During Windows millennium days, I accessed internet mainly from internet cafe's, most of them had windows restrictions enabled, with downloads disabled, my computer hidden and such.
Open notepad, and from notepad I access USB drive then run opera browser installed on it. mail, web, downloads..
Windows Notepad App Remote Code Execution Vulnerability
401–410 of 538 posts
Re: Windows Notepad App Remote Code Execution Vulnerability
#402Earlier quoted context omitted.
Something felt off about your comments, so I checked your account. You signed up almost six years ago, and in all that time made zero submissions and your only comments are these two on this thread? I’ve been seeing this more and more on HN. What exactly is going on here?
Looks like they logged in the first time in years to make a post https://news.ycombinator.com/item?id=46975123 And decided to jump in on some threads just as well.
That post happened six hours after the comments. Doesn’t seem plausible they logged in to do it then got distracted.
Re: Windows Notepad App Remote Code Execution Vulnerability
#403Earlier quoted context omitted.
I believe it is. Just tested it. You can make the link "C:\windows\system32\cmd.exe" and clicking it will launch the Command Prompt. I noticed you can't make it "C:\windows\system32\cmd.exe /c some-nefarious-thing"; it doesn't like the space. Exploiting may require you to ship both the malicious EXE and the MD, then trick the user into clicking the link inside the MD. But then you could have just tricked them into di…
>Exploiting may require you to ship both the malicious EXE and the MD, then trick the user into clicking the link inside the MD. But then you could have just tricked them into directly clicking the EXE. 1. You can use UNC paths to access remote servers via SMB 2. Even if it's local, it's still more useful than you make it out to be. For instance, suppose you downloaded a .zip file of some github project. The .zip fil…
> 1. You can use UNC paths to access remote servers via SMB
Relevant article from The Old New Thing: https://devblogs.microsoft.com/oldnewthing/20060509-30/?p=31...
Programs (this is true for most mainstream operating systems) can become network facing without realizing it. I've sometimes found a bunch of Windows programs sometimes tends to assume that I/O completes "instantly" (even if async I/O has been common on Windows for a very long time) and don't have a good UX for cancelling long running I/O operations
Re: Windows Notepad App Remote Code Execution Vulnerability
#404By looking at their 2025 shareholder report (Look for the part below "NOTE 18"), Windows is only at the 5th place in terms of revenue source, even below the LinkedIn: https://www.microsoft.com/investor/reports/ar25/index.html# I can only think that they do not even care about Windows anymore, let alone Notepad...
[deleted]
Re: Windows Notepad App Remote Code Execution Vulnerability
#405Earlier quoted context omitted.
> What counts as "large"? Remote into a machine that you're not allowed to copy data out of. You only have the utilities baked into Windows and whatever the validated CI/CD process put there. You need to open a log file that has ballooned to at least several hundred megabytes, maybe more. Moby Dick is about 1MB of text. That's really not much compared to a lot of log files on pretty hot servers. I do agree though, if…
Oh right, generated files exist. Though logging systems usually have a rollover file size you can configure, should this happen to you in real life. Honestly I'm okay with having to resort to power tools for these edge cases. Notepad is more for the average user who is less likely to run into 100 MB text files and more likely to run into a 2 kB text file someone shared on Discord.
> Though logging systems usually have a rollover file size you can configure, should this happen to you in real life
I get what you're saying. But if things were done right I probably wouldn't have to be remoting into this box to hunt for a log file that wasn't properly being shipped to some other centralized logging platform.
Re: Windows Notepad App Remote Code Execution Vulnerability
#406Earlier quoted context omitted.
> Except no, we don't. notepad.exe was DONE SOFTWARE While 8.8 score is embarrassing, by no measure notepad was done software. It couldn't load a large text file for one, its search was barely functional, had funky issues with encoding, etc. Notepad++ is closer to what should be expected from an OS basic text editor
Notepad++ might be too much for a simple utility. Plus for many years Word was one of the main cash cows for MS, so they didn't want to make an editor that would take away from Word. And you could see how adding new things adds vulnerabilities. In this case they added ability to see/render markdown and with markdown they render links, which in this case allowed executing remote code when user clicks on a link.
> Plus for many years Word was one of the main cash cows for MS, so they didn't want to make an editor that would take away from Word.
Wordpad was the bundled rich text editor and was also a mess
I don't think an improved notepad could have cannibalized Word
Re: Windows Notepad App Remote Code Execution Vulnerability
#407Earlier quoted context omitted.
You can Ctrl+shift+v to paste plain text in windows.
In some cases. In others, the application does whatever it wants.
> application does whatever it wants
Obsidian has a mildly infuriating default of opening previews with ctrl shift v keys instead of pasting with no formatting.
Re: Windows Notepad App Remote Code Execution Vulnerability
#408It is to do with link handling: https://msrc.microsoft.com/update-guide/vulnerability/CVE-20... > An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad, causing the application to launch unverified protocols that load and execute remote files.
> It is to do with link handling: Notepad? Link handling? That's like my pencil having a CVE that's to do with how it loads the ink. That old saying about 'if Microsoft built a car' is more true now than it was then: https://www.snopes.com/fact-check/car-balk/
It's hard for me to imagine anyone balking at this feature. My core note taking workflow frequently involves:
1. Note about blah 2. Paste link to blah 3. Open that link later when reviewing my notes.
Blah is sometimes a web link, sometimes a link to a doc on my system, and sometimes a link to an item in my todo tracker. The better analogy is this is like a pencil having an eraser built in.
I use Drafts instead of Notepad, but if I used Notepad I would want to be able to easily open links in my notes. When I do find myself in Notepad, it's because I double clicked on a readme file that often contains links to resources I need.
Re: Windows Notepad App Remote Code Execution Vulnerability
#409Earlier quoted context omitted.
I explicitly stopped this habit so that I don't accidentally do it with sensitive data I don't want to go to my search engine provider's auto complete API.
Disabling remote search autocomplete is one of the first things I do when I setup a new browser instance. It's a privacy and security nightmare I don't want.
> Disabling remote search autocomplete
I've always have a suspicion that even with auto complete off, some sort of telemetry or obscure feature is still leaking browser address bar text.
Re: Windows Notepad App Remote Code Execution Vulnerability
#410Earlier quoted context omitted.
I believe it is. Just tested it. You can make the link "C:\windows\system32\cmd.exe" and clicking it will launch the Command Prompt. I noticed you can't make it "C:\windows\system32\cmd.exe /c some-nefarious-thing"; it doesn't like the space. Exploiting may require you to ship both the malicious EXE and the MD, then trick the user into clicking the link inside the MD. But then you could have just tricked them into di…
>Exploiting may require you to ship both the malicious EXE and the MD, then trick the user into clicking the link inside the MD. But then you could have just tricked them into directly clicking the EXE. 1. You can use UNC paths to access remote servers via SMB 2. Even if it's local, it's still more useful than you make it out to be. For instance, suppose you downloaded a .zip file of some github project. The .zip fil…
Definitely; I didn't mean to underplay it. Here's a fun one:
[Free AI credits](C:\windows\system32\logoff.exe)