3 ms·

It looks nice. I suggest that all http requests to redirect to https (also enabling HSTS and preload it into browsers HSTS list), it makes admins easier to sugg

by leni536 11y ago

It looks nice. I suggest that all http requests to redirect to https (also enabling HSTS and preload it into browsers HSTS list), it makes admins easier to suggest the software for their users. On the other hand I wouldn't suggest a closed source software for ssh for my users, but that's just me. However it's hard to suggest putty for Windows users either since it's virtually impossible to download it securely [1]. I think the most secure suggestion is cygwin+openssh also it's the most inconvenient. [1] https://noncombatant.org/2014/03/03/downloading-software-safely-is-nearly-impossible/ https://noncombatant.org/2014/03/03/downloading-software-saf...

frik 11y ago
It's based on GNU GPL software and MobaXTerm is under GPL v3. I found the license link on the bottom (http://mobaxterm.mobatek.net/license.html http://mobaxterm.mobatek.net/license.html) and the source files (http://download.mobatek.net/sources/?C=M;O=D http://download.mobatek.net/sources/?C=M;O=D). "To compile the program, you will need Borland Delphi 7 Professional Edition with the Jedi VCL library, AlphaControls components, SecureBlackbox components and Overbyte ICS components." (from the readme in mobaxterm-7.7-src.tar.bz2)
- leni536 11y ago
  Oh, sorry then. It seems to be a plus for a security critical software that it's open source though, it could be advertised more. Although compiling the pro version for free could be simple, it requires more expensive software to do so.
xorcist 11y ago
This is bad advice. The linked document seems to be interspersed with misconceptions. It is important to remember that downloading your software over an encrypted link does nothing to ensure the integrity of the software. Please note that the complete infrastructure of all the big Linux distributions (Red Hat, Debian, etc.) is all served over plaintext only. This is for a very good reason, and you must understand these reasons before making suggestions on software distribution schemes. Software should be verified using PGP signatures. These signatures should be distributed with the software. Keys are published on keyservers and signed through the web of trust (easiest done by attending any open source conference). There must be no trust placed in distribution archives and mirrors. If software integrity was entrusted to the transport layer, any employee of sourceforge, github or any one of the hundreds of mirrors out there could backdoor anything. There is also strength in numbers with the distribution method. If every little package had their own way to check integrity, it would be easy to fool the casual user to use a less secure method by controlling the distribution point.

by leni536 11y ago

frik 11y ago

It's based on GNU GPL software and MobaXTerm is under GPL v3. I found the license link on the bottom (http://mobaxterm.mobatek.net/license.html http://mobaxterm.mobatek.net/license.html) and the source files (http://download.mobatek.net/sources/?C=M;O=D http://download.mobatek.net/sources/?C=M;O=D). "To compile the program, you will need Borland Delphi 7 Professional Edition with the Jedi VCL library, AlphaControls components, SecureBlackbox components and Overbyte ICS components." (from the readme in mobaxterm-7.7-src.tar.bz2)

leni536 11y ago
Oh, sorry then. It seems to be a plus for a security critical software that it's open source though, it could be advertised more. Although compiling the pro version for free could be simple, it requires more expensive software to do so.

xorcist 11y ago

This is bad advice. The linked document seems to be interspersed with misconceptions. It is important to remember that downloading your software over an encrypted link does nothing to ensure the integrity of the software. Please note that the complete infrastructure of all the big Linux distributions (Red Hat, Debian, etc.) is all served over plaintext only. This is for a very good reason, and you must understand these reasons before making suggestions on software distribution schemes. Software should be verified using PGP signatures. These signatures should be distributed with the software. Keys are published on keyservers and signed through the web of trust (easiest done by attending any open source conference). There must be no trust placed in distribution archives and mirrors. If software integrity was entrusted to the transport layer, any employee of sourceforge, github or any one of the hundreds of mirrors out there could backdoor anything. There is also strength in numbers with the distribution method. If every little package had their own way to check integrity, it would be easy to fool the casual user to use a less secure method by controlling the distribution point.