Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows Notepad App Remote Code Execution Vulnerability

cve.org

Post reply on HN
Print view View original

351–360 of 538 posts

Re: Windows Notepad App Remote Code Execution Vulnerability

#351

Post by optymizer »

appreciatorBus wrote: post #321
optymizer wrote: post #285

Earlier quoted context omitted.

"why won't other people make sacrifices for me?" Because the society in US is arranged as a competition with no safety net and where your employer has a disproportionate amount of influence on your well being and the happiness of your kids. I'm not going to give up $1M in total comp and excellent insurance for my family because you and I don't like where AI is going.

Just having the option of giving up $1 million in compensation put one far far far above meaningful worries about your well-being and the happiness of your kids.

Not really. We would have to downsize our life.

I'll have to explain it to the wife: "well, you see, we cant live in this house anymore because AI in Notepad was just too much".

I'll dial up my ethical and moral stance on software up to 11 when I see a proper social safety net in this country, with free healthcare and free education.

And if we cant all agree on having even those vital things for free, then relying on collective agreement on software issues will never work in practice so my sacrifice would be for nothing. I would just end up being the dumb idealist.

Re: Windows Notepad App Remote Code Execution Vulnerability

#353

Post by tristor »

fuzzzerd wrote: post #308
joshuaissac wrote: post #233

Earlier quoted context omitted.

> FIPS-compliant bindings (OpenSSL) Using FIPS mode can be insecure because the latest FIPS-compliant version can be years older than the latest non-FIPS one with all the updates. The only time it makes sense to use the FIPS version is where there is a legal or contractual requirement that trumps security considerations.

While I think this is good advice, the fact that it's true feels backward to me. "We have a legal or contractual obligation to be less secure than we otherwise would be." Just seems silly.

Welcome to the reality of most of the "information security" business, which is mostly just compliance by checkbox. A significant proportion of encrypted Internet traffic that is transiting government agencies or major enterprises gets decrypted in flight for inspection, literally inserting a black-box with privileged MITM capabilities into otherwise secure protocols, purely for the purpose of checking a compliance box, and that's not even the worst sin.

There's no insecurity like compliant cybersecurity :)

Re: Windows Notepad App Remote Code Execution Vulnerability

#354

Post by vachina »

ubixar wrote: post #234

Notepad had one job, display text. Microsoft decided it needed an attack surface instead. The year of the Linux desktop doesn't need to arrive - it just needs Windows to keep shipping.

More like the year of the Mac OS (or MacBook). Once market saturates with cheap M series you will see everyone switching.

Re: Windows Notepad App Remote Code Execution Vulnerability

#355

Post by petee »

1970-01-01 wrote: post #328
petee wrote: post #301

Earlier quoted context omitted.

Works great still, but now windows won't let me associate .txt files with it. God damn I hate the future

ftype txtfile=c:\windows\NOTEPAD.EXE %1

I can successfully set that as admin, but it doesn't change anything - file won't open and "open with" pops up an error still that notepad can't be used.

Edit: going with EmEditor; forgot that existed

Re: Windows Notepad App Remote Code Execution Vulnerability

#356

Post by tristor »

r2vcap wrote: post #37

A few days ago, Notepad++ got compromised—apparently by a state actor (or a proxy). And now, today, Windows’ built-in Notepad has a fresh CVE. What a life. At this point, what am I supposed to do other than uninstall Windows completely? No real sandboxing, a mountain of legacy…

> At this point, what am I supposed to do other than uninstall Windows completely?

Uninstall Windows completely 4 years ago when Windows 11 was released heralding in a new era of absolutely insane, self-destructive, unnecessary and unwanted shit?

There is no valid excuse for this vulnerability. It's existence is a category error that's only possible because Microsoft has completely jumped the shark. Continuing to use /any/ of their products is a choice to accept pure insanity as a default.

Re: Windows Notepad App Remote Code Execution Vulnerability

#357

Post by Rohansi »

optymizer wrote: post #290
gruez wrote: post #249

Earlier quoted context omitted.

>At some point, they need to stop asking "can we add this feature?" and start asking "does this text editor need a network-aware rendering stack?" But so far as I can tell the bug isn't related to "network-aware rendering stack" or AI (as other people are blindly speculating)? From MSRC: >How could an attacker exploit this vulnerability? >An attacker could trick a user into clicking a malicious link inside a Markdown…

That's why we have text editors, markdown viewers, image viewers, etc. You were never able to "click a link" in Notepad in the past. Mixing responsibilities brings with it lots of baggage, security vulnerabilities being one of them.

I think there are more text editors around that render clickable links than there are that don't. Even your terminal probably renders clickable links.

Despite the scary words and score this wouldn't even be a vulnerability if people weren't so hard wired to click every link they see. It's not some URL parsing gone wrong triggering an RCE. Most likely they allowed something like file:// links which of course opens that file. Totally valid link, but the feature must be neutered to only http(s):// because people.

Re: Windows Notepad App Remote Code Execution Vulnerability

#358

Post by dataflow »

usrbinbash wrote: post #269
keepamovin wrote: post #215

Earlier quoted context omitted.

That is completely valid for personal threat models, I rely on LUKS/BitLocker for my daily driver too. The specific gap this fills is 'Defense in Depth' + compliance. OS-level encryption (like FDE) is transparent once you log in. If you walk away from an unlocked machine, FDE does nothing. App-level encryption, however, ensures the specific sensitive notes remain encrypted on disk even while the OS is running and the…

> If you walk away from an unlocked machine ...then I might as well ask what happens when I walk away from the encrypting edior while a file is still open. User Error can happen with any encryption or security schema. Pointing out a trueism is not an argument. > It's also portable So is encrypting files using a specialized tool. I don't need my editor to do this. The entire point of my criticism, and indeed the entir…

For what it's worth I understood the argument and think it is valid. It's one thing for the file you're working on to be vulnerable if you walk away leaving the editor open; it's another for all of your other files to be vulnerable too. It's O(1) vs. O(n). The difference is clearly not zero.

Re: Windows Notepad App Remote Code Execution Vulnerability

#359

Post by xaldir »

oblio wrote: post #172
MonkeyClub wrote: post #156

Earlier quoted context omitted.

I'm sure eventually it will, it's law: Every text editor, if it survives long enough, will end up implementing a partial, bug-ridden version of Emacs.

> Every text editor, if it survives long enough, will end up implementing a partial, bug-ridden version of Emacs. Every text editor, including Emacs [...].

No, no, no, Emacs is a pretty good operating system, it just lacks a good text editor.

Re: Windows Notepad App Remote Code Execution Vulnerability

#360

Post by gkcnlr »

By looking at their 2025 shareholder report (Look for the part below "NOTE 18"), Windows is only at the 5th place in terms of revenue source, even below the LinkedIn:

https://www.microsoft.com/investor/reports/ar25/index.html#

I can only think that they do not even care about Windows anymore, let alone Notepad...

Post reply on HN