Earlier quoted context omitted.
You are missing what are actually relevant for me, syntax highlighting, tab completion, projects, and plugins. Notepad has nothing of that.
Don't forget regex!
Yeah, that is also quite good.
Notepad++ supply chain attack breakdown
171–180 of 205 posts
Re: Notepad++ supply chain attack breakdown
#172I am running a lot of tools inside sandbox now for exactly this reason. The damage is confined to the directory I'm running that tool in. There is no reason for a tool to implicitly access my mounted cloud drive directory and browser cookies data.
MacOS has been getting a lot of flak recently for (correct) UI reasons, but I honestly feel like they're the closest to the money with granular app permissions. Linux people are very resistant to this, but the future is going to be sandboxed iOS style apps. Not because OS vendors want to control what apps do, but because users do. If the FOSS community continues to ignore proper security sandboxing and distribution o…
It's truly perverse that, at the same time that desktop systems are trying to lock down what trusted, conventional native apps can and cannot do and/or access, you have the Chrome team pushing out proposals to expand what browsers allow websites to do to the user's file system, like silently/arbitrarily reading and writing to the user's disk—gated only behind a "Are you sure you want to allow this? Y/N"-style dialog that, for extremely good reasons, anyone with any sense about design and interaction has strongly opposed for the last 20+ years.
Re: Notepad++ supply chain attack breakdown
#173Earlier quoted context omitted.
The thing is that I trust the Debian maintainers, so I use dpkg to install my software. I do not trust Microsoft, so I use the browser to install software.
If you trust Microsoft enough to run their operating system, you trust them enough to develop a package manager. Suppose, for example, that they caught up to where Debian was 30 years ago and Windows shipped with a default list of sources for the core OS to which you could add your internal or preferred partners (e.g. Adobe in many companies). Literally millions of systems wouldn’t have been compromised because they…
> If you trust Microsoft enough to run their operating system, you trust them enough to develop a package manager.
Yeah enough to run MS Windows in a VM, with services that mess with Windows Update and modified Group Policy.
I do install as most things as possible with the MSYS2 package manager.
> Suppose, for example, that they caught up to where Debian was 30 years ago and Windows shipped with a default list of sources for the core OS to which you could add your internal or preferred partners (e.g. Adobe in many companies). Literally millions of systems wouldn’t have been compromised because they had unpatched apps. If they’d had a curated list of responsible vendors, multiple generations of people wouldn’t have been trained that it’s normal to run installers because a web page told you so.
The issue is that Microsoft is already forcing a lot on its "users", if only installing things from the OS store becomes commonplace, then I think MS Windows will end up like iOS and that is way worse (for me).
Re: Notepad++ supply chain attack breakdown
#174Shouldn't public signature of the hash of the exe file from a known key before execution fix this??? What am I missing?
Re: Notepad++ supply chain attack breakdown
#175Earlier quoted context omitted.
I imagine that it depends on the use case. Using notepad++ (or whatever other program) in a manner that deals with internet content a lot - then updating is the thing. Using these tools in a trusted space (local files/network only) : then don't update unless it needs to be different to do what you want. For many people, something in between because new files/network-tech comes and goes from the internet. So, update o…
>Using notepad++ (or whatever other program) in a manner that deals with internet content a lot - then updating is the thing. Disagree. It's hard to screw up a text editor so much that you have buffer overflows 10 years after it's released, so it's probably safe. It's not impossible, but based on a quick search (though incomplete because google is filled with articles describing this incident) it doesn't look like th…
I agree with you regarding particular exploits by arbitrary input files against Notepad++ in particular.
I was trying - poorly it seems - to make a more general point regarding exposure to the internet and across "whatever other program" too. Something like 7-zip, VLC, syncthing, whatever other open source tools you may like, and how you use it exposing you to possibility of attack.
IE you are interacting with "the wild west of the internet" then the balance of update/not-update shifts more towards update. But if not, then the balance shifts to not-update.
But you are correct that either way it depends on the program in particular.
Re: Notepad++ supply chain attack breakdown
#176I am running a lot of tools inside sandbox now for exactly this reason. The damage is confined to the directory I'm running that tool in. There is no reason for a tool to implicitly access my mounted cloud drive directory and browser cookies data.
MacOS has been getting a lot of flak recently for (correct) UI reasons, but I honestly feel like they're the closest to the money with granular app permissions. Linux people are very resistant to this, but the future is going to be sandboxed iOS style apps. Not because OS vendors want to control what apps do, but because users do. If the FOSS community continues to ignore proper security sandboxing and distribution o…
Flatpak
Re: Notepad++ supply chain attack breakdown
#177Why a simple text editor requires auto-updates at all?
Because Windows users don't have basic package management that anyone can use and they probably got tired of idiots getting malware trying to Google random Notepad++ binaries. It's turtles all the way down.
Re: Notepad++ supply chain attack breakdown
#178Earlier quoted context omitted.
Well, try again. I just managed to copy a random .exe to C:\Windows\System32 using an administrator account. I got a typical UAC dialog that most people would blindly click "Continue" on, and the copy succeeded. :)
And you likely have protected folders and certainly s mode disabled
It's a testing box, sure, but a lot of people have the same setting, usually because of some legacy app that requires it.
It does contradict your insistence that Windows would never allow such things. An exploit doesn't need to do its thing silently in order to be effective. If a security apparatus can be bypassed by tricking a user to flip a switch, it WILL be bypassed. Heck, just trying to install or update Notepad++ throws up a UAC dialog. Who would suspect anything?
Re: Notepad++ supply chain attack breakdown
#179Earlier quoted context omitted.
The lack of a well-known, well-designed package manager for Windows has always been a problem. Too many programs, including FOSS programs, are downloaded from suspicious-looking websites with tons of ads, and every app updates itself in a different way. The crappy installation and update channels are often tightly integrated with the vendors' monetization strategies, so there's a huge amount of inertia. Microsoft Sto…
Honest question. Are you telling me this has never happened to Linux? I seem to recall a situation where the source code was compromised. But maybe I am wrong.
Happened to Linux Mint, famously: https://www.bitdefender.com/en-us/blog/hotforsecurity/tamper...
Re: Notepad++ supply chain attack breakdown
#180This is the nudge I needed to stop using VSCodium completely. (No offense to its devs, mind you, who seem to much better have their act together.)