#putty — Public Fediverse posts

Perhaps I should also tell the story of when one of the servers involved in #PuTTY was actually broken into.

How the attackers got in wasn't interesting. Came from another already-compromised machine via an authorised SSH key, used the kernel vulnerability of the day to get root, installed a rootkit. The usual.

The machine's administrator shut it down, rebooted from trusted media, and painstakingly re-secured it by finding and checking all the files that differed from a pre-compromise backup. Eliminated the rootkit, and found the hidden directory they'd used as a base while they set it up.

In that directory was a file called 'putty.tgz', which the admin passed on to me to analyse. My blood ran cold. I expected it to be a set of carefully doctored PuTTY binaries, that they'd intended to substitute for the real versions, and pwn everyone who downloaded PuTTY.

But it wasn't.

putty.tgz turned out to be a copy of ~/src/putty from my own home directory on that machine. I could tell it was from there, because I hardly ever do any actual development there, and the revision I happened to have checked out was about a year old. And that revision was exactly what was in the tarball.

These attackers had broken in to a machine involved in PuTTY development … and _stolen the source code_.

And not even a preview of anything unreleased; they got an older version than they could have got straight out of source control.

I really hope it was several days before anyone pointed out their mistake. If there's any justice, they would have been bragging to _everyone_ about this achievement, so that by the time they realised it was completely pointless, it was far too late to pretend it had never happened!

Perhaps I should also tell the story of when one of the servers involved in #PuTTY was actually broken into.

How the attackers got in wasn't interesting. Came from another already-compromised machine via an authorised SSH key, used the kernel vulnerability of the day to get root, installed a rootkit. The usual.

The machine's administrator shut it down, rebooted from trusted media, and painstakingly re-secured it by finding and checking all the files that differed from a pre-compromise backup. Eliminated the rootkit, and found the hidden directory they'd used as a base while they set it up.

In that directory was a file called 'putty.tgz', which the admin passed on to me to analyse. My blood ran cold. I expected it to be a set of carefully doctored PuTTY binaries, that they'd intended to substitute for the real versions, and pwn everyone who downloaded PuTTY.

But it wasn't.

putty.tgz turned out to be a copy of ~/src/putty from my own home directory on that machine. I could tell it was from there, because I hardly ever do any actual development there, and the revision I happened to have checked out was about a year old. And that revision was exactly what was in the tarball.

These attackers had broken in to a machine involved in PuTTY development … and _stolen the source code_.

And not even a preview of anything unreleased; they got an older version than they could have got straight out of source control.

I really hope it was several days before anyone pointed out their mistake. If there's any justice, they would have been bragging to _everyone_ about this achievement, so that by the time they realised it was completely pointless, it was far too late to pretend it had never happened!

RE: https://hachyderm.io/@simontatham/117088511870432555

In 2004, one of the servers used by the #PuTTY team was subjected to an SSH MITM attack. I discussed it in a thread just now, but it deserves promoting to a top-level toot.

Those annoying host key prompts indicate some kind of mistake much more often than a real attack. But real attacks do happen. Check your host keys!

RE: https://hachyderm.io/@simontatham/117088511870432555

In 2004, one of the servers used by the #PuTTY team was subjected to an SSH MITM attack. I discussed it in a thread just now, but it deserves promoting to a top-level toot.

Those annoying host key prompts indicate some kind of mistake much more often than a real attack. But real attacks do happen. Check your host keys!

@simontatham on behalf of all those who ever benefitted from #PuTTY by having it a. save their ass when they couldn’t get to a Linux system, b. helping them sysadmin before they were ready to switch to Linux full time, or c. literally any other use, THANK YOU for writing and maintaining this free tool for the greater good of the people of the internet. Truly.

@simontatham on behalf of all those who ever benefitted from #PuTTY by having it a. save their ass when they couldn’t get to a Linux system, b. helping them sysadmin before they were ready to switch to Linux full time, or c. literally any other use, THANK YOU for writing and maintaining this free tool for the greater good of the people of the internet. Truly.

There's been some discussion recently of what motivates free software authors.

