Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows Notepad App Remote Code Execution Vulnerability

cve.org

Post reply on HN
Print view View original

481–490 of 538 posts

Re: Windows Notepad App Remote Code Execution Vulnerability

#481

Post by NetMageSCW »

barosl wrote: post #126
xnorswap wrote: post #81

Earlier quoted context omitted.

Wow that's a hit of nostalgia, I'd completely forgotten about metapad, but I loved it back in the day. And it's hard to believe now, but yes, support for Ctrl+S to save file was a notable feature because notepad itself didn't support that back then.

Oh wow, yes I remember now, I used to type `Alt+F` and then `S` immediately because Notepad didn't support `Ctrl+S` back then. Thanks for giving me nostalgia!

I always did ALT-F4 Y (but I think it is S now) because I like to live dangerously.

Re: Windows Notepad App Remote Code Execution Vulnerability

#482

Post by zabzonk »

NetMageSCW wrote: post #475
zabzonk wrote: post #128

Earlier quoted context omitted.

Yep. Back when I used to teach Windows programming in C commercially, the course exercise was to replicate notepad. It was surprising how many of its features you could implement in a week-long course, especially as many of our clients were no great shakes at C.

I think it is more surprising how many deeper features were hidden in Notepad (I did a complete re-implementation using MFC for Windows CE). Did you implement .LOG and Unicode support with BOM handling?

This was on Windows 3.1. I don't think the version of notepad there had any Unicode support - certainly the one in our training course didn't; I didn't feel up to teaching C, the Windows API _and_ Unicode. It was just a slightly realistic exercise where our clients could implement as much or as little as they felt happy with, making use of standard windows controls as much as possible.

Re: Windows Notepad App Remote Code Execution Vulnerability

#483

Post by NetMageSCW »

xxs wrote: post #18
dark-star wrote: post #3

Yeah, clicking unverified links in a markdown document to launch an executable.... Clicking unknown links is always a bad idea, but a CVE for that? I dunno....

clicking links should not be a security issue and yes the CVE is totally deserved: that's remote code execution.

How is the code execution remote?

Re: Windows Notepad App Remote Code Execution Vulnerability

#484

Post by bigstrat2003 »

wang_li wrote: post #411
titzer wrote: post #313

Earlier quoted context omitted.

As I posted in a sibling, I thought the whole point of markdown was that it was simplified to the point that rendering it was easy to do from scratch. But we fumbled that because we (collectively) have no idea what we are doing.

>But we fumbled that because we (collectively) have no idea what we are doing. Because, almost entirely, the software development industry has disclaimed all responsibility. It's super common for people to try to do shit they have no experience or skill at, push their effort to be adopted by others, then when it crashes and burns they have no accountability. If software "engineers" adopted the rigors and accountabili…

And on top of that, now we have people letting LLMs go to town on their work, even though the things can't program worth a damn, all because those people can't be assed to actually program (you know, their job). We're entering very dark days for software quality, unfortunately.

Re: Windows Notepad App Remote Code Execution Vulnerability

#485

Post by bigstrat2003 »

oblio wrote: post #395
TZubiri wrote: post #339

Earlier quoted context omitted.

Just make another user bro. If you can't even create a user to run a program you distrust, the issue is not that windows doesn't provide sandboxes, it's that you don't use them And no, it's not "a lot of work" it's the bare minimum

Yet 99% of the planet doesn't do "the bare minimum", bro. We have supposedly all the smartest minds in the world working in tech and they haven't been able to create a simple, cheap, reliable cross platform solution for user data protection, backup and restore. It's easier to blame users instead.

> It's easier to blame users instead.

Yes, because the users are in fact the problem. The options are either to trust the user to make decisions (and technically illiterate users will screw things up for themselves), or lock down the system so that the user isn't allowed to do anything the corporate overlord doesn't let them. There is no middle ground.

Re: Windows Notepad App Remote Code Execution Vulnerability

#486

Post by appreciatorBus »

optymizer wrote: post #351
appreciatorBus wrote: post #321

Earlier quoted context omitted.

Just having the option of giving up $1 million in compensation put one far far far above meaningful worries about your well-being and the happiness of your kids.

