Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Notepad++ hijacked by state-sponsored actors

notepad-plus-plus.org

Post reply on HN
Print view View original

221–230 of 560 posts

Re: Notepad++ hijacked by state-sponsored actors

#221

Post by arcfour »

Lammy wrote: post #204
arcfour wrote: post #189

Earlier quoted context omitted.

If the people with access to Room 641A want you, you're toast unless you're ready to make some REALLY big digital lifestyle changes that most people would not be amenable to, because you would have to be extremely paranoid on multiple fronts all the time. That kind of heightened vigilance is exhausting and really not worth it. Threat modeling: it keeps things realistic.

Sorry for assuming you'd be able to extrapolate from one example. It could be at any level of the funnel from your local machine to the wider Internet. Closer to home: this sort of fingerprinting could defeat things like MAC randomization in a PSK-authed business/university setting if those IT departments had some reason to want to track you. I once worked at a company where the Security team were very proud of this…

Ah, so, in addition to turning off automatic updates (everyone knows patches are for wimps! The real threat is supply chain compromise, not 1-days!), you also have taken all of the other necessary steps to protect yourself from the NSA? What if they just compel Microsoft to backdoor Windows/WinGet against you?

And these updaters almost universally use HTTPS, which network-based adversaries can't see except for SNI, and even that's going away...?

Re: Notepad++ hijacked by state-sponsored actors

#222

Post by jajuuka »

LoganDark wrote: post #81
stirfish wrote: post #67

Earlier quoted context omitted.

Sometimes when the politics deeply affects you, you just need a little break from it.

You can't take a break from that. I have transgender friends who fear for their life every day. They don't know what is going to happen to their rights or their healthcare. I have diabetic friends who can't work and also fear for their life because losing Medicaid would mean they will stop being able to afford insulin and will die . This is what people mean when they talk about politics being important. It's not just…

And if all you do all day is worry about someone else's or your own problems and politics you will not survive. Everyone has problems. Every single person has an issue that could cause them to die or a political event that could cause them harm. Your friends are not special or unique. There are billions of people who don't know if they will have food for their next meal, don't have money to pay rent, struggle with an addiction, etc.

It's okay to watch a show about knights and demons and enjoy it. It's okay to use a piece of software that doesn't code every release as a protest against something. Instead of judging other people for not burning out, maybe take a break yourself. It's okay and normal.

Re: Notepad++ hijacked by state-sponsored actors

#223

Post by chii »

ryandrake wrote: post #44
LoganDark wrote: post #33

Earlier quoted context omitted.

I can't help but feel there must some better venue for such messaging. When I see politics in software updates or documentation, nothing happens because I'm not looking to use the software for political activism. Maybe I tell my adblocker to remove the messaging, and carry on with my task. I can engage with politics in a social context, when political messaging isn't interrupting something else I'm doing; that's a be…

Similar comments also come up in the [now regular] "I don't want to see political articles on HN" threads, and I think the response is similar: Asking for "no politics" is itself a strong political view: One in support/service of whatever the current status quo is. Trying to set oneself apart from (or above) politics is itself political. If you're lucky enough to be one of the fortunate people on earth who are not un…

> One in support/service of whatever the current status quo is. Trying to set oneself apart from (or above) politics is itself political.

apparently, it's OK to have this stance of "if you're not with us, you're against us".

It's absolutely possible to not want political discussions in various places - it doesn't mean you support one or the other side. It simply means you don't want that discussion here. You could support the incumbents or not - not wanting the discussion does not imply support for the incumbents.

Re: Notepad++ hijacked by state-sponsored actors

#224

Post by surajrmal »

maxkfranz wrote: post #170
simlevesque wrote: post #3

Probably related to this: https://notepad-plus-plus.org/news/v869-about-taiwan/

Everyone is entitled to their opinions. My opinion is that open source documentation is like polite dinner conversation: It’s not the proper place to discuss politics. If an author wishes to use their open source project as a platform to discuss politics, that’s the author’s prerogative. But then, as perhaps in this instance, it could be to the detriment of the project itself.

This is a very head in the sand approach to life that only those who are entitled may partake in. Reality is that most cannot live in ignorance of what is happening around them because it is also happening to them. Obviously not everything needs to remind you of stressful reality, but we also shouldn't avoid reality just because we are privileged enough to do so.

Re: Notepad++ hijacked by state-sponsored actors

#225

Post by bsder »

esperent wrote: post #88
ryandrake wrote: post #44

Earlier quoted context omitted.