#PuTTY was originally just a Telnet client. It became really useful when I added an SSH backend, during my last year at university. I did that partly because I thought network security seemed like a good idea, but mostly because I had exams coming up, and it seemed like more fun than revising for them.

Three years earlier, #NASM started off as a long design discussion with about 17 people on an email list. Eventually the time came to write code. I volunteered to write an initial prototype for everyone to work on improving. Another member of the mailing list – also a student – suggested that he'd write one too, and then we could decide which one to use. He was at Oxford and I was at Cambridge, so naturally I went all-out to make sure mine would be better. (He never finished his, as it turned out.)

In other words, my two biggest serious free software projects were motivated significantly by Oxbridge rivalry and by revision avoidance.

I'm not quite sure that's how a university education is _supposed_ to bring benefit to the world, but I'll take it!

There's been some discussion recently of what motivates free software authors.

#PuTTY was originally just a Telnet client. It became really useful when I added an SSH backend, during my last year at university. I did that partly because I thought network security seemed like a good idea, but mostly because I had exams coming up, and it seemed like more fun than revising for them.

Three years earlier, #NASM started off as a long design discussion with about 17 people on an email list. Eventually the time came to write code. I volunteered to write an initial prototype for everyone to work on improving. Another member of the mailing list – also a student – suggested that he'd write one too, and then we could decide which one to use. He was at Oxford and I was at Cambridge, so naturally I went all-out to make sure mine would be better. (He never finished his, as it turned out.)

In other words, my two biggest serious free software projects were motivated significantly by Oxbridge rivalry and by revision avoidance.

I'm not quite sure that's how a university education is _supposed_ to bring benefit to the world, but I'll take it!

playtime

dreaming… a random bit

** in the ending of The Daily Post’s Weekly Photo Challenges from WordPress, here’s your Sunday Weekly Photo Prompt: travel **

medicine buddha mantra: Tayata Om Bekandze Bekandze Maha Bekandze Radza Samudgate Soha

health, wealth, and prosperity: Om Vasudhare Svaha

Rate this:

playtime

dreaming… a random bit

** in the ending of The Daily Post’s Weekly Photo Challenges from WordPress, here’s your Sunday Weekly Photo Prompt: travel **

medicine buddha mantra: Tayata Om Bekandze Bekandze Maha Bekandze Radza Samudgate Soha

health, wealth, and prosperity: Om Vasudhare Svaha

Rate this:

@pancake still in use by puttygen from https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html
#putty #ssh #cli

@pancake still in use by puttygen from https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html
#putty #ssh #cli

So I find myself suddenly needing to get everything off my work laptop and make sure the toolchain I was accustomed to for years works on my own hardware.

THis is proving pretty complicated, particularly since I need something that can run Premiere for my videos. I realized the best choice is my #Windows gaming laptop, so I'm tooling that up to do the job.

Windows is... a weird world. First up, ssh client. #termius Looks good. $10/mo?!? For an #SSH client? Eff that. #putty it is.

So I find myself suddenly needing to get everything off my work laptop and make sure the toolchain I was accustomed to for years works on my own hardware.

THis is proving pretty complicated, particularly since I need something that can run Premiere for my videos. I realized the best choice is my #Windows gaming laptop, so I'm tooling that up to do the job.

Windows is... a weird world. First up, ssh client. #termius Looks good. $10/mo?!? For an #SSH client? Eff that. #putty it is.

#PuTTY 0.84 has been released ( #SSH / #SerialPort / #RS232 / #Telnet ) https://chiark.greenend.org.uk/~sgtatham/putty

#PuTTY 0.84 has been released ( #SSH / #SerialPort / #RS232 / #Telnet ) https://chiark.greenend.org.uk/~sgtatham/putty

New Version: #Putty 0.84 (stable;x86) http://the.earth.li/~sgtatham/putty/latest/x86/putty.exe

@[email protected]

I remember using #PuTTY on #Linux to connect to #OpenVMS hosts. 😎

@[email protected] @[email protected]

@[email protected]

I remember using #PuTTY on #Linux to connect to #OpenVMS hosts. 😎

@[email protected] @[email protected]

We've released #PuTTY version 0.84.

