rel=me is the important part) [...] <a rel="me" href="https://hachyderm.io/@simontatham"> [...]
        closewith 1y ago
        No, it really means nothing. Identity on the internet is not a solved problem.
        pferde 1y ago
        You are wrong. It means that whoever owns the website marked as verified also owns the social account. See https://joinmastodon.org/verification https://joinmastodon.org/verification for a quick overview of how it works.
        closewith 1y ago
        No, it means a certain link exists on the website. On Hacker News of all sites, I would think we should all know that's not sufficient evidence of identity for an update regarding the source of critical software like a terminal.
        viraptor 1y ago
        Nobody claimed it validates the identity in any way. It validates that the person at the other website confirms it's their social account and the social account matches the other direction. The real identity is not involved here in any way and never was. You're disagreeing with someone nobody here raises. But the link validation confirms that if you believed that the original download site belongs to the author, then you would have almost the same guarantee about the social account. (+/- the chances of the putty website being hacked)
      - zo1 1y ago
        It was bad enough that we had to tell developers to trust some rando website to download a tool that we'd use to potentially plug in sensitive production usernames + credentials. A link that looks like this: https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.ht... And now they've gone and made it worse by posting some new site and confirming the new link is real on their weird "hachyderm" social media post thing. Yeah, talk about a grey-beard get-off-my-lawn developer screaming at the wind and wanting to make it worse for themselves and their "brand".
        viraptor 1y ago
        > on their weird "hachyderm" social media post thing At this point tech people should understand what Mastodon is. For their own benefit. It's been years.
        closewith 1y ago
        10 MM MAU estimated. Not exactly foundational to online discourse.
        viraptor 1y ago
        We're talking in context of Putty which is itself an extremely niche software. But if you think of just the software/tech people - Mastodon is quite an important place.
        CRConrad 1y ago
        [flagged]
    - andrewflnr 1y ago
      I just checked his home page: https://www.chiark.greenend.org.uk/~sgtatham/ https://www.chiark.greenend.org.uk/~sgtatham/
- jachee 1y ago
  So… what would be a trusted domain, for you, then?
  - zaphirplane 1y ago
    https://www.chiark.greenend.org.uk/~sgtatham/putty/ https://www.chiark.greenend.org.uk/~sgtatham/putty/
    - zugi 1y ago
      Exactly. Which nicely confirms all this by saying: Latest news 2025-08-14 New website, putty.software We have a new domain name for the PuTTY website! ...
      - cyphar 1y ago
        Which is what the original response linked to. :P
      - roman_soldier 1y ago
        What if someone hacked his site and inserted that news item? Better to visit the guy in person and verify.
        rzzzt 1y ago
        What if someone planted the idea of adding a new website for the project while he was asleep?
RainyDayTmrw 1y ago
As much as I like fedi, it does make it hard to understand which user on which instance is the correct one.
- pferde 1y ago
  Luckily, fediverse has an account-to-website verification feature, see https://joinmastodon.org/verification https://joinmastodon.org/verification . Mr. Tatham's account on hachyderm.io uses it, so we can be reasonably certain that it's the correct account for him.

The man himself also posted about it on his social media https://hachyderm.io/@simontatham/115025974777386803 https://hachyderm.io/@simontatham/115025974777386803

throaway920181 1y ago

Cool, but hachyderm.io also is not a trusted/recognizable domain for me. Trust issues all the way down!

andrewflnr 1y ago
It's definitionally the correct domain for Simon Tatham's social media. What are you expecting here?
- closewith 1y ago
  How would the average person know that?
  - viraptor 1y ago
    Average person aware of trust on social network / internet - because https://hachyderm.io/@simontatham https://hachyderm.io/@simontatham has a validated link to the author's homepage. Others - they don't understand the trust anyway, so there prerequisite steps missing before the main question anyway.
    - jstanley 1y ago
      hachyderm.io says it has a validated link to his homepage, but if you don't already trust hachyderm.io that means nothing.
      - viraptor 1y ago
        It means a lot - you need to check the other side's meta to confirm yourself. https://fedi.tips/how-do-i-verify-my-account/ https://fedi.tips/how-do-i-verify-my-account/
        mjmas 1y ago
        For example, at https://www.chiark.greenend.org.uk/~sgtatham/ https://www.chiark.greenend.org.uk/~sgtatham/ : (the rel=me is the important part) [...] <a rel="me" href="https://hachyderm.io/@simontatham"> [...]
        closewith 1y ago
        No, it really means nothing. Identity on the internet is not a solved problem.
        pferde 1y ago
        You are wrong. It means that whoever owns the website marked as verified also owns the social account. See https://joinmastodon.org/verification https://joinmastodon.org/verification for a quick overview of how it works.
        closewith 1y ago
        No, it means a certain link exists on the website. On Hacker News of all sites, I would think we should all know that's not sufficient evidence of identity for an update regarding the source of critical software like a terminal.
        viraptor 1y ago
        Nobody claimed it validates the identity in any way. It validates that the person at the other website confirms it's their social account and the social account matches the other direction. The real identity is not involved here in any way and never was. You're disagreeing with someone nobody here raises. But the link validation confirms that if you believed that the original download site belongs to the author, then you would have almost the same guarantee about the social account. (+/- the chances of the putty website being hacked)
    - zo1 1y ago
      It was bad enough that we had to tell developers to trust some rando website to download a tool that we'd use to potentially plug in sensitive production usernames + credentials. A link that looks like this: https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.ht... And now they've gone and made it worse by posting some new site and confirming the new link is real on their weird "hachyderm" social media post thing. Yeah, talk about a grey-beard get-off-my-lawn developer screaming at the wind and wanting to make it worse for themselves and their "brand".
      - viraptor 1y ago
        > on their weird "hachyderm" social media post thing At this point tech people should understand what Mastodon is. For their own benefit. It's been years.
        closewith 1y ago
        10 MM MAU estimated. Not exactly foundational to online discourse.
        viraptor 1y ago
        We're talking in context of Putty which is itself an extremely niche software. But if you think of just the software/tech people - Mastodon is quite an important place.
      - CRConrad 1y ago
        [flagged]
  - andrewflnr 1y ago
    I just checked his home page: https://www.chiark.greenend.org.uk/~sgtatham/ https://www.chiark.greenend.org.uk/~sgtatham/
jachee 1y ago
So… what would be a trusted domain, for you, then?
- zaphirplane 1y ago
  https://www.chiark.greenend.org.uk/~sgtatham/putty/ https://www.chiark.greenend.org.uk/~sgtatham/putty/
  - zugi 1y ago
    Exactly. Which nicely confirms all this by saying: Latest news 2025-08-14 New website, putty.software We have a new domain name for the PuTTY website! ...
    - cyphar 1y ago
      Which is what the original response linked to. :P
    - roman_soldier 1y ago
      What if someone hacked his site and inserted that news item? Better to visit the guy in person and verify.
      - rzzzt 1y ago
        What if someone planted the idea of adding a new website for the project while he was asleep?

RainyDayTmrw 1y ago

As much as I like fedi, it does make it hard to understand which user on which instance is the correct one.

pferde 1y ago
Luckily, fediverse has an account-to-website verification feature, see https://joinmastodon.org/verification https://joinmastodon.org/verification . Mr. Tatham's account on hachyderm.io uses it, so we can be reasonably certain that it's the correct account for him.