Live data from Hacker News

Windows Notepad App Remote Code Execution Vulnerability

cve.org

411–420 of 538 posts

Re: Windows Notepad App Remote Code Execution Vulnerability

#411
post #313

Earlier quoted context omitted.

You cannot claim you're "against feature bloat" while then in the same breath say that it is acceptable that a basic text editor have an entire additional render pipeline. If you want Markdown use VSCode, it is a first class citizen. Don't take an intentionally stripped down text editor and bolt on VSCode-like features.

As I posted in a sibling, I thought the whole point of markdown was that it was simplified to the point that rendering it was easy to do from scratch. But we fumbled that because we (collectively) have no idea what we are doing.

>But we fumbled that because we (collectively) have no idea what we are doing.

Because, almost entirely, the software development industry has disclaimed all responsibility. It's super common for people to try to do shit they have no experience or skill at, push their effort to be adopted by others, then when it crashes and burns they have no accountability. If software "engineers" adopted the rigors and accountability and dignity of traditional engineering, the industry would be very different.

Re: Windows Notepad App Remote Code Execution Vulnerability

#413

Earlier quoted context omitted.

If I had to guess, the mandate to cram AI in everywhere came down from Nadella and the executive level with each level of management having KPIs for AI in their product all the way down. Much like the "everything has to be .NET even though nobody has any idea what .NET means" when it was first introduced and every MS product suddenly sprouted .NET at the end of their names. When executive management gives stupid non-…

AI is useful but these management type typically don’t know how to make it useful.

Now imagine that you are someone who doesn't even think AI is useful, and imagine just how much more infuriating it is to have it crammed in. Drives me up a wall.

Re: Windows Notepad App Remote Code Execution Vulnerability

#414
post #126

Earlier quoted context omitted.

Oh wow, yes I remember now, I used to type `Alt+F` and then `S` immediately because Notepad didn't support `Ctrl+S` back then. Thanks for giving me nostalgia!

I've still got the very fast muscle memory of "Alt-F S", I used to do it habitually in Word and Excel. Still do it occasionally, then having to then undo whatever it does now (luckily it's usually nothing), but sometimes it leaves the Alt press 'open' so the next letter I press does something unpredictable.

The menu should be closeable with escape according to IBM CUA IIRC

Re: Windows Notepad App Remote Code Execution Vulnerability

#415

Earlier quoted context omitted.

Microsoft is Windows. Anyone saying otherwise is completely delusional. Most of M$ office software has alternatives (Google Docs, OpenOffice...), M$ has no AI model and no AI labs to speak of, Github is constantly crashing and burning, Azure is garbage, and they uttery killed Xbox. Oh and Linkedin is for actual psychopaths. If Windows dies, all of their other junk that is attached to the platform will die as well.

> Microsoft is Windows. Anyone saying otherwise is completely delusional. What's delusional is making an unsubstantiated claims and then dismissing any counterarguments before they're made. > Most of M$ office software has alternatives (Google Docs, OpenOffice...) True. Yet MS Office is still the de facto standard. > Github is constantly crashing and burning True. But that doesn't mean it isn't still a business strat…

I know devs are a different market, but how many folks do we know daily drive Mac/Linux and use MS dev tools? VS Code, Typescript, .NET?

I think they'll do just fine if Windows dies on the vine. They'll keep selling all the same software; even for PC gaming they already have their titles on Steam.

Re: Windows Notepad App Remote Code Execution Vulnerability

#416
post #360

By looking at their 2025 shareholder report (Look for the part below "NOTE 18"), Windows is only at the 5th place in terms of revenue source, even below the LinkedIn: https://www.microsoft.com/investor/reports/ar25/index.html# I can only think that they do not even care about Windows anymore, let alone Notepad...

Microsoft is Windows. Anyone saying otherwise is completely delusional. Most of M$ office software has alternatives (Google Docs, OpenOffice...), M$ has no AI model and no AI labs to speak of, Github is constantly crashing and burning, Azure is garbage, and they uttery killed Xbox. Oh and Linkedin is for actual psychopaths. If Windows dies, all of their other junk that is attached to the platform will die as well.

> LinkedIn is for actual psychopaths

This is true. Peruse r/LinkedinLunatics to see them in action

Re: Windows Notepad App Remote Code Execution Vulnerability

#417
post #15

Yeah, clicking unverified links in a markdown document to launch an executable.... Clicking unknown links is always a bad idea, but a CVE for that? I dunno....

Clicking an unknown link shouldn't result in compromise. Fortunately, MS-Windows disallows running anything not vetted by MS unless you figure out how to bypass the "SmartScreen" filter. This filter is super annoying to many a techie or gamer, but for MS-Windows refusing to run "unknown" programs is a feature, not a bug. So yes, MS will likely denounce this as not their problem and move on.

so if you download a random EXE in your browser and run that, it can not result in compromise?

Re: Windows Notepad App Remote Code Execution Vulnerability

#418

Earlier quoted context omitted.

>Creating a separate User (User folders are permission locked to their user by default, system binaries cannot be modified without admin access) Common practice, and even encouraged by Windows itself, is having the administrator account be the only account. This misuse is a very common thread in Windows systems, and security breaches alike.

Windows has garbage defaults, but if you read through their documentation on enterprise architecture they definitely do not recommend having admin be the only account. They do in fact encourage separate accounts, multiple level of privileges with login restrictions across different types of machines, etc. Many Linux distros are also guilty of this, disabling the root account by default and having the only user have s…

Yes, however much more can be done in the user's own directory on Unix systems. Needing sudo raises some eyebrows, whereas most Windows users don't necessarily understand UAC, and almost never think twice about pressing "Yes" on the popups, which are seen more as an annoyance than something critical for safety. Some even completely disable UAC.

Re: Windows Notepad App Remote Code Execution Vulnerability

#419

Earlier quoted context omitted.

>No real sandboxing, a mountain of legacy… You have: - Windows Sandbox (consumer-level sandbox) - Creating a separate User (User folders are permission locked to their user by default, system binaries cannot be modified without admin access) - HyperV (VM hypervisor) - Edge Browsers Don't get me wrong MSFT quality is dropping steeply, but this is still a strong point. For comparision, on Ubuntu, user folder by default…

>Creating a separate User (User folders are permission locked to their user by default, system binaries cannot be modified without admin access) Common practice, and even encouraged by Windows itself, is having the administrator account be the only account. This misuse is a very common thread in Windows systems, and security breaches alike.

> Common practice, and even encouraged by Windows itself, is having the administrator account be the only account.

This hasn't been true since Vista. Kind of even before that with XP, it really showcased using multiple accounts to home users with a much more stylized user selection screen.

Re: Windows Notepad App Remote Code Execution Vulnerability

#420
post #65

use SublimeText, it is perhaps faster now than the stock Notepad

As much as I used to love Sublime, the version switching caught me out which burned me a bit, even if admittedly my v2 key lasted an unreasonable time through the version 3 beta, but I don't want to risk buying a v4 key without a clear roadmap of when they might switch to version 5.

They changed how that works. Licenses are no longer tied to version, you get 3 years of updates no matter what the version is.
Post reply on HN