Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Notepad++ hijacked by state-sponsored actors

notepad-plus-plus.org

Post reply on HN
Print view View original

441–450 of 560 posts

Re: Notepad++ hijacked by state-sponsored actors

#441

Post by nonameiguess »

esperent wrote: post #88
ryandrake wrote: post #44

Earlier quoted context omitted.

Similar comments also come up in the [now regular] "I don't want to see political articles on HN" threads, and I think the response is similar: Asking for "no politics" is itself a strong political view: One in support/service of whatever the current status quo is. Trying to set oneself apart from (or above) politics is itself political. If you're lucky enough to be one of the fortunate people on earth who are not un…

I partially agree, but as a non-US user of the English speaking internet, the issue is with specifically US politics and social issues being everywhere . It drowns out all attempts at discourse for anything else, and Americans, including people here, seem uniquely incapable of nuance in their thinking when it comes to politics. So, while I fully agree with your stance that banning political discourse is support for t…

To be clear, this is a Frenchman of Chinese descent advocating for Taiwanese independence and your complaint is about Americans.

Re: Notepad++ hijacked by state-sponsored actors

#442

Post by pxc »

tasuki wrote: post #432
illiac786 wrote: post #336

Earlier quoted context omitted.

Yes, it is very much atypical. Most hacks happen because admins still haven’t applied a 2 years old patch. I hate updates, but it‘s statistically safer that running an old software version. Try exposing a windows XP to the internet and watch how long it takes before it‘s hacked.

I don't know about Windows, but I've been running all kinds of outdated Linux (Debian mostly) and it never once caused a security problem.

Debian backports security patches.

Re: Notepad++ hijacked by state-sponsored actors

#443

Post by lelanthran »

Wilder7977 wrote: post #393
lelanthran wrote: post #388

Earlier quoted context omitted.

Okay, lets go with your reasoning - software should not be apolitical/should be more political. Where's the bar where you shut down discussion? I mean, even politics is contextual, right? You entering a campaign about the plight of Myanmar and getting annoyed at people who don't want to hear your message about Gaza puts the blame for any conflict arising on that purely on ... YOU! IOW, Even within political discussio…

You are confusing being political with carrying out political discourse. They are not the same thing. Being political for software means for example making some specific choices while designing it and advertising them as such. Means choosing a license over another. Means announcing political positions and possibly aligning the software to them (depending on what it is). It doesn't mean going in forums related to that…

> You are confusing being political with carrying out political discourse. They are not the same thing.

Okay, lets assume you are correct[1]; is that a counterargument to my main argument:

>> IOW, Even within political discussion, you can still be off-topic!

------------------------------------

[1] I don't think I am confused about the difference, TBH - I explicitly called out political preference of a project and political discussion within the project.

Re: Notepad++ hijacked by state-sponsored actors

#444

Post by the_fall »

avazhi wrote: post #355
the_fall wrote: post #226

Earlier quoted context omitted.

That's the most honest assessment you can expect from any small-scale developer. What do you expect them to say or do? Their adversary is presumably a national intelligence agency of a superpower . The odds may be better if you operate the way OpenSSH does: move slow, security first, architect everything to be very difficult to attack. But if you're building a text editor, it's not your mindset, and probably never wi…

> The odds may be better if you operate the way OpenSSH does: move slow, security first, architect everything to be very difficult to attack. But if you're building a text editor, it's not your mindset, and probably never will be. I mean, if you look at the Notepad++ website this developer seems just as concerned at spamming political messaging all over everything as much as he is with writing the software he's distr…

First, you're getting upset at a random person on the internet for expressing their political views. Second, your objection almost certainly has nothing to do with this attack. It targeted some specific subset of users of Notepad++, not the maintainer.

Re: Notepad++ hijacked by state-sponsored actors

#445

Post by pxc »

bibimsz wrote: post #184
username223 wrote: post #177

Earlier quoted context omitted.

Disable auto-updates, just like you should with every piece of software on your machine. This was the result of letting other people silently replace your programs. Don't allow that.

that's why I still run Windows XP. Automatic updates are dangerous!

