[flagged]
Notepad++ supply chain attack breakdown
151–160 of 205 posts
Re: Notepad++ supply chain attack breakdown
#152Earlier quoted context omitted.
The lack of a well-known, well-designed package manager for Windows has always been a problem. Too many programs, including FOSS programs, are downloaded from suspicious-looking websites with tons of ads, and every app updates itself in a different way. The crappy installation and update channels are often tightly integrated with the vendors' monetization strategies, so there's a huge amount of inertia. Microsoft Sto…
The stupid thing is that a packaging system - MSI and later MSIX - has existed for a long time. But the tooling for it, to put things into packages, is a mess; nor is there a single tool even for Microsoft's own stuff. They really need to get onto dogfooding this stuff. But then, in an environment dominated by corporate IT who have no real means of switching, why improve the product?
The thing is that I trust the Debian maintainers, so I use dpkg to install my software. I do not trust Microsoft, so I use the browser to install software.
Re: Notepad++ supply chain attack breakdown
#153Earlier quoted context omitted.
First three things I install on any machine - 7zip, Notepad++, alternate browser.
Yes, but I start with the browser. What are the Notepad++ alternatives on Linux and MacOS, for those times when I have to use them?
These kind of editors are typically already installed. Pluma, Kate, Emacs, Vi... If anything there is still nano.
And of course “Ed is the standard text editor.”
Re: Notepad++ supply chain attack breakdown
#154Earlier quoted context omitted.
Many apps require unnecessarily broad permissions with Flatpak. Unlike Android and iOS apps they weren't designed for environments with limited permissions.
> Unlike Android My experience with android apps seems to be different. Every other app seems to be asking for contacts or calling or access to files.
You can usually deny those. If they ask for them without a good reason, that's already suspicious.
Re: Notepad++ supply chain attack breakdown
#155Earlier quoted context omitted.
The stupid thing is that a packaging system - MSI and later MSIX - has existed for a long time. But the tooling for it, to put things into packages, is a mess; nor is there a single tool even for Microsoft's own stuff. They really need to get onto dogfooding this stuff. But then, in an environment dominated by corporate IT who have no real means of switching, why improve the product?
The thing is that I trust the Debian maintainers, so I use dpkg to install my software. I do not trust Microsoft, so I use the browser to install software.
If you trust Microsoft enough to run their operating system, you trust them enough to develop a package manager.
Suppose, for example, that they caught up to where Debian was 30 years ago and Windows shipped with a default list of sources for the core OS to which you could add your internal or preferred partners (e.g. Adobe in many companies). Literally millions of systems wouldn’t have been compromised because they had unpatched apps. If they’d had a curated list of responsible vendors, multiple generations of people wouldn’t have been trained that it’s normal to run installers because a web page told you so.
Re: Notepad++ supply chain attack breakdown
#156[flagged]
> increasingly trust code they haven't personally reviewed
while the problems you describe are valid, my personal experience is fully opposite — trust is decreasing. I do not remember anyone worrying about supply chain 15ish years ago — windows was where the viruses lived, and unix people were installing distros, compiling kernel modules and building tarballs without auditing anything.
Re: Notepad++ supply chain attack breakdown
#157Earlier quoted context omitted.
The lack of a well-known, well-designed package manager for Windows has always been a problem. Too many programs, including FOSS programs, are downloaded from suspicious-looking websites with tons of ads, and every app updates itself in a different way. The crappy installation and update channels are often tightly integrated with the vendors' monetization strategies, so there's a huge amount of inertia. Microsoft Sto…
Do you really need the entire walled garden of the store? It's not impervious just harder to attack but due to it's scale and value it will be constantly attacked. Not a great trade. What happened to just good old OS APIs? You could wrap the entire "secure update" process into a function call. Does Windows somehow not already have this?
The value of the store is curation: if the random scammers who put up “Totally Acrobat PDF” websites can’t get listed, it’s safer for people who aren’t security experts to trust the installer isn’t blatant malware.
The problem is that this needs strong regulation to prevent it from turning into a payola marketing scam where vendors have to pay for placement.
Re: Notepad++ supply chain attack breakdown
#158Re: Notepad++ supply chain attack breakdown
#159[flagged]
> developers and users increasingly trust code they haven't personally reviewed.
This has been true since we left the era where you typed the program in each time you ran it. Ken Thompson rather famously wrote about this four decades ago: https://www.cs.umass.edu/~emery/classes/cmpsci691st/readings...
Sandboxing certainly helps but it’s not a panacea: for example, Notepad++ is exactly the kind of utility people would grant access to edit system files and they would have trusted the updater, too.
Re: Notepad++ supply chain attack breakdown
#160Notepad++ is one of my favourite editors, now it is forbidden by IT and checked for on security compliance checks if still installed, thanks to this attack.
> Notepad++ is one of my favourite editors
Same, but there are 2 basic key features - tabs, and spell check. There are other nice-to-haves but these are the big ones.
Notepad has those features too now.
Notepad also has a *#&!$ CoPilot button, but at least you can still turn that off the in the settings.