Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Notepad++ supply chain attack breakdown

securelist.com

Post reply on HN
Print view View original

71–80 of 205 posts

Re: Notepad++ supply chain attack breakdown

#71

Post by okanat »

marky1991 wrote: post #27
josephg wrote: post #17

Earlier quoted context omitted.

I've been arguing for this for years. There's no reason every random binary should have unfettered, invisible access to everything on my computer as if it were me . iOS and Android both implement these security policies correctly. Why can't desktop operating systems?

Mobile platforms are entirely useless to me for exactly this reason, individual islands that don't interact to make anything more generally useful. I would never use any os that worked like that, it's for toys and disposable software only imo.

There is a middle ground (maybe even closer to more limited OS design principles) exist. It is not just toys. Otherwise neither UWP on Windows nor Flatpaks or Firejail would exist nor systemd would implement containerization features.

In such a scenario, you can launch your IDE from your application manager and then only give write access to specific folders for a project. The IDE's configuration files can also be stored in isolated directories. You can still access them with your file manager software or your terminal app which are "special" and need to be approved by you once (or for each update) as special. You may think "How do I even share my secrets like Git SSH keys?". Well that's why we need services like the SSH Agent or Freedesktop secret-storage-spec. Windows already has this btw as the secret vaults. They are there since at least Windows 7 maybe even Vista.

Re: Notepad++ supply chain attack breakdown

#72

Post by jofla_net »

josephg wrote: post #60
marky1991 wrote: post #27

Earlier quoted context omitted.

Mobile platforms are entirely useless to me for exactly this reason, individual islands that don't interact to make anything more generally useful. I would never use any os that worked like that, it's for toys and disposable software only imo.

Mobile platforms are far more secure than desktop computing software. I'd rather do internet banking on my phone than on my computer. You should too. We can make operating systems where the islands can interact. Its just needs to be opt in instead of opt out. A bad Notepad++ update shouldn't be able to invisibly read all of thunderbird's stored emails, or add backdoors to projects I'm working on or cryptolocker my do…

Both are true, and both should be allowed to exist as they serve different purposes.

Sound engineers don't use lossy formats such as MP3 when making edits in preproduction work, as its intended for end users and would degrade quality cumulatively. In the same way someone working on software shouldn't be required to use an end-user consumption system when they are at work.

It would be unfortunate to see the nuance missed just because a system isn't 'new', it doesn't mean the system needs to be scrapped.

Re: Notepad++ supply chain attack breakdown

#74

Post by kibwen »

h4x0rr wrote: post #62
black_knight wrote: post #42

Earlier quoted context omitted.

I think we could get a lot further if we implement proper capability based security. Meaning that the authority to perform actions follows the objects around. I think that is how we get powerful tools and freedom, but still address the security issues and actually achieve the principle of least privilege. For FreeBSD there is capsicum, but it seems a bit inflexible to me. Would love to see more experiments on Linux a…

Eli5, what is that supposed to mean?

The original model of computer security is "anything running on the machine can do and touch anything it wants to".

A slightly more advanced model, which is the default for OSes today, is to have a notion of a "user", and then you grant certain permissions to a user. For example, for something like Unix, you have the read/write/execute permissions on files that differ for each user. The security mentioned above just involves defining more such permissions than were historically provided by Unix.

But the holy grail of security models is called "capability-based security", which is above and beyond what any current popular OS provides. Rather than the current model which just involves talking about what a process can do (the verbs of the system), a capability involves taking about what a process can do an operation on (the nouns of the system). A "capability" is an unforgeable cryptographic token, managed by the OS itself (sort of like how a typical OS tracks file handles), which grants access to a certain object.

Crucially, this then allows processes to delegate tasks to other processes in a secure way. Because tokens are cryptographically unforgeable, the only way that a process could have possibly gotten the permission to operate on a resource is if it were delegated that permission by some other process. And when delegating, processes can further lock down a capability, e.g. by turning it from read/write to read-only, or they can e.g. completely give up a capability and pass ownership to the other process, etc.

https://en.wikipedia.org/wiki/Capability-based_security

Re: Notepad++ supply chain attack breakdown

#75

Post by bigstrat2003 »

LostMyWords wrote: post #44
kotaKat wrote: post #29

Earlier quoted context omitted.

First three things I install on any machine - 7zip, Notepad++, alternate browser.

Yes, but I start with the browser. What are the Notepad++ alternatives on Linux and MacOS, for those times when I have to use them?

Sublime Text. I think it's better than Notepad++ and is available for all computer platforms, not just Windows.

Re: Notepad++ supply chain attack breakdown

#76

Post by bee_rider »

da_chicken wrote: post #51
TingPing wrote: post #10

Earlier quoted context omitted.

Literally yes: https://survey.stackoverflow.co/2025/

This might be a better link: https://survey.stackoverflow.co/2025/technology#1-dev-id-es It's listed as the third most popular IDE after Visual Studio Code and Visual Studio by respondents to Stack Overflow's annual survey. Interestingly, it's higher among professionals than learners. Maybe that's because learners are going to be using some of those newer AI-adjacent editors, or because learners are less likely to be…

I think the argument you made for combining vim and neovim is pretty good actually. But it seems pretty unique to those two editors (well, throw vi in there if it ever shows up on the chart), so “worst” case notepad++ would be bumped down just one spot.

Re: Notepad++ supply chain attack breakdown

#77

Post by anonymars »

Avicebron wrote: post #24
Someone1234 wrote: post #22

I'm out of the loop: How did they bypass Notepad++'s digital signatures? I just downloaded it to double-check, and the installer is signed with a valid code-signing certificate.

https://notepad-plus-plus.org/news/8.8.2-available-in-1-week...

Jeez, they didn't waste any time, did they? No more signing certificate in June, compromise in July

Re: Notepad++ supply chain attack breakdown

#80

Post by nosrepa »

LostMyWords wrote: post #44
kotaKat wrote: post #29

Earlier quoted context omitted.

First three things I install on any machine - 7zip, Notepad++, alternate browser.

Yes, but I start with the browser. What are the Notepad++ alternatives on Linux and MacOS, for those times when I have to use them?

Geany. Both npp and geany use the same editor component.
Post reply on HN