Notepad++ supply chain attack breakdown

Post by int_19h » Thu, Feb 05, 2026, 5:08 AM UTC

troad wrote: post #85

hibikir wrote: post #81

Earlier quoted context omitted.

Yet we look at phones, and we see people accepting outrageous permissions for many apps: They might rely on snooping into you for ads, or anything else, and yet the apps sell, and have no problem staying in stores. So when it's all said and done, I do not expect practical levels of actual isolation to be that great.

> Yet we look at phones, and we see people accepting outrageous permissions for many apps The data doesn't support the suggestion that this is happening on any mass scale. When Apple made app tracking opt-in rather than opt-out in iOS 14 ("App Tracking Transparency"), 80-90% of users refused to give consent. It does happen more when users are tricked (dare I say unlawfully defrauded?) into accepting, such as when ins…

Post by ddtaylor » Thu, Feb 05, 2026, 6:14 AM UTC

Panzerschrek wrote: post #182

ddtaylor wrote: post #177

Earlier quoted context omitted.

Because Windows users don't have basic package management that anyone can use and they probably got tired of idiots getting malware trying to Google random Notepad++ binaries. It's turtles all the way down.

This not answers my question. I just don't see any necessity to update an editor like Notepad++ at all. Such programs are usually stable and there is no need to add new features constantly. Even security vulnerabilities don't matter much, since a text editor isn't that critical piece of software. My Notepad++ installation, for example, is 5 years old and it's fine for me.

Post by stby » Thu, Feb 05, 2026, 11:22 AM UTC

ziml77 wrote: post #93

kijin wrote: post #86

Earlier quoted context omitted.

The lack of a well-known, well-designed package manager for Windows has always been a problem. Too many programs, including FOSS programs, are downloaded from suspicious-looking websites with tons of ads, and every app updates itself in a different way. The crappy installation and update channels are often tightly integrated with the vendors' monetization strategies, so there's a huge amount of inertia. Microsoft Sto…

The Microsoft store would have needed proper vetting and support for normal desktop apps from day 1 for it to actually have been a good option. Also, not requiring the system be set up with an online account would have been helpful for adoption. I can't say it would have guaranteed people would have liked it, just that those were needed for it to have a chance.

Post by DANmode » Thu, Feb 05, 2026, 4:42 PM UTC

_zagj wrote: post #180

This is the nudge I needed to stop using VSCodium completely. (No offense to its devs, mind you, who seem to much better have their act together.)

Post by the_harpia_io » Thu, Feb 05, 2026, 5:05 PM UTC

112233 wrote: post #156

the_harpia_io wrote: post #151

[flagged]

> increasingly trust code they haven't personally reviewed while the problems you describe are valid, my personal experience is fully opposite — trust is decreasing. I do not remember anyone worrying about supply chain 15ish years ago — windows was where the viruses lived, and unix people were installing distros, compiling kernel modules and building tarballs without auditing anything.