Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Notepad++ hijacked by state-sponsored actors

notepad-plus-plus.org

Post reply on HN
Print view View original

251–260 of 560 posts

Re: Notepad++ hijacked by state-sponsored actors

#251

Post by Lammy »

arcfour wrote: post #221
Lammy wrote: post #204

Earlier quoted context omitted.

Sorry for assuming you'd be able to extrapolate from one example. It could be at any level of the funnel from your local machine to the wider Internet. Closer to home: this sort of fingerprinting could defeat things like MAC randomization in a PSK-authed business/university setting if those IT departments had some reason to want to track you. I once worked at a company where the Security team were very proud of this…

Ah, so, in addition to turning off automatic updates (everyone knows patches are for wimps! The real threat is supply chain compromise, not 1-days!), you also have taken all of the other necessary steps to protect yourself from the NSA? What if they just compel Microsoft to backdoor Windows/WinGet against you? And these updaters almost universally use HTTPS, which network-based adversaries can't see except for SNI, a…

> What if they just compel Microsoft to backdoor Windows/WinGet against you?

You are confusing cause with effect. Leaking this type of fingerprint data over time is what allows users of Palantir-like systems to decide you're somebody worth individually targeting.

Re: Notepad++ hijacked by state-sponsored actors

#252

Post by leosarev »

mmsc wrote: post #239
LoganDark wrote: post #33

Earlier quoted context omitted.

I can't help but feel there must some better venue for such messaging. When I see politics in software updates or documentation, nothing happens because I'm not looking to use the software for political activism. Maybe I tell my adblocker to remove the messaging, and carry on with my task. I can engage with politics in a social context, when political messaging isn't interrupting something else I'm doing; that's a be…

If the political messages said "gas the Jews", "exterminate the Ukrainians and give Ukraine to Russia", and "Taiwan has and always will be a province of china", you probably wouldn't use notepad++.

> Taiwan has and always will be a province of china

You know that's official position of 99% countries in the world, including all superpowers and every NATO member?

Re: Notepad++ hijacked by state-sponsored actors

#253

Post by mshroyer »

ryandrake wrote: post #44
LoganDark wrote: post #33

Earlier quoted context omitted.

I can't help but feel there must some better venue for such messaging. When I see politics in software updates or documentation, nothing happens because I'm not looking to use the software for political activism. Maybe I tell my adblocker to remove the messaging, and carry on with my task. I can engage with politics in a social context, when political messaging isn't interrupting something else I'm doing; that's a be…

Similar comments also come up in the [now regular] "I don't want to see political articles on HN" threads, and I think the response is similar: Asking for "no politics" is itself a strong political view: One in support/service of whatever the current status quo is. Trying to set oneself apart from (or above) politics is itself political. If you're lucky enough to be one of the fortunate people on earth who are not un…

> Asking for "no politics" is itself a strong political view

No, it explicitly is not, and this "deepity" doesn't change any rational analysis. The injection of politics into every aspect of society must and should be refused.

Re: Notepad++ hijacked by state-sponsored actors

#254

Post by m-schuetz »

xeromal wrote: post #233
the_fall wrote: post #226

Earlier quoted context omitted.

That's the most honest assessment you can expect from any small-scale developer. What do you expect them to say or do? Their adversary is presumably a national intelligence agency of a superpower . The odds may be better if you operate the way OpenSSH does: move slow, security first, architect everything to be very difficult to attack. But if you're building a text editor, it's not your mindset, and probably never wi…

Yup, the only way to combat this as a smalltime dev would be to turn off auto updates and make people build from source.

Why woul building from source be safer? Are you veting every single line of third-party source code you compile and use?

Re: Notepad++ hijacked by state-sponsored actors

#255

Post by leosarev »

FormerBandmate wrote: post #237
kvemkon wrote: post #129

Earlier quoted context omitted.

> would such free protest be allowed if the developers of Notepad++ were based in - US arguing for independence of any of the States for whatever reasons? - Spain for Catalonia? - France for Basque? and many more just in Europe. https://en.wikipedia.org/wiki/List_of_active_separatist_move...

