30 ms·
Notepad++ hijacked by state-sponsored actors
- dyauspitr 9mo agoWhat’s a good alternative?
- thisislife2 9mo agoWow. I'd love to know more how the targeted systems were actually compromised.
- N_Lens 9mo agoProbably backdooring end user machines by pushing updates with vulnerabilities for the purpose of spying, data exfiltration & control.
- dgrin91 9mo agoAgreed. Supply chain attacks are scary. I open all sorts of secrets in NPP - did they all get leaked?
- digdigdag 9mo agoDepends. Are you a Chinese/Taiwanese national or diplomat who holds a strategic value to the CCP?
- hsbauauvhabzb 9mo agoAnd who was targeted. The current messaging is very vague.
- mapontosevenths 9mo agoThere is more detail linked below: https://www.heise.de/en/news/Notepad-updater-installed-malware-11109726.html https://www.heise.de/en/news/Notepad-updater-installed-malwa... https://doublepulsar.com/small-numbers-of-notepad-users-reporting-security-woes-371d7a3fd2d9 https://doublepulsar.com/small-numbers-of-notepad-users-repo... The TLDR is that until version 8.8.7 of Notepad++, the developer used a self-signed certificate, which was available in the Github source code. The author enabled this by not following best practices. The "good news" is that the attacks were very targeted and seemed to involve hands on keyboard attacks against folks in Asia. Blaming the hosting company is kind of shady, as the author should own at least some level of the blame for this.
- metalcrow 9mo agoout of curiosity, why is a self signed cert bad for this case? Can't the updater check the validity of the cert just as well regardless? Or did the attackers get access to the signing key as well?
- tgsovlerkhgsel 9mo agoFrom the Heise article: > Until version 8.8.7 of Notepad++, the developer used a self-signed certificate, which is available in the Github source code. This made it possible to create manipulated updates and push them onto victims, as binaries signed this way cause a warning „Unknown Publisher“ It also mentions "installing a root certificate". I suspect that it means that users who installed the root cert could check that a downloaded binary was legit but everyone else (i.e. the majority of users) were trained to blindly click through the warning.
- kevin_thibedeau 9mo agoNotepad++ has way too many updates for a text editor. I purposely decline most of the nags to update for precisely this reason. It is too juicy of a target and was bound to get compromised.
- lukan 9mo agoWell, some people use it as a IDE, so there are more feature they need. But I am not sure if a less frequent update routine would be safer.
- mapontosevenths 9mo agoIt would still have been less than ideal, but he might have gotten away with it if the private key wasnt stored within the public Github repo.
- idiotsecant 9mo agoIf the attackers did limit themselves to a small number of Asian machines they gave up an absolute goldmine. I would venture to say a lot of technical people use notepad++ at work in jobs that would be very lucrative for an attacker to exploit. I know I definitely had an 'oh shit' moment when I read this and thought about where I have notepad++ installed.
- simlevesque 9mo agoProbably related to this: https://notepad-plus-plus.org/news/v869-about-taiwan/ https://notepad-plus-plus.org/news/v869-about-taiwan/
- icelancer 9mo agoYeah, Notepad++ is known for political messaging in their updates. Taiwan, Ukraine, etc.
- lobito25 9mo agoProbably the real motive.
- chvid 9mo ago“ The incident began from June 2025. Multiple independaent security researchers have assessed that the threat acotor is likely a Chinese state-sponsored group, which would explain the highly selective targeting obseved during the campaign.” How do they know it was a Chinese group or even a state sponsored one?
- cwnyth 9mo agoThey said "likely", so they don't "know." Yours is the wrong question.
- skeledrew 9mo agoThe "likely" does give the impression that they have a pretty good idea.
- cwnyth 9mo agoI didn't say that to be pedantic, but to avoid that particular type of asker who isn't actually asking a genuine question here. After listing all the ways that Notepad++ (as an example here) suspects who they suspect, the asker then comes back with "Yeah, but how do you know?", as if that's some sort of gotcha. It's disingenuous. Even if the person I replied to isn't attempting this, I find it good to call out and get people to ask a better question: what's the evidence and why does that evidence point to this conclusion?
- jmole 9mo agoi always worry about tools like this, maintained by small teams, that are so universal that even if only a small fraction of installs are somehow co-opted by malicious actors, you have a wide open attack surface on most tech companies. e.g. iTerm, Cyberduck, editors of all shades, various VSCode extensions, etc.
- josho 9mo agoSimilarly I worry about how these apps automatically update themselves. I know it can be done securely. I also doubt that these companies invest the engineering effort to do so.
- hsbauauvhabzb 9mo agoIf you think large companies are somehow immune to this, you’re gonna have a bad time.
- Arainach 9mo agoIt's not a matter of "immune" - larger organizations generally have more resources to allocate to things like this. That doesn't mean they get it right 100% of the time, but they are at least able to try, while small teams or volunteer projects often simply don't have the hours to spend on things like this.
- calvinmorrison 9mo agoand unlike GPL software, there is typical an army of lawyers, an expressed warranty, legal liability, etc.
- SoftTalker 9mo agoTerms of use typically disclaim all liability.
- its_ubuntu 9mo ago[flