Live data from Hacker News

Notepad++ hijacked by state-sponsored actors

notepad-plus-plus.org

491–500 of 560 posts

Re: Notepad++ hijacked by state-sponsored actors

#491
post #331

Earlier quoted context omitted.

> So, let me get this straight. If I've been lazy, postponed updates and I'm still on 8.5.8 (Oct 2023) - it turns out I'm actually...safer? Is this surprising? My model is that keeping with the new versions is generally more dangerous than sticking with an old version, unless that old version has specific known and exploitable vulnerabilities.

Yes, it is very much atypical. Most hacks happen because admins still haven’t applied a 2 years old patch. I hate updates, but it‘s statistically safer that running an old software version. Try exposing a windows XP to the internet and watch how long it takes before it‘s hacked.

To be fair I doubt there are that many people scanning for internet facing XPs in 2026.

On the other hand, any server running old, unpatched versions of apache or similar will get picked up by script kiddies scanning for publicly known vulns very, very fast.

The notepad++ attack is politically targeted and done through unconventional channels (compromise in the hosting provider). I don't think 99% of the people reading this thread has a comparable threat model.

Re: Notepad++ hijacked by state-sponsored actors

#492

Earlier quoted context omitted.

I'm taking you're from the US from the "either team" comment. That is a really elementary understanding of politics. Politics, again, is a word describing how humans behave in groups. Where are roads built? That's a political decision made by groups of humans reaching consensus. What is the budget for the local security force? That's a political decision made by groups of humans reaching consensus. How much money is…

You know what's even more important than politics? Water. That doesn't mean I need to read a prologue about water in every HN article reminding me that I require water to survive. You seem very angry at a stranger on the internet. I think a break from thinking about everything through the lens of politics might be good for you.

People will start talking about water when a water shortage starts impacting their day to day life. For the average western world resident, water is not a problem, yet. But I bet you people in Tehran cares a fuckton about their water running out.

The same with politics. When politicians keep their hands off the society, no one feels pressed to talk about politics. When an authoritarian regime compromises a widely used open source software to conduct espionage, of course people will start talking about politics.

Re: Notepad++ hijacked by state-sponsored actors

#493
post #480

Earlier quoted context omitted.

Which firewall software do you use? I should probably start using firewalls in my computers as well...

I've been using Fort: https://github.com/tnodir/fort It's the best one I found after trying a few, because it's pretty easy to use, and lets me disable notification popups which is a part that always frustrates me about other options.

Why am I hearing about that specific FW in year 2026, this seems really good, at least the features written if it really supports rules based on parent processes, wildcards, SvcHost granularity without gotchas. Been wrangling with Windows FW for ages, trying to get some badly behaved programs to update like Discord, Teams and others that change install paths or updater executable names or hiddenly use msedgewebview2. PolicyAppId and tagging based rules have given some success but Windows FW is still really broken. Definitely giving Fort a try.

Re: Notepad++ hijacked by state-sponsored actors

#494
post #314

Earlier quoted context omitted.

Anecdotally, my company has a device driver posted on Windows Update. I inherited the project and was digging through Microsoft’s hardware dashboard trying to find information on the stability of the driver. I ended up finding that our driver was crashing rather frequently. Looking closer, the name of the driver shown was curious as it contained the name of our driver as defined in the inf file, and appended at the e…

You're sure that you have a complete log of all the drivers that were ever uploaded?

Are you able to modify and resign locally without uploading?

Re: Notepad++ hijacked by state-sponsored actors

#495
post #332

I’m on version 8.8.8, which says a lot. This time I unfortunately have to move on from Notepad++. Vibes have been negative for a while but out of inertia (and because there weren't obvious alternatives) I never pulled the trigger. Now it's time. The trust is gone. Thanks NP++ for being free and useful for so many years. Can anyone suggest a solid alternative on Windows? I'm fine with Linux and macOS but I have to kee…

Sublime Text. It's art.

It was great 10 years ago before VS Code, but Sublime has been abandonware for years now.

Re: Notepad++ hijacked by state-sponsored actors

#496

Earlier quoted context omitted.

This is a good point. What would people think if there was constant political discussion here about, for instance, South Sudan and things happening there now? I'm sure there's bad stuff going on there and it's unfortunately, but if we had constant references to and discussions about the internal politics of South Sudan, I think a lot of people would get annoyed about issues that don't affect them at all in their day-…

Do you think it's socially acceptable to ignore everything that doesn't affect you personally? Many activists would certainly have you think otherwise. As far as I can tell, fighting that habit is a huge goal of activism.

>Do you think it's socially acceptable to ignore everything that doesn't affect you personally?

No one has the time to pay attention to every little injustice in the world. For all the people crying about Gaza, how many of them are dedicating as much energy to the wars in Sudan, Yemen, or Myanmar, or the abuses by Russian security services (like imprisoning a guy for holding up a blank card)? This isn't to say that we should just ignore Gaza or Ukraine or ICE in the US, but we need to make a choice: either we spend ALL our energy addressing every injustice in the world, until there is no more injustice left (and this means we need to stop everything else we're doing now, including keeping society running, making food, etc.), or we need to choose when and how much attention we'll devote to various issues.

