Live data from Hacker News

Notepad++ hijacked by state-sponsored actors

notepad-plus-plus.org

321–330 of 560 posts

Re: Notepad++ hijacked by state-sponsored actors

#321
post #55

Earlier quoted context omitted.

Isn't Little Snitch exactly the sort of application they're worried about?

Zing! The state of the world is such that I have started running everything inside VMs. Baseline OS install + virtual machine management and that is it. Which is still not immune, but makes me feel a lot better than core OS utilities are probably getting better vetting than nifty-utility-123 on which I depend.

Qubes OS?

Re: Notepad++ hijacked by state-sponsored actors

#322
That's sad. China should be more helpful with regards to open source.

Notepad++ is a great editor. I don't use it on Linux, because I have an older editor I am very used to, but on Windows I like notepad++ a lot (though lately I have been using geany on Windows, mostly for convenience - I think notepad++ is better but I sort of like the github-based development of geany; either way notepad++ is really excellent as well).

Re: Notepad++ hijacked by state-sponsored actors

#323
post #230

Earlier quoted context omitted.

This reminds me of college, when some of my professors were still sorting out their curriculum and would give us homework assignments with bugs in it. I complained many times that they were enabling my innate procrastination by proving over and over again that starting the homework early meant you would get screwed. Every time I'd wait until the people in the forum started sounding optimistic before even looking at t…

For windows updates r/sysadmin has people who run updates and post their experience on patch Tuesday.

You can delay by a week or two very easily and automatically as well

Re: Notepad++ hijacked by state-sponsored actors

#325

Earlier quoted context omitted.

I am an American and I make a very conscious effort to appreciate social and political nuances. And I go out of my way to point out nuances to others who, in my opinion, oversimplify their statements. It could be argued that the expression of stereotyping Americans as lacking nuance, itself lacks nuance. I believe really most people are similar in that we have our biases, differences in context and experiences. We ca…

What really do Americans know about Ukraine or Taiwan? E.g. can even 1% of US population show Ukraine on the world map (without using Google Maps)? Could they do it before 2022? Before 2014? Do they know anything about Ukraine or Taiwan history? How many Americans know a single foreign language? If tomorrow there would be a war or protests in, say, Burundi. Will Americans stay with Burundi or against it? Or with the…

To be fair, lack of knowledge of other countries is hardly uniquely American. As an Irish person travelling around the non western world, there's a lot of people who don't know that Ireland is a country separate to the UK, or even that it exists.

Re: Notepad++ hijacked by state-sponsored actors

#326
post #161

Earlier quoted context omitted.

I find it difficult to believe that there is levels of cooperation between different companies that would allow this to work. Source. I work for a company for longer than the internet has been alive.

You have worked for the same company for >55 years? That's wild. Can you share the industry?

IBM, although I consider internet and arpanet different things.

Like saying pstn and fiber are different things.

Re: Notepad++ hijacked by state-sponsored actors

#327

Probably related to this: https://notepad-plus-plus.org/news/v869-about-taiwan/

Ah, so this has to do with mainland China going after those who think the Taiwanese do not belong to mainland China. Well, I see them as independent folks. Mainland China needs to stop thinking it can occupy land willy-nilly; unfortunately with USA, Russia and China thinking they can bully other countries that lack nukes, I think these smaller countries absolutely need nukes for defensive purpose.

It is also annoying that all these three countries think they can bully other countries too. That is basically them saying they can kill other people in other countries at all times no matter the real "reason" (just make up a fake reason, such as Russia with regard to Ukraine) - annoying to no ends.

Having said that, and I just pointed out I disagree with mainland China bullying the Taiwanese, I think it would actually be better to have software itself be completely apolitical. I never understood why people felt a need to tie political goals into software. That is a valid statement even if I happen to agree with the political goals here.

Re: Notepad++ hijacked by state-sponsored actors

#328

Earlier quoted context omitted.

I can't help but feel there must some better venue for such messaging. When I see politics in software updates or documentation, nothing happens because I'm not looking to use the software for political activism. Maybe I tell my adblocker to remove the messaging, and carry on with my task. I can engage with politics in a social context, when political messaging isn't interrupting something else I'm doing; that's a be…

Similar comments also come up in the [now regular] "I don't want to see political articles on HN" threads, and I think the response is similar: Asking for "no politics" is itself a strong political view: One in support/service of whatever the current status quo is. Trying to set oneself apart from (or above) politics is itself political. If you're lucky enough to be one of the fortunate people on earth who are not un…

[deleted]

Re: Notepad++ hijacked by state-sponsored actors

#329

So, let me get this straight. If I've been lazy, postponed updates and I'm still on 8.5.8 (Oct 2023) - it turns out I'm actually...safer? Anyway, I hope the author can be a bit more specific about what actually has happened to those unlucky enough to have received these malicious updates. And perhaps a tool to e.g. do a checksum of all Notepad++ files, and compare them to the ones of a verified clean install of the u…

> And perhaps a tool to e.g. do a checksum of all Notepad++ files, and compare them to the ones of a verified clean install of the user's installed version, would be a start? Did I understand the attack wrongly? The software could have a 100% correct checksum, because the attack happened in a remote machine that deals with call home events from Notepad++, I guess one of those "Telemetry" add-ons. The attackers did a…

The remote machine that was compromised was responsible for Notepad++ updates, so the concern is that it could cause a compromised version of the software to be installed. But if it could do that, it could probably cause anything to be installed anywhere on the user's machine, so inspecting the installed N++ binary probably wouldn't be too useful.

Re: Notepad++ hijacked by state-sponsored actors

#330
I’m on version 8.8.8, which says a lot.

This time I unfortunately have to move on from Notepad++. Vibes have been negative for a while but out of inertia (and because there weren't obvious alternatives) I never pulled the trigger. Now it's time. The trust is gone.

Thanks NP++ for being free and useful for so many years.

Can anyone suggest a solid alternative on Windows? I'm fine with Linux and macOS but I have to keep a Windows machine around for some legacy, win only, software.

Maybe Sublime Text could be an option? At this point I'd rather pay for something lightweight, fast, and probably better.

I don't like tooling that increases my exposure to bad state actors (whatever state they're from).

Post reply on HN