Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows Notepad App Remote Code Execution Vulnerability

cve.org

Post reply on HN
Print view View original

221–230 of 538 posts

Re: Windows Notepad App Remote Code Execution Vulnerability

#221

Post by funnybeam »

TZubiri wrote: post #136
Fiveplus wrote: post #14

We have officially reached the logical conclusion of the feature-bloat-to-vulnerability pipeline. For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text. An 8.8 CVSS on a utility meant for viewing data is a fundamental failure of the principle of least privilege. At some point, they need to stop aski…

EDIT: THE OLD NOTEPAD IS STILL IN WINDOWS AND WE CAN USE IT! https://learn.microsoft.com/en-us/answers/questions/3845356/... You basically have to find the "execution alias" setting and disable notepad and you get the ole reliable :D OLD POST: This has hurt me specifically. Since I work without IDEs, no VIM, no vs code. On linux I use nano, on windows I use Notepad. I like the minimalism and the fact that I have abso…

Except it keeps reverting to the new notepad every few days….

I’ve been fighting this for the last couple of weeks but it just doesn’t stick

Re: Windows Notepad App Remote Code Execution Vulnerability

#222

Post by capitainenemo »

7bit wrote: post #197
dspillett wrote: post #159

Earlier quoted context omitted.

> nailing down Unicode and text encodings was still considered rocket science. Now this is a solved problem I wish… Detecting text encoding is only easy if all you need to contend with is UTF16-with-BOM, UTF8-with-BOM, UTF8-without-BOM, and plain ASCII (which is effectively also UTF8). As soon as you might see UTF16 or UCS without a BOM, or 8-bit codepages other than plain ASCII (many apps/libs assume that these are…

The very fact that UTF-8 itself discouraged from using the BOM is just so alien to me. I understand they want it to be the last encoding and therefore not in need of a explicit indicator, but as it currently IS NOT the only encoding that is used, it makes is just so difficult to understand if I'm reading any of the weird ASCII derivatives or actual Unicode. It's maddening and it's frustrating. The US doesn't have any…

From wikipedia...

    UTF-8 always has the same byte order,[5] so its only use in UTF-8 is to signal at the start that the text stream is encoded in UTF-8...
    Not using a BOM allows text to be backwards-compatible with software designed for extended ASCII. For instance many programming languages permit non-ASCII bytes in string literals but not at the start of the file. ...
   A BOM is unnecessary for detecting UTF-8 encoding. UTF-8 is a sparse encoding: a large fraction of possible byte combinations do not result in valid UTF-8 text.
That last one is a weaker point but it is true that with CSV a BOM is more likely to do harm, than good.

Re: Windows Notepad App Remote Code Execution Vulnerability

#223

Post by PlatoIsADisease »

Hackbraten wrote: post #191
BLKNSLVR wrote: post #182

Earlier quoted context omitted.

> It is to do with link handling: Notepad? Link handling? That's like my pencil having a CVE that's to do with how it loads the ink. That old saying about 'if Microsoft built a car' is more true now than it was then: https://www.snopes.com/fact-check/car-balk/

Unpopular opinion: rudimentary Markdown support is not entirely far-fetched even for a dumb text editor. Even though I’m all against feature bloat, I think that making Markdown hyperlinks clickable is still within the Overton window of what a simple editor should be doing.

Maybe I don't understand what markdown support will imply, but doesn't this hide text?

Like, if I have a h2 or url, its going to show as special text rather than the h2 tag?

Re: Windows Notepad App Remote Code Execution Vulnerability

#224

Post by g-b-r »

7bit wrote: post #197
dspillett wrote: post #159

Earlier quoted context omitted.

> nailing down Unicode and text encodings was still considered rocket science. Now this is a solved problem I wish… Detecting text encoding is only easy if all you need to contend with is UTF16-with-BOM, UTF8-with-BOM, UTF8-without-BOM, and plain ASCII (which is effectively also UTF8). As soon as you might see UTF16 or UCS without a BOM, or 8-bit codepages other than plain ASCII (many apps/libs assume that these are…

The very fact that UTF-8 itself discouraged from using the BOM is just so alien to me. I understand they want it to be the last encoding and therefore not in need of a explicit indicator, but as it currently IS NOT the only encoding that is used, it makes is just so difficult to understand if I'm reading any of the weird ASCII derivatives or actual Unicode. It's maddening and it's frustrating. The US doesn't have any…

Indeed, I've been using the BOM in all my text files for maybe decades now, those who wrote the recommendation are clearly from an English country

Re: Windows Notepad App Remote Code Execution Vulnerability

#227

Post by guidopallemans »

karel-3d wrote: post #212
r2vcap wrote: post #37

A few days ago, Notepad++ got compromised—apparently by a state actor (or a proxy). And now, today, Windows’ built-in Notepad has a fresh CVE. What a life. At this point, what am I supposed to do other than uninstall Windows completely? No real sandboxing, a mountain of legacy…

Visual Studio Code was not compromised.

Visual Studio Code is the compromise

Re: Windows Notepad App Remote Code Execution Vulnerability

#228

Post by jdsampayo »

throwpoaster wrote: post #204
cyanydeez wrote: post #192

Earlier quoted context omitted.

Microsoft is driving AI adoption. Why blame tge workers for this?

Microsoft is comprised of its workers.

All workers are equal, but some workers are more equal than others

Re: Windows Notepad App Remote Code Execution Vulnerability

#229

Post by StilesCrisis »

oblio wrote: post #176
dgxyz wrote: post #104

Earlier quoted context omitted.

The first point is fairly obvious and the latter point is not true (AppArmor etc)

Phew, I'm so relieved that now we have the One True Security Solution To Rule Them All, AppArmor. Oh, what do you mean there's also SELinux, Snap, Flatpack, Docker, Podman, ...?

He did say "etc"...

Re: Windows Notepad App Remote Code Execution Vulnerability

#230

Post by latexr »

jfaganel99 wrote: post #11

Notepad had one job... Seems like bringing markdown features killed it :)

Something felt off about your comments, so I checked your account. You signed up almost six years ago, and in all that time made zero submissions and your only comments are these two on this thread? I’ve been seeing this more and more on HN. What exactly is going on here?
Post reply on HN