Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows Notepad App Remote Code Execution Vulnerability

cve.org

Post reply on HN
Print view View original

471–480 of 538 posts

Re: Windows Notepad App Remote Code Execution Vulnerability

#471

Post by efreak »

latexr wrote: post #230
jfaganel99 wrote: post #11

Notepad had one job... Seems like bringing markdown features killed it :)

Something felt off about your comments, so I checked your account. You signed up almost six years ago, and in all that time made zero submissions and your only comments are these two on this thread? I’ve been seeing this more and more on HN. What exactly is going on here?

This perfectly describes my former experience with Reddit: I used to browse quite frequently without being logged in. If I wanted to post a reply badly enough to bother with logging in, I would then start commenting on other parts as well; the next day I'd likely be logged out again and not be willing to bother with signing in again for a few more months. Though this did change when the I started using mobile apps more.

Re: Windows Notepad App Remote Code Execution Vulnerability

#472

Post by NetMageSCW »

procaryote wrote: post #448
Hackbraten wrote: post #191

Earlier quoted context omitted.

Unpopular opinion: rudimentary Markdown support is not entirely far-fetched even for a dumb text editor. Even though I’m all against feature bloat, I think that making Markdown hyperlinks clickable is still within the Overton window of what a simple editor should be doing.

Markdown is readable as plain text, that's kind of the point of it There's also a pretty large jump between "I can ask the system to open this link in the default browser" and "I have built my own link handling in a memory-unsafe language to support some really fringe features, and oops it's exploitable"

Except memory-unsafe and fringe features have nothing to do with this CVE, which seems incredibly dumb on the face of it.

Replace Notepad with Chrome or Edge - clicking on a link downloads content from the Internet! Oh noes!

Re: Windows Notepad App Remote Code Execution Vulnerability

#473

Post by JasonADrury »

keepamovin wrote: post #67
Fiveplus wrote: post #14

We have officially reached the logical conclusion of the feature-bloat-to-vulnerability pipeline. For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text. An 8.8 CVSS on a utility meant for viewing data is a fundamental failure of the principle of least privilege. At some point, they need to stop aski…

I couldn't agree more. A text editor exposing an attack surface via a network stack is precisely the kind of bloat that makes modern computing ultra-fragile. I actually built a "dumb" alternative in Rust last week specifically to escape this. It’s a local-only binary—no network permissions, encrypted at rest, and uses FIPS-compliant bindings (OpenSSL) just to keep the crypto boring and standard. It’s inspectable if y…

This is all vibecoded FWIW, I think it'd be cool if authors more proactively disclosed this.

Re: Windows Notepad App Remote Code Execution Vulnerability

#474

Post by NetMageSCW »

abustamam wrote: post #453
graemep wrote: post #260

Earlier quoted context omitted.

Is this a big deal? is it also not a problem with anything that renders clickable links? Browsers, email clients, whatever. Is this not a problem with anything that offers a preview of markdown (or HTML, or anything with embedded links)?

It could be. But why is notepad doing anything other than rendering text? I don't expect it to make links clickable, or render markdown.

That was old Notepad. This is new Notepad.

Re: Windows Notepad App Remote Code Execution Vulnerability

#475

Post by NetMageSCW »

zabzonk wrote: post #128
pjmlp wrote: post #69

Earlier quoted context omitted.

The reason being it is a plain text edit component, with a window around it, hence the limitation.

Yep. Back when I used to teach Windows programming in C commercially, the course exercise was to replicate notepad. It was surprising how many of its features you could implement in a week-long course, especially as many of our clients were no great shakes at C.

I think it is more surprising how many deeper features were hidden in Notepad (I did a complete re-implementation using MFC for Windows CE).

Did you implement .LOG and Unicode support with BOM handling?

Re: Windows Notepad App Remote Code Execution Vulnerability

#476

Post by SV_BubbleTime »

grougnax wrote: post #459

At this point Windows should just be thrown to the trash already

Meme aside, I’ve honest seen more people switch to Linux this year for “windows really sucks now” reasons than ever before.

I was there last year myself. Decades of “eh, it’s not that bad” to “nope no, no fuck this”.

Re: Windows Notepad App Remote Code Execution Vulnerability

#477

Post by abustamam »

NetMageSCW wrote: post #474
abustamam wrote: post #453

Earlier quoted context omitted.

It could be. But why is notepad doing anything other than rendering text? I don't expect it to make links clickable, or render markdown.

That was old Notepad. This is new Notepad.

I think my comment still stands though. Why is "new" Notepad getting new features? It was perfect as it was.

Re: Windows Notepad App Remote Code Execution Vulnerability

#478

Post by NetMageSCW »

SPICLK2 wrote: post #63
IsTom wrote: post #48

Earlier quoted context omitted.

> in the design of Notepad++ One could argue it's an issue with windows where you can't just pull updates using a package manager/app store.

I'm not sure who I trust less to handle package integrity, the 3rd party hosting provider that Notepad++ used, or Microsoft.

The third party hosting provider had nothing to do with package integrity, that was under Notepad++ control and basically they had none. The real issue is every company or application creating their own Internet update system.

Re: Windows Notepad App Remote Code Execution Vulnerability

#479

Post by NetMageSCW »

voidUpdate wrote: post #55
IsTom wrote: post #48

Earlier quoted context omitted.

> in the design of Notepad++ One could argue it's an issue with windows where you can't just pull updates using a package manager/app store.

You can if you use the windows store. It's just that you usually install things outside of that, unlike in linuxes where you generally use the package manager that can handle updates for you

There’s a real problem trying to use the store with command line tools as they don’t use Windows standards for installing things but create GUID folders under your profile instead, which means your path has to be full of garbage or you have to create a lot of aliases.

Re: Windows Notepad App Remote Code Execution Vulnerability

#480

Post by NetMageSCW »

oblio wrote: post #395
TZubiri wrote: post #339

Earlier quoted context omitted.

Just make another user bro. If you can't even create a user to run a program you distrust, the issue is not that windows doesn't provide sandboxes, it's that you don't use them And no, it's not "a lot of work" it's the bare minimum

Yet 99% of the planet doesn't do "the bare minimum", bro. We have supposedly all the smartest minds in the world working in tech and they haven't been able to create a simple, cheap, reliable cross platform solution for user data protection, backup and restore. It's easier to blame users instead.

The iPad and iPhone say “Hi!” - at least until the EU and other companies get done ruining them.
Post reply on HN