You can totally say Texas should be independent. A lot of Texans have. You can’t be against the Ukraine war in Russia because Putin is an evil dictator

I'm writing this comment from Russia, St. Petersburg, and yes, you can be against the Ukraine war in Russia.

Re: Notepad++ hijacked by state-sponsored actors

#256

Post by mckn1ght »

jajuuka wrote: post #231
cespare wrote: post #187

Earlier quoted context omitted.

Skirt too short, in other words? I'm going to place the blame on the party committing the crimes, not the person exercising free expression.

This is a zero sum take. There are no winners, only the people you deem using free expression correctly. Would a developer who names releases like "Ukrainians are nazi's" or "Taiwan is China" be met with this same sympathy? Or would you brush them off as a mouthpiece for those governments? I'm thinking it's the latter. Free expression is rarely anything other than socially acceptable expression.

IMO the ethical response should be positive disengagement with entities with which you disagree, instead of negative engagement.

See something in the release notes of an app you don’t like? Go use a different app, give your money to a different entity. Don’t spend your time and resources messing with the producer or user of the thing you don’t like.

This of course runs the risk of maximal polarization once everyone has filtered themselves into their neat and tidy little bubbles. What happens then, everybody leaves each other alone? Or do the echo chambers slide into further radicalized detachment from each other?

Re: Notepad++ hijacked by state-sponsored actors

#257

Post by somenameforme »

uhx wrote: post #215
chvid wrote: post #168

Earlier quoted context omitted.

“ The incident began from June 2025. Multiple independaent security researchers have assessed that the threat acotor is likely a Chinese state-sponsored group, which would explain the highly selective targeting obseved during the campaign.” How do they know it was a Chinese group or even a state sponsored one?

By analyzing payloads / C2 address, etc...

Yeah because a state level actor would be completely incapable of false attribution.

Re: Notepad++ hijacked by state-sponsored actors

#258

Post by zeroq »

I've been thinking a lot lately about open source.

It seems to be a lot like the communism - sounds great on paper but we are yet to see a proper implementation.

Between GIT, Linux and SQLite there are a few projects that has been led by weirdos that have time, resources and conviction to drive these through time.

Unless you create some sort of a an auxiliary business and get an acquihire deal most things will fizzle out.

Years ago when I started working for BigCo I was amazed by their denial of FOSS. At one point in the project I pointed out a problem, which was heard and recognized, to which I followed up with a solution using an open source package. I thought I was clever - we needed an extra package in our system, but I was able to find a suitable open source solution that would not add to the overall cost of the project. My proposal was immediately pushed back.

Initially I thought it was due to responsibility issue - if we'd employ a FOSS solution we'd be responsible for the outcome. Having a 3rd party vendor the management would have the opportunity to shell themselves.

But that doesn't have to be the case. The FOSS project could easily fizzle out. And if we don't have enough resources to incorporate it and make it our own, we can potentially risk being left out to dry.

Re: Notepad++ hijacked by state-sponsored actors

#259

Post by tjwebbnorfolk »

anonymous908213 wrote: post #250
tjwebbnorfolk wrote: post #241

Earlier quoted context omitted.

Not wanting politics crammed into every nook and cranny of daily life is not a "political" view of one kind or another, it's a preference for how I want to consume information and interact with people. There is such a thing as being able to act and think in ways that aren't political in nature. Maybe not for you, but it absolutely is possible.

Way to completely and totally miss the point. I don't actually think you could've missed the point any harder than you did. Politics are quite literally life-or-death for many people. War is politics. Access to healthcare is politics. Economic policy that determines whether businesses and careers succeed or fail is politics. Freedom to say what you want, believe or not believe in whatever religion you want, and be wh…

That you seem to believe politics exists to solve people's problems is probably the reason you feel it is so important. I'm sorry that you are so profoundly confused.
Post reply on HN