Live data from Hacker News

Windows Notepad App Remote Code Execution Vulnerability

cve.org

81–90 of 538 posts

Re: Windows Notepad App Remote Code Execution Vulnerability

#81
post #19
post #6

I miss when the Notepad was doing what the Notepad is supposed to do: show a text file, plain and simple.

This was already better when the latest from MS was still called "* XP": https://liquidninja.com/metapad/

Wow that's a hit of nostalgia, I'd completely forgotten about metapad, but I loved it back in the day.

And it's hard to believe now, but yes, support for Ctrl+S to save file was a notable feature because notepad itself didn't support that back then.

Re: Windows Notepad App Remote Code Execution Vulnerability

#84

Earlier quoted context omitted.

Win9x Notepad in particular can only load files up to 64KB in size (edit: and supports only ANSI encoding, no Unicode). There were some actually useful additions to it up until Windows 10 or so - for example being able to handle LF (in addition to CRLF) line endings. But yeah, everything added in Windows 11 is just pure bloat.

I find notepad useful for sanitising clipboard content. No bold text, italics, bullet points, invisible html.. Just get the text and can copy it to paste again somewhere else. Ala Cmd+Shift+V on Mac

I somewhat regularly use the almost embarrassing key sequence Ctrl-C Ctrl-L Ctrl-V Ctrl-A Ctrl-X to sanitize text I’ve copied from a browser, using the address field to remove any formatting.

Re: Windows Notepad App Remote Code Execution Vulnerability

#85

We have officially reached the logical conclusion of the feature-bloat-to-vulnerability pipeline. For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text. An 8.8 CVSS on a utility meant for viewing data is a fundamental failure of the principle of least privilege. At some point, they need to stop aski…

"For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text." Well, except that this did not prevent it from having embarrassing bugs. Google "Bush hid the facts" for an example. I'm serious, you won't be disappointed. I think complexity is relative. At the time of the "Bush hid the facts" bug, nailing d…

It's not solved, we just don't have to guess the encoding any more because it's always UTF-8.

Re: Windows Notepad App Remote Code Execution Vulnerability

#86
post #61

You can literally one-shot Opus 4.6 to make a better, faster, safer, more secure notepad.exe than the one that comes with Windows. This isn't an AI slop problem.

Tools are almost never the problem. The application of tools is.

I 100% agree. I'm just trying to point out the problem isn't Microsoft AI slopping their software. Even if you slopped it, the software could turn out better than what they're putting out.

There must be something much worse than slop going on to get to this point.

Re: Windows Notepad App Remote Code Execution Vulnerability

#87

We have officially reached the logical conclusion of the feature-bloat-to-vulnerability pipeline. For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text. An 8.8 CVSS on a utility meant for viewing data is a fundamental failure of the principle of least privilege. At some point, they need to stop aski…

"For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text." Well, except that this did not prevent it from having embarrassing bugs. Google "Bush hid the facts" for an example. I'm serious, you won't be disappointed. I think complexity is relative. At the time of the "Bush hid the facts" bug, nailing d…

https://en.wikipedia.org/wiki/Bush_hid_the_facts

Re: Windows Notepad App Remote Code Execution Vulnerability

#88
post #50
post #37

A few days ago, Notepad++ got compromised—apparently by a state actor (or a proxy). And now, today, Windows’ built-in Notepad has a fresh CVE. What a life. At this point, what am I supposed to do other than uninstall Windows completely? No real sandboxing, a mountain of legacy…

Well technically Unixes like Linux are a mountain of legacy and they are fine. Windows is just a mountain of shit.

Unixes like Linux are not immune.

Re: Windows Notepad App Remote Code Execution Vulnerability

#89
post #25

Seems whatever they do they step in shit. They should stop doing stuff. They spent the last few years entirely compromising their products rather than improving them.

Exactly my predicament. My laptop reached EOL but I'm struggling to purchase a new one. They're all bundled with AI features (I absolutely don't need) and never in my life will I buy a mac for coding. My current laptop is HODL'ing and idk if this enshittification will end soon.

Install Linux

Re: Windows Notepad App Remote Code Execution Vulnerability

#90
post #65

use SublimeText, it is perhaps faster now than the stock Notepad

As much as I used to love Sublime, the version switching caught me out which burned me a bit, even if admittedly my v2 key lasted an unreasonable time through the version 3 beta, but I don't want to risk buying a v4 key without a clear roadmap of when they might switch to version 5.
Post reply on HN