Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Notepad++ hijacked by state-sponsored actors

notepad-plus-plus.org

Post reply on HN
Print view View original

451–460 of 560 posts

Re: Notepad++ hijacked by state-sponsored actors

#451

Post by p_ing »

nophunphil wrote: post #151
p_ing wrote: post #143

Earlier quoted context omitted.

> I would argue that this has been an effective avenue for messaging/protest. You’re responding to it on this very board - that means you’re thinking about it. I think about a lot of things I do absolutely nothing about (or with). Thinking about whatever messaging is here is like saying "thoughts and prayers". It means shit all nothing. The messaging was a waste of my time and your time. It was an ad for a product yo…

I don’t see it as a waste of my time. I am not in the habit of seeing conflicts in which innocent people die as a “waste of my time”. The idea that my time is somehow more valuable than another person’s is narcissistic.

Yet more "thoughts and prayers" rhetoric. If you want to actually be engaged, go do something directly for those people. Until that point, it's simply thoughts and prayers.

Re: Notepad++ hijacked by state-sponsored actors

#452

Post by beached_whale »

edb_123 wrote: post #185

So, let me get this straight. If I've been lazy, postponed updates and I'm still on 8.5.8 (Oct 2023) - it turns out I'm actually...safer? Anyway, I hope the author can be a bit more specific about what actually has happened to those unlucky enough to have received these malicious updates. And perhaps a tool to e.g. do a checksum of all Notepad++ files, and compare them to the ones of a verified clean install of the u…

lol, im on 7.3.x for extra safety

Re: Notepad++ hijacked by state-sponsored actors

#453

Post by throw5543e4f »

LoganDark wrote: post #33
icelancer wrote: post #6

Earlier quoted context omitted.

Yeah, Notepad++ is known for political messaging in their updates. Taiwan, Ukraine, etc.

I can't help but feel there must some better venue for such messaging. When I see politics in software updates or documentation, nothing happens because I'm not looking to use the software for political activism. Maybe I tell my adblocker to remove the messaging, and carry on with my task. I can engage with politics in a social context, when political messaging isn't interrupting something else I'm doing; that's a be…

I agree, especially because they are so selective with their messaging and support causes as well.

Re: Notepad++ hijacked by state-sponsored actors

#454

Post by throw5543e4f »

iamnothere wrote: post #148
nophunphil wrote: post #112

Earlier quoted context omitted.

> I can't help but feel there must some better venue for such messaging. I would argue that this has been an effective avenue for messaging/protest. You’re responding to it on this very board - that means you’re thinking about it. Another angle: would such free protest be allowed if the developers of Notepad++ were based in China or Russia? I seriously doubt it.

Typically when I see such messaging in an out of place venue it nudges me slightly against both the message and the venue pushing the message. This occurs regardless of whether I agree with the message. I feel the same way as when I see an ad: this does not belong here. I don’t think I am the only one who has this reaction. People who do this should consider if it’s actually helping their cause. If not it’s just feel…

Same, especially if I see they have a double standard.

Re: Notepad++ hijacked by state-sponsored actors

#455

Post by QuiEgo »

dec0dedab0de wrote: post #448
hinkley wrote: post #193

Earlier quoted context omitted.

This reminds me of college, when some of my professors were still sorting out their curriculum and would give us homework assignments with bugs in it. I complained many times that they were enabling my innate procrastination by proving over and over again that starting the homework early meant you would get screwed. Every time I'd wait until the people in the forum started sounding optimistic before even looking at t…

They should have just gave out extra credit for finding bugs.

I had a professor who did this. One letter grade bump *after curve* applied per assignment per bug found (reproduce case and fix required).

Loved that class.

Re: Notepad++ hijacked by state-sponsored actors

#456

Post by Saris »

I guess my habit of running a firewall and not allowing programs to access the internet unless they actually need it is helpful for stuff like this.

Absolutely no reason a text editor needs internet access.

I only update stuff through winget, which fetches the installer from github in a lot of cases, and changing a package requires a PR to the winget repo AFAIK. Not foolproof of course though.

Re: Notepad++ hijacked by state-sponsored actors

#457

Post by rdiddly »

nhinck3 wrote: post #354
maremmano wrote: post #330

I’m on version 8.8.8, which says a lot. This time I unfortunately have to move on from Notepad++. Vibes have been negative for a while but out of inertia (and because there weren't obvious alternatives) I never pulled the trigger. Now it's time. The trust is gone. Thanks NP++ for being free and useful for so many years. Can anyone suggest a solid alternative on Windows? I'm fine with Linux and macOS but I have to kee…

> I don't like tooling that increases my exposure to bad state actors > Can anyone suggest a solid alternative on Windows What a weird reason to switch. I don't know why you'd believe any other piece of software is somehow more secure against state actors.

Are we supposed to ignore announcements of documented compromises then? Or are you saying compromised software is the safest of all?

Re: Notepad++ hijacked by state-sponsored actors

#458

Post by sbohacek »

tech234a wrote: post #32

Notably Notepad++ was recently shipping unsigned/self-signed updates, apparently overlapping with the time of this incident, see releases 8.8.2-8.8.6: https://notepad-plus-plus.org/news/

The lack of signing and/or checking the signature when updating is the real issue here. But the write up blames the attack on the hosting server. That doesn't bode well for future security.

Re: Notepad++ hijacked by state-sponsored actors

#459

Post by 1970-01-01 »

This is where package managers shine. You never know if there are vulns in the update servers, and you don't know if they even bother with checksums. I never trust apps that self-update for exactly this reason. Turn that shit off and do

     choco update notepadplusplus
or

     winget upgrade Notepad++.Notepad++
Of course, this does nothing for bugs in the code.

Re: Notepad++ hijacked by state-sponsored actors

#460

Post by lII1lIlI11ll »

kvemkon wrote: post #435
FormerBandmate wrote: post #237

Earlier quoted context omitted.

You can totally say Texas should be independent. A lot of Texans have. You can’t be against the Ukraine war in Russia because Putin is an evil dictator

> You can totally say ... "Say" in the sense of demonstrate peacefully for this? Then I'm impressed. If someone else can confirm this? Is this because of USA being a federal union? Before Ukraine declared independence, there were voices to make Ukraine a federal state, so that people in the West part of Ukraine can live their way of life and people living 1600 km (!) away in the East and Southern parts would be not m…

> Is this because of USA being a federal union? Before Ukraine declared independence, there were voices to make Ukraine a federal state, so that people in the West part of Ukraine can live their way of life and people living 1600 km (!) away in the East and Southern parts would be not much affected from that and vice versa.

You are falling for Russian propaganda about evil western-Ukrainian nazis attempting to enslave peaceful-Russian-speaking-peoples-of-Donbass-or-whatever who were just minding their own business ("way of life"). As a Russian-speaking Ukrainian neither do I want Putin to protect me (apparently by looting my apartment and raping my girlfriend or in whichever way he is trying to do it these days), nor do absolute majority of population of, say, Kharkiv, Odesa or Kherson.

> Voices for the unitary state were stronger because of stability of the state. Would be interesting to see some documentary "what if", whether a federal state would be more stable against pulling from the west (Europe, US) and the east (Russia).

As a Ukrainian I find that idea quite laughable. It is not really possible for a part of federal union (say a state of USA or a Swiss canton) to join NATO and for other part to "decide" to become a Russian-occupied quasi-state like Belarus. Same goes for a part of it joining EU while some other part decides it wants to be part of EAEU Customs Union. State's foreign affairs are still decided by some central government.

Also, you can research how great "deciding on their own way of life" works in Russian Federation. You could start with first and second Chechen Wars.

Post reply on HN