X-Git-Url: https://asedeno.scripts.mit.edu/gitweb/?a=blobdiff_plain;f=doc%2Ffaq.but;h=e2e2374207a62e23632c74de93cdaeaffa0c69a8;hb=5471539a6738484b48fb938c88dce547a3e4b299;hp=07c913ed8e6e1284cbb68db76f882ff8d5b65053;hpb=549e5e8b7b256fb4bfad41737287172bb429be24;p=PuTTY.git

diff --git a/doc/faq.but b/doc/faq.but
index 07c913ed..e2e23742 100644
--- a/doc/faq.but
+++ b/doc/faq.but
@@ -1,5 +1,3 @@
-\define{versionidfaq} \versionid $Id$
-
 \A{faq} PuTTY \i{FAQ}
 
 This FAQ is published on the PuTTY web site, and also provided as an
@@ -65,6 +63,9 @@ files into PuTTY's format.
 
 Yes. SSH-1 support has always been available in PuTTY.
 
+However, the SSH-1 protocol has many weaknesses and is no longer
+considered secure; it should be avoided if at all possible.
+
 \S{faq-localecho}{Question} Does PuTTY support \i{local echo}?
 
 Yes. Version 0.52 has proper support for local echo.
@@ -151,17 +152,18 @@ military-strength cipher. That insignificant host key prompt really
 does make \e{that} much difference.
 
 If you're having a specific problem with host key checking - perhaps
-you want an automated batch job to make use of PSCP or Plink, and
-the interactive host key prompt is hanging the batch process - then
-the right way to fix it is to add the correct host key to the
-Registry in advance. That way, you retain the \e{important} feature
-of host key checking: the right key will be accepted and the wrong
-ones will not. Adding an option to turn host key checking off
-completely is the wrong solution and we will not do it.
+you want an automated batch job to make use of PSCP or Plink, and the
+interactive host key prompt is hanging the batch process - then the
+right way to fix it is to add the correct host key to the Registry in
+advance, or if the Registry is not available, to use the \cw{-hostkey}
+command-line option. That way, you retain the \e{important} feature of
+host key checking: the right key will be accepted and the wrong ones
+will not. Adding an option to turn host key checking off completely is
+the wrong solution and we will not do it.
 
 If you have host keys available in the common \i\c{known_hosts} format,
 we have a script called 
-\W{http://svn.tartarus.org/sgt/putty/contrib/kh2reg.py?view=markup}\c{kh2reg.py}
+\W{http://tartarus.org/~simon-git/gitweb/?p=putty.git;a=blob;f=contrib/kh2reg.py;hb=HEAD}\c{kh2reg.py}
 to convert them to a Windows .REG file, which can be installed ahead of
 time by double-clicking or using \c{REGEDIT}.
 
@@ -1075,7 +1077,7 @@ actively malicious PC and get away with typing passwords into it.
 If you do trust the PC, then it's probably OK to use PuTTY on it
 (but if you don't trust the network, then the PuTTY download might
 be tampered with, so it would be better to carry PuTTY with you on a
-floppy).
+USB stick).
 
 \S{faq-cleanup}{Question} What does PuTTY leave on a system? How can
 I \i{clean up} after it?
@@ -1188,7 +1190,7 @@ Partly, because we don't want to move the web site location (see
 Also, security reasons. PuTTY is a security product, and as such it
 is particularly important to guard the code and the web site against
 unauthorised modifications which might introduce subtle security
-flaws. Therefore, we prefer that the Subversion repository, web site and
+flaws. Therefore, we prefer that the Git repository, web site and
 FTP site remain where they are, under the direct control of system
 administrators we know and trust personally, rather than being run
 by a large organisation full of people we've never met and which is
@@ -1488,6 +1490,38 @@ suppliers so that it clearly distinguishes paid vendors who know about
 you from free software developers who don't have any idea who you are.
 Then, only send out these mass mailings to the former.
 
+\S{faq-checksums}{Question} The \c{sha1sums} / \c{sha256sums} / etc
+files on your download page don't match the binaries.
+
+People report this every so often, and usually the reason turns out to
+be that they've matched up the wrong checksums file with the wrong
+binaries.
+
+The PuTTY download page contains more than one version of the
+software. There's a \e{latest release} version; there are the
+\e{development snapshots}; and when we're in the run-up to making a
+release, there are also \e{pre-release} builds of the upcoming new
+version. Each one has its own collection of binaries, and its own
+collection of checksums files to go with them.
+
+So if you've downloaded the release version of the actual program, you
+need the release version of the checksums too, otherwise you will see
+a mismatch. Similarly, the development snapshot binaries go with the
+development snapshot checksums, and so on. (We've colour-coded the
+download page in an effort to reduce this confusion a bit.)
+
+If you have double-checked that, and you still think there's a real
+mismatch, then please send us a report carefully quoting everything
+relevant:
+
+\b the exact URL you got your binary from
+
+\b the checksum of the binary after you downloaded
+
+\b the exact URL you got your checksums file from
+
+\b the checksum that file says the binary should have.
+
 \H{faq-misc} Miscellaneous questions
 
 \S{faq-openssh}{Question} Is PuTTY a port of \i{OpenSSH}, or based on