Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows Notepad App Remote Code Execution Vulnerability

cve.org

Post reply on HN
Print view View original

341–350 of 538 posts

Re: Windows Notepad App Remote Code Execution Vulnerability

#341

Post by hypercube33 »

mdavid626 wrote: post #31
voidUpdate wrote: post #26

I found a copy of the win98 (I believe) notepad.exe a while back, and it works perfectly on windows 11 (though the "about notepad" dialog shows the windows 11 version for some reason??). I can write text into it, save it, and load text again. What more does notepad need? And it has a very nostalgic font too

I extracted out notepad.exe, calc.exe and mspaint.exe from Windows 7. I use them on Windows 11. They work perfectly.

There used to be a website that has these installable.

Update - it's just the games; I thought it had notepad and calc as well

Re: Windows Notepad App Remote Code Execution Vulnerability

#342

Post by onion2k »

appreciatorBus wrote: post #320
onion2k wrote: post #245

Earlier quoted context omitted.

Because there are plenty of developers who'll say yes, so anyone saying no is putting their ethics ahead of their livelihood. Few people will be willing to put their beliefs ahead of providing for their family. It's easy to say you will, and very hard to actually do it.

You can say exactly the same thing about the management and the shareholders. If they say no, someone else will say yes, so why blame them?

They make the decision about what to say yes to. They can choose to do something else without it impacting their individual circumstances.

Re: Windows Notepad App Remote Code Execution Vulnerability

#343

Post by TZubiri »

MonkeyClub wrote: post #162
TZubiri wrote: post #136

Earlier quoted context omitted.

EDIT: THE OLD NOTEPAD IS STILL IN WINDOWS AND WE CAN USE IT! https://learn.microsoft.com/en-us/answers/questions/3845356/... You basically have to find the "execution alias" setting and disable notepad and you get the ole reliable :D OLD POST: This has hurt me specifically. Since I work without IDEs, no VIM, no vs code. On linux I use nano, on windows I use Notepad. I like the minimalism and the fact that I have abso…

> the purity of "working with what's installed". Oh, a kindred spirit! I too absolutely love the notion of the base install, and what can be done just by means of its already available toolset. (Fun tidbit: Did you know Windows comes with a bare bones C# 5 toolchain, with csc.exe, and even vbc.exe and jsc.exe?)

I played with the preinstalled languages in windows before, but the legacy stuff dizzied me before llms existed.

now that llms exist I am learning with dotnet, that now comes with windows, (or at least it comes with winget, and you can install a lot of kosher software, which is almost as good as having it preinstalled.)

If I ever hop onto an older machine I'll use the gpt to see what I get, i recall there's vbscript, apparently a .net compiler+runtime, and I saw a js interpreter in very old OS too.

A big inspiration in this realm is FogBugz historical "Wasabi". Their idea of compiling to PHP and c# i think it was, because it's what most OS come with, and their corpo clients can use it as it. It's in a joel spolsky blog post somewhere.

Re: Windows Notepad App Remote Code Execution Vulnerability

#344

Post by vachina »

ThrowawayB7 wrote: post #297
bigfatkitten wrote: post #160

Earlier quoted context omitted.

> At some point, they need to stop asking "can we add this feature?" and start asking "does this text editor need a network-aware rendering stack?" They didn’t stop there. They also asked “does this need AI?” and came up with the wrong answer.

If I had to guess, the mandate to cram AI in everywhere came down from Nadella and the executive level with each level of management having KPIs for AI in their product all the way down. Much like the "everything has to be .NET even though nobody has any idea what .NET means" when it was first introduced and every MS product suddenly sprouted .NET at the end of their names. When executive management gives stupid non-…

AI is useful but these management type typically don’t know how to make it useful.

Re: Windows Notepad App Remote Code Execution Vulnerability

#346

Post by TZubiri »

sneak wrote: post #168
MonkeyClub wrote: post #162

Earlier quoted context omitted.

