6 ms·

$73/year is not free but calling it "insanely expensive" is pretty unfair.

joshstrange 11y ago
While I fully understand where you are coming from let's try and remember that putty is 100% free and I'd bet money the author puts in more time/energy/money than he gets back from it. That means that ANY money spent is more money in the hole making $73/yr ($219 all at once b/c you have to pay for 3 years) quite a bit of money.
- pdabbadabba 11y ago
  I suspect that if the Putty dev created a Patreon for code signing, and posted it on HN and Reddit, he'd almost immediately have that $73/yr covered for the foreseeable future.
  - Kluny 11y ago
    And then some - I don't see a donate link anywhere on putty.org or the linked sites, but who wouldn't donate 5 bucks to putty, when they use it for free basically every day? I've paid 5 bucks for less useful programs.
    - Symbiote 11y ago
      I remember reading the statement about beer and curry some years ago, so I knew there was a link somewhere: http://www.chiark.greenend.org.uk/~sgtatham/putty/faq.html#faq-donations http://www.chiark.greenend.org.uk/~sgtatham/putty/faq.html#f...
  - cat9 11y ago
    Or "paid version is signed, free version is not."
  - joshstrange 11y ago
    No doubt but we all need to remember that sometimes accepting money is more trouble than it's worth. I know that sounds crazy but people taking donations have to declare that on their taxes and some people don't want to deal with that. Also while crowdfunding platforms have gotten really easy they still take effort and sometimes some sort of verification process. It's obvious the putty dev is not a designer (I don't say that to be mean) so I'm sure there would be people here on HN that would be all like "Ugh, this guy is asking for money and he can't take 2 minutes to make his funding site look halfway decent???" (Those people would be clarified as douches but that wouldn't stop them from making the comment nor the dev potentially reading them). Lastly let's say he gets the money and takes care of the taxes and all of that. Now he has to get a code signing cert (not a fast or easy process I would assume) and add that to the list of things he needs to do for each release. We are talking about a non-trivial amount of work over a month or more all so that people will stop bitching about the FREE and OPEN SOURCE product he is producing... If you find code signing/HTTPS to be so important I suggest you do it yourself, the code is freely available and since it's under an MIT licence you can even SELL access to your code-signed and https-protected putty version. I'm not saying that either of these things are not important (they both are) but let's not jump down the dev's throat because they aren't giving up even more of their time on something they seen no return on.
    - pdabbadabba 11y ago
      I certainly don't mean to jump down the dev's throat -- I have been using Putty for years (without, I must admit, a second thought about whether the binary might be compromised) with nothing but gratitude. And I don't think anyone else should direct their complaints at the dev either. My comments are addressed to those who complain, in a general way, that it is not easy enough for a developer to write trusted code. Putty seeks to perform a security-critical function. It may simply not be realistic to expect that someone can simply step into the market and provide such a tool safely, without putting some effort into building trust with users through, e.g., a code signing certificate. That, after all, is one of the reasons why trust works--it is non-trivial to build. Again, I don't blame a developer for not doing these things, and I am all for helping developers jump through the hoops they need to jump through, if they are willing.
- DangerousPie 11y ago
  That may be true, but it's so little that I'm sure he could find thousands of people/companies that would be happy to sponsor this. Including me.
r1ch 11y ago
There's a non-trivial paperwork requirement too. I'd have no problem paying and getting a cert from the comfort of your chair like you can do with SSL. However for code signing I have to take time out of the day to visit a notary public to verify my identity as part of the process. This is likely also going to cost additional money.

While I fully understand where you are coming from let's try and remember that putty is 100% free and I'd bet money the author puts in more time/energy/money than he gets back from it. That means that ANY money spent is more money in the hole making $73/yr ($219 all at once b/c you have to pay for 3 years) quite a bit of money.

pdabbadabba 11y ago
I suspect that if the Putty dev created a Patreon for code signing, and posted it on HN and Reddit, he'd almost immediately have that $73/yr covered for the foreseeable future.
- Kluny 11y ago
  And then some - I don't see a donate link anywhere on putty.org or the linked sites, but who wouldn't donate 5 bucks to putty, when they use it for free basically every day? I've paid 5 bucks for less useful programs.
  - Symbiote 11y ago
    I remember reading the statement about beer and curry some years ago, so I knew there was a link somewhere: http://www.chiark.greenend.org.uk/~sgtatham/putty/faq.html#faq-donations http://www.chiark.greenend.org.uk/~sgtatham/putty/faq.html#f...
- cat9 11y ago
  Or "paid version is signed, free version is not."
- joshstrange 11y ago
  No doubt but we all need to remember that sometimes accepting money is more trouble than it's worth. I know that sounds crazy but people taking donations have to declare that on their taxes and some people don't want to deal with that. Also while crowdfunding platforms have gotten really easy they still take effort and sometimes some sort of verification process. It's obvious the putty dev is not a designer (I don't say that to be mean) so I'm sure there would be people here on HN that would be all like "Ugh, this guy is asking for money and he can't take 2 minutes to make his funding site look halfway decent???" (Those people would be clarified as douches but that wouldn't stop them from making the comment nor the dev potentially reading them). Lastly let's say he gets the money and takes care of the taxes and all of that. Now he has to get a code signing cert (not a fast or easy process I would assume) and add that to the list of things he needs to do for each release. We are talking about a non-trivial amount of work over a month or more all so that people will stop bitching about the FREE and OPEN SOURCE product he is producing... If you find code signing/HTTPS to be so important I suggest you do it yourself, the code is freely available and since it's under an MIT licence you can even SELL access to your code-signed and https-protected putty version. I'm not saying that either of these things are not important (they both are) but let's not jump down the dev's throat because they aren't giving up even more of their time on something they seen no return on.
  - pdabbadabba 11y ago
    I certainly don't mean to jump down the dev's throat -- I have been using Putty for years (without, I must admit, a second thought about whether the binary might be compromised) with nothing but gratitude. And I don't think anyone else should direct their complaints at the dev either. My comments are addressed to those who complain, in a general way, that it is not easy enough for a developer to write trusted code. Putty seeks to perform a security-critical function. It may simply not be realistic to expect that someone can simply step into the market and provide such a tool safely, without putting some effort into building trust with users through, e.g., a code signing certificate. That, after all, is one of the reasons why trust works--it is non-trivial to build. Again, I don't blame a developer for not doing these things, and I am all for helping developers jump through the hoops they need to jump through, if they are willing.
DangerousPie 11y ago
That may be true, but it's so little that I'm sure he could find thousands of people/companies that would be happy to sponsor this. Including me.

r1ch 11y ago

There's a non-trivial paperwork requirement too. I'd have no problem paying and getting a cert from the comfort of your chair like you can do with SSL. However for code signing I have to take time out of the day to visit a notary public to verify my identity as part of the process. This is likely also going to cost additional money.