Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows Notepad App Remote Code Execution Vulnerability

cve.org

Post reply on HN
Print view View original

521–530 of 538 posts

Re: Windows Notepad App Remote Code Execution Vulnerability

#521

Post by samspot »

delusional wrote: post #424
samspot wrote: post #408

Earlier quoted context omitted.

It's hard for me to imagine anyone balking at this feature. My core note taking workflow frequently involves: 1. Note about blah 2. Paste link to blah 3. Open that link later when reviewing my notes. Blah is sometimes a web link, sometimes a link to a doc on my system, and sometimes a link to an item in my todo tracker. The better analogy is this is like a pencil having an eraser built in. I use Drafts instead of Not…

But then notepad wouldn't be fetching the content. While I would still prefer notepad to be simple, and just making you copy paste the link, I would expect it to forward a link a browser, or something. I would not expect notepad to go out and fetch random content from the internet.

I read the bug as notepad can launch unsafe links by delegating them to the OS to open.

Re: Windows Notepad App Remote Code Execution Vulnerability

#522

Post by JCattheATM »

TZubiri wrote: post #136
Fiveplus wrote: post #14

We have officially reached the logical conclusion of the feature-bloat-to-vulnerability pipeline. For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text. An 8.8 CVSS on a utility meant for viewing data is a fundamental failure of the principle of least privilege. At some point, they need to stop aski…

EDIT: THE OLD NOTEPAD IS STILL IN WINDOWS AND WE CAN USE IT! https://learn.microsoft.com/en-us/answers/questions/3845356/... You basically have to find the "execution alias" setting and disable notepad and you get the ole reliable :D OLD POST: This has hurt me specifically. Since I work without IDEs, no VIM, no vs code. On linux I use nano, on windows I use Notepad. I like the minimalism and the fact that I have abso…

Does Windows come with a compiler I don't know about? Or do you only code batch files and VB Script?

Re: Windows Notepad App Remote Code Execution Vulnerability

#524

Post by hbn »

lucketone wrote: post #491
0cf8612b2e1e wrote: post #457

Earlier quoted context omitted.

The desperation for feedback is grating. You have a monopoly position, you know I cannot switch from this, why waste my time with this dialogue? Not like you take user opinions seriously anyway.

Just an act of asking for the opinion matters. (Maybe not for all, but definitely for some) https://en.wikipedia.org/wiki/Hawthorne_effect

That claims surveying workers improved their productivity at the job.

I don't think you can apply that to be interrupted with a popup while using a calculator.

Re: Windows Notepad App Remote Code Execution Vulnerability

#525

Post by tremon »

mdavid626 wrote: post #497
d3Xt3r wrote: post #454

Earlier quoted context omitted.

When was the last time you tried it? Assetto Corsa EVO has a Gold rating on ProtonDB[1] and apparently SimHub also works fine, according to the SimHub forums[2]. [1] https://www.protondb.com/app/3058630 [2] https://www.simhubdash.com/community-2/simhub-support/guide-...

Yes, I know that they might work just fine on Linux. But… ACC EVO is alpha at the moment. It barely runs without bugs on Windows. It’s just less hassle on Windows.

The alpha stage is the best time to test if it also works via Wine or Proton -- while you can still give feedback to the devs about it.

Re: Windows Notepad App Remote Code Execution Vulnerability

#526

Post by ziml77 »

amiga386 wrote: post #516
paleotrope wrote: post #511

Earlier quoted context omitted.

I haven't had time to look at it in detail but surely the vulnerability is more than a "click a URL".

No, that's exactly what the vulnerability is as far as I know. "An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad, causing the application to launch unverified protocols that load and execute remote files." https://msrc.microsoft.com/update-guide/vulnerability/CVE-20... Imagine some Markdown: [link](https://badsite.com) [link](file://C:/windows/system32/cmd.exe) [l…

I wish they made this clearer as being the issue. It's what it came across to me like, but I couldn't actually say for sure that's what they meant because the CVE pages didn't make it obvious. And the comments here didn't help because everyone is just complaining about feature creep rather than discussing the actual problem.

Anyway, what this now has me thinking is, should protecting against this be expected to be done per-app or should it be at the OS level? It seems like it would make more sense to have the OS keep records on what application is allowed to open what kinds of links. Maybe with some mechanism to allow the app to cooperate with the OS if they want finer-grained permissions (such as a chat app passing the poster's user ID to the OS when invoking the link, so you could set an 'always allow' rule for links from specific users rather than the full app).

Re: Windows Notepad App Remote Code Execution Vulnerability

#527

Post by wtetzner »

7bit wrote: post #197
dspillett wrote: post #159

Earlier quoted context omitted.

> nailing down Unicode and text encodings was still considered rocket science. Now this is a solved problem I wish… Detecting text encoding is only easy if all you need to contend with is UTF16-with-BOM, UTF8-with-BOM, UTF8-without-BOM, and plain ASCII (which is effectively also UTF8). As soon as you might see UTF16 or UCS without a BOM, or 8-bit codepages other than plain ASCII (many apps/libs assume that these are…

The very fact that UTF-8 itself discouraged from using the BOM is just so alien to me. I understand they want it to be the last encoding and therefore not in need of a explicit indicator, but as it currently IS NOT the only encoding that is used, it makes is just so difficult to understand if I'm reading any of the weird ASCII derivatives or actual Unicode. It's maddening and it's frustrating. The US doesn't have any…

> The very fact that UTF-8 itself discouraged from using the BOM is just so alien to me.

Adding a BOM makes it incompatible with ASCII, which is one of the benefits of using UTF-8.

Re: Windows Notepad App Remote Code Execution Vulnerability

#528

Post by bigfatkitten »

vachina wrote: post #344
ThrowawayB7 wrote: post #297

Earlier quoted context omitted.

If I had to guess, the mandate to cram AI in everywhere came down from Nadella and the executive level with each level of management having KPIs for AI in their product all the way down. Much like the "everything has to be .NET even though nobody has any idea what .NET means" when it was first introduced and every MS product suddenly sprouted .NET at the end of their names. When executive management gives stupid non-…

AI is useful but these management type typically don’t know how to make it useful.

I’m all for AI integrated into applications where it makes sense; “remove background” buttons in image editors, for example, where the application uses AI to perform a useful function, without the user needing to care what happened under the hood.

Microsoft’s product managers however have no imagination, and so they insist on just mindlessly shoving obnoxious Copilot buttons everywhere.

Re: Windows Notepad App Remote Code Execution Vulnerability

#529

Post by keepamovin »

JasonADrury wrote: post #473
keepamovin wrote: post #67

Earlier quoted context omitted.

I couldn't agree more. A text editor exposing an attack surface via a network stack is precisely the kind of bloat that makes modern computing ultra-fragile. I actually built a "dumb" alternative in Rust last week specifically to escape this. It’s a local-only binary—no network permissions, encrypted at rest, and uses FIPS-compliant bindings (OpenSSL) just to keep the crypto boring and standard. It’s inspectable if y…

This is all vibecoded FWIW, I think it'd be cool if authors more proactively disclosed this.

What have you built lately?

Re: Windows Notepad App Remote Code Execution Vulnerability

#530

Post by MikePlacid »

abustamam wrote: post #477
NetMageSCW wrote: post #474

Earlier quoted context omitted.

That was old Notepad. This is new Notepad.

I think my comment still stands though. Why is "new" Notepad getting new features? It was perfect as it was.

Programmers and their managers need food. And other nice things.
Post reply on HN