Notepad++ supply chain attack breakdown

Post by kwanbix » Wed, Feb 04, 2026, 3:01 PM UTC

kijin wrote: post #86

Soerensen wrote: post #34

The WinGUp updater compromise is a textbook example of why update mechanisms are such high-value targets. Attackers get code execution on machines that specifically trust the update channel. What's concerning is the 6-month window. Supply chain attacks are difficult to detect because the malicious code runs with full user permissions from a "trusted" source. Most endpoint protection isn't designed to flag software fr…

The lack of a well-known, well-designed package manager for Windows has always been a problem. Too many programs, including FOSS programs, are downloaded from suspicious-looking websites with tons of ads, and every app updates itself in a different way. The crappy installation and update channels are often tightly integrated with the vendors' monetization strategies, so there's a huge amount of inertia. Microsoft Sto…

Post by SideburnsOfDoom » Wed, Feb 04, 2026, 3:15 PM UTC

pjmlp wrote: post #162

SideburnsOfDoom wrote: post #160

Earlier quoted context omitted.

> Notepad++ is one of my favourite editors Same, but there are 2 basic key features - tabs, and spell check. There are other nice-to-haves but these are the big ones. Notepad has those features too now. Notepad also has a *#&!$ CoPilot button, but at least you can still turn that off the in the settings.

You are missing what are actually relevant for me, syntax highlighting, tab completion, projects, and plugins. Notepad has nothing of that.

Post by w4rh4wk5 » Wed, Feb 04, 2026, 3:44 PM UTC

red_admiral wrote: post #148

kijin wrote: post #86

Earlier quoted context omitted.

The lack of a well-known, well-designed package manager for Windows has always been a problem. Too many programs, including FOSS programs, are downloaded from suspicious-looking websites with tons of ads, and every app updates itself in a different way. The crappy installation and update channels are often tightly integrated with the vendors' monetization strategies, so there's a huge amount of inertia. Microsoft Sto…

> Microsoft Store could have changed this situation Don't you need to create a Microsoft account to use it? That makes sense for a store where you buy apps with money, but not for a package manager for free software like Notepad++. P.S. I'm waiting for the day you need a registered Ubuntu account to use their snap store :(

Post by marxisttemp » Wed, Feb 04, 2026, 4:53 PM UTC

pjmlp wrote: post #162

SideburnsOfDoom wrote: post #160

Earlier quoted context omitted.

> Notepad++ is one of my favourite editors Same, but there are 2 basic key features - tabs, and spell check. There are other nice-to-haves but these are the big ones. Notepad has those features too now. Notepad also has a *#&!$ CoPilot button, but at least you can still turn that off the in the settings.

You are missing what are actually relevant for me, syntax highlighting, tab completion, projects, and plugins. Notepad has nothing of that.

Post by bsmith » Wed, Feb 04, 2026, 5:34 PM UTC

pjmlp wrote: post #162

SideburnsOfDoom wrote: post #160

Earlier quoted context omitted.

> Notepad++ is one of my favourite editors Same, but there are 2 basic key features - tabs, and spell check. There are other nice-to-haves but these are the big ones. Notepad has those features too now. Notepad also has a *#&!$ CoPilot button, but at least you can still turn that off the in the settings.

You are missing what are actually relevant for me, syntax highlighting, tab completion, projects, and plugins. Notepad has nothing of that.