Live data from Hacker News

Windows Notepad App Remote Code Execution Vulnerability

cve.org

371–380 of 538 posts

Re: Windows Notepad App Remote Code Execution Vulnerability

#371
post #37

A few days ago, Notepad++ got compromised—apparently by a state actor (or a proxy). And now, today, Windows’ built-in Notepad has a fresh CVE. What a life. At this point, what am I supposed to do other than uninstall Windows completely? No real sandboxing, a mountain of legacy…

Install vim for Windows. I just use gvim as a notepad replacement. No plugins or anything required.

Re: Windows Notepad App Remote Code Execution Vulnerability

#372

Earlier quoted context omitted.

I extracted out notepad.exe, calc.exe and mspaint.exe from Windows 7. I use them on Windows 11. They work perfectly.

I have the mspaint.exe from the same version too :P. It complains about registry stuff on launch but other than that it works fine. There's no spray can in the modern paint!

Why does it show registry error?

I copied out mspaint.exe and some resource files as well were needed.

It runs for me without error.

Re: Windows Notepad App Remote Code Execution Vulnerability

#373

Earlier quoted context omitted.

But... did they add a http server in it? Mail reader?

no, and the person at Microsoft that wrote it is adamant about keeping it as an editor only.

Management: add "AI" or we'll fire you and give the project to one who will.

Re: Windows Notepad App Remote Code Execution Vulnerability

#374

Earlier quoted context omitted.

But... did they add a http server in it? Mail reader?

Rewrote it in Rust

That explains why it's so nice. Well, not really, but it does hint at it being new and built by someone who gives a damn. It's honestly far nicer for my use than vi or nano, which is annoying since I'm on Linux.

Edit: Fedora has it available as "msedit". What a time to be alive.

Re: Windows Notepad App Remote Code Execution Vulnerability

#375

Earlier quoted context omitted.

I extracted out notepad.exe, calc.exe and mspaint.exe from Windows 7. I use them on Windows 11. They work perfectly.

Kind of a weird feeling that in order to get the better Windows 11 experience one requires programs from four operating system versions earlier. Windows 11 also takes a huge amount of time to get working as i intend. I have to remove a lot of 'features' and heavily optimize some processes. It's stable and it works, but i'm getting more and more annoyed by it that upcoming updates sometimes destroy all my effort. Kind…

I’d wish to use Linux.

But some things just don’t run there (properly).

Like Assetto Corsa EVO or SimHub.

Re: Windows Notepad App Remote Code Execution Vulnerability

#376
post #134

It is to do with link handling: https://msrc.microsoft.com/update-guide/vulnerability/CVE-20... > An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad, causing the application to launch unverified protocols that load and execute remote files.

[deleted]

Re: Windows Notepad App Remote Code Execution Vulnerability

#377

Earlier quoted context omitted.

I extracted out notepad.exe, calc.exe and mspaint.exe from Windows 7. I use them on Windows 11. They work perfectly.

Kind of a weird feeling that in order to get the better Windows 11 experience one requires programs from four operating system versions earlier. Windows 11 also takes a huge amount of time to get working as i intend. I have to remove a lot of 'features' and heavily optimize some processes. It's stable and it works, but i'm getting more and more annoyed by it that upcoming updates sometimes destroy all my effort. Kind…

Probably the only good thing about Google Docs becoming so popular in school/education use... All you need is a current Chromium based browser mostly.

The Web versions of Office, err MS 365, err CoPilot App.. (OMG!>!!>) ... aren't so bad to use in a Linux browser either.

Re: Windows Notepad App Remote Code Execution Vulnerability

#378
post #298
post #277

Earlier quoted context omitted.

> Except no, we don't. notepad.exe was DONE SOFTWARE While 8.8 score is embarrassing, by no measure notepad was done software. It couldn't load a large text file for one, its search was barely functional, had funky issues with encoding, etc. Notepad++ is closer to what should be expected from an OS basic text editor

What counts as "large"? I'm pretty sure at some point in my life I'd opened the entirety of Moby Dick in Notepad. Unless you want to look for text in a binary file (which Notepad definitely isn't for) I doubt you'll run into that problem too often. Also, I hope the irony of you citing Notepad++ [1] as what Notepad should aim to be isn't lost on you. My point being, these kinds of vulnerabilities shouldn't exist in a…

I know about the vulnerabilities in notepad++, however I was referring to the feature set.

Regarding large, I am referring to log files for example. I think the issue was lack of use of memory mapped files, which meant the entire file was loaded to RAM always, often giving the frozen window experience

Re: Windows Notepad App Remote Code Execution Vulnerability

#379
post #209

Earlier quoted context omitted.

I have the mspaint.exe from the same version too :P. It complains about registry stuff on launch but other than that it works fine. There's no spray can in the modern paint!

I like paint shop pro, I use 4.12.

I need to just break down and find an old version of that... from before the Jasc sellout. IIRC, it ran via Wine without issue too.

I try to use Pinta/Paint.Net, but it's not quite as good as I remember psp being. I don't even hate the newer MS Paint... thought I'm only on windows for my work environment and even then.

Aside: I've been using my personal computer more, so I can work on a limited surface with docker and ai agent, then just bring in the components I'm working on when ready. My work environment is really locked down, no wsl, no docker... and it's like working in 2002 to some extent... It's literally easier for me to create stand-alone projects, work on a given feature in complete isolation... AI agent mostly to boilerplate the environment and most of the automated sanity tests, then I can focus on just what I'm working on.

Re: Windows Notepad App Remote Code Execution Vulnerability

#380
post #166

Earlier quoted context omitted.

It’s just resumé driven development. Corporate droids gotta justify their salaries somehow. It doesn’t pay to call software “done”.

Individual developers or even developer management doesn't get much of a say in product direction at large corporations. The product management folks are who decide what features go in and when.

PMs have resumes too :)

- Successfully led key efforts to modernize aging platform technologies

- Directed integration of cutting-edge system-wide artificial intelligence functionality

Post reply on HN