Centralized automatic updates, like those of a Linux distribution or Microsoft's Windows Updates, involve giving permission to way fewer parties permission to download and run (unsigned, in the case of Notepad++ this time) code on your machine with high privileges.

And for more modern software distribution mechanisms (e.g., Nix, Guix, Flatpak), centralized package updates may not actually run any vendor code with high privileges at all.

The norm for proprietary software updates on Windows is indeed a free-for-all of every publisher downloading and running code with admin rights, and it is indeed a terrible way to operate. Avoiding that kind of madness doesn't necessarily mean running lots of old, vulnerable software.

Re: Notepad++ hijacked by state-sponsored actors

#446

Post by hnuser123456 »

direwolf20 wrote: post #407
mshroyer wrote: post #253

Earlier quoted context omitted.

> Asking for "no politics" is itself a strong political view No, it explicitly is not, and this "deepity" doesn't change any rational analysis. The injection of politics into every aspect of society must and should be refused.

Can you name some aspects of society that are non–political? I can't think of many. Maybe the frequency spectrum of sunlight?

Politics is more of a way of thinking and speaking than about any specific topic. For those of us who see a lot of problems with society but know that things will never be how they "should be", it is healthy to limit amount of time spent thinking about problems that cannot and will not be solved.

Re: Notepad++ hijacked by state-sponsored actors

#447

Post by 1vuio0pswjnm7 »

edb_123 wrote: post #185

So, let me get this straight. If I've been lazy, postponed updates and I'm still on 8.5.8 (Oct 2023) - it turns out I'm actually...safer? Anyway, I hope the author can be a bit more specific about what actually has happened to those unlucky enough to have received these malicious updates. And perhaps a tool to e.g. do a checksum of all Notepad++ files, and compare them to the ones of a verified clean install of the u…

"So, let me get this straight. If I've been lazy, postponed updates and I'm still on 8.5.8 (Oct 2023) - it turns out I'm actually...safer?"

This is true for a large number of software "security" issues

A software version earlier in date/time is not necessarily inferior (or superior) to a version later in date/time

As it is "updated" or rewritten,, software can become worse instead of better, or vice versa, for a vaariety of reasons

Checking software's release date, or enabling/allowing "automatic updates" is not a substitute for reading source code and evaluating software on the merits

Re: Notepad++ hijacked by state-sponsored actors

#448

Post by dec0dedab0de »

hinkley wrote: post #193
edb_123 wrote: post #185

So, let me get this straight. If I've been lazy, postponed updates and I'm still on 8.5.8 (Oct 2023) - it turns out I'm actually...safer? Anyway, I hope the author can be a bit more specific about what actually has happened to those unlucky enough to have received these malicious updates. And perhaps a tool to e.g. do a checksum of all Notepad++ files, and compare them to the ones of a verified clean install of the u…

This reminds me of college, when some of my professors were still sorting out their curriculum and would give us homework assignments with bugs in it. I complained many times that they were enabling my innate procrastination by proving over and over again that starting the homework early meant you would get screwed. Every time I'd wait until the people in the forum started sounding optimistic before even looking at t…

They should have just gave out extra credit for finding bugs.

Re: Notepad++ hijacked by state-sponsored actors

#449

Post by alighter »

appreciatorBus wrote: post #437
stackbutterflow wrote: post #392

Earlier quoted context omitted.

Allowing politics on HN doesn't mean discussing politics in every thread. If it's a story about someone who improved performance of their system by using Rust then sure there's no need to bring anything political. But threads about Nvidia, Tesla, encryption, internet blackouts, social media, startups investments, etc, all warrants political discourse.

I wish that were true, but in my experience so far, it isn’t. Not only does politics and general stories crowd out everything else over time on other sites, there are HN submitters who seem to be trying to accelerate this. During the war, when HN was getting Israel-Palestine stories constantly, I started looking at the submission history of some of the submitters, and some of them were just pushing these types of sto…

Globalizing the intifada means pushing an agenda everywhere, including on HN, on posts where it is relevant and on posts where some obscure or conspiratorial connection can be made.

If HN is going to allow accusations to be slung against groups of people it has to allow others to respond, and that sets off endless debate amongst people who will not be changing their minds on the matter but will repeat the same argument on the next post.

Post reply on HN