This release fixes three security vulnerabilities, although all are minor as far as we know. One allows a malicious server or MITM to make PuTTY crash with a double-free, although we don't know of a way this can be exploited for worse than a DoS. Another allows the same MITM to cause an assertion failure (and maybe lose your scrollback) instead of giving the right error message. The third marks text from the server as "trusted", but only when connecting via Telnet or similar through a proxy that asks for authentication.

New features: support for running a command before connecting (e.g. to perform wake-on-LAN, or a port knock), and on the Unix version, support for displaying 'pre-edit text' (Unicode characters you're half way through typing via a multiple-keystroke sequence).

Other bug fixes include (on Windows) fixes for spurious network errors using proxy authentication and for mishandling of cursor blinking when it's disabled in the OS, and (on Unix) better support for running on Wayland.

We've released #PuTTY version 0.84.

This release fixes three security vulnerabilities, although all are minor as far as we know. One allows a malicious server or MITM to make PuTTY crash with a double-free, although we don't know of a way this can be exploited for worse than a DoS. Another allows the same MITM to cause an assertion failure (and maybe lose your scrollback) instead of giving the right error message. The third marks text from the server as "trusted", but only when connecting via Telnet or similar through a proxy that asks for authentication.

New features: support for running a command before connecting (e.g. to perform wake-on-LAN, or a port knock), and on the Unix version, support for displaying 'pre-edit text' (Unicode characters you're half way through typing via a multiple-keystroke sequence).

Other bug fixes include (on Windows) fixes for spurious network errors using proxy authentication and for mishandling of cursor blinking when it's disabled in the OS, and (on Unix) better support for running on Wayland.

Simon Tatham released #PuTTY version 0.84. https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html

Simon Tatham released #PuTTY version 0.84. https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html

Around 2000, when #PuTTY first started to become popular, it brought me more and more email. At some point it became hard to answer it all, and my inbox started to grow.

Young and optimistic, I came up with a plan to fix this. I drew a line in my inbox (by sending myself an email with subject "---------"), and told myself that I'd keep the region below the line clear, and every few days, deal with a few messages from above the line, until eventually the line was at the top again.

Of course, it didn't work at all. Soon enough there was a huge backlog even below the line, and the stuff above the line was all still there. The line became part of the problem, not the solution.

It took a historian friend of mine to point out the fallacy. To answer more mail, you must spend more time answering mail. No amount of classifying, rearranging, or reorganising it makes there be less of it. You must either answer the mail or decide not to. (And once there's too much of it, only one of *those* is possible.)

This is a post about management methods that respond to any problem by spending more rather than less time moving issues around the bug tracker or kanban board or what have you.

Around 2000, when #PuTTY first started to become popular, it brought me more and more email. At some point it became hard to answer it all, and my inbox started to grow.

Young and optimistic, I came up with a plan to fix this. I drew a line in my inbox (by sending myself an email with subject "---------"), and told myself that I'd keep the region below the line clear, and every few days, deal with a few messages from above the line, until eventually the line was at the top again.

Of course, it didn't work at all. Soon enough there was a huge backlog even below the line, and the stuff above the line was all still there. The line became part of the problem, not the solution.

It took a historian friend of mine to point out the fallacy. To answer more mail, you must spend more time answering mail. No amount of classifying, rearranging, or reorganising it makes there be less of it. You must either answer the mail or decide not to. (And once there's too much of it, only one of *those* is possible.)

This is a post about management methods that respond to any problem by spending more rather than less time moving issues around the bug tracker or kanban board or what have you.

1960s Silly Putty: Iconic Egg of Endless Fun Unveiled!

The ad's focus on the packaging highlights the product's unique presentation, making it a memorable symbol of childhood play and creativity.

#sillyputty #classictoys #vintagetoys #retrotoys #kidstoys #1960s #60sads #childhoodmemories #nostalgiatoys #putty #elastictoy #bouncingputty #binneyandsmith #crayola #playtime #iconictoy #eggcontainer #classiccommercials #vintagetvads #retrocommercials

There are 3 USB-C ports labelled as being USB-PD compatible, plus 2 type A ports labelled QC 3.0. Then there is a power/load indicator which looks like 4 bars/LEDs.

