Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Windows Notepad App Remote Code Execution Vulnerability

cve.org

Post reply on HN
Print view View original

531–538 of 538 posts

Re: Windows Notepad App Remote Code Execution Vulnerability

#531

Post by 7bit »

dspillett wrote: post #509
7bit wrote: post #197

Earlier quoted context omitted.

The very fact that UTF-8 itself discouraged from using the BOM is just so alien to me. I understand they want it to be the last encoding and therefore not in need of a explicit indicator, but as it currently IS NOT the only encoding that is used, it makes is just so difficult to understand if I'm reading any of the weird ASCII derivatives or actual Unicode. It's maddening and it's frustrating. The US doesn't have any…

> The very fact that UTF-8 itself discouraged from using the BOM is just so alien to me. One of the key advantages of UTF8 is that all ASCII content is effectively UTF-8. Having the BOM present reduces that convenience a bit, and a file starting with the three bytes 0xEF,0xBB,0xBF may be mistaken by some tools for a binary file rather than readable text.

Did you read past the first sentence I wrote?

ASCII does not work for any country than the US, making it a shit encoding.

Re: Windows Notepad App Remote Code Execution Vulnerability

#532

Post by 7bit »

wtetzner wrote: post #527
7bit wrote: post #197

Earlier quoted context omitted.

The very fact that UTF-8 itself discouraged from using the BOM is just so alien to me. I understand they want it to be the last encoding and therefore not in need of a explicit indicator, but as it currently IS NOT the only encoding that is used, it makes is just so difficult to understand if I'm reading any of the weird ASCII derivatives or actual Unicode. It's maddening and it's frustrating. The US doesn't have any…

> The very fact that UTF-8 itself discouraged from using the BOM is just so alien to me. Adding a BOM makes it incompatible with ASCII, which is one of the benefits of using UTF-8.

Another one who fails to read past my first sentence...

Re: Windows Notepad App Remote Code Execution Vulnerability

#533

Post by cindyllm »

7bit wrote: post #531
dspillett wrote: post #509

Earlier quoted context omitted.

> The very fact that UTF-8 itself discouraged from using the BOM is just so alien to me. One of the key advantages of UTF8 is that all ASCII content is effectively UTF-8. Having the BOM present reduces that convenience a bit, and a file starting with the three bytes 0xEF,0xBB,0xBF may be mistaken by some tools for a binary file rather than readable text.

Did you read past the first sentence I wrote? ASCII does not work for any country than the US, making it a shit encoding.

[dead]

Re: Windows Notepad App Remote Code Execution Vulnerability

#534

Post by abustamam »

MikePlacid wrote: post #530
abustamam wrote: post #477

Earlier quoted context omitted.

I think my comment still stands though. Why is "new" Notepad getting new features? It was perfect as it was.

Programmers and their managers need food. And other nice things.

Don't programmers now just get fed tokens?

/s

Re: Windows Notepad App Remote Code Execution Vulnerability

#535

Post by wtetzner »

7bit wrote: post #532
wtetzner wrote: post #527

Earlier quoted context omitted.

> The very fact that UTF-8 itself discouraged from using the BOM is just so alien to me. Adding a BOM makes it incompatible with ASCII, which is one of the benefits of using UTF-8.

Another one who fails to read past my first sentence...

I read past your first sentence, but ASCII is used by non English speaking countries for many things. Source code, for one.

Re: Windows Notepad App Remote Code Execution Vulnerability

#536

Post by erikts »

BLKNSLVR wrote: post #514
Zenul_Abidin wrote: post #422

Earlier quoted context omitted.

Old notepad is still there, it's just in System32 and you have to disable app execution alias for notepad.exe (apps > advanced app settings > app execution aliases)

FYI, old notepad has a permanent advertisement / notification at the top saying that there's a new version of Notepad available! I'm not sure if it's possible to get rid of the nag banner. And even if it is possible to get rid of it temporarily, it's probably not possible to get rid of it permanently. I will find out...

I close the banner on the first run and it never shows up in subsequent run of Notepad

Re: Windows Notepad App Remote Code Execution Vulnerability

#537

Post by lucketone »

hbn wrote: post #524
lucketone wrote: post #491

Earlier quoted context omitted.

Just an act of asking for the opinion matters. (Maybe not for all, but definitely for some) https://en.wikipedia.org/wiki/Hawthorne_effect

That claims surveying workers improved their productivity at the job. I don't think you can apply that to be interrupted with a popup while using a calculator.

There probably is a second order effect - designers who have heard this, are more likely to add survey/feedback form into an app. (Even if first order effect is not real)

Re: Windows Notepad App Remote Code Execution Vulnerability

#538

Post by [deleted] »

hulitu wrote: post #502
Rohansi wrote: post #357

Earlier quoted context omitted.

I think there are more text editors around that render clickable links than there are that don't. Even your terminal probably renders clickable links. Despite the scary words and score this wouldn't even be a vulnerability if people weren't so hard wired to click every link they see. It's not some URL parsing gone wrong triggering an RCE. Most likely they allowed something like file:// links which of course opens tha…

Ed doesn't.

[deleted]
Post reply on HN