Live data from Hacker News

Notepad++ hijacked by state-sponsored actors

notepad-plus-plus.org

201–210 of 560 posts

Re: Notepad++ hijacked by state-sponsored actors

#201

Earlier quoted context omitted.

Disable auto-updates, just like you should with every piece of software on your machine. This was the result of letting other people silently replace your programs. Don't allow that.

that's why I still run Windows XP. Automatic updates are dangerous!

How's Windows 11 treating you, my man?

Re: Notepad++ hijacked by state-sponsored actors

#202

Earlier quoted context omitted.

Similar comments also come up in the [now regular] "I don't want to see political articles on HN" threads, and I think the response is similar: Asking for "no politics" is itself a strong political view: One in support/service of whatever the current status quo is. Trying to set oneself apart from (or above) politics is itself political. If you're lucky enough to be one of the fortunate people on earth who are not un…

Nah, it doesn't mean they support the status quo. It just means some political tactics are pointless, incompetent, and counterproductive. Political opinions about how things should be don't automatically dictate the actions that should be taken in support of those opinions. I can be mad about a law or a court decision and still have the good sense to, for example, not throw red paint on a lawmaker or judge. Some beha…

[deleted]

Re: Notepad++ hijacked by state-sponsored actors

#203

Earlier quoted context omitted.

I can't help but feel there must some better venue for such messaging. When I see politics in software updates or documentation, nothing happens because I'm not looking to use the software for political activism. Maybe I tell my adblocker to remove the messaging, and carry on with my task. I can engage with politics in a social context, when political messaging isn't interrupting something else I'm doing; that's a be…

Similar comments also come up in the [now regular] "I don't want to see political articles on HN" threads, and I think the response is similar: Asking for "no politics" is itself a strong political view: One in support/service of whatever the current status quo is. Trying to set oneself apart from (or above) politics is itself political. If you're lucky enough to be one of the fortunate people on earth who are not un…

[deleted]

Re: Notepad++ hijacked by state-sponsored actors

#204
post #182

Vindicated once again for turning off any update checks the moment I install any new piece of software. Even if this sort of (obviously rare) attack is not a concern, it baffles me how few otherwise-intelligent people fail to see the way these updaters provide the network (which itself is always listening, see Room 641A and friends) with a fingerprint of your specific computer and a way to track its physical location…

If the people with access to Room 641A want you, you're toast unless you're ready to make some REALLY big digital lifestyle changes that most people would not be amenable to, because you would have to be extremely paranoid on multiple fronts all the time. That kind of heightened vigilance is exhausting and really not worth it. Threat modeling: it keeps things realistic.

Sorry for assuming you'd be able to extrapolate from one example. It could be at any level of the funnel from your local machine to the wider Internet. Closer to home: this sort of fingerprinting could defeat things like MAC randomization in a PSK-authed business/university setting if those IT departments had some reason to want to track you.

I once worked at a company where the Security team were very proud of this and all the other tricks they used to catch leakers by figuring out who was on campus, where, at what time, usually via fingerprinting personal devices carried alongside corporate devices.

Re: Notepad++ hijacked by state-sponsored actors

#205

Earlier quoted context omitted.

This take is completely blind to how sciences has worked throughout history of humanity and specifically post major world wars. Additionally, it is based on a false notion that political banners in software helps in pursuing anyone let alone change political outcomes.

Science has absolutely engaged in the politics du jour, including in major world wars. See, for example, the Szilárd petition[1]. (If you need a post-WWII example, those same scientists continued petitioning after the war on the dangers of nukes, too.) Further, political banners in software have absolute helped, and have changed political outcomes. As an example of that, SOPA, and later PIPA, were defeated by website…

A petition and including your political opinions whenever you engage in your trade or profession is not the same.

This is the entire point and objection with politicisation of everything.

