Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Notepad++ hijacked by state-sponsored actors

notepad-plus-plus.org

Post reply on HN
Print view View original

481–490 of 560 posts

Re: Notepad++ hijacked by state-sponsored actors

#481

Post by Saris »

sciencejerk wrote: post #474
Saris wrote: post #456

I guess my habit of running a firewall and not allowing programs to access the internet unless they actually need it is helpful for stuff like this. Absolutely no reason a text editor needs internet access. I only update stuff through winget, which fetches the installer from github in a lot of cases, and changing a package requires a PR to the winget repo AFAIK. Not foolproof of course though.

LittleSnitch is great for MacOS; it is easily configured to alert you every time your machine makes ip/domain connections, which can then be accepted, denied, or rules made

Yeah I've been using Fort on windows, it's easy to use and not closed source and full of bloat like the commonly suggested windows firewalls from various security companies.

Re: Notepad++ hijacked by state-sponsored actors

#482

Post by Saris »

Pet_Ant wrote: post #465
Saris wrote: post #456

I guess my habit of running a firewall and not allowing programs to access the internet unless they actually need it is helpful for stuff like this. Absolutely no reason a text editor needs internet access. I only update stuff through winget, which fetches the installer from github in a lot of cases, and changing a package requires a PR to the winget repo AFAIK. Not foolproof of course though.

Checking for updates and pulling in plug-ins. Both are valid.

I think these days updates through the OS package manager is a better option, windows has had winget for 5+ years now, and obviously linux and macos both have their own established systems.

Re: Notepad++ hijacked by state-sponsored actors

#483

Post by nonamenoslogan »

np1810 wrote: post #479
sciencejerk wrote: post #474

Earlier quoted context omitted.

LittleSnitch is great for MacOS; it is easily configured to alert you every time your machine makes ip/domain connections, which can then be accepted, denied, or rules made

> LittleSnitch is great for MacOS; it is easily configured to alert you every time your machine makes ip/domain connections, which can then be accepted, denied, or rules made For an open-source alternative, consider checking out - Lulu [0]. It's not as feature rich nor has impressive UI like the former but gets the main work done. [0] https://github.com/objective-see/LuLu

I use LuLu, it works great. Its kept my older versions of Photoshop and Acrobat from complaining and showing me ads for newer versions for the last couple years!

Re: Notepad++ hijacked by state-sponsored actors

#484

Post by Lammy »

hypeatei wrote: post #417
Lammy wrote: post #220

Earlier quoted context omitted.

I use a package manager that checks the hash of the downloaded installer against what's recorded in the package listing for that version. WinGet has been built in to Windows since one of the 2018-era releases of Windows 10: https://i.ibb.co/VYGXdc56/2026-02-01-20-46-28-Greenshot.png

Integrity checks say nothing about the package authenticity, though. State sponsored actors could just... change the hash on the listing in a hypothetical attack.

“Just” lol

That would be two things that would have to be compromised and redirected simultaneously to malicious versions. Way more likely to be noticed too because one of them would be GitHub, and unless they mirror the entire rest of the package metadata index and keep it up to date for everything else besides their targeted malicious package.

Re: Notepad++ hijacked by state-sponsored actors

#485

Post by djkoolaide »

nonamenoslogan wrote: post #483
np1810 wrote: post #479

Earlier quoted context omitted.

> LittleSnitch is great for MacOS; it is easily configured to alert you every time your machine makes ip/domain connections, which can then be accepted, denied, or rules made For an open-source alternative, consider checking out - Lulu [0]. It's not as feature rich nor has impressive UI like the former but gets the main work done. [0] https://github.com/objective-see/LuLu

I use LuLu, it works great. Its kept my older versions of Photoshop and Acrobat from complaining and showing me ads for newer versions for the last couple years!

Tossing in a suggestion for Vallum[0] here. It's not FOSS but very polished and a fraction of the cost of Little Snitch.

[0]: https://vallumfirewall.com/

Re: Notepad++ hijacked by state-sponsored actors

#486

Post by latexr »

expedition32 wrote: post #401
card_zero wrote: post #349

Earlier quoted context omitted.

Debatable. "I connected Windows XP to the Internet; it was fine" - https://news.ycombinator.com/item?id=40528117 One comment there points out that XP is old enough for infected attack vectors to have all died out. I dunno.

Anyone else noticed that we don't even GET patch notes anymore? "Fixed some bugs" Yes thank you very helpful that! Now I can make a very informed decision.

I hate that. “Bug fixes and improvements” every time. And then there are the ones who think they’re being cute with “our bird Fernando has been hard ar work eating those nasty bugs and flying over the rainbow to bring you an ever delightful experience”. Just, no. I don’t mind you flexing some creative writing muscles in your release notes if you provide actual clear information, but if you’re going to say nothing like everyone else, might as well use the same standard useless message so I can dismiss it quick.

Re: Notepad++ hijacked by state-sponsored actors

#487

Post by cwnyth »

skeledrew wrote: post #433
cwnyth wrote: post #213

Earlier quoted context omitted.

They said "likely", so they don't "know." Yours is the wrong question.

The "likely" does give the impression that they have a pretty good idea.

I didn't say that to be pedantic, but to avoid that particular type of asker who isn't actually asking a genuine question here. After listing all the ways that Notepad++ (as an example here) suspects who they suspect, the asker then comes back with "Yeah, but how do you know?", as if that's some sort of gotcha. It's disingenuous. Even if the person I replied to isn't attempting this, I find it good to call out and get people to ask a better question: what's the evidence and why does that evidence point to this conclusion?

Re: Notepad++ hijacked by state-sponsored actors

#488

Post by akimbostrawman »

direwolf20 wrote: post #407
mshroyer wrote: post #253

Earlier quoted context omitted.

> Asking for "no politics" is itself a strong political view No, it explicitly is not, and this "deepity" doesn't change any rational analysis. The injection of politics into every aspect of society must and should be refused.

Can you name some aspects of society that are non–political? I can't think of many. Maybe the frequency spectrum of sunlight?

please tell me about the intricate politics of a phone booth. just because you can make everything political doesn't mean it is inherently political or doesn't make you look like a terminal online annoying loser when you try to compensate for your vapid personality outside of ideological dogma.

Re: Notepad++ hijacked by state-sponsored actors

#489

Post by idiotsecant »

cookiengineer wrote: post #118
idiotsecant wrote: post #99

Earlier quoted context omitted.

Someone tried to kill you?! People actually killed your friends? Not sure if schizophrenia or actual story ... I desperately need to hear more of this story.

[flagged]

I have to say, the fact that you immediately ascribe to malicious intent my very clearly curious request is not making me think schizophrenic less.

Re: Notepad++ hijacked by state-sponsored actors

#490

Post by nophunphil »

leosarev wrote: post #255
FormerBandmate wrote: post #237

Earlier quoted context omitted.

You can totally say Texas should be independent. A lot of Texans have. You can’t be against the Ukraine war in Russia because Putin is an evil dictator

I'm writing this comment from Russia, St. Petersburg, and yes, you can be against the Ukraine war in Russia.

Educate me then. The mental image I have from researching the topic seems contrary to what you’re saying.
Post reply on HN