Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows Notepad App Remote Code Execution Vulnerability

cve.org

Post reply on HN
Print view View original

191–200 of 538 posts

Re: Windows Notepad App Remote Code Execution Vulnerability

#191

Post by Hackbraten »

BLKNSLVR wrote: post #182
mjmas wrote: post #134

It is to do with link handling: https://msrc.microsoft.com/update-guide/vulnerability/CVE-20... > An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad, causing the application to launch unverified protocols that load and execute remote files.

> It is to do with link handling: Notepad? Link handling? That's like my pencil having a CVE that's to do with how it loads the ink. That old saying about 'if Microsoft built a car' is more true now than it was then: https://www.snopes.com/fact-check/car-balk/

Unpopular opinion: rudimentary Markdown support is not entirely far-fetched even for a dumb text editor.

Even though I’m all against feature bloat, I think that making Markdown hyperlinks clickable is still within the Overton window of what a simple editor should be doing.

Re: Windows Notepad App Remote Code Execution Vulnerability

#192

Post by cyanydeez »

sneak wrote: post #166
bigfatkitten wrote: post #160

Earlier quoted context omitted.

> At some point, they need to stop asking "can we add this feature?" and start asking "does this text editor need a network-aware rendering stack?" They didn’t stop there. They also asked “does this need AI?” and came up with the wrong answer.

It’s just resumé driven development. Corporate droids gotta justify their salaries somehow. It doesn’t pay to call software “done”.

Microsoft is driving AI adoption. Why blame tge workers for this?

Re: Windows Notepad App Remote Code Execution Vulnerability

#193

Post by chrisjj »

MonkeyClub wrote: post #162
TZubiri wrote: post #136

Earlier quoted context omitted.

EDIT: THE OLD NOTEPAD IS STILL IN WINDOWS AND WE CAN USE IT! https://learn.microsoft.com/en-us/answers/questions/3845356/... You basically have to find the "execution alias" setting and disable notepad and you get the ole reliable :D OLD POST: This has hurt me specifically. Since I work without IDEs, no VIM, no vs code. On linux I use nano, on windows I use Notepad. I like the minimalism and the fact that I have abso…

> the purity of "working with what's installed". Oh, a kindred spirit! I too absolutely love the notion of the base install, and what can be done just by means of its already available toolset. (Fun tidbit: Did you know Windows comes with a bare bones C# 5 toolchain, with csc.exe, and even vbc.exe and jsc.exe?)

> Did you know Windows comes with a bare bones C# 5 toolchain

Shh, please. If MS find out, they'll add a parrot to "improve" it.

Re: Windows Notepad App Remote Code Execution Vulnerability

#194

Post by nottorp »

ganzsz wrote: post #186
autoexec wrote: post #141

Earlier quoted context omitted.

EDIT.COM still works in dosbox

Edit is ported to win11 and edit(.exe) should work in your shell of choice. https://learn.microsoft.com/en-us/windows/edit/

But... did they add a http server in it? Mail reader?

Re: Windows Notepad App Remote Code Execution Vulnerability

#195

Post by nottorp »

Hackbraten wrote: post #191
BLKNSLVR wrote: post #182

Earlier quoted context omitted.

> It is to do with link handling: Notepad? Link handling? That's like my pencil having a CVE that's to do with how it loads the ink. That old saying about 'if Microsoft built a car' is more true now than it was then: https://www.snopes.com/fact-check/car-balk/

Unpopular opinion: rudimentary Markdown support is not entirely far-fetched even for a dumb text editor. Even though I’m all against feature bloat, I think that making Markdown hyperlinks clickable is still within the Overton window of what a simple editor should be doing.

Except notepad was the safe option for editing files and making sure what you see is what gets saved. Not any more?

Re: Windows Notepad App Remote Code Execution Vulnerability

#197

Post by 7bit »

dspillett wrote: post #159
weinzierl wrote: post #59

Earlier quoted context omitted.

"For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text." Well, except that this did not prevent it from having embarrassing bugs. Google "Bush hid the facts" for an example. I'm serious, you won't be disappointed. I think complexity is relative. At the time of the "Bush hid the facts" bug, nailing d…

> nailing down Unicode and text encodings was still considered rocket science. Now this is a solved problem I wish… Detecting text encoding is only easy if all you need to contend with is UTF16-with-BOM, UTF8-with-BOM, UTF8-without-BOM, and plain ASCII (which is effectively also UTF8). As soon as you might see UTF16 or UCS without a BOM, or 8-bit codepages other than plain ASCII (many apps/libs assume that these are…

The very fact that UTF-8 itself discouraged from using the BOM is just so alien to me. I understand they want it to be the last encoding and therefore not in need of a explicit indicator, but as it currently IS NOT the only encoding that is used, it makes is just so difficult to understand if I'm reading any of the weird ASCII derivatives or actual Unicode.

It's maddening and it's frustrating. The US doesn't have any of these issues, but in Europe, that's a complete mess!

Re: Windows Notepad App Remote Code Execution Vulnerability

#199

Post by naikrovek »

In the past I would have defended Microsoft for this, somehow.

The Microsoft of 2026 is insane and I have 40,000 ideas to improve things without being anticompetitive but I no longer want to work at that company for any amount of money.

Microsoft have been stagnating and letting business people steer product direction for about 30 years too long. MBAs don't know shit. Stop letting them lead product direction. Stop letting people who are not power-users of a product make decisions about that product. PERIOD. No more PMs who aren't advanced users who lived in the tool 8 hours a day for months in a previous role.

Promote people who think differently, ESPECIALLY IF THEY DO NOT FIT IN THE CULTURE AT MICROSOFT TODAY. Think about ways to innovate. Advance the computing landscape, god dammit. Why are terminals still textual? How the fuck have we not moved past this ancient paradigm? Look at Plan9 and adopt features that Plan9 pioneered, and pay zero attention to what customers will accept while doing it - you can change the shape of these features to make them palatable at a later stage of design (there's no reason these features need to be painful for anyone, but they can be--and should be--very secure and inherent, rather than opt-in.)

Just pull your flippin' head out of your ass, Microsoft. Holy shit.

Post reply on HN