Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows Notepad App Remote Code Execution Vulnerability

cve.org

Post reply on HN
Print view View original

321–330 of 538 posts

Re: Windows Notepad App Remote Code Execution Vulnerability

#321

Post by appreciatorBus »

optymizer wrote: post #285
eterm wrote: post #254

Earlier quoted context omitted.

That's what ethics are. If you don't make sacrifices for them they aren't ethics they're just conveniences.

"why won't other people make sacrifices for me?" Because the society in US is arranged as a competition with no safety net and where your employer has a disproportionate amount of influence on your well being and the happiness of your kids. I'm not going to give up $1M in total comp and excellent insurance for my family because you and I don't like where AI is going.

Just having the option of giving up $1 million in compensation put one far far far above meaningful worries about your well-being and the happiness of your kids.

Re: Windows Notepad App Remote Code Execution Vulnerability

#322

Post by JCattheATM »

Fiveplus wrote: post #14

We have officially reached the logical conclusion of the feature-bloat-to-vulnerability pipeline. For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text. An 8.8 CVSS on a utility meant for viewing data is a fundamental failure of the principle of least privilege. At some point, they need to stop aski…

Things started going downhill when they added a Bing option to one of the menus, which was only very recently after they added support for *nix newlines. A very mishandled product, but then the whole OS has been mishandled since 10. Some would say 7.

Re: Windows Notepad App Remote Code Execution Vulnerability

#323

Post by 1970-01-01 »

Let's ask the obvious. There should be zero vulns in notepad. It should be feature complete since XP. Who approved this vulnerability, and how quickly can they be fired? The App store is a joke. At least call it Notepad 2.0 or some other flashy garbage so we can proactively label the bullshit as such.

Re: Windows Notepad App Remote Code Execution Vulnerability

#324

Post by mghackerlady »

wormpilled wrote: post #240
cyanydeez wrote: post #192

Earlier quoted context omitted.

Microsoft is driving AI adoption. Why blame tge workers for this?

Why can't Indian software developers stand up for themselves and say no?

It's a cultural thing. They'd much rather do what they think someone means than question authority

Re: Windows Notepad App Remote Code Execution Vulnerability

#325

Post by mghackerlady »

usrbinbash wrote: post #184
weinzierl wrote: post #59

Earlier quoted context omitted.

"For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text." Well, except that this did not prevent it from having embarrassing bugs. Google "Bush hid the facts" for an example. I'm serious, you won't be disappointed. I think complexity is relative. At the time of the "Bush hid the facts" bug, nailing d…

As funny as the "Bush hid the facts" bug may be, there is a world of difference between an embarassing mistake by a function that guesses the text encoding wrong, and a goddamn remote code execution with an 8.8 score > and we have other battles we fight. Except no, we don't. notepad.exe was DONE SOFTWARE. It was feature complete. It didn't have to change. This is not a battle that needed fighting, this was hitting a…

For a good built in "done" text editor, theres apples textedit. It's barely changed since NeXTSTEP and works flawlessly and is FOSS. As much as I hate apple there's a reason I have GNUstep installed on most of my *nix boxes

Re: Windows Notepad App Remote Code Execution Vulnerability

#326

Post by Romario77 »

breppp wrote: post #277
usrbinbash wrote: post #184

Earlier quoted context omitted.

As funny as the "Bush hid the facts" bug may be, there is a world of difference between an embarassing mistake by a function that guesses the text encoding wrong, and a goddamn remote code execution with an 8.8 score > and we have other battles we fight. Except no, we don't. notepad.exe was DONE SOFTWARE. It was feature complete. It didn't have to change. This is not a battle that needed fighting, this was hitting a…

> Except no, we don't. notepad.exe was DONE SOFTWARE While 8.8 score is embarrassing, by no measure notepad was done software. It couldn't load a large text file for one, its search was barely functional, had funky issues with encoding, etc. Notepad++ is closer to what should be expected from an OS basic text editor

Notepad++ might be too much for a simple utility.

Plus for many years Word was one of the main cash cows for MS, so they didn't want to make an editor that would take away from Word.

And you could see how adding new things adds vulnerabilities. In this case they added ability to see/render markdown and with markdown they render links, which in this case allowed executing remote code when user clicks on a link.

Re: Windows Notepad App Remote Code Execution Vulnerability

#327

Post by stalfosknight »

jdsampayo wrote: post #228
throwpoaster wrote: post #204

Earlier quoted context omitted.

Microsoft is comprised of its workers.

All workers are equal, but some workers are more equal than others

I have been thinking about this Animal Farm quote a lot recently.

Re: Windows Notepad App Remote Code Execution Vulnerability

#328

Post by 1970-01-01 »

petee wrote: post #301
Stevvo wrote: post #200

Old notepad is still in Windows 11 at C:\Windows\notepad.exe

Works great still, but now windows won't let me associate .txt files with it. God damn I hate the future

     ftype txtfile=c:\windows\NOTEPAD.EXE %1

Re: Windows Notepad App Remote Code Execution Vulnerability

#329

Post by graemep »

laserbeam wrote: post #312
graemep wrote: post #260

Earlier quoted context omitted.

Is this a big deal? is it also not a problem with anything that renders clickable links? Browsers, email clients, whatever. Is this not a problem with anything that offers a preview of markdown (or HTML, or anything with embedded links)?

The problem is notepad itself would download and execute bad stuff if you click the evil link. If you would paste that same link in a browser you'd be ok. And the problem is a notepad app is expected to be dead simple, have few features, and be hard to get wrong while implementing.

So Notepad will download and execute itself rather than launch an appropriate application to handle the URL? That was not clear to me.

Re: Windows Notepad App Remote Code Execution Vulnerability

#330

Post by mghackerlady »

BLKNSLVR wrote: post #164
TZubiri wrote: post #136

Earlier quoted context omitted.

EDIT: THE OLD NOTEPAD IS STILL IN WINDOWS AND WE CAN USE IT! https://learn.microsoft.com/en-us/answers/questions/3845356/... You basically have to find the "execution alias" setting and disable notepad and you get the ole reliable :D OLD POST: This has hurt me specifically. Since I work without IDEs, no VIM, no vs code. On linux I use nano, on windows I use Notepad. I like the minimalism and the fact that I have abso…

I had a USB that I carried around with me with a whole bunch of portable apps on it. That allowed me to have some kind of "standard environment" I could rely on. I've since migrated to Linux 100% (outside of work) and whilst there are the odd annoyances, it's been a breath of fresh air compared to Windows. And I can have a good chuckle almost once a week these days with each new Windows consumer hostility coming acro…

You can do that (probably even better) on linux with a Live Usb. I have a fedora one on my keychain since it has firefox and libreoffice included by default
Post reply on HN