Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows Notepad App Remote Code Execution Vulnerability

cve.org

Post reply on HN
Print view View original

391–400 of 538 posts

Re: Windows Notepad App Remote Code Execution Vulnerability

#391

Post by bigbuppo »

Culonavirus wrote: post #384
gkcnlr wrote: post #360

By looking at their 2025 shareholder report (Look for the part below "NOTE 18"), Windows is only at the 5th place in terms of revenue source, even below the LinkedIn: https://www.microsoft.com/investor/reports/ar25/index.html# I can only think that they do not even care about Windows anymore, let alone Notepad...

Microsoft is Windows. Anyone saying otherwise is completely delusional. Most of M$ office software has alternatives (Google Docs, OpenOffice...), M$ has no AI model and no AI labs to speak of, Github is constantly crashing and burning, Azure is garbage, and they uttery killed Xbox. Oh and Linkedin is for actual psychopaths. If Windows dies, all of their other junk that is attached to the platform will die as well.

This is why I have been saying that Microsoft is about to go the way of Sears when the AI bubble pops.

Re: Windows Notepad App Remote Code Execution Vulnerability

#392

Post by DuckConference »

gkcnlr wrote: post #360

By looking at their 2025 shareholder report (Look for the part below "NOTE 18"), Windows is only at the 5th place in terms of revenue source, even below the LinkedIn: https://www.microsoft.com/investor/reports/ar25/index.html# I can only think that they do not even care about Windows anymore, let alone Notepad...

It splits revenue out to 3 categories, "Productivity and Business Processes", "Intelligent Cloud", and "More Personal Computing", with windows as one of several things in the 3rd group. How did you figure it out as a 5th place revenue source?

Re: Windows Notepad App Remote Code Execution Vulnerability

#393

Post by ddtaylor »

w4yai wrote: post #117
ddtaylor wrote: post #99

Earlier quoted context omitted.

Do you have a moment to talk about Linux?

Half of my software don't work on Linux. My job also depends on running PE in a legitimate (read not Wine) environment - and I don't want to spend half of my RAM running VMs. What should I do ?

I know many people that access many different systems using remote desktop for this purpose.

I use qemu in a docker container for many Windows related things, partially because I don't want to keep a "real" Windows system running and partially because I don't want to let that OS run outside of a VM or container.

It depends on your security mindset and goals, but I think we're far into the world of VMs and containers all the way down.

With respect to memory, try it and see. Modern Linux is very good at memory management, since it powers the entire data center world. You can certainly overcommit memory with Docker containers easily without a problem.

Re: Windows Notepad App Remote Code Execution Vulnerability

#394

Post by ddtaylor »

petepete wrote: post #150
w4yai wrote: post #117

Earlier quoted context omitted.

Half of my software don't work on Linux. My job also depends on running PE in a legitimate (read not Wine) environment - and I don't want to spend half of my RAM running VMs. What should I do ?

If you have to use Windows, just grit your teeth and use it. Thankfully I don't.

I think there is a difference between using Windows as something you need versus using it as your home base. I shudder at the idea of trying to "build a nest" with Windows. I'll go stay in someone elses crappy nest for a night or two, but I can't live like that.

Re: Windows Notepad App Remote Code Execution Vulnerability

#395

Post by oblio »

TZubiri wrote: post #339
oblio wrote: post #180

Earlier quoted context omitted.

> when literally the only files that matter to me are in /home, which is a free-for-all? > The home folder's read write is usually restricted to the user. Yeah, and that is the point. All user's programs including curl, wget, the web browser, anything else that connects to the network run as the user, and all the user's programs, by default, have access to everything inside ${HOME}. Most people don't really care if /…

Just make another user bro. If you can't even create a user to run a program you distrust, the issue is not that windows doesn't provide sandboxes, it's that you don't use them And no, it's not "a lot of work" it's the bare minimum

Yet 99% of the planet doesn't do "the bare minimum", bro.

We have supposedly all the smartest minds in the world working in tech and they haven't been able to create a simple, cheap, reliable cross platform solution for user data protection, backup and restore.

It's easier to blame users instead.

Re: Windows Notepad App Remote Code Execution Vulnerability

#396

Post by ptx »

tracker1 wrote: post #382
ptx wrote: post #148

Earlier quoted context omitted.

What? Did they accidentally revert the improvements they already made to previously shipped versions of the old notepad program?

I think it's in reference to using Win9x notepad.exe as opposed to somewhere in the Win7-10 timeframe before they went over the top in Win11.

Ah, yes, I misread it as the newer versions shipping an older notepad.

Re: Windows Notepad App Remote Code Execution Vulnerability

#397

Post by hnlmorg »

Culonavirus wrote: post #384
gkcnlr wrote: post #360

By looking at their 2025 shareholder report (Look for the part below "NOTE 18"), Windows is only at the 5th place in terms of revenue source, even below the LinkedIn: https://www.microsoft.com/investor/reports/ar25/index.html# I can only think that they do not even care about Windows anymore, let alone Notepad...

