6 ms·

Thanks for the heads up. Would using LibreOffice be safer?

gruez 6y ago
Yes, in the same sense that browsing the web with lynx is safer because there's no javascript to exploit. Some people even consider the lack of javascript to be a feature. If you're just opening documents for viewing/basic editing, you probably won't mind macros being missing. The bigger problem might be the inconsistent layout (and other compatibility issues) that you get.
- EE84M3i 6y ago
  LibreOffice fully supports a lot of macro features, so I'm not sure what you're refering to about "macros being missing".
- anthk 6y ago
  LO supports some macros. Also, I use Lynx/Links+ (and a upgraded Netsurf) because of those JS pests. So far I can: - Use pleroma (Mastodon) from https://brutaldon.online https://brutaldon.online. Much faster than any JS bloated platform. Images are viewed externally from sxiv, nothing is lost. - Search YT from Idiotbox and playing the video with mpv + youtube-dl. - Read Medium/Tedium general news articles without bogging my CPU down. Links -g supports images. - Comment here. - For Reddit I use either TUIR or Gopher. - I can avoid all malicious cookies too by setting a different config file for links and tunneling it thru torsocks. For DOCX/XLSX files, you can use antiword/wv and convert the DOC/X file to RTF and then open it under Ted (a really lightweight WP), and sc-im plus gnuplot for spreadsheets. Much faster and secure. On potentially malicious PDF's and PostScripts, convert them into DJVU and use DJView to read them.
9935c101ab17a66 6y ago
This attack only works if the user clicks 'enable macros' when the document is opened or when the "“Disable all macros without notification" setting is enabled (ironic) or if you are using Office 2011. TL;DR: Looks like most of the exploits have been patched, and even still, if they hadn't been patched you probably would have been fine using later versions of office (at least in the context of the attacks outlined) if you don't open and run documents with macros and you don't have that setting enabled.
- deleted 6y ago
  [deleted]
- tinus_hn 6y ago
  No it features a different exploit involving an ancient programming language in an ancient file format that they forgot when they added the notifications.
kayodelycaon 6y ago
Yes, but... as an author, I’m stuck using Word for working with editors and publishers. (I prefer to use Scrivener.) Using any other application is a bad idea due to incompatibilities. This isn’t theoretical. Change tracking is critical and the “mostly correct” support in other applications is not an acceptable compromise.
- nwallin 6y ago
  Do you use any wysiwyg features of word, or is it literally notepad+git with a UX/UI that people are familiar with? What's unusual about authoring, editing, and publishing such that Word is better than the alternatives? I can't imagine that publishers use Word beyond "ok thanks now I'll arduously convert it into the real format". FWIW, I (as a programmer) would immediately disqualify any job candidate (except interns) who didn't understand why change tracking was important and know how to use one or more implementations of it. I imagine nearly all of the programmers on HN feel similarly. Explaining that change tracking is critical isn't an unusual claim.
  - nine_k 6y ago
    WYSIWYG is not relevant here. The structured document format, very much is. Chapters, footnotes, references, quotations, tables, etc. It's more like Org mode + TeX + git.
    - nwallin 6y ago
      I guess I'm misunderstanding then. Word's core feature is wysiwyg. Word as a document format is necessarily unstructured - "hey I'm gonna increase the font size of this text over here by like 12 or 14 pts or whatever and switch it to center identation and write 'Chapter 3'" -- that's the 'killer feature' of Word that defines it. Structural stuff like the idea of chapters or version keeping are all secondary to the defining wysiwyg feature. If the goal is structure+change tracking, it seems like switching from an unstructured document format to a format/combination of formats that provides structure+change tracking is an easy slam dunk. Structure and interoperability with version control systems are both first class features of latex. Structure and version control are secondary features of Word. ...Why?
ubermonkey 6y ago
I mean, probably, but you'll also go nuts trying to any serious collaboration with true-Office people.

Yes, in the same sense that browsing the web with lynx is safer because there's no javascript to exploit. Some people even consider the lack of javascript to be a feature. If you're just opening documents for viewing/basic editing, you probably won't mind macros being missing. The bigger problem might be the inconsistent layout (and other compatibility issues) that you get.

EE84M3i 6y ago
LibreOffice fully supports a lot of macro features, so I'm not sure what you're refering to about "macros being missing".
anthk 6y ago
LO supports some macros. Also, I use Lynx/Links+ (and a upgraded Netsurf) because of those JS pests. So far I can: - Use pleroma (Mastodon) from https://brutaldon.online https://brutaldon.online. Much faster than any JS bloated platform. Images are viewed externally from sxiv, nothing is lost. - Search YT from Idiotbox and playing the video with mpv + youtube-dl. - Read Medium/Tedium general news articles without bogging my CPU down. Links -g supports images. - Comment here. - For Reddit I use either TUIR or Gopher. - I can avoid all malicious cookies too by setting a different config file for links and tunneling it thru torsocks. For DOCX/XLSX files, you can use antiword/wv and convert the DOC/X file to RTF and then open it under Ted (a really lightweight WP), and sc-im plus gnuplot for spreadsheets. Much faster and secure. On potentially malicious PDF's and PostScripts, convert them into DJVU and use DJView to read them.

9935c101ab17a66 6y ago

This attack only works if the user clicks 'enable macros' when the document is opened or when the "“Disable all macros without notification" setting is enabled (ironic) or if you are using Office 2011. TL;DR: Looks like most of the exploits have been patched, and even still, if they hadn't been patched you probably would have been fine using later versions of office (at least in the context of the attacks outlined) if you don't open and run documents with macros and you don't have that setting enabled.

deleted 6y ago
[deleted]
tinus_hn 6y ago
No it features a different exploit involving an ancient programming language in an ancient file format that they forgot when they added the notifications.

kayodelycaon 6y ago

Yes, but... as an author, I’m stuck using Word for working with editors and publishers. (I prefer to use Scrivener.) Using any other application is a bad idea due to incompatibilities. This isn’t theoretical. Change tracking is critical and the “mostly correct” support in other applications is not an acceptable compromise.

nwallin 6y ago
Do you use any wysiwyg features of word, or is it literally notepad+git with a UX/UI that people are familiar with? What's unusual about authoring, editing, and publishing such that Word is better than the alternatives? I can't imagine that publishers use Word beyond "ok thanks now I'll arduously convert it into the real format". FWIW, I (as a programmer) would immediately disqualify any job candidate (except interns) who didn't understand why change tracking was important and know how to use one or more implementations of it. I imagine nearly all of the programmers on HN feel similarly. Explaining that change tracking is critical isn't an unusual claim.
- nine_k 6y ago
  WYSIWYG is not relevant here. The structured document format, very much is. Chapters, footnotes, references, quotations, tables, etc. It's more like Org mode + TeX + git.
  - nwallin 6y ago
    I guess I'm misunderstanding then. Word's core feature is wysiwyg. Word as a document format is necessarily unstructured - "hey I'm gonna increase the font size of this text over here by like 12 or 14 pts or whatever and switch it to center identation and write 'Chapter 3'" -- that's the 'killer feature' of Word that defines it. Structural stuff like the idea of chapters or version keeping are all secondary to the defining wysiwyg feature. If the goal is structure+change tracking, it seems like switching from an unstructured document format to a format/combination of formats that provides structure+change tracking is an easy slam dunk. Structure and interoperability with version control systems are both first class features of latex. Structure and version control are secondary features of Word. ...Why?

ubermonkey 6y ago

I mean, probably, but you'll also go nuts trying to any serious collaboration with true-Office people.