Re: Notepad++ hijacked by state-sponsored actors

#206
post #162

why does this read like it was written by a state-sponsored actor

The thought crossed my mind as well. Lots of typos, plus "old version compromised, use new version ASAP" could also be said to get people on a newly compromised version, right? Though it's probably just that the post author is stressed and rushed the post out. I do wonder if there's a way to verify the post was written by the real dev and that he still has control. Old known GPG sig?

Posted with the new version not even out yet?

Re: Notepad++ hijacked by state-sponsored actors

#207

Earlier quoted context omitted.

I partially agree, but as a non-US user of the English speaking internet, the issue is with specifically US politics and social issues being everywhere . It drowns out all attempts at discourse for anything else, and Americans, including people here, seem uniquely incapable of nuance in their thinking when it comes to politics. So, while I fully agree with your stance that banning political discourse is support for t…

I am an American and I make a very conscious effort to appreciate social and political nuances. And I go out of my way to point out nuances to others who, in my opinion, oversimplify their statements. It could be argued that the expression of stereotyping Americans as lacking nuance, itself lacks nuance. I believe really most people are similar in that we have our biases, differences in context and experiences. We ca…

I think that the stereotype of Americans lacking nuance around political issue is valid. Obviously, like all stereotypes, it’s not 100% true but Americans seem to feel obliged to pick one side of an issue, most of the time aligned with the worth of their choice, and then to view everything that’s happening through that lens.

Try to point out to a democrat that Trump is doing something right or to a Trump voter that Biden did something right. Most of them can’t accept that. The “other” side has to all bad. I don’t see this to such an extreme in other countries I know like Germany or Spain.

Re: Notepad++ hijacked by state-sponsored actors

#208

Earlier quoted context omitted.

I partially agree, but as a non-US user of the English speaking internet, the issue is with specifically US politics and social issues being everywhere . It drowns out all attempts at discourse for anything else, and Americans, including people here, seem uniquely incapable of nuance in their thinking when it comes to politics. So, while I fully agree with your stance that banning political discourse is support for t…

This is a good point. What would people think if there was constant political discussion here about, for instance, South Sudan and things happening there now? I'm sure there's bad stuff going on there and it's unfortunately, but if we had constant references to and discussions about the internal politics of South Sudan, I think a lot of people would get annoyed about issues that don't affect them at all in their day-…

Do you think it's socially acceptable to ignore everything that doesn't affect you personally? Many activists would certainly have you think otherwise. As far as I can tell, fighting that habit is a huge goal of activism.

Re: Notepad++ hijacked by state-sponsored actors

#209

Earlier quoted context omitted.

If you think large companies are somehow immune to this, you’re gonna have a bad time.

It's not a matter of "immune" - larger organizations generally have more resources to allocate to things like this. That doesn't mean they get it right 100% of the time, but they are at least able to try, while small teams or volunteer projects often simply don't have the hours to spend on things like this.

I've sat in some pretty large orgs and my own experience was the "resources allocated" went to the PR team. I can assure you that they would have had a more boring, corporate sounding announcement with multiple references to their legal team and the actions they would have taken, alongside some useless information about being PCI compliant or something. I'm not convinced the practical output is any better.

Re: Notepad++ hijacked by state-sponsored actors

#210

Earlier quoted context omitted.

Maybe, but telling people who are speaking to their audience on the platforms that audience is voluntarily visiting that they need to shut up is even more pointless, incompetent, and counterproductive . Notepad++ is free, open source software for which there are dozens of alternative packages of equivalent quality. The entire cost of using this software and benefiting from the work of the developer, is having to scro…

Notepad++ maintainers can do whatever they want. I don't care. I'm just taking apart this tedious, superficial, self-serving activist cliche about how not being an activist is supporting the status quo. Some people want change just as much as activists do, but they have different ideas about when and how it's helpful to be an activist.

It's ok for you to have a different opinion. I'm sure both views are well reasoned. Neither one is "wrong".
Post reply on HN