True.
But what would signing do? Primarily prove identification.
I (or Brad) could sign an exe stacked with malware.
Given that it was a “scratch your itch” type of project for him, I doubt it’s worth the effort/cost of going through 3rd party authentication/signing (and even those aren’t foolproof, as evidenced by several high profile root cert failures of recent years).
My suggestion would be to diff mine against his. If they’re the same, that means minimal risk of them both containing attack vectors.
Ultimately, of course, run your own checks. Or simply don’t use it. You’re responsible for the security of your machine, after all.
]]>Sorry, crappy css on my part (I don’t know what I was thinking). There are a coupla links in the third para that are now blindingly obvious. You can get putty-bkg from either of them.
]]>