I cut the welded seam at the plug end, and the end just pulls off, leaving the #PCB inside. It uses that style of connection where the back end of the mains contacts just insert into some springy metal receptors on the PCB, so it's easier to assemble and doesn't require soldering.

Then the circuit board just pulls out.

That odd weight at one end? The plug end had a huge wad of grey, suspiciously dense putty stuffed into it. I think it's a metal-loaded #putty. It serves no purpose other than giving the thing some heft, so it doesn't feel as cheap. Scam products used to generally come with a lump of pig iron for this purpose, so they're moving up in the world, I guess?

The circuit board weighs approximately nothing in comparison. And you will be Not Shocked that this thing is so very, very fake. There is a tiny, tiny transformer that looks like it's wound on the same form that they use for those tiny little 1:1 600 Ω audio isolation transformers. I wouldn't trust it to handle a 10 W load, much less 240 W.

The output reservoir capacitor is shared across all 5 outputs, and is rated 10 volts 😆 . So this thing definitely doesn't produce the higher voltages that USB-PD requires (up to 20 V).

It gets better.

2/x

#PigIron #MetalPutty

There are 3 USB-C ports labelled as being USB-PD compatible, plus 2 type A ports labelled QC 3.0. Then there is a power/load indicator which looks like 4 bars/LEDs.

I cut the welded seam at the plug end, and the end just pulls off, leaving the #PCB inside. It uses that style of connection where the back end of the mains contacts just insert into some springy metal receptors on the PCB, so it's easier to assemble and doesn't require soldering.

Then the circuit board just pulls out.

That odd weight at one end? The plug end had a huge wad of grey, suspiciously dense putty stuffed into it. I think it's a metal-loaded #putty. It serves no purpose other than giving the thing some heft, so it doesn't feel as cheap. Scam products used to generally come with a lump of pig iron for this purpose, so they're moving up in the world, I guess?

The circuit board weighs approximately nothing in comparison. And you will be Not Shocked that this thing is so very, very fake. There is a tiny, tiny transformer that looks like it's wound on the same form that they use for those tiny little 1:1 600 Ω audio isolation transformers. I wouldn't trust it to handle a 10 W load, much less 240 W.

The output reservoir capacitor is shared across all 5 outputs, and is rated 10 volts 😆 . So this thing definitely doesn't produce the higher voltages that USB-PD requires (up to 20 V).

It gets better.

2/x

#PigIron #MetalPutty

@simontatham It's been a looong time since I used #putty (I ran it in a #Wine "bottle", these came from #flatpak, I'm using Debian 13 #KDE). Thanks for all your efforts!

To my mind, 98% of the time, people would use putty to log into a #linux box/VPS, like say a #RaspberryPi (Raspberry Pi OS, is #Debian Trixie 13-based). This would be a sensible default assumption, **demographically**.

It took a good 2 hours of struggling, just to get 256 colors to work in Putty! (#Python's textualize library seriously expects 256, or *it can crash* when the Theme is changed). Please let the defaults be sane, so there's no struggle for 256 colors! Please alleviate my nerd rage - I beseech you!

1) Sane TERM env var:
Connection -> Data -> Terminal details -> Terminal-type string -> "putty-256color"

2) Sane default font:
Window -> Appearance -> Font settings -> "Change" button -> adwaita mono 12

3) Sane bolding of text:
Window -> Colors -> General options for color usage -> Indicate bolded text by changing: The font

4) Sane (Linux-terminal-style) Ctrl + Shift + {C,V} (for copy and paste):
Window -> Selection -> Assign copy/paste actions to clipboard -> Ctrl + Shift + (C,V}: System Clipboard

In for #Putty on #PuttyDay26

#UpThePutt
#VerdantBrewing

Fake Microsoft Teams and Google Meet Downloads Spread Oyster Backdoor https://hackread.com/fake-microsoft-teams-google-meet-download-oyster-backdoor/ #MicrosoftTeams #CleanUpLoader #Cybersecurity #Malvertising #SEOPoisoning #CyberAttack #Broomstick #CyberProof #GoogleMeet #Security #backdoor #security #Malware #Oyster #WinSCP #PuTTY

