Top all-time · #1708
Chris Palmer
Personal blog · noncombatant.orgsecurityprogramming
Chris Palmer writes Noncombatant, a personal blog at noncombatant.org about security and programming. Since 2011, 42 different Hacker News readers have linked it 60 times, most often “Downloading PuTTY Safely Is Nearly Impossible (2014)”. It is still writing: the last post was on 2024-12-18, and you can follow it by feed.
Too few sampled comments (23) to say how often HN recommends it.?
Why HN links it
HN readers link Chris Palmer's blog for security writing: the PuTTY download-verification post, HTTPS and HPKP, browser privacy settings, and a guide to getting into security engineering.
- Recommended for · 9 comments
- Called 'well-reasoned', 'really great', 'an amazing overview' and 'a good place to start'.
Summarised by Claude from a sample of 23 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
Most-linked posts?
- Downloading PuTTY Safely Is Nearly Impossible (2014)10 people · 12 mentions · first linked 2015-05-20
- Prioritizing Memory Safety Migrations4 people · 4 mentions · first linked 2021-04-09
- The State of Software Security in 20193 people · 3 mentions · first linked 2019-01-07
- /2015/11/24/what-is-hpkp-for/3 people · 3 mentions · first linked 2015-11-25
- Chris Palmer on Getting into Security Engineering3 people · 3 mentions · first linked 2016-06-28
- Against Security Nihilism2 people · 2 mentions · first linked 2016-01-28
- /2014/03/11/privacy-and-security-settings-in-chrome/2 people · 2 mentions · first linked 2015-01-10
- About Public Key Pinning2 people · 2 mentions · first linked 2015-05-02
- Everyone Needs Secure Usability2 people · 2 mentions · first linked 2016-01-31
- Decoding Chrome’s HTTPS UX2 people · 2 mentions · first linked 2017-02-15
What Hacker News says?
so windows users might finally be able to download a verifiable/signed and maybe "trusted" application to use ssh with? ( https://noncombatant.org/2014/03/03/downloading-software-saf... )
Comment linking /2014/03/03/downloading-software-safely-is-nearly-impossible/
on “Looking Forward: Support for Secure Shell”Submitted Downloading Software Safely Is Nearly Impossible as a story · 368 points
HN discussionjust read this: https://noncombatant.org/2014/03/03/downloading-software-saf...
Comment linking /2014/03/03/downloading-software-safely-is-nearly-impossible/
on “Looking Forward: Support for Secure Shell”Submitted The State of Software Security in 2019 as a story · 311 points
HN discussionIt would be cool if someone would donate to him a domain. Downloading PuTTY involves relying on greenend.org.uk (which isn't obviously connected with PuTTY). You can check your download using the hashes provided on the site; but if the download has been messed with, then the hash is untrustworthy too. https://noncombatant.org/2014/03/03/downloading-software-saf...
Comment linking /2014/03/03/downloading-software-safely-is-nearly-impossible/
on “Putty maintainer on his attitude towards security and open source”Submitted Downloading PuTTY Safely Is Nearly Impossible (2014) as a story · 264 points
HN discussionAt first I thought "The title is bait.... what a waste of time, etc...". Clearly the problem isn't HTTPS, it is the current CA structure. I then went on Chris' site ( http://noncombatant.org/ ) and there he summarizes it well: "The problems are social and economic more than technical. The technical problems are in usability, not in cryptography. In general, security people should start learning about usability." I s…
Comment linking /
on “It's Time to Fix HTTPS”Submitted About Public Key Pinning as a story · 72 points
HN discussionI believe chiark is the server that is the home of PuTTY. This is an amusing article about getting a known-good copy of PuTTY. https://noncombatant.org/2014/03/03/downloading-software-saf... (They have HTTPS now, so perhaps the problems are mitigated)
Comment linking /2014/03/03/downloading-software-safely-is-nearly-impossible/
on “Upgrading from Debian Jessie to Bullseye after nearly 30 years”Submitted Maybe We Can Have Nice Things as a story · 67 points
HN discussionThere's a ton of important software that people are installing over HTTP, so using HTTPS is unfortunately already super-substantial progress. Chris Palmer gave the sad example of PuTTY a couple of years ago: https://noncombatant.org/2014/03/03/downloading-software-saf... (after what I think was a long time, the actual download links themselves are now HTTPS, although they're all still served -- along with the signat…
Comment linking /2014/03/03/downloading-software-safely-is-nearly-impossible/
on “Let's Encrypt and Nginx – State of the art secure web deployment”Submitted Simple And Terrible Machines as a story · 49 points
HN discussionReminds me of this article posted back in 2014 by Chris Palmer https://noncombatant.org/2014/03/03/downloading-software-saf...
Comment linking /2014/03/03/downloading-software-safely-is-nearly-impossible/
on “PuTTY 0.68 has been released”Submitted Prioritizing Memory Safety Migrations as a story · 45 points
HN discussionHas much changed since this? https://noncombatant.org/2014/03/03/downloading-software-saf... Related comments: https://news.ycombinator.com/item?id=9577861
Comment linking /2014/03/03/downloading-software-safely-is-nearly-impossible/
on “PuTTY 0.68 has been released”Submitted Some problems of URLs as a story · 34 points
HN discussionRegarding Chrome, here's a good place to start: https://noncombatant.org/2014/03/11/privacy-and-security-set... There are also people who use Chromium, or particular configurations of Chromium, instead of Chrome. That's fine. But don't use forks of Chromium , no matter who maintains them, even if it looks like a sizable effort. You don't want your browser to be any number of days behind the Chromium patch cycle. I u…
Comment linking /2014/03/11/privacy-and-security-settings-in-chrome/
on “Ask HN: Online Security Tips for Newbie Freedom Activists?”Submitted Long Live Sandboxing as a story · 31 points
HN discussionThat's because putty.org isn't the official site for PuTTY. Think of it like "friendly" domain squatting, then despair at the security implications. See https://noncombatant.org/2014/03/03/downloading-software-saf... (but many of the points have been resolved)
Comment linking /2014/03/03/downloading-software-safely-is-nearly-impossible/
on “KiTTY – A fork of PuTTY 0.67 with many additional features”Submitted Improving Software ‘Numbers’ as a story · 26 points
HN discussionAs a software engineer you're more than half of the way there. A lot of people pivot into this industry with almost zero experience because it's pretty fun and they end up learning computer science along the way. I'd first start by reading this blog https://noncombatant.org/2016/06/20/get-into-security-engine... and everything it links. Then study them to start getting a breadth of knowledge in the security space. I…
Comment linking /2016/06/20/get-into-security-engineering/
on “Ask HN: Is it just me or do 99% of SWE jobs offers seem completely pointless?”Submitted Everyone Needs Secure Usability as a story · 13 points
HN discussionFun fact: the google engineers responsible for this decision were repeatedly accused of being NSA plants as a result: https://twitter.com/sleevi_/status/668911789841608706 Chris Palmer also wrote a really great blog post about this: https://noncombatant.org/2015/11/24/what-is-hpkp-for/
Comment linking /2015/11/24/what-is-hpkp-for/
on “The Security Impact of HTTPS Interception [pdf]”Submitted The state of software security in 2019 as a story · 4 points
HN discussionWhich is also not on HTTPS. I read this "old" piece about PuTTY the other day and it still seems just as absurd: https://noncombatant.org/2014/03/03/downloading-software-saf...
Comment linking /2014/03/03/downloading-software-safely-is-nearly-impossible/
on “PuTTY 0.66 fixes security vulnerability”Submitted Prioritizing Memory Safety Migrations as a story · 3 points
HN discussionOn one hand, Dell seems to think there is a market of people willing to pay to install Firefox. Whoever conducted that research probably found people trusting Firefox than IE or Chrome or Opera. That's just my guess. I have heard people saying "web download is broken. You first have to use some browser like Chrome or IE to install Firefox, but what if that IE version is compromised? What if people click on the wrong…
Comment linking /2014/03/03/downloading-software-safely-is-nearly-impossible/
on “Mozilla is investigating why Dell is charging to install Firefox”Submitted Everyone Needs Secure Usability as a story · 3 points
HN discussionPlease note, I am not accusing any specific person of being a government spook intent on weakening security, but I can’t help notice the parallels in this situation with what is known about how Internet standards get compromised Except that's exactly what the author is doing. Otherwise why did I have to wade through the first 50% of this blog post? Palmer's blog on the subject [1] is well-reasoned and makes the moti…
Comment linking /2015/11/24/what-is-hpkp-for/
on “Dell, Google, and Internet Security”Submitted Styling Graphviz with CSS as a story · 2 points
HN discussion