Similar comments also come up in the [now regular] "I don't want to see political articles on HN" threads, and I think the response is similar: Asking for "no politics" is itself a strong political view: One in support/service of whatever the current status quo is. Trying to set oneself apart from (or above) politics is itself political. If you're lucky enough to be one of the fortunate people on earth who are not un…

I partially agree, but as a non-US user of the English speaking internet, the issue is with specifically US politics and social issues being everywhere . It drowns out all attempts at discourse for anything else, and Americans, including people here, seem uniquely incapable of nuance in their thinking when it comes to politics. So, while I fully agree with your stance that banning political discourse is support for t…

> the issue is with specifically US politics and social issues being everywhere. It drowns out all attempts at discourse for anything else

Unfortunately, US politics also drives tech issues elsewhere like the EU. For example, local data control is a big thing that some of us have been screaming about forever but nobody paid attention to--until US politics made it a hot button issue.

And, to be honest, if the EU would get off its ass and at least try to foster some alternatives, even those of us in the US would benefit. EU alternatives would mean that people in the US could finally vote against the megajillionaires with their wallets.

> Americans, including people here, seem uniquely incapable of nuance in their thinking when it comes to politics.

Bullets and beatings don't leave much room for nuance regardless of country.

Re: Notepad++ hijacked by state-sponsored actors

#226

Post by the_fall »

dabinat wrote: post #216

> With these changes and reinforcements, I believe the situation has been fully resolved. Fingers crossed. I get that this is a difficult situation for a small developer, but ending with this line did not fill me with confidence that the problem is actually resolved and make me trust their software on my system.

That's the most honest assessment you can expect from any small-scale developer. What do you expect them to say or do? Their adversary is presumably a national intelligence agency of a superpower.

The odds may be better if you operate the way OpenSSH does: move slow, security first, architect everything to be very difficult to attack. But if you're building a text editor, it's not your mindset, and probably never will be.

Re: Notepad++ hijacked by state-sponsored actors

#228

Post by abeyer »

firesteelrain wrote: post #102
adzm wrote: post #71

Earlier quoted context omitted.

Code signing certs are unfortunately expensive

$700+ at Sectigo for two years Something of Notepad++ size might think about it now

"of Notepad++ size" is basically one guy in his free time, no?

Re: Notepad++ hijacked by state-sponsored actors

#229

Post by andyferris »

vjvjvjvjghv wrote: post #207
devkit1 wrote: post #169

Earlier quoted context omitted.

I am an American and I make a very conscious effort to appreciate social and political nuances. And I go out of my way to point out nuances to others who, in my opinion, oversimplify their statements. It could be argued that the expression of stereotyping Americans as lacking nuance, itself lacks nuance. I believe really most people are similar in that we have our biases, differences in context and experiences. We ca…

I think that the stereotype of Americans lacking nuance around political issue is valid. Obviously, like all stereotypes, it’s not 100% true but Americans seem to feel obliged to pick one side of an issue, most of the time aligned with the worth of their choice, and then to view everything that’s happening through that lens. Try to point out to a democrat that Trump is doing something right or to a Trump voter that B…

My personal take is this is a consequence of the two-party system. In the US you can "identify" as a democrat or republican. Once you do that, you don't _have_ to think, you can let tribalism guide you.

If in another country I vote for these guys or sometimes those other guys, and once this little party that got a seat, but not really those ones, and I really hate these ones, then your "political identity" already has a lot of nuance. In Australia with preferencial voting, a single vote has a lot of naunce.

What can you get in America? Green Party supportors who "strategically" vote for a democrat? Not much else...

Re: Notepad++ hijacked by state-sponsored actors

#230

Post by ozim »

hinkley wrote: post #193
edb_123 wrote: post #185

So, let me get this straight. If I've been lazy, postponed updates and I'm still on 8.5.8 (Oct 2023) - it turns out I'm actually...safer? Anyway, I hope the author can be a bit more specific about what actually has happened to those unlucky enough to have received these malicious updates. And perhaps a tool to e.g. do a checksum of all Notepad++ files, and compare them to the ones of a verified clean install of the u…

This reminds me of college, when some of my professors were still sorting out their curriculum and would give us homework assignments with bugs in it. I complained many times that they were enabling my innate procrastination by proving over and over again that starting the homework early meant you would get screwed. Every time I'd wait until the people in the forum started sounding optimistic before even looking at t…

For windows updates r/sysadmin has people who run updates and post their experience on patch Tuesday.
Post reply on HN