Re: Notepad++ hijacked by state-sponsored actors

#497
post #493
post #480

Earlier quoted context omitted.

I've been using Fort: https://github.com/tnodir/fort It's the best one I found after trying a few, because it's pretty easy to use, and lets me disable notification popups which is a part that always frustrates me about other options.

Why am I hearing about that specific FW in year 2026, this seems really good, at least the features written if it really supports rules based on parent processes, wildcards, SvcHost granularity without gotchas. Been wrangling with Windows FW for ages, trying to get some badly behaved programs to update like Discord, Teams and others that change install paths or updater executable names or hiddenly use msedgewebview2.…

It's quite good! It definitely deserves to be more popular, I hope it gets some more recognition.

Wildcards are great, like you said for those apps that change the directory name every single update.

Re: Notepad++ hijacked by state-sponsored actors

#498

Earlier quoted context omitted.

It intrinsically does. Whatever stance changes nothing or prefers to change nothing is a vote for the status quo, by definition.

I wouldn't say that avoiding political discussion yourself because you can't handle it is a vote for the status quo, but telling others not to talk about politics is definitely a vote for the status quo.

Doesn't that depend entirely on the context? Telling the grocery store not to carry dairy products is an anti-dairy stance. Objecting to dairy products in the vegetable section is not anti-dairy it's pro-keeping-things-organized. Debating whether or not dairy ought to be allowed in the vegetable section is also not anti-dairy, at least in the general case.

Re: Notepad++ hijacked by state-sponsored actors

#499
post #225

Earlier quoted context omitted.

> the issue is with specifically US politics and social issues being everywhere. It drowns out all attempts at discourse for anything else Unfortunately, US politics also drives tech issues elsewhere like the EU. For example, local data control is a big thing that some of us have been screaming about forever but nobody paid attention to--until US politics made it a hot button issue. And, to be honest, if the EU would…

The EU is trying but these things have to happen bottom–up. The EU Council or EU Parliament isn't a software development shop. They allocate funds to groups like NLNET who allocate them to a selection of the projects they get proposals for. NLNET can only allocate funds to something an individual or small group proposes. If you want to propose something, please go ahead. Capitalists can also start software businesses…

> NLNET can only allocate funds to something an individual or small group proposes. If you want to propose something, please go ahead.

Well, gee, let's look at the sponsorship page for KiCad: https://www.kicad.org/sponsors/sponsors/

I see a couple EU companies, but no EU governments. It takes a paltry $15K to be a Platinum sponsor.

I picked KiCad because PCB design is critical military infrastructure, the alternative programs are almost all under non-EU jurisdictions and could be pulled, and KiCad is both open source and local desktop to top it all off. This is exactly the kind of quiet, unflashy toil that desperately needs support from a government entity.

Lots of areas need support for open source alternatives that are controlled by proprietary software that might vaporize. I picked PCB design because it's an easy target. Cadence and Synopsys have locks on VLSI design domains that could get yanked from the EU. VHDL tooling is still disastrously poor. Everybody could use an alternative 3D modeling kernel (the EU is a little better here because the dominant proprietary kernels are from Dassault Systèmes and Siemens). I'm sticking to software as the domain because the purpose of the funding is obvious (pay developers, duh), but it also applies to things like small manufacturing and maintaining domestic supply chains (but the purpose and focus becomes a lot messier).

And yet, everywhere I look, any project I pick, crickets.

I don't expect the EU to front run, but something like KiCad is 3 bloody decades old.

> those are all in Silicon Valley because the money is there because the US has a privileged financial position.

And yet you had the rise of Akihabara as an electronic parts mecca which then later got eclipsed by Shenzhen. And that's not even talking about the fact that the modern computing sits atop a mountain of stuff developed out of the VLSI Project (https://en.wikipedia.org/wiki/VLSI_Project).

All of those occurred because their respective governments threw money around.

Sure, maybe you won't create another Silicon Valley hare, but, perhaps, just perhaps, you might create a relentless, open source EU tortoise that slowly displaces the proprietary software. The EU is good at slow--relentless, not so much.

Sadly, a continual state of inertia and sclerosis and failure around tech seems to be historically European: https://www.phenomenalworld.org/analysis/the-eurochip/

Re: Notepad++ hijacked by state-sponsored actors

#500
post #60
post #40

Earlier quoted context omitted.

Taiwan is already independent. Surely the normal way to refer to it would be as coming out against assimilation with mainland China?

>Taiwan is already independent. That is a very controversial statement, and one that both Taipei and Beijing disagree with.

Taipei only disagrees because they're under threat. Doublespeak should generally be called out. Taiwan lives under perpetual fear of occupation and forced assimilation.
Post reply on HN