Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Notepad++ supply chain attack breakdown

securelist.com

Post reply on HN
Print view View original

51–60 of 205 posts

Re: Notepad++ supply chain attack breakdown

#51

Post by da_chicken »

TingPing wrote: post #10
bluenose69 wrote: post #4

The article starts out by saying that Notepad++ "is a text editor popular among developers". Really?

Literally yes: https://survey.stackoverflow.co/2025/

This might be a better link: https://survey.stackoverflow.co/2025/technology#1-dev-id-es

It's listed as the third most popular IDE after Visual Studio Code and Visual Studio by respondents to Stack Overflow's annual survey. Interestingly, it's higher among professionals than learners. Maybe that's because learners are going to be using some of those newer AI-adjacent editors, or because learners are less likely to be using Windows at all.

I'm sure people will leap to the defense of their chosen text editor, like they always do. "Oh, they separated vim and Neovim! Those are basically the same! I can combine those, really, to get a better score!" But I think a better takeaway is that it's incredible that Notepad++, an open source application exclusive to Windows that has had, basically, a single developer over the course of 22 years, has managed to reach such a widespread audience. Especially when Scintilla's other related editors (SciTE, EditPlus) essentially don't rate.

Re: Notepad++ supply chain attack breakdown

#52

Post by gruez »

Erlangen wrote: post #48

> Notably, the first scan of this URL on the VirusTotal platform occurred in late September, by a user from Taiwan. Could this be the attacker? The scan happened before the hack was first exposed on the forum.

You would be a dumbass to do that, because virustotal allows security researchers to see submitted samples/urls. The last thing you want to do is to draw attention to your C&C server.

Re: Notepad++ supply chain attack breakdown

#53

Post by Marsymars »

troad wrote: post #2

It now seems to be best practice to simultaneously keep things updated (to avoid newly discovered vulnerabilities), but also not update them too much (to avoid supply chain attacks). Honestly not sure how I'm meant to action those at the same time.

The easiest way to action as a user seems like it would be to use local package managers that includes something like Dependabot's cooldown config. I'm not aware of any local package managers that do something like this?

https://docs.github.com/en/code-security/reference/supply-ch...

Re: Notepad++ supply chain attack breakdown

#54

Post by gruez »

da_chicken wrote: post #51
TingPing wrote: post #10

Earlier quoted context omitted.

Literally yes: https://survey.stackoverflow.co/2025/

This might be a better link: https://survey.stackoverflow.co/2025/technology#1-dev-id-es It's listed as the third most popular IDE after Visual Studio Code and Visual Studio by respondents to Stack Overflow's annual survey. Interestingly, it's higher among professionals than learners. Maybe that's because learners are going to be using some of those newer AI-adjacent editors, or because learners are less likely to be…

>Maybe that's because learners are going to be using some of those newer AI-adjacent editors, or because learners are less likely to be using Windows at all.

You can use the 2022 (ie. pre-chatgpt) results for control for that. The results are basically the same.

https://survey.stackoverflow.co/2022/#most-popular-technolog...

Re: Notepad++ supply chain attack breakdown

#55

Post by dizhn »

LostMyWords wrote: post #44
kotaKat wrote: post #29

Earlier quoted context omitted.

First three things I install on any machine - 7zip, Notepad++, alternate browser.

Yes, but I start with the browser. What are the Notepad++ alternatives on Linux and MacOS, for those times when I have to use them?

I love a feature of notepad++ where when you have documents open and exit, it won't bother you with a save dialog and when you open it again the previous state will be there. I found that mousepad on linux can do this.

For something functionality close I would look at Kate.

Re: Notepad++ supply chain attack breakdown

#56

Post by kbelder »

kotaKat wrote: post #29
bluenose69 wrote: post #4

The article starts out by saying that Notepad++ "is a text editor popular among developers". Really?

First three things I install on any machine - 7zip, Notepad++, alternate browser.

Same, but additionally Irfanview. And once upon a time, Media Player Classic used to be on that list.

This train of thought made me go find https://www.oldversion.com/. For a while, that was invaluable.

Re: Notepad++ supply chain attack breakdown

#57

Post by lifeisgood99 »

ashishb wrote: post #35
troad wrote: post #14

Earlier quoted context omitted.

MacOS has been getting a lot of flak recently for (correct) UI reasons, but I honestly feel like they're the closest to the money with granular app permissions. Linux people are very resistant to this, but the future is going to be sandboxed iOS style apps. Not because OS vendors want to control what apps do, but because users do. If the FOSS community continues to ignore proper security sandboxing and distribution o…

It also has persistent permissions. Think about it from a real world perspective. I knock on your door. You invite me to sit with you in your living room. I can't easily sneak into your bed room. Further, your temporary access ends as soon as you exit my house. The same should happen with apps. When I run 'notepad dir1/file1.txt', the package should not sneakily be able to access dir2. Further, as soon as I exit the…

A better example would be requiring the mailman to obtain written permission to step on your property every day. Convenience trumps maximal security for most people.

Re: Notepad++ supply chain attack breakdown

#58

Post by netsharc »

dizhn wrote: post #55
LostMyWords wrote: post #44

Earlier quoted context omitted.

Yes, but I start with the browser. What are the Notepad++ alternatives on Linux and MacOS, for those times when I have to use them?

I love a feature of notepad++ where when you have documents open and exit, it won't bother you with a save dialog and when you open it again the previous state will be there. I found that mousepad on linux can do this. For something functionality close I would look at Kate.

I love and hate it at the same time, just like my browser tabs hoarding, it means I currently have 218 open documents on Notepad++ (and 96 browser tabs). I might not even need them anymore, but it's always "I'll look at them... later".

Re: Notepad++ supply chain attack breakdown

#59

Post by billforsternz »

bluenose69 wrote: post #4

The article starts out by saying that Notepad++ "is a text editor popular among developers". Really?

I enjoy coding something new up in Notepad++, without any annoying autocomplete and jank. I call it unplugged (acoustic?) mode. Jeepers Visual Studio these days starts autocompleting if and while for example and sometimes doesn't respect normal keystrokes because it expects me to complete these kind of interactions instead.

Re: Notepad++ supply chain attack breakdown

#60

Post by josephg »

marky1991 wrote: post #27
josephg wrote: post #17

Earlier quoted context omitted.

I've been arguing for this for years. There's no reason every random binary should have unfettered, invisible access to everything on my computer as if it were me . iOS and Android both implement these security policies correctly. Why can't desktop operating systems?

Mobile platforms are entirely useless to me for exactly this reason, individual islands that don't interact to make anything more generally useful. I would never use any os that worked like that, it's for toys and disposable software only imo.

Mobile platforms are far more secure than desktop computing software. I'd rather do internet banking on my phone than on my computer. You should too.

We can make operating systems where the islands can interact. Its just needs to be opt in instead of opt out. A bad Notepad++ update shouldn't be able to invisibly read all of thunderbird's stored emails, or add backdoors to projects I'm working on or cryptolocker my documents. At least not without my say so.

I get that permission prompts are annoying. There are some ways to do the UI aspect in a better way - like have the open file dialogue box automatically pass along permissions to the opened file. But these are the minority of cases. Most programs only need to access to their own stuff. Having an OS confirmation for the few applications that need to escape their island would be a much better default. Still allow all the software we use today, but block a great many of these attacks.

Post reply on HN