PuTTY was written back in a time when SSH was proprietary software. It predates the first release of OpenSSH, which I believe was BSD-only at the time, by almost a year.

That aside, the official SSH implementation has never been any princess either. The PuTTY implementation is superior in many ways, not least in terms of modularity, although evidently just as prone to security problems as OpenSSH.

I'm all for new alternative implementations of important pieces of our stack, but please God no more security-critical C.

> The idea that PuTTY has bugs that aren't originating from the openssh project is really bothersome to me. All that work to reimplement, for what?

Agreed. OpenSSH wasted a lot of needless effort reimplementing PuTTY. Except now that you know the timeline is reversed I expect your opinion on reimplementation to suddenly 180 as well.

> PuTTY Initial Release: January 8, 1999

> OpenSSH Initial Release: 1 December 1999

Via Wikipedia

Note, OpenSSH wasn't brand new code on its first release. It was forked from the original SSH software from a version before it went commercial. I can't remember the whole history of that earlier open source project, but I can remember that I installed it on a university workstation in mid 1996.

On the other hand, this bug only affects PuTTY users instead of all openssh users, which means it’s that much less of an appealing target for Hackers.

This bug actually affects OpenSSH, too. See https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2020-2...

Very surprised to see a bug get patched in putty but says OpenSSH won't fix. Anyone reading this with the kind of background who can comment on that?

If I read the report correctly, this is a protocol level issue. The report lists a potential client side fix, but it’s not without problems and includes the following sentence regarding openssh: “ The developers of OpenSSH are not planning to change the behavior of OpenSSH regarding this issue, because of the aforementioned drawbacks. ”