2 ms·

Certificate by Let's Encrypt, issued to "putty.software" no other info. Sometimes I feel like we are training users to disregard safety mechanisms for phishing

Certificate by Let's Encrypt, issued to "putty.software" no other info. Sometimes I feel like we are training users to disregard safety mechanisms for phishing. Using putty was never the pinnacle of professionalism and open source auditing anyway, it's just a binary you download on windows before you hear the gospel of linux and ssh.

nottorp 1y ago
I'm sure you could ask Mr Tatham to offer a version with feel-good certificates for the low low price of a couple Silicon Valley lattes per month...
account42 1y ago
> Certificate by Let's Encrypt, issued to "putty.software" no other info. That's how domain validated certificates that are used on most website today work. And yes, it's bonkers that we need to rely on authorities like Let's Encrypt for this instead of just delegating trust via the same hierarchy as DNS.
akoboldfrying 1y ago
> Using putty was never the pinnacle of professionalism and open source auditing anyway Huh? The source is available on the original site and TTBOMK always has been, you're welcome to compile it yourself.
- TZubiri 1y ago
  No one in the history of humanity has compiled a tool from source in windows
  - mdaniel 1y ago
    Apologies, detecting sarcasm on the Internet is always tricky, but relevant to this discussion I have even gone so far as to make a CMake descriptor for PuTTY because I was compiling on Windows to fix some quirk that I didn't like (it was so many years ago I don't recall, but I did recall thinking "whhhhyyyyy!!!" to people that do cutesy home-grown build systems) However, it seems that the universe heard my pleas https://git.tartarus.org/?p=simon/putty.git;a=commit;h=c19e7215ddd1d6a890fdb94d89bc5ccb46151363 https://git.tartarus.org/?p=simon/putty.git;a=commit;h=c19e7... Replace mkfiles.pl with a CMake build system For context, I believe that a tool isn't open source unless I can build it, so I actually build almost anything I can from source for that reason
    - TZubiri 1y ago
      Congratulations on being the first to build something from source on Windows! (It's more of hyperbole than sarcasm.)
viraptor 1y ago
Why would that be disregarding safety? There's no extra text you can put on the website that would prove anything else (apart from messages signed by a known key, but honestly nobody would check those). Certificates don't provide any identity validation in practice.
- TZubiri 1y ago
  Certificates have fields for location, company or name of person.
  - viraptor 1y ago
    They mean very little. Even the fully reviewed software signing cert I got with id validation was a total hack job (company didn't know how to read my ID, asked to change some field and they did).
  - mbrndtgn 1y ago
    So you're suggesting we should bring back extended validation? Currently they don't mean anything.

nottorp 1y ago

I'm sure you could ask Mr Tatham to offer a version with feel-good certificates for the low low price of a couple Silicon Valley lattes per month...

account42 1y ago

> Certificate by Let's Encrypt, issued to "putty.software" no other info. That's how domain validated certificates that are used on most website today work. And yes, it's bonkers that we need to rely on authorities like Let's Encrypt for this instead of just delegating trust via the same hierarchy as DNS.

akoboldfrying 1y ago

> Using putty was never the pinnacle of professionalism and open source auditing anyway Huh? The source is available on the original site and TTBOMK always has been, you're welcome to compile it yourself.

TZubiri 1y ago
No one in the history of humanity has compiled a tool from source in windows
- mdaniel 1y ago
  Apologies, detecting sarcasm on the Internet is always tricky, but relevant to this discussion I have even gone so far as to make a CMake descriptor for PuTTY because I was compiling on Windows to fix some quirk that I didn't like (it was so many years ago I don't recall, but I did recall thinking "whhhhyyyyy!!!" to people that do cutesy home-grown build systems) However, it seems that the universe heard my pleas https://git.tartarus.org/?p=simon/putty.git;a=commit;h=c19e7215ddd1d6a890fdb94d89bc5ccb46151363 https://git.tartarus.org/?p=simon/putty.git;a=commit;h=c19e7... Replace mkfiles.pl with a CMake build system For context, I believe that a tool isn't open source unless I can build it, so I actually build almost anything I can from source for that reason
  - TZubiri 1y ago
    Congratulations on being the first to build something from source on Windows! (It's more of hyperbole than sarcasm.)

viraptor 1y ago

Why would that be disregarding safety? There's no extra text you can put on the website that would prove anything else (apart from messages signed by a known key, but honestly nobody would check those). Certificates don't provide any identity validation in practice.

TZubiri 1y ago
Certificates have fields for location, company or name of person.
- viraptor 1y ago
  They mean very little. Even the fully reviewed software signing cert I got with id validation was a total hack job (company didn't know how to read my ID, asked to change some field and they did).
- mbrndtgn 1y ago
  So you're suggesting we should bring back extended validation? Currently they don't mean anything.