Live data from Hacker News

Windows Notepad App Remote Code Execution Vulnerability

cve.org

101–110 of 538 posts

Re: Windows Notepad App Remote Code Execution Vulnerability

#101

I found a copy of the win98 (I believe) notepad.exe a while back, and it works perfectly on windows 11 (though the "about notepad" dialog shows the windows 11 version for some reason??). I can write text into it, save it, and load text again. What more does notepad need? And it has a very nostalgic font too

> What more does notepad need?

Most of the features that were added in later versions: unicode, tabs, auto-reload, support for large files. CTRL+S is also nice.

Re: Windows Notepad App Remote Code Execution Vulnerability

#102
post #50

Earlier quoted context omitted.

Well technically Unixes like Linux are a mountain of legacy and they are fine. Windows is just a mountain of shit.

Unixes like Linux are not immune.

True, as systemd and wayland point out elegantly. But at least there is a modicum of choice there.

Re: Windows Notepad App Remote Code Execution Vulnerability

#103
post #22
post #2

So what this means is every Windows program is now a cve nightmare (or goldmine, depending on view)?

Yeah the other day in calc.exe I pressed F7 in programmer mode to change to octal (F5 to F8 select Hex, Dec, Oct, Bin), and instead it asked if I was sure I wanted to enable caret browsing.

Oof. That's a special kind of stupid. I get how it happened, but like, they found a way to make calc bad while also bringing an obscure feature in modern browsers I hate with a passion.

It reminds me of King of the Hill where Hank says "Can't you see you're not making Christianity better and you're only making rock music worse?"

Re: Windows Notepad App Remote Code Execution Vulnerability

#104
post #50

Earlier quoted context omitted.

Well technically Unixes like Linux are a mountain of legacy and they are fine. Windows is just a mountain of shit.

"Fine" Why does every Linux distro under the sun try so hard to protect the garbage under /usr/bin/ and /etc/ when literally the only files that matter to me are in /home, which is a free-for-all?

The first point is fairly obvious and the latter point is not true (AppArmor etc)

Re: Windows Notepad App Remote Code Execution Vulnerability

#105

We have officially reached the logical conclusion of the feature-bloat-to-vulnerability pipeline. For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text. An 8.8 CVSS on a utility meant for viewing data is a fundamental failure of the principle of least privilege. At some point, they need to stop aski…

"For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text." Well, except that this did not prevent it from having embarrassing bugs. Google "Bush hid the facts" for an example. I'm serious, you won't be disappointed. I think complexity is relative. At the time of the "Bush hid the facts" bug, nailing d…

Embarrassing bugs are not RCEs. Also the industry should be more mature now, not less. But move fast and break things, I guess...

Re: Windows Notepad App Remote Code Execution Vulnerability

#106

I found a copy of the win98 (I believe) notepad.exe a while back, and it works perfectly on windows 11 (though the "about notepad" dialog shows the windows 11 version for some reason??). I can write text into it, save it, and load text again. What more does notepad need? And it has a very nostalgic font too

Win9x Notepad in particular can only load files up to 64KB in size (edit: and supports only ANSI encoding, no Unicode). There were some actually useful additions to it up until Windows 10 or so - for example being able to handle LF (in addition to CRLF) line endings. But yeah, everything added in Windows 11 is just pure bloat.

Notepad is so slow at loading large files that it crashing quickly is a feature.

The windows 7-10 versions that could open anything would just get stuck for half an hour when you opened the wrong thing in them, which was rather annoying.

Re: Windows Notepad App Remote Code Execution Vulnerability

#107

Earlier quoted context omitted.

I couldn't agree more. A text editor exposing an attack surface via a network stack is precisely the kind of bloat that makes modern computing ultra-fragile. I actually built a "dumb" alternative in Rust last week specifically to escape this. It’s a local-only binary—no network permissions, encrypted at rest, and uses FIPS-compliant bindings (OpenSSL) just to keep the crypto boring and standard. It’s inspectable if y…

What does notepad need openssl for?

Cryptography I guess

Re: Windows Notepad App Remote Code Execution Vulnerability

#108
post #61

You can literally one-shot Opus 4.6 to make a better, faster, safer, more secure notepad.exe than the one that comes with Windows. This isn't an AI slop problem.

Well, it might be "more secure" in the sense of "no hacker will use it as an attack vector", not necessarily "it is free of security of security bugs".

Re: Windows Notepad App Remote Code Execution Vulnerability

#110

Earlier quoted context omitted.

I couldn't agree more. A text editor exposing an attack surface via a network stack is precisely the kind of bloat that makes modern computing ultra-fragile. I actually built a "dumb" alternative in Rust last week specifically to escape this. It’s a local-only binary—no network permissions, encrypted at rest, and uses FIPS-compliant bindings (OpenSSL) just to keep the crypto boring and standard. It’s inspectable if y…

What does notepad need openssl for?

For the built-in web-browser instance it likely contains by now.
Post reply on HN