Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows Notepad App Remote Code Execution Vulnerability

cve.org

Post reply on HN
Print view View original

271–280 of 538 posts

Re: Windows Notepad App Remote Code Execution Vulnerability

#271

Post by dspillett »

OptionOfT wrote: post #250
silon42 wrote: post #207

Earlier quoted context omitted.

Excel CSV is broken anyway, since in some (EU, ...) countries it needs ; as separator.

That's not an excel issue. That's a locale issue. Due to (parts of?) the EU using then comma as the decimal separator, you have to use another symbol to separate your values.

Comma for decimal separator, and point (or sometimes 'postraphy) for thousands separator if there is one, is very common. IIRC more European countries use that than don't, officially, and a bunch of countries outside Europe do too.

It wouldn't normally necessitate not using comma as the field separator in CSV files though, wrapping those values is quotes is how that would usually be handled in my experience.

Though many people end up switching to “our way”, despite their normal locale preferences, because of compatibility issues they encounter otherwise with US/UK software written naively.

Re: Windows Notepad App Remote Code Execution Vulnerability

#273

Post by dspillett »

7bit wrote: post #197
dspillett wrote: post #159

Earlier quoted context omitted.

> nailing down Unicode and text encodings was still considered rocket science. Now this is a solved problem I wish… Detecting text encoding is only easy if all you need to contend with is UTF16-with-BOM, UTF8-with-BOM, UTF8-without-BOM, and plain ASCII (which is effectively also UTF8). As soon as you might see UTF16 or UCS without a BOM, or 8-bit codepages other than plain ASCII (many apps/libs assume that these are…

The very fact that UTF-8 itself discouraged from using the BOM is just so alien to me. I understand they want it to be the last encoding and therefore not in need of a explicit indicator, but as it currently IS NOT the only encoding that is used, it makes is just so difficult to understand if I'm reading any of the weird ASCII derivatives or actual Unicode. It's maddening and it's frustrating. The US doesn't have any…

> The US doesn't have any of these issues

I think you mean “the US chooses to completely ignore these issues and gets away with it because they defined the basic standard that is used, ASCII, way-back-when, and didn't foresee it becoming an international thing so didn't think about anyone else” :)

Re: Windows Notepad App Remote Code Execution Vulnerability

#274

Post by cube00 »

kgwxd wrote: post #151
Fiveplus wrote: post #14

We have officially reached the logical conclusion of the feature-bloat-to-vulnerability pipeline. For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text. An 8.8 CVSS on a utility meant for viewing data is a fundamental failure of the principle of least privilege. At some point, they need to stop aski…

The day calculator brought me to an MS Store login was the day I became a radical.

Mine was when they asked me to rate the calculator on the store.

Re: Windows Notepad App Remote Code Execution Vulnerability

#276

Post by dspillett »

g-b-r wrote: post #224
7bit wrote: post #197

Earlier quoted context omitted.

The very fact that UTF-8 itself discouraged from using the BOM is just so alien to me. I understand they want it to be the last encoding and therefore not in need of a explicit indicator, but as it currently IS NOT the only encoding that is used, it makes is just so difficult to understand if I'm reading any of the weird ASCII derivatives or actual Unicode. It's maddening and it's frustrating. The US doesn't have any…

Indeed, I've been using the BOM in all my text files for maybe decades now, those who wrote the recommendation are clearly from an English country

> are clearly from an English country

One particular English-speaking country… The UK has issues with ASCII too, as our currently symbol (£) is not included. Not nearly as much trouble as non-English languages due to the lack of accents & such that they need, but we are still affected.

Re: Windows Notepad App Remote Code Execution Vulnerability

#277

Post by breppp »

usrbinbash wrote: post #184
weinzierl wrote: post #59

Earlier quoted context omitted.

"For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text." Well, except that this did not prevent it from having embarrassing bugs. Google "Bush hid the facts" for an example. I'm serious, you won't be disappointed. I think complexity is relative. At the time of the "Bush hid the facts" bug, nailing d…

As funny as the "Bush hid the facts" bug may be, there is a world of difference between an embarassing mistake by a function that guesses the text encoding wrong, and a goddamn remote code execution with an 8.8 score > and we have other battles we fight. Except no, we don't. notepad.exe was DONE SOFTWARE. It was feature complete. It didn't have to change. This is not a battle that needed fighting, this was hitting a…

> Except no, we don't. notepad.exe was DONE SOFTWARE

While 8.8 score is embarrassing, by no measure notepad was done software. It couldn't load a large text file for one, its search was barely functional, had funky issues with encoding, etc.

Notepad++ is closer to what should be expected from an OS basic text editor

Re: Windows Notepad App Remote Code Execution Vulnerability

#278

Post by cameron_b »

jahsome wrote: post #255
sneak wrote: post #166

Earlier quoted context omitted.

It’s just resumé driven development. Corporate droids gotta justify their salaries somehow. It doesn’t pay to call software “done”.

And yet, if they were raising a Series A, they'd be lauded as "disruptors"

By some

Some of us were impressionable when Jurassic Park came out.

Re: Windows Notepad App Remote Code Execution Vulnerability

#279

Post by delecti »

MarleTangible wrote: post #214
usrbinbash wrote: post #184

Earlier quoted context omitted.

As funny as the "Bush hid the facts" bug may be, there is a world of difference between an embarassing mistake by a function that guesses the text encoding wrong, and a goddamn remote code execution with an 8.8 score > and we have other battles we fight. Except no, we don't. notepad.exe was DONE SOFTWARE. It was feature complete. It didn't have to change. This is not a battle that needed fighting, this was hitting a…

They also wanted to use the popularity of Notepad, so they replaced it with an AI bloatware version instead of creating a new app with extra features.

They didn't need to create a new app. At the same time that they started adding LLM garbage to Notepad, they discontinued WordPad.

https://en.wikipedia.org/wiki/Windows_Notepad#Change_in_deve... https://en.wikipedia.org/wiki/WordPad#Discontinuation

They likely knew nobody would be drawn to WordPad by the additions, so they had to scavenge their rapidly diminishing list of actually useful software for sacrifices on the altar to their outrageous AI investments.

Re: Windows Notepad App Remote Code Execution Vulnerability

#280

Post by anthk »

OptionOfT wrote: post #250
silon42 wrote: post #207

Earlier quoted context omitted.

Excel CSV is broken anyway, since in some (EU, ...) countries it needs ; as separator.

That's not an excel issue. That's a locale issue. Due to (parts of?) the EU using then comma as the decimal separator, you have to use another symbol to separate your values.

Locales should have died long ago. You use plain data, stop parsing it depdending on wen your live. Plan9/9front uses where right long ago. Just use Unicode everywhere, use context-free units for money.
Post reply on HN