Not really. We would have to downsize our life. I'll have to explain it to the wife: "well, you see, we cant live in this house anymore because AI in Notepad was just too much". I'll dial up my ethical and moral stance on software up to 11 when I see a proper social safety net in this country, with free healthcare and free education. And if we cant all agree on having even those vital things for free, then relying on…

I posed my comment poorly and trollishly.

I don't think you should make any change you don't want to, I'm not arguing for collective agreement on anything, and I'm not convinced there's a big ethical case for or against AI, even in Notepad.exe. If you can make $1M, go nuts, I just think it's not a great example of dealing with ethics & tradeoffs.

I was more just reacting to your the contrast between ideas early in this thread, and your implication of a $1M comp. Early in the thread there was implication that poor/exploited/low-level workers with few other options were either being blamed for AI in notepad, or should not be blamed. Then you casually drop the $1M comp line. Maybe that's real, maybe it's not but regardless, it felt silly to compare the earlier population with people who can or have made $1M. Of course we all face challenges, and the hedonic treadmill calls for us equally at $1K/year and $1M/year, I just think people in the latter have objectively more options, even if the wife complains, than people in the former, and it's tough to take the latter seriously when they talk about lifestyle adjustments.

Re: Windows Notepad App Remote Code Execution Vulnerability

#487

Post by contextfree »

jiggawatts wrote: post #451

For Linux folks: Notepad is the Windows equivalent of a console editor such as Pico or Vi. Its job is to be robust, simple, and always available. It's supposed to show you the symbols in markdown, not render them. It is useful for opening potentially dangerous content in a 100% safe way, because "txt" should always be safe to inspect! It is regularly used to open gigabyte-sized log files and the like, which it has to…

It doesn't do any markdown parsing unless you specifically open a .md file

Re: Windows Notepad App Remote Code Execution Vulnerability

#488

Post by jiggawatts »

contextfree wrote: post #487
jiggawatts wrote: post #451

For Linux folks: Notepad is the Windows equivalent of a console editor such as Pico or Vi. Its job is to be robust, simple, and always available. It's supposed to show you the symbols in markdown, not render them. It is useful for opening potentially dangerous content in a 100% safe way, because "txt" should always be safe to inspect! It is regularly used to open gigabyte-sized log files and the like, which it has to…

It doesn't do any markdown parsing unless you specifically open a .md file

It should never do any kind of parsing for any kind of file, irrespective of the file extension!

It's supposed to be a basic text file viewer / editor, not an alternative to WordPad or VS Code!

Not every app has to be everything for everybody.

We're in an era now where Calc.exe takes appreciable time to start and pops up HTTP web proxy authentication prompts on some networks.

It's just incredible to me the level of enshittification people just shrug off like it's nothing.

Just now, I'm trying to debug something in Visual Studio 2026. The debugger's "view list" control takes over 10 seconds to pop up a simple table of text.

Text! Tens of seconds! On a gaming/workstation PC!

Nobody at Microsoft thought this was a problem.

Re: Windows Notepad App Remote Code Execution Vulnerability

#489

Post by Falkon1313 »

I still don't understand this one. Yes, clicking a link can trigger what it's linking to. That's the entire concept of links.

You can also put a shortcut to a program on your desktop and - horror of horrors! - clicking the shortcut will execute the program! How crazy is that?

I get that some people don't want the markdown functionality in notepad (you can turn it off very easily, btw). But I don't understand why suddenly the idea of hyperlinks is being blasted as a terrible security vulnerability?

Surely there has to be more to this, in order to generate so much hubbub, than just people not understanding the basic concept of hyperlinks?

Re: Windows Notepad App Remote Code Execution Vulnerability

#490

Post by 1vuio0pswjnm7 »

asadm wrote: post #463
gkcnlr wrote: post #360

By looking at their 2025 shareholder report (Look for the part below "NOTE 18"), Windows is only at the 5th place in terms of revenue source, even below the LinkedIn: https://www.microsoft.com/investor/reports/ar25/index.html# I can only think that they do not even care about Windows anymore, let alone Notepad...

Windows is their trojan-horse.

Redmond botnet
Post reply on HN