PuTTY has a new website (opens in new tab)

> I can't consider relying on probabilistic algorithms controlled by 3rd parties to be a wise strategy.

That's pretty much all of the AI industry and clients.

Google right now lists the title of putty.org as "PuTTY", even though right now this text is only in the footer. Up until August I guess it provided a download link, but the title was not "PuTTY".

My first 3 matches are https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.ht..., https://www.putty.org/ and https://www.chiark.greenend.org.uk/~sgtatham/putty/

I can sell you some AdWords to solve it.

Google.com > putty > I'm feeling lucky > https://www.chiark.greenend.org.uk/~sgtatham/putty/

> Why should I need to use some third party tool to find your thing?

How else would you find it? By typing domain name guesses into your address bar until you hit the right one? How would you be sure you've hit the right one and not a scammer/squatter?

This is not a particularly easy problem to solve, and I agree that relying on Google to accurately and safely deliver you to the correct web site isn't great either, but I think we'd be much worse off without search engines.

It is sketchy. :) Your intuition is correct.

The idea is that you will need to put some trust in the project anyway, since you’re trying to install it. Might as well make it easier with a one line install.

Edit: You should only do this if someone reliable tells you to, honestly. Doing this with truly random projects you aimlessly find is not a good idea.

If you hadn’t discovered this already with you mac CLI commands, OpenSSH from OpenSSL ‘ssh-keygen’ command is a good way to create SSH keys in ClI and ships in many OSes or is a lightweight download. The OpenSSL website name is unambiguous, which is a benefit.

https://docs.github.com/en/authentication/connecting-to-gith...

The wikipedia article has links to the official websites, and not to the scams: https://en.m.wikipedia.org/wiki/PuTTY

That trick requires you to already know the correct website though.

> Since 2020 I have been speaking out against the fraudulent pandemic and the intentionally dangerous injections and my experience has been to have been censored and smeared. If you have not heard of me before, that's the reason.

One weird trick to make your insignificance seem significant!

Did putty.org once link to the putty software? Or an alternative SSH client? Why did the site ever become popular?

I'm trying to grok this, but all of the posts sort of obliquely refer to things that happened in the past (even the old HN links here), rather than explicitly just explain what the hell happened.

This seems similar to the Notepad++ team using their platform to promote political viewpoints.

The same thing happened with Facebook "pages", when they became a personal "soap box" by the owner of the page. It was downhill from there... You might as well turn the whole web into FB/Twitter/X/Insta promotional spam at that point.

    > Unfortunately the person who owns putty.org
    > started to use it to spread misinformation
    > about vaccines and[...]

Isn't that rather fortunate in the grand scheme of things? It could have been a landing page monetizing various SSH clients for windows.

Instead it's just some guy's website clearly unrelated to PuTTY. He's even gone out of his way to point people looking for PuTTY in the right direction. Who cares what his opinion is about anything else?

[flagged]

Cool, but hachyderm.io also is not a trusted/recognizable domain for me. Trust issues all the way down!

As much as I like fedi, it does make it hard to understand which user on which instance is the correct one.

One non-obvious strategy is that the number of mines that are left on the field is known. Especially near the end, this can break a tie between two patterns of mines.

I have to say, I liked SecureCRT a lot, too.

PuTTY was just easier to get ahold of on a new install.

I think that's why it won out for me. That and its simplicity.

Indeed, that and “git bash” were always the weird outliers. I’m glad there’s now native options.

One nice thing about putty is that it let's you specify the password on the command line. Can't stand software that doesn't let you make your own decisions.

Just pull the trigger. A surprisingly large amount of software just works on wine.

I'm a c# dev with near 20 years experience, and I finally got the shits with advertising in the start menu. Arch Linux, because I figured why not do it properly?

I game a fair bit, and find most things on steam just work.

I agree with you and just wanted to add that for what it's worth one can optionally limit where ssh keys are useful by adding network restrictions on the public key / server side. e.g.

    grep AuthorizedKeysFile /etc/ssh/sshd_config
    AuthorizedKeysFile /etc/ssh/keys/%u

    cat /etc/ssh/keys/bender
    from="[192.redacted]/24,[redacted]/20" ssh-ed25519 AAAAC[snip...] comment

or wherever your system is configured to look for public keys, typically /home/username/.ssh/id_dsa.pub. I use a different location. Even being really broad like adding a /16 or /8 for a home ISP is still better than allowing the entire internet. This can also be useful where machine-to-machine ssh keys are utilized one can limit the access to that network so that should keys leak the potential blast radius of damage is reduced. For example, the keys for an Ansible account can be restricted to the Primary/Secondary Ansible server IP addresses or at very least the CIDR block(s) of the network(s) they reside in. Broad restrictions are not perfect but perfect is the enemy of good or good enough.

Example use case would be that lets say a contractor from Microsoft tries one of your keys. Your restriction limits the key validity to 24.0.0.0/8 and they are coming from 207.0.0.0/8. They will be denied Authentication refused and you now have log entries that can be shared with their fraud department, the world, whomever. Obviously the tighter the restrictions the better, at the risk of requiring a static IPv4 or IPv6 address if too tight. One can always have lighter restrictions on a fall-back account that requires additional hoops to sudo / doas / su.

Is such paranoia warranted? Millions of corporate laptops run Windows 11 just fine. I know M$ is evil and spying on you, but not to such degree.

Can you tell us which software? (Even if it’s very niche) I’m really curious where the gaps are.

On one Windows box I once put my password in for a private Github site. Never had to do that again, it just 'remembered' it... Not what I would expect or want.

Why replace it? Wine works fine.

If Windows were to steal your SSH keys (lol), would you really think using a third-party program would protect you? The evil code could just read the key you configured in PuTTY.

Have they fixed it spying on you? https://github.com/MicrosoftDocs/terminal/issues/139

Are you referring to the pixel-level font smoothing they use by default (as opposed to CMD's subpixel-level font smoothing)?

You need to define the "antialiasingMode" key in the settings JSON for the default profile to hold the value "cleartype", rather than "grayscale" (which is the default value). I don't believe this is exposed in the GUI settings page.

Note that this only affects the actual terminal emulation area. The rest of the application will still be pixel-level font smoothed (so e.g. the tab titlebars, the settings, etc.).

I’ve never noticed any issues on any computer with it…

The first time I ever saw it, the text already looked better than cmd.exe via conhost.

I've only used it through RDP on Wayland and it's been fine visually. Downloading it can be a challenge if you don't know where to look (Github, not Microsoft's App Store...)

It's much weirder now.

The current holder of that domain is using it to host a single page that pushes anti-vax nonsense under the guise of fighting censorship... but also links to the actual PuTTY site. Very weird mix of maybe-well-meaning and nonsense.

That looks like an open and shut ICANN trademark case to me.

https://web.archive.org/web/20250728091154/https://www.putty...

Because it looks very ugly and has (had...) a non-rememberable URL.

The new one even has CSS making it much more modern.

Yeah, I use Windows Terminal for a lot of day-to-day stuff, but PuTTY is still my go-to for older systems, serial stuff, SSH tunnels, and anything needing more detailed control over the session.

It's still needed for some use cases.

As far as I know it's still one of the best ways to handle serial connections on Windows, and a surprising amount stuff still supports or defaults to serial. Great for managing headless OpenBSD systems.

Those actually feel spammy too; e.g. seeing "official" or "download" in a name has always triggered a suspicion, because normally there's no need to specially say your site is "official" or "download" besides to mislead.

Then again, I may be biased due to always remembering PuTTY's official page being someone's personal site hosted on a .org.uk server.

There is actually a mirror at https://www.puttyssh.org/

anything with "download" in the domain name looks scammy to me

>puttydownloads.com

This sounds like a virus site.

All of these are better than and I assume cheaper than that .software one.

Even puttytelnet.com/org/net is available.

Hell the puttytel.net is available

Alternatively, the "popular" TLDs are a money grab by vested interests who already own popular domains.

Why would that be disregarding safety? There's no extra text you can put on the website that would prove anything else (apart from messages signed by a known key, but honestly nobody would check those). Certificates don't provide any identity validation in practice.

> Certificate by Let's Encrypt, issued to "putty.software" no other info.

That's how domain validated certificates that are used on most website today work.

And yes, it's bonkers that we need to rely on authorities like Let's Encrypt for this instead of just delegating trust via the same hierarchy as DNS.

> Using putty was never the pinnacle of professionalism and open source auditing anyway

Huh? The source is available on the original site and TTBOMK always has been, you're welcome to compile it yourself.

I'm sure you could ask Mr Tatham to offer a version with feel-good certificates for the low low price of a couple Silicon Valley lattes per month...

Putty is also still useful for when you need to automate connections to SSH servers with password-based login. OpenSSH's client really doesn't want you to do that.

Well, they say that they are planning to move everything to this page, so I guess it's just temporary.

Nice page.

I do see this type of versioning as an indictment of such a technology for production scenarios, it's all a house of cards if that's what you are building upon.

It's a liability disclaimer versioning schema

One assumes PuTTY uses Courier as the default font because it was the default monospace font on Windows at the time of release (1999). But Consolas has been the replacement default since Vista (2006).

It is a reasonable change to make. Do the rest of their native Win32 UI controls still use MS Sans Serif (Windows 98) or Tahoma (XP) instead of Segoe UI (Vista)?

What else is there to do? We live in an era where there's nothing left to talk about except gpu enabled terminal emulators and how much capitalism sucks