5 ms·
Multiple Notepad++ Flaws Let Attackers Execute Arbitrary Code
- jackfoxy 3y agoI would certainly accept this vulnerability in order to have Notepad++ on Linux. Nothing like it.
- rpgwaiter 3y agoWhat does nppp give you that vscode, sublime, or the gnome editor doesn't?
- gmiller123456 3y agoSimplicity. I use VSCode when working on a project, but if I just need to edit a single file I use NPPP.
- TylerE 3y agoWhat’s wrong with doing that in sublime? If you don’t install a bunch of kids it’s very minimal.
- jay_kyburz 3y agoSublime pissed a lot of people off when they started nagging v3 user to upgrade to v4, then when you do, they nag you to pay again. I also got tired of how the package manager worked. Whenever I was setting up a new install, I could never remember what combination of packages I needed to install to get everything to work how it used to.
- dralley 3y agoJust copy the configuration files and extensions out of the directory where they're installed. Or use sync functionality.
- prepend 3y agoN++ is just simpler. There are ways to avoid sublime’s annoyances. But N++ doesn’t annoy. Although if you have sublime installed and running the way you like it, you probably don’t need N++.
- kcartlidge 3y ago> I also got tired of how the package manager worked. Whenever I was setting up a new install, I could never remember what combination of packages I needed to install to get everything to work how it used to. This is one of the things VS Code does quite well. Stick a recommended extentions file in your repo root and anyone who pulls it gets automatically offered the chance to install them. (View -> Command Palette -> search for "Recommended Extensions")
- crosvenir 3y agoVscode? Near instant start times. Macros? Standard column select with just alt. Sublime? Honestly I can't remember as it's been a while since i used it. Gedit? 100s ROM standard text operations such as line trims, case replacement, line ending replacement, find in files, replace in files, replace via regex in files, split window of same file, auto save non-saved files, show whitespace from tool bar, opening of very large files quickly, code folding, line numbers shown by default, probably wouldn't print errors when executed in the background on a fresh or updated install for the last 10 years necessitating the redirecting of all output streams thereby hiding possible issues. And I actually kinda like gedit... Waiting for the "if we'd all just use emacs" folks to show up.
- jay_kyburz 3y agoTry Kate. Its great!
- kjs3 3y agoVi, you despicable emacs heretic.
- jackfoxy 3y agoVsCode, or Codium, which is what I use, does not have a macro facility. That for me is the killer feature of Notepad++. I have no experience with the other editors, but I suspect they also have no macro capability, or if they do it doesn't measure up.
- vlovich123 3y agoNot even through extensions? https://marketplace.visualstudio.com/items?itemName=EXCEEDSYSTEM.vscode-macros https://marketplace.visualstudio.com/items?itemName=EXCEEDSY...
- billti 3y agoI find the Vim extension for VS Code has macro support that is good enough for most of my use cases (if you’re a fan of Vim key bindings - obviously). https://github.com/VSCodeVim/Vim/blob/master/ROADMAP.md#repeating-commands https://github.com/VSCodeVim/Vim/blob/master/ROADMAP.md#repe...
- westurner 3y ago- Microsoft/vscode#4490: "Macro recording" (2016-) https://github.com/microsoft/vscode/issues/4490 https://github.com/microsoft/vscode/issues/4490 It looks like there are a number of vscode extensions for recording macros: - https://www.google.com/search?q=vscode+macro+recorder https://www.google.com/search?q=vscode+macro+recorder - https://marketplace.visualstudio.com/search?term=Macro&target=VSCode&category=All%20categories&sortBy=Relevance https://marketplace.visualstudio.com/search?term=Macro&targe... - the macro-commander README explains its JSON-based macro language. YAML might be easier to maintain than JSON. https://github.com/jeff-hykin/macro-commander#what-are-some-examples https://github.com/jeff-hykin/macro-commander#what-are-some-... For teams with multiple editors, you can specify workflow automation scripts with shell scripts, or e.g. hubflow, or CI container/cmd YAML, and/or a pre-commit.yml instead of with an IDE-specific tool. Isn't there native real-time collaboration functionality in vscode/vscodium that would be useful for a native macro recording feature? (Edit) Live Share can't be installed in vscodium. https://github.com/VSCodium/vscodium/issues/128 https://github.com/VSCodium/vscodium/issues/128 Support for jupyter-collaboration Y.js CRDT RTC could be added to vscode-jupyter and/or a more generic extension: "Support for real-time collaboration in the extension?" https://github.com/microsoft/vscode-jupyter/discussions/12933 https://github.com/microsoft/vscode-jupyter/discussions/1293... jupyterlab/jupyter-collaboration: https://github.com/jupyterlab/jupyter-collaboration https://github.com/jupyterlab/jupyter-collaboration And then vscode sessions and thus macros could be recorded from ide events and appended to a jupyter_ydoc: https://github.com/jupyter-server/jupyter_ydoc https://github.com/jupyter-server/jupyter_ydoc
- 29athrowaway 3y agonotepadqq
- jackfoxy 3y agoTook a look at it and rejected it pretty much out of hand...don't remember why, but IIRC it doesn't fully implement macros among other things.
