Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Notepad++ hijacked by state-sponsored actors

notepad-plus-plus.org

Post reply on HN
Print view View original

551–560 of 560 posts

Re: Notepad++ hijacked by state-sponsored actors

#551

Post by jollyllama »

edb_123 wrote: post #185

So, let me get this straight. If I've been lazy, postponed updates and I'm still on 8.5.8 (Oct 2023) - it turns out I'm actually...safer? Anyway, I hope the author can be a bit more specific about what actually has happened to those unlucky enough to have received these malicious updates. And perhaps a tool to e.g. do a checksum of all Notepad++ files, and compare them to the ones of a verified clean install of the u…

Yes, of course you're safer. If your system is working as desired, updates can only break it. This is just Engineering 101, but for whatever reason, all logic is abandoned on the topic of security updates.

Re: Notepad++ hijacked by state-sponsored actors

#552

Post by Chaosvex »

adzm wrote: post #71
bakugo wrote: post #41

Earlier quoted context omitted.

So they just conveniently decided not to sign their releases right around the time they were supposedly "hacked"? Something doesn't seem right here.

Code signing certs are unfortunately expensive

You don't even need a certificate to prevent update tampering like this. The updates could have shipped with an ECDSA signature and this wouldn't have happened. It's also free and doable in an afternoon.

Re: Notepad++ hijacked by state-sponsored actors

#553

Post by Chaosvex »

hjoutfbkfd wrote: post #340
firesteelrain wrote: post #102

Earlier quoted context omitted.

$700+ at Sectigo for two years Something of Notepad++ size might think about it now

the issue was not the money, but that it was difficult to get a certificate without having some sort of legal entity

It was negligence. You don't need a certificate to prevent update tampering.

Re: Notepad++ hijacked by state-sponsored actors

#554

Post by cookiengineer »

idiotsecant wrote: post #489
cookiengineer wrote: post #118

Earlier quoted context omitted.

[flagged]

I have to say, the fact that you immediately ascribe to malicious intent my very clearly curious request is not making me think schizophrenic less .

> I have to say, the fact that you immediately ascribe to malicious intent my very clearly curious request is not making me think schizophrenic less.

I didn't frame the question as an implied disease as a cause for my comment, that's on you.

I don't compromise on my ideals, and especially won't doxx myself on HN. Next time maybe frame your questions in a nicer way and you'll get a nicer answer in return. Just a hint, because that's how debates are supposed to work in my opinion. If you judge me for that, then so be it.

Re: Notepad++ hijacked by state-sponsored actors

#555

Post by greazy »

wiether wrote: post #383
greazy wrote: post #382

Earlier quoted context omitted.

I work in a lab as an analyst (bioinformatician), we are register and pay for quality assurance programs that contain an embarrassing about of technical errors.

> an embarrassing about of technical errors amount? ;)

Haha I laughed after reading your comment and mine.

Yep auto correct got me good.

Re: Notepad++ hijacked by state-sponsored actors

#556

Post by Breza »

latexr wrote: post #486
expedition32 wrote: post #401

Earlier quoted context omitted.

Anyone else noticed that we don't even GET patch notes anymore? "Fixed some bugs" Yes thank you very helpful that! Now I can make a very informed decision.

I hate that. “Bug fixes and improvements” every time. And then there are the ones who think they’re being cute with “our bird Fernando has been hard ar work eating those nasty bugs and flying over the rainbow to bring you an ever delightful experience”. Just, no. I don’t mind you flexing some creative writing muscles in your release notes if you provide actual clear information, but if you’re going to say nothing lik…

Yes! Mobile apps are the worst about this. As a rule, I don't update any apps unless I have a clear reason to do so.

Re: Notepad++ hijacked by state-sponsored actors

#557

Post by nophunphil »

leosarev wrote: post #546
nophunphil wrote: post #490

Earlier quoted context omitted.

Educate me then. The mental image I have from researching the topic seems contrary to what you’re saying.

Safe and socially acceptable: "war is bad and I wish it will end sooner". "We should be friends with Ukraine and/or West". "Putin was not right to start a war". "I want that Putin resigns and/or voted out" Safe for regular person, but socially risky: "We should surrender and pay reparations" "This war is totally Putin'a fault" "Putin is corrupt dictator" "Zelensky is a good guy" Could in theory lead to a fine and/or…

Thank you. This is helpful.

Re: Notepad++ hijacked by state-sponsored actors

#558

Post by maremmano »

hansifer wrote: post #495
nzd wrote: post #332

Earlier quoted context omitted.

Sublime Text. It's art.

It was great 10 years ago before VS Code, but Sublime has been abandonware for years now.

I got both Sublime and VSCode. Sublime is a work of love. You can probably do more things with vscode, but I'm not sure you can do many of these things better or faster than sublime. I don't think so.

Re: Notepad++ hijacked by state-sponsored actors

#559

Post by just_testing »

Saris wrote: post #480
just_testing wrote: post #473

Earlier quoted context omitted.

Which firewall software do you use? I should probably start using firewalls in my computers as well...

I've been using Fort: https://github.com/tnodir/fort It's the best one I found after trying a few, because it's pretty easy to use, and lets me disable notification popups which is a part that always frustrates me about other options.

Thank you!!

Re: Notepad++ hijacked by state-sponsored actors

#560

Post by Saris »

maronato wrote: post #534
thegrim000 wrote: post #512

Earlier quoted context omitted.

As for updates - my OS has a built-in package management system, which is responsible for installing and updating packages. Why should notepad++ bypass that and do its own independent update process?

Because other OSs do not and the notepad++ team wants all users to have a similar experience. If you don’t need auto updates, just disable them. More importantly, notepad++ being able to update itself is not the exploit here. Your OS’ package manager would download the same compromised binary as notepad++’s built in updater.

What OS doesn't have a package manager now? Windows, Linux, and MacOS all have their own systems.

On windows, the package manager downloads the release of notepad++ directly from github, so it would not have been compromised. The hijack was done on the notepad++ website at the webhost level as I understand it, and the built in updater pulled from there.

Post reply on HN