> the purity of "working with what's installed". Oh, a kindred spirit! I too absolutely love the notion of the base install, and what can be done just by means of its already available toolset. (Fun tidbit: Did you know Windows comes with a bare bones C# 5 toolchain, with csc.exe, and even vbc.exe and jsc.exe?)

Not having one’s configuration present is kneecapping yourself needlessly. If you’re going to have a custom config, you might as well have a custom executable.

Oh but we have our configuration, it's all in the defaults baby. And what isn't like locking down /home/user permissions and increasing bash_history sizes, I keep it small and configurable in less than 2 minutes. (And server side only, which always requires more setup.

Not saying that spending the first days on a new project configuring your custom setup with the company's stack is bad, especially if you are categorizing as employee and are looking for a multi year long run. But I tend to do small contracts, 1 to 6 months, and starting right away is a nice boost.

Re: Windows Notepad App Remote Code Execution Vulnerability

#347

Post by Rohansi »

titzer wrote: post #306
Fiveplus wrote: post #14

We have officially reached the logical conclusion of the feature-bloat-to-vulnerability pipeline. For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text. An 8.8 CVSS on a utility meant for viewing data is a fundamental failure of the principle of least privilege. At some point, they need to stop aski…

It'd be more hilarious if it weren't so sad. In just 10 years a disturbingly large number of huge development teams decided that making a GUI application using the old ways [1] was too hard and decided to ship an entire web engine (electron) to render 10 buttons. [1] (native GUI widgets? agggh)

Which 10 buttons?

Re: Windows Notepad App Remote Code Execution Vulnerability

#348

Post by TZubiri »

funnybeam wrote: post #221
TZubiri wrote: post #136

Earlier quoted context omitted.

EDIT: THE OLD NOTEPAD IS STILL IN WINDOWS AND WE CAN USE IT! https://learn.microsoft.com/en-us/answers/questions/3845356/... You basically have to find the "execution alias" setting and disable notepad and you get the ole reliable :D OLD POST: This has hurt me specifically. Since I work without IDEs, no VIM, no vs code. On linux I use nano, on windows I use Notepad. I like the minimalism and the fact that I have abso…

Except it keeps reverting to the new notepad every few days…. I’ve been fighting this for the last couple of weeks but it just doesn’t stick

Did you bring out the big guns? Regedit.exe

Re: Windows Notepad App Remote Code Execution Vulnerability

#349

Post by jahsome »

cameron_b wrote: post #278
jahsome wrote: post #255

Earlier quoted context omitted.

And yet, if they were raising a Series A, they'd be lauded as "disruptors"

By some Some of us were impressionable when Jurassic Park came out.

The vast majority of hn commentors, I'd wager.

Re: Windows Notepad App Remote Code Execution Vulnerability

#350

Post by dspillett »

anthk wrote: post #280
OptionOfT wrote: post #250

Earlier quoted context omitted.

That's not an excel issue. That's a locale issue. Due to (parts of?) the EU using then comma as the decimal separator, you have to use another symbol to separate your values.

Locales should have died long ago. You use plain data, stop parsing it depdending on wen your live. Plan9/9front uses where right long ago. Just use Unicode everywhere, use context-free units for money.

Locales are fine for display, but yes they should not affect what goes into files for transfer. There have always been appropriate control characters in the common character sets, in ASCII and most 8-bit codepages there are non-printing control characters that have suitable meanings to be used in place of commas and EOL so they could be used unescaped in data fields. Numbers could be plain, perhaps with the dot still as a standard decimal point or we could store non-integers as a pair of ints (value and scale), dates in an unambiguous format (something like one of the options from ISO8601), etc.

Unfortunately people like CSV to be at least part way human-readable, which means readable delimiters, end-or-record markers being EOLs that a text editor would understand, and the decimal/thousand/currency symbols & date formatting that they are used to.

Post reply on HN