Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows Notepad App Remote Code Execution Vulnerability

cve.org

Post reply on HN
Print view View original

281–290 of 538 posts

Re: Windows Notepad App Remote Code Execution Vulnerability

#281

Post by anthk »

oblio wrote: post #172
MonkeyClub wrote: post #156

Earlier quoted context omitted.

I'm sure eventually it will, it's law: Every text editor, if it survives long enough, will end up implementing a partial, bug-ridden version of Emacs.

> Every text editor, if it survives long enough, will end up implementing a partial, bug-ridden version of Emacs. Every text editor, including Emacs [...].

Emacs has EMMS for music, reusing mpg123/mpv/ffplay and the like, but it can emulate Vim well enough too ;)

Altough now I'm using 9front, Sam and Acme. I feel myself weird not using the keyboard but at least I understood structural expressions for Sam/Acme really fast, first with 'Vis' and next under Acme. Oh, Acme can do mail and news and a bunch more... because it has I/O since the beginning, you can plug anything into it, from commands to the text buffer to sockets. Even a crude HN client if you dare.

Re: Windows Notepad App Remote Code Execution Vulnerability

#282

Post by zerkten »

sneak wrote: post #166
bigfatkitten wrote: post #160

Earlier quoted context omitted.

> At some point, they need to stop asking "can we add this feature?" and start asking "does this text editor need a network-aware rendering stack?" They didn’t stop there. They also asked “does this need AI?” and came up with the wrong answer.

It’s just resumé driven development. Corporate droids gotta justify their salaries somehow. It doesn’t pay to call software “done”.

Even if you talk to users, you can do it the wrong way. Big companies are incentivized by the stock market to care more about new users than existing ones because their only focus is growth. Growth can't be rooted in your existing users is a common feeling in product management circles. If you try to do things for people other than your existing users, then you end up doing odd stuff that at best is a mild annoyance. More likely you hurt their ability to continue using the app.

Re: Windows Notepad App Remote Code Execution Vulnerability

#283

Post by xantronix »

trinix912 wrote: post #264
eterm wrote: post #254

Earlier quoted context omitted.

That's what ethics are. If you don't make sacrifices for them they aren't ethics they're just conveniences.

This is easy to say until you're an immigrant worker in a foreign country - something one probably worked for their entire life up to that point - risking it all (and potentially wrecking the life of their entire family) just to stop some random utility from having a Copilot button. It's not "this software will be used to kill people", it's more like "there's this extra toolbar which nobody uses". In life you have to…

I hadn't made more solid connections between the current state of software and industry, the subjugation of immigrants, and the death of the American neoliberal order until this comment thread but it here it lies bare, naked, and essentially impossible to ignore. With regards to the whole picture, there's no good or moral place to "RETVRN" to in a nostalgic sense. The one question that keeps ringing through my head as I see the world in constant upheaval, and my one refuge in meaning, technical craftsmanship, tumbling, is: Why did I not see this coming?

Re: Windows Notepad App Remote Code Execution Vulnerability

#285

Post by optymizer »

eterm wrote: post #254
onion2k wrote: post #245

Earlier quoted context omitted.

Because there are plenty of developers who'll say yes, so anyone saying no is putting their ethics ahead of their livelihood. Few people will be willing to put their beliefs ahead of providing for their family. It's easy to say you will, and very hard to actually do it.

That's what ethics are. If you don't make sacrifices for them they aren't ethics they're just conveniences.

"why won't other people make sacrifices for me?"

Because the society in US is arranged as a competition with no safety net and where your employer has a disproportionate amount of influence on your well being and the happiness of your kids.

I'm not going to give up $1M in total comp and excellent insurance for my family because you and I don't like where AI is going.

Re: Windows Notepad App Remote Code Execution Vulnerability

#286

Post by wlesieutre »

zerkten wrote: post #282
sneak wrote: post #166

Earlier quoted context omitted.

It’s just resumé driven development. Corporate droids gotta justify their salaries somehow. It doesn’t pay to call software “done”.

Even if you talk to users, you can do it the wrong way. Big companies are incentivized by the stock market to care more about new users than existing ones because their only focus is growth. Growth can't be rooted in your existing users is a common feeling in product management circles. If you try to do things for people other than your existing users, then you end up doing odd stuff that at best is a mild annoyance.…

Exemplified by every website with a massive SIGN UP button and then a little 8 pt font log in tucked away somewhere underneath.

Gee thanks for helping me find the button I'll use literally once and making me hunt for the one I'll need the other 99999 times I use this service.

Existing users can go fuck themselves as long as new people are registering. Line go up!

Re: Windows Notepad App Remote Code Execution Vulnerability

#288

Post by oblio »

StilesCrisis wrote: post #229
oblio wrote: post #176

Earlier quoted context omitted.

Phew, I'm so relieved that now we have the One True Security Solution To Rule Them All, AppArmor. Oh, what do you mean there's also SELinux, Snap, Flatpack, Docker, Podman, ...?

He did say "etc"...

Fairly sure the "etc" came after my comment, in an edit.

Re: Windows Notepad App Remote Code Execution Vulnerability

#289

Post by anthk »

voidUpdate wrote: post #26

I found a copy of the win98 (I believe) notepad.exe a while back, and it works perfectly on windows 11 (though the "about notepad" dialog shows the windows 11 version for some reason??). I can write text into it, save it, and load text again. What more does notepad need? And it has a very nostalgic font too

Get notepad.exe from reactos' nightly ISO, it's in reactos.cab

Extract both the ISO and reactos.cab wth 7zip.

Re: Windows Notepad App Remote Code Execution Vulnerability

#290

Post by optymizer »

gruez wrote: post #249
Fiveplus wrote: post #14

We have officially reached the logical conclusion of the feature-bloat-to-vulnerability pipeline. For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text. An 8.8 CVSS on a utility meant for viewing data is a fundamental failure of the principle of least privilege. At some point, they need to stop aski…

>At some point, they need to stop asking "can we add this feature?" and start asking "does this text editor need a network-aware rendering stack?" But so far as I can tell the bug isn't related to "network-aware rendering stack" or AI (as other people are blindly speculating)? From MSRC: >How could an attacker exploit this vulnerability? >An attacker could trick a user into clicking a malicious link inside a Markdown…

That's why we have text editors, markdown viewers, image viewers, etc.

You were never able to "click a link" in Notepad in the past.

Mixing responsibilities brings with it lots of baggage, security vulnerabilities being one of them.

Post reply on HN