Is there a "detect infection and clean it up" app from a reputable source yet (beyond the "version 8.8.8 is bad" designator)?
Run MS Defender offline mode .
Notepad++ supply chain attack breakdown
121–130 of 205 posts
Re: Notepad++ supply chain attack breakdown
#122Earlier quoted context omitted.
I love a feature of notepad++ where when you have documents open and exit, it won't bother you with a save dialog and when you open it again the previous state will be there. I found that mousepad on linux can do this. For something functionality close I would look at Kate.
I love and hate it at the same time, just like my browser tabs hoarding, it means I currently have 218 open documents on Notepad++ (and 96 browser tabs). I might not even need them anymore, but it's always "I'll look at them... later".
For the browser you can use something like Session Buddy. Save the session and move on secure in the knowledge that the tabs are there IF you need them.
Re: Notepad++ supply chain attack breakdown
#123Earlier quoted context omitted.
The lack of a well-known, well-designed package manager for Windows has always been a problem. Too many programs, including FOSS programs, are downloaded from suspicious-looking websites with tons of ads, and every app updates itself in a different way. The crappy installation and update channels are often tightly integrated with the vendors' monetization strategies, so there's a huge amount of inertia. Microsoft Sto…
There are always Chocolatey and Scoop.
Why wouldn't those also become a target, if they would grow to be sizable?
And if they have prevention mechanisms, why can't existing supply chains be secured with similar prevention mechanisms, instead of funneling to a single package manager provider?
Re: Notepad++ supply chain attack breakdown
#124I am running a lot of tools inside sandbox now for exactly this reason. The damage is confined to the directory I'm running that tool in. There is no reason for a tool to implicitly access my mounted cloud drive directory and browser cookies data.
I almost feel like this should just be the default action for all applications. I don't need them to escape out of a defined root. It's almost like your documents and application are effectively locked together. You have to give permissions for an app to extra data from outside of the sandbox. Linux has this capability, of course. And it seems like MacOS prompts me a lot for "such and such application wants to access…
They tried. And the rent seekers made a huge noise against
Re: Notepad++ supply chain attack breakdown
#125I am running a lot of tools inside sandbox now for exactly this reason. The damage is confined to the directory I'm running that tool in. There is no reason for a tool to implicitly access my mounted cloud drive directory and browser cookies data.
MacOS has been getting a lot of flak recently for (correct) UI reasons, but I honestly feel like they're the closest to the money with granular app permissions. Linux people are very resistant to this, but the future is going to be sandboxed iOS style apps. Not because OS vendors want to control what apps do, but because users do. If the FOSS community continues to ignore proper security sandboxing and distribution o…
> Linux people are very resistant to this
Because security people often does not know the balance between security and usability, and we end up with software that is crippled and annoying to use.
Re: Notepad++ supply chain attack breakdown
#126Earlier quoted context omitted.
The lack of a well-known, well-designed package manager for Windows has always been a problem. Too many programs, including FOSS programs, are downloaded from suspicious-looking websites with tons of ads, and every app updates itself in a different way. The crappy installation and update channels are often tightly integrated with the vendors' monetization strategies, so there's a huge amount of inertia. Microsoft Sto…
Do you really need the entire walled garden of the store? It's not impervious just harder to attack but due to it's scale and value it will be constantly attacked. Not a great trade. What happened to just good old OS APIs? You could wrap the entire "secure update" process into a function call. Does Windows somehow not already have this?
Windows already has a built in updater for MSIX packages.
The Store uses that behind the scenes. You don't have to use the store to use the system update system.
It's particularly good because updates can happen in the background, without having to launch your app to trigger them.
Re: Notepad++ supply chain attack breakdown
#127Earlier quoted context omitted.
First three things I install on any machine - 7zip, Notepad++, alternate browser.
Yes, but I start with the browser. What are the Notepad++ alternatives on Linux and MacOS, for those times when I have to use them?
A lite (without node) version of Zed could be it.
Re: Notepad++ supply chain attack breakdown
#128Earlier quoted context omitted.
The lack of a well-known, well-designed package manager for Windows has always been a problem. Too many programs, including FOSS programs, are downloaded from suspicious-looking websites with tons of ads, and every app updates itself in a different way. The crappy installation and update channels are often tightly integrated with the vendors' monetization strategies, so there's a huge amount of inertia. Microsoft Sto…
There are always Chocolatey and Scoop.
These days there is Winget which I'd rather use than either of those.
Re: Notepad++ supply chain attack breakdown
#129I am running a lot of tools inside sandbox now for exactly this reason. The damage is confined to the directory I'm running that tool in. There is no reason for a tool to implicitly access my mounted cloud drive directory and browser cookies data.
MacOS has been getting a lot of flak recently for (correct) UI reasons, but I honestly feel like they're the closest to the money with granular app permissions. Linux people are very resistant to this, but the future is going to be sandboxed iOS style apps. Not because OS vendors want to control what apps do, but because users do. If the FOSS community continues to ignore proper security sandboxing and distribution o…
> Linux people are very resistant to this, but the future is going to be sandboxed iOS style apps.
Linux people are NOT resistant to this. Atomic desktops are picking up momentum and people are screaming for it. Snaps, flatpaks, appimages, etc. are all moving in that direction.
As for plain development, sadly, the OS developers are simply ignoring the people asking. See:
https://github.com/containers/toolbox/issues/183
https://github.com/containers/toolbox/issues/348
https://github.com/containers/toolbox/issues/1470
I'll leave it up to you to speculate why.
Perhaps getting a bit of black eye and some negative attention from the Great Orange Website(tm) can light a fire under some folks.
Re: Notepad++ supply chain attack breakdown
#130So if one were theoretically infected right now, would a Malwarebytes scan indicate as such?
OP post has an indicators of compromise list, also seen in
https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-...
I'm surprised this wasn't linked from the original notepad++ disclosure