Microsoft is Windows. Anyone saying otherwise is completely delusional. Most of M$ office software has alternatives (Google Docs, OpenOffice...), M$ has no AI model and no AI labs to speak of, Github is constantly crashing and burning, Azure is garbage, and they uttery killed Xbox. Oh and Linkedin is for actual psychopaths. If Windows dies, all of their other junk that is attached to the platform will die as well.

> Microsoft is Windows. Anyone saying otherwise is completely delusional.

What's delusional is making an unsubstantiated claims and then dismissing any counterarguments before they're made.

> Most of M$ office software has alternatives (Google Docs, OpenOffice...)

True. Yet MS Office is still the de facto standard.

> Github is constantly crashing and burning

True. But that doesn't mean it isn't still a business strategy for MS.

> Azure is garbage

Also true. But that doesn't mean it isn't profitable: "Microsoft Cloud revenue increased 23% to $168.9 billion."

> and they uttery killed Xbox

Quite the opposite. Xbox is thriving: "Xbox content and services revenue increased 16%."

> Oh and Linkedin is for actual psychopaths.

That's subjective. And even if it were true, that's got nothing to do with profitability (eg look at Facebook).

> If Windows dies, all of their other junk that is attached to the platform will die as well.

First off, literally no-one is claiming Windows is going to "die".

Secondly, even if it were to "die", you've provided no evidence why their other revenue streams wouldn't succeed when it's already been demonstrated that those revenue streams are growing, and in some cases, have already overtaken Windows.

Re: Windows Notepad App Remote Code Execution Vulnerability

#398

Post by gkcnlr »

DuckConference wrote: post #392
gkcnlr wrote: post #360

By looking at their 2025 shareholder report (Look for the part below "NOTE 18"), Windows is only at the 5th place in terms of revenue source, even below the LinkedIn: https://www.microsoft.com/investor/reports/ar25/index.html# I can only think that they do not even care about Windows anymore, let alone Notepad...

It splits revenue out to 3 categories, "Productivity and Business Processes", "Intelligent Cloud", and "More Personal Computing", with windows as one of several things in the 3rd group. How did you figure it out as a 5th place revenue source?

Search for this: "Revenue, classified by significant product and service offerings"

Re: Windows Notepad App Remote Code Execution Vulnerability

#399

Post by jerf »

titzer wrote: post #310
jerf wrote: post #299

Earlier quoted context omitted.

The main problem with "Markdown support" in Notepad is that "Markdown support" is an ill-defined phrase. The closest thing to a well-defined definition is to support CommonMark but that is far, far from universal. Microsoft being Microsoft they'd probably still half-ass the job then just declare their new half-ass support a newly embraced-and-extended standard and leave it that way for the next 20 years, so asking No…

I might be dumb, but I thought the whole point of markdown was to get rid of all the bells and whistles of styling, having a really simplified and dumb format that only outlines structure. The follow-on being that many tools could parse, transform and render said markdown files in a way that makes sense for them. That way there's lots of tools that don't share code, but a shared definition of the format . I.e. markdo…

Goals aren't results. It was a goal for Markdown to be simple and universal. It is not a result.

You may be struggling a bit because you are reading some sort of moralization into the statement, some sort of emotional judgment, but there isn't any. It is clear that there does not exist a function that takes a span of "Markdown text" in and emits an abstract syntax tree that everyone agrees upon [1]. That's a fairly mathematical way of putting it, but even from an engineering point of view, the differences matter. Very quickly. It's not like you need to reach deep into crazy syntax to get to real, concrete disagreements between systems, you can hit problems with something as simple as

    "_hello world _"
between the systems where they will do substantially different things.

There are literally dozens of markdown formats now.

How we got there, why such a thing exists, as interesting as those questions may be none of them change the reality on the ground. There is no universal markdown to be appealed to. The closest is CommonMark, and that explicitly exists precisely because there was no consensus in the first place. If markdown was a format, CommonMark would never have been created.

[1]: Nor does its inverse, which at times is more frustrating to me than this. I have in mind what I want to do and either can't figure out how to do it or it simply can't be done.

Re: Windows Notepad App Remote Code Execution Vulnerability

#400

Post by icegreentea2 »

BLKNSLVR wrote: post #169
rmunn wrote: post #7

"An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad, causing the application to launch unverified protocols that load and execute remote files." I didn't even know Notepad would render Markdown.

Notepad rendering other formats removes one of the specific reasons I use notepad: to strip the stupid formatting that all sorts of applications seem to want to attach to text these days. Notepad handily strips away all the custom link namings and formats that totally fuck the expected output of a simple copy and paste. That's a big part of the its magic: it's immunity to the choices of marketing teams and dud manage…

You can still do this in W11 notepad. Firstly, there's a global setting for having formatting/markdown being enabled at all, and secondly it only does the rendering for .md files. Finally, while formatting is enabled, and editting a markdown file, you have the option to toggle between formatted and "syntax" view (ie raw text).
Post reply on HN