381–390 of 538 posts
Earlier quoted context omitted.
I extracted out notepad.exe, calc.exe and mspaint.exe from Windows 7. I use them on Windows 11. They work perfectly.
I feel bad for anyone at MS who thought these applications needed anything more than bugfixes. Welcome to the Notepad team, the entire world would be better off it you did nothing at all!
Earlier quoted context omitted.
you can also just uninstall the "new" notepad, at which point Windows will let you run the old one again (which is still shipped!). By using a version that is _that_ old you do lose out on some of the actually useful updates legacy nodepad received, such as LF line ending support.
What? Did they accidentally revert the improvements they already made to previously shipped versions of the old notepad program?
Earlier quoted context omitted.
Strictly, no. But it was a vulnerability in the design of Notepad++, key elements here being the featureset that requires frequent updates and the lack of integrity checks during the upgrade process. This has prompted me to move on from Notepad++ - it's sad, because I've used it for many years, but this is too much.
> in the design of Notepad++ One could argue it's an issue with windows where you can't just pull updates using a package manager/app store.
By looking at their 2025 shareholder report (Look for the part below "NOTE 18"), Windows is only at the 5th place in terms of revenue source, even below the LinkedIn: https://www.microsoft.com/investor/reports/ar25/index.html# I can only think that they do not even care about Windows anymore, let alone Notepad...
Most of M$ office software has alternatives (Google Docs, OpenOffice...), M$ has no AI model and no AI labs to speak of, Github is constantly crashing and burning, Azure is garbage, and they uttery killed Xbox.
Oh and Linkedin is for actual psychopaths.
If Windows dies, all of their other junk that is attached to the platform will die as well.
It is to do with link handling: https://msrc.microsoft.com/update-guide/vulnerability/CVE-20... > An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad, causing the application to launch unverified protocols that load and execute remote files.
> It is to do with link handling: Notepad? Link handling? That's like my pencil having a CVE that's to do with how it loads the ink. That old saying about 'if Microsoft built a car' is more true now than it was then: https://www.snopes.com/fact-check/car-balk/
Calculator hasn't been infiltrated by Copilot yet, but I'm sure the day is coming.
Earlier quoted context omitted.
You can if you use the windows store. It's just that you usually install things outside of that, unlike in linuxes where you generally use the package manager that can handle updates for you
Plus Windows Store is not supported on all version of Windows particularly Datacenter versions - your most valuable assets !!
Yeah, clicking unverified links in a markdown document to launch an executable.... Clicking unknown links is always a bad idea, but a CVE for that? I dunno....
What other markdown viewers or editors support URL schemes that just execute code? And not in a browser sandbox but in the same security context notepad itself is running in.
Earlier quoted context omitted.
You cannot claim you're "against feature bloat" while then in the same breath say that it is acceptable that a basic text editor have an entire additional render pipeline. If you want Markdown use VSCode, it is a first class citizen. Don't take an intentionally stripped down text editor and bolt on VSCode-like features.
As I posted in a sibling, I thought the whole point of markdown was that it was simplified to the point that rendering it was easy to do from scratch. But we fumbled that because we (collectively) have no idea what we are doing.
Earlier quoted context omitted.
But is it running ShellExecute on URIs?
I believe it is. Just tested it. You can make the link "C:\windows\system32\cmd.exe" and clicking it will launch the Command Prompt. I noticed you can't make it "C:\windows\system32\cmd.exe /c some-nefarious-thing"; it doesn't like the space. Exploiting may require you to ship both the malicious EXE and the MD, then trick the user into clicking the link inside the MD. But then you could have just tricked them into di…
A few days ago, Notepad++ got compromised—apparently by a state actor (or a proxy). And now, today, Windows’ built-in Notepad has a fresh CVE. What a life. At this point, what am I supposed to do other than uninstall Windows completely? No real sandboxing, a mountain of legacy…
Install vim for Windows. I just use gvim as a notepad replacement. No plugins or anything required.
https://github.com/microsoft/edit
Yeah, it's a re-creation of edit, but it's pretty great... also runs outside windows.