- justin_oaks 3y agoI use notepadqq. It does most things I use Notepad++ for in Windows. That said, I'll switch to Vim for serious text manipulation or an IDE for coding.
- armchairhacker 3y agoMaybe there are power features or something which makes Notepad++ better, but for my usage Kate (https://kate-editor.org/ https://kate-editor.org/) fits the same niche. Fast startup and good UI for quick edits on individual files. But it has enough features to technically be an IDE (including LSP integration apparently)
- pyeri 3y agoAlso don't forget geany! It is pretty much the Notepad++ of Linux Desktop world I think.
- kcartlidge 3y agoKate renders nicely, performs fluidly, opens fast, and never lets you down. I use Notepad++ on Windows as it's work-approved, but Kate where I can.
- eru 3y agoWhat about Wine?
- pyeri 3y ago> In this case, there are 4 bugs. One causes N++ to write 1 to 3 bytes past the end of a buffer, the other bugs cause N++ to read some bytes past the end of heap objects, even the researchers aren't sure how they could be exploited. Honestly, if you go down to the C level of buffers and stack overflows, I think most modern day GUI apps will come up with some bug or other. It's almost like torturing the data to come up with the conclusion you want, EVENTUALLY it is bound to yield you something!
- molticrystal 3y agoPreviously discussed 5 days ago over here: https://news.ycombinator.com/item?id=37320304 https://news.ycombinator.com/item?id=37320304
- notRobot 3y agoTop comment from that post: > In this case, there are 4 bugs. One causes N++ to write 1 to 3 bytes past the end of a buffer, the other bugs cause N++ to read some bytes past the end of heap objects, even the researchers aren't sure how they could be exploited. > While it's good they're fixed, it looks pretty much like what you get running code in a fuzzer with ASan enabled - finding obscure and very difficult to exploit memory correctness bugs. Unless a miracle happens and those 3 bytes can be made to belong to some very important structure, there's not much can be done with control of those 3 bytes. https://news.ycombinator.com/item?id=37321074 https://news.ycombinator.com/item?id=37321074
- LegionMammal978 3y agoIn fact, it's not even a 3-byte heap buffer overflow: it's a 1-byte overflow resulting from a 3-byte write operation. The relevant string on the heap is read precisely once, to insert the text into the current document, and freed once the file has finished loading (in the destructor of the Utf8_16_Read object). Therefore, the only thing that can be corrupted is the first byte in the Size field of the _HEAP_ENTRY corresponding to the subsequent object in the heap. However, some cursory research indicates that the 2 bytes of the Size field are protected (alongside the 1-byte Flags) by an XOR checksum stored in SmallTagIndex. Therefore, the worst it could ever do (unless I am missing something important) is cause an error when that subsequent object is freed. (Also, that particular write overflow is preceded by a 1-byte read overflow, but since the same buffer is reused for each block in the file, and since the bug can only occur after the first block, the read overflow will always read a byte from earlier in the same file.)
- Gigachad 3y agoC++ software should really only be run in a sandbox since this kind of stuff is inevitable.
- nijave 3y agoWould that make a difference for a text editor since it likely already has filesytem access? Snap/Flatpak (can) do sandboxing
- eru 3y agoYou can give your texteditor very restricted filesystem access.
- nijave 3y agoWhile it's possible, I'm not sure how practical it is. On macOS (which has fairly granular permissions in recent releases), my terminal emulator and text editor end up with access to pretty much everything. If you're editing code/scripts, a malicious actor could insert something into a file the editor has access to and wait for it to be executed
- Gigachad 3y agoWith something like flatpak portals you could restrict the directories it has access too. Though it could possibly insert something in the code you will be running unsandboxed.
- MuffinFlavored 3y agowhat if the sandbox is written in C++?
- 0RQ2kaTBBlQp 3y agothose are features, not bugs
- sinuhe69 3y agoI only run N++ on my text files. I can not imagine how it could be exploited to run arbitrary code?
- LegionMammal978 3y agoIt's a 1-byte heap buffer overflow when it loads a specially-crafted UTF-16 file with an odd length over 131,076 bytes. The Windows NT heap implementation already contains a mitigation against overflows of up to 3 bytes (which, as far as I can tell, is 100% effective against 1-byte overflows), so arbitrary code execution is very implausible.