Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Notepad++ hijacked by state-sponsored actors

notepad-plus-plus.org

Post reply on HN
Print view View original

31–40 of 560 posts

Re: Notepad++ hijacked by state-sponsored actors

#31

Post by calvinmorrison »

Arainach wrote: post #22
hsbauauvhabzb wrote: post #17

Earlier quoted context omitted.

If you think large companies are somehow immune to this, you’re gonna have a bad time.

It's not a matter of "immune" - larger organizations generally have more resources to allocate to things like this. That doesn't mean they get it right 100% of the time, but they are at least able to try, while small teams or volunteer projects often simply don't have the hours to spend on things like this.

and unlike GPL software, there is typical an army of lawyers, an expressed warranty, legal liability, etc.

Re: Notepad++ hijacked by state-sponsored actors

#33

Post by LoganDark »

icelancer wrote: post #6
simlevesque wrote: post #3

Probably related to this: https://notepad-plus-plus.org/news/v869-about-taiwan/

Yeah, Notepad++ is known for political messaging in their updates. Taiwan, Ukraine, etc.

I can't help but feel there must some better venue for such messaging.

When I see politics in software updates or documentation, nothing happens because I'm not looking to use the software for political activism. Maybe I tell my adblocker to remove the messaging, and carry on with my task.

I can engage with politics in a social context, when political messaging isn't interrupting something else I'm doing; that's a better place for activism, IMHO.

I almost always see activists using the argument that if I don't like the messaging then I'm part of the problem. Somehow I doubt that, given I don't mind messaging at all, where it's appropriate.

Re: Notepad++ hijacked by state-sponsored actors

#34

Post by its_ubuntu »

Arainach wrote: post #22
hsbauauvhabzb wrote: post #17

Earlier quoted context omitted.

If you think large companies are somehow immune to this, you’re gonna have a bad time.

It's not a matter of "immune" - larger organizations generally have more resources to allocate to things like this. That doesn't mean they get it right 100% of the time, but they are at least able to try, while small teams or volunteer projects often simply don't have the hours to spend on things like this.

[flagged]

Re: Notepad++ hijacked by state-sponsored actors

#35

Post by digdigdag »

dgrin91 wrote: post #8
thisislife2 wrote: post #2

Wow. I'd love to know more how the targeted systems were actually compromised.

Agreed. Supply chain attacks are scary. I open all sorts of secrets in NPP - did they all get leaked?

Depends. Are you a Chinese/Taiwanese national or diplomat who holds a strategic value to the CCP?

Re: Notepad++ hijacked by state-sponsored actors

#36

Post by bakugo »

So uhh... what exactly did the "state-sponsored actors" do?

They go on about how their server was compromised, and how the big bad Chinese were definitely behind it, and then claim the "situation has been fully resolved", but there is zero mention of any investigation into what was actually done by the attackers. Why? If I downloaded an installer during the time they were hacked, do I have malware now?

The utter lack of any such information feels bizarre.

Re: Notepad++ hijacked by state-sponsored actors

#37

Post by guessmyname »

jmole wrote: post #4

i always worry about tools like this, maintained by small teams, that are so universal that even if only a small fraction of installs are somehow co-opted by malicious actors, you have a wide open attack surface on most tech companies. e.g. iTerm, Cyberduck, editors of all shades, various VSCode extensions, etc.

I don’t get it, why don’t you all—absolutely all of you reading—use Little Snitch? [1]

It really doesn’t compute in my head why would any macOS user not use a network firewall like this, or similar, to block unwanted outgoing HTTP(s) requests. You can easily inspect the packet with tools like Wireshark or Burp Suite Professional (or Community) edition, or any other proxy tool, of which there are many in the macOS ecosystem.

And this is not unique to macOS, this is all possible in Windows, Linux and any other OS.

[1] https://www.obdev.at/products/littlesnitch/index.html

Re: Notepad++ hijacked by state-sponsored actors

#38

Post by icelancer »

LoganDark wrote: post #33
icelancer wrote: post #6

Earlier quoted context omitted.

Yeah, Notepad++ is known for political messaging in their updates. Taiwan, Ukraine, etc.

I can't help but feel there must some better venue for such messaging. When I see politics in software updates or documentation, nothing happens because I'm not looking to use the software for political activism. Maybe I tell my adblocker to remove the messaging, and carry on with my task. I can engage with politics in a social context, when political messaging isn't interrupting something else I'm doing; that's a be…

I generally agree with you. But I put up with it since Notepad++ is good software. It is what it is.

Re: Notepad++ hijacked by state-sponsored actors

#39

Post by SoftTalker »

calvinmorrison wrote: post #31
Arainach wrote: post #22

Earlier quoted context omitted.

It's not a matter of "immune" - larger organizations generally have more resources to allocate to things like this. That doesn't mean they get it right 100% of the time, but they are at least able to try, while small teams or volunteer projects often simply don't have the hours to spend on things like this.

and unlike GPL software, there is typical an army of lawyers, an expressed warranty, legal liability, etc.

Terms of use typically disclaim all liability.

Re: Notepad++ hijacked by state-sponsored actors

#40

Post by permo-w »

stackghost wrote: post #27
_alternator_ wrote: post #25

Earlier quoted context omitted.

Sorry, what does this have to do with notepad++?

The notepad++ author has publicly come out in favor of Taiwanese independence.

Taiwan is already independent. Surely the normal way to refer to it would be as coming out against assimilation with mainland China?
Post reply on HN