Earlier quoted context omitted.
Microsoft is driving AI adoption. Why blame tge workers for this?
Why can't Indian software developers stand up for themselves and say no?
[deleted]
Windows Notepad App Remote Code Execution Vulnerability
261–270 of 538 posts
Re: Windows Notepad App Remote Code Execution Vulnerability
#262Earlier quoted context omitted.
I explicitly stopped this habit so that I don't accidentally do it with sensitive data I don't want to go to my search engine provider's auto complete API.
Disabling remote search autocomplete is one of the first things I do when I setup a new browser instance. It's a privacy and security nightmare I don't want.
Same here. And I just noticed yesterday that Firefox had added and enabled a "Suggestions from sponsors" feature. Which I've now disabled, but presumably it's been sending anything I type into the address bar to Mozilla since 2021. I am tired of Mozilla but Chrome is very much worse.
ETA: I only noticed yesterday because a "sponsored suggestion" popped up when I was typing, which I've not seen before. So either they actually enabled it recently, or advertisers don't bid on the kinds of things I usually type.
Re: Windows Notepad App Remote Code Execution Vulnerability
#263Notepad had one job... Seems like bringing markdown features killed it :)
Something felt off about your comments, so I checked your account. You signed up almost six years ago, and in all that time made zero submissions and your only comments are these two on this thread? I’ve been seeing this more and more on HN. What exactly is going on here?
HN is a psy-op.
Re: Windows Notepad App Remote Code Execution Vulnerability
#264Earlier quoted context omitted.
Because there are plenty of developers who'll say yes, so anyone saying no is putting their ethics ahead of their livelihood. Few people will be willing to put their beliefs ahead of providing for their family. It's easy to say you will, and very hard to actually do it.
That's what ethics are. If you don't make sacrifices for them they aren't ethics they're just conveniences.
This is easy to say until you're an immigrant worker in a foreign country - something one probably worked for their entire life up to that point - risking it all (and potentially wrecking the life of their entire family) just to stop some random utility from having a Copilot button. It's not "this software will be used to kill people", it's more like "there's this extra toolbar which nobody uses".
In life you have to choose your battles.
Re: Windows Notepad App Remote Code Execution Vulnerability
#265We have officially reached the logical conclusion of the feature-bloat-to-vulnerability pipeline. For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text. An 8.8 CVSS on a utility meant for viewing data is a fundamental failure of the principle of least privilege. At some point, they need to stop aski…
EDIT: THE OLD NOTEPAD IS STILL IN WINDOWS AND WE CAN USE IT! https://learn.microsoft.com/en-us/answers/questions/3845356/... You basically have to find the "execution alias" setting and disable notepad and you get the ole reliable :D OLD POST: This has hurt me specifically. Since I work without IDEs, no VIM, no vs code. On linux I use nano, on windows I use Notepad. I like the minimalism and the fact that I have abso…
There's still old tiny Metapad. And also more modern and fully featured (but still light) Notepad 2/3/4 and Notepad++.
For full replacement, i just renamed all instances to notepad.exe.bak, back then on Windows 7 & 10, and rename-replaced it with metapad.exe. Though, i guess with UWP apps (modern Notepad is one), it's just file associations nowadays. There's surely some mass-reassociate utility around?
Btw, nano is only 50/50 chance that's it's pre-installed. Learn some vim, will ya? ;)
Re: Windows Notepad App Remote Code Execution Vulnerability
#266Earlier quoted context omitted.
We have reached peak software stability, it's all gonna be downhill from here.
Peak software stability was Windows 7, that's why it's still used in industrial environments.
Funny how back then people claimed peak stability was Windows 2000. 10 years from now people will look at Windows 10 and claim that was peak stability.
Re: Windows Notepad App Remote Code Execution Vulnerability
#267I found a copy of the win98 (I believe) notepad.exe a while back, and it works perfectly on windows 11 (though the "about notepad" dialog shows the windows 11 version for some reason??). I can write text into it, save it, and load text again. What more does notepad need? And it has a very nostalgic font too
If you go that far, metapad (from 98) is still better than notepad ever was. Also loads 100k lines files quickly.
Re: Windows Notepad App Remote Code Execution Vulnerability
#268Earlier quoted context omitted.
> to get Excel to correctly load a UTF8 encoded CSV or similar you must include the BOM Ah so that’s the trick! I’ve run into this problem a bunch of times in the wild, where some script emits csv which works on the developers machine but fails strangely with real world data. Good to know there’s a simple solution. I hope I remember your comment next time I see this!
Excel CSV is broken anyway, since in some (EU, ...) countries it needs ; as separator.
A lot of the time when people say CSV they mean “character separated values” rather than specifically “comma separated values”.
In the text files we get from clients we sometimes see tab used instead of comma, or pipe. I don't think we've seen semicolon yet, though our standard file interpreter would quietly cope¹ as long as there is nothing really odd in the header row.
--------
[1] it uses the heuristic “the most common non-alpha-numeric non-space non-quote character found in the header row” to detect the separator used if it isn't explicitly told what to expect
Re: Windows Notepad App Remote Code Execution Vulnerability
#269Earlier quoted context omitted.
Why does my text-editor need to do "encryption at rest"? If I want data encrypted, I store it in an encrypted drive with a transparent en/decryption layer.
That is completely valid for personal threat models, I rely on LUKS/BitLocker for my daily driver too. The specific gap this fills is 'Defense in Depth' + compliance. OS-level encryption (like FDE) is transparent once you log in. If you walk away from an unlocked machine, FDE does nothing. App-level encryption, however, ensures the specific sensitive notes remain encrypted on disk even while the OS is running and the…
> If you walk away from an unlocked machine
...then I might as well ask what happens when I walk away from the encrypting edior while a file is still open. User Error can happen with any encryption or security schema. Pointing out a trueism is not an argument.
> It's also portable
So is encrypting files using a specialized tool. I don't need my editor to do this. The entire point of my criticism, and indeed the entire point of this thread, is that software that should focus on a narrow task, tries to do way too much, leading to problems.
Re: Windows Notepad App Remote Code Execution Vulnerability
#270Microsoft is stuck in exactly the same situation Linux is: It has to be all things to all people. It has to be simple enough that grandma can use it, but powerful enough to not alienate their business customers. Putting link-handling (rich text) in Notepad (the plain-text editor) was idiotic, however.