Ahh now I get why still a ot of #Windows folks still use #Putty xD lol

Windows is just a bad habit forming enslavement tool… And no it is not easier to use… the Administration of Windows is imho much more annoying then administrating anything in #Linux 🤷

For a moment there I thought #putty download server was offline. Further investigation showed 'the.earth.li' was resolving to 0.0.0.0, to the #pihole! Sure enough, one of the lists I use 'https://raw.githubusercontent.com/RPiList/specials/master/Blocklisten/malware' has it marked. One allow-listing later and we're in business.

#dokumentacja #Putty dla Windows gotowa https://blog.jurkiewicz.pro/2025/11/11/Putty-dla-Windows-w-10-minut-z-kluczem-ssh/

One Open-source Project Daily

Over 425 terminal color schemes/themes for iTerm/iTerm2. Includes ports to Terminal, Konsole, PuTTY, Xresources, XRDB, Remmina, Termite, XFCE, Tilda, FreeBSD VT, Terminator, Kitty, MobaXterm, LXTerminal, Microsoft's Windows Terminal, Visual Studio, Alacritty, Ghostty, and many more

https://github.com/mbadolato/iTerm2-Color-Schemes

#1ospd #opensource #colorscheme #freebsdvt #iterm #iterm2 #konsole #konsolecolorschemes #lxterminal #osxterminalthemes #putty #puttycolorschemes #schemes #terminal #terminalschemes #terminalthemes #terminator #theme #themes #windowsterminal #xrdb #xresources

Оживляем ESP8266 и ESP32 за 15 минут без программистских заморочек с помощью MicroPython

Что, если я скажу, что для прошивки ESP8266/ESP32 не нужна Arduino IDE? Покажу, как с помощью портативных программ за 15 минут вдохнуть жизнь в ваш модуль: прошить MicroPython, помигать светодиодом и даже подключиться к Wi-Fi. Без установки гигабайтных программ и лишних телодвижений. Прошить и оживить

https://habr.com/ru/articles/960102/

#micropython #esp #esp8266 #esp32 #esp8266_arduino #espressif #putty

#ClamAV is falsely reporting that #PuTTY 0.83 is infected with malware: allegedly the "Win.Exploit.Marte-10058127-0" virus. We were notified this morning: the ClamAV database entry is brand new. But the binary it accuses is six months old.

As usual, we believe this report is a falsehood. PuTTY has a long history of being insulted by virus checkers, and we've never worked out why, though we have a number of theories in our wishlist page for the phenomenon https://www.chiark.greenend.org.uk/~sgtatham/putty/wishlist/false-positive-malware.html.

In this case, the analysis in the screenshot shows that the identification is based on finding particular _text strings_ in the binary. Those text strings are the names of PuTTY source files, baked into the executable by something in the build process (most likely __FILE__, via assert statements). The full pathname includes a randomised build directory name created by mkstemp(), which identifies these strings as ones that would appear _only_ in the release build of PuTTY 0.83 – any other build would have chosen a different build directory. So this alleged virus signature is actually a signature of that particular PuTTY binary build.

Of course, I've submitted a false-positive report. (Quite a grumpy one, since this isn't the first time.) But I do wonder how this keeps happening. I could certainly believe that putty.exe was reused unchanged by some actual malware, and then somehow the signature of putty.exe got into the virus db entry instead of the signature of anything specific to the malware. But another possibility is that someone is maliciously making these database entries. I wonder if there's any way to tell which is true.

#opensuse
#tumbleweed

sshd[]: OpenSSL version mismatch. Built against 30500000, you have 3050003f

so install #putty on #linux :shame:

When #PortKnocking was first introduced, somebody made a fork of #PuTTY which had it built in. We didn't take the patch upstream, because it seemed so likely that port knocks would keep evolving and we'd have to run to keep up; we thought a better design would be to delegate to a "make my connection, with any necessary knocks" sub-tool.

But the best thing about this fork was its name. The author called it PoTTY. And it came with a full suite of supporting tools with names like Pogeant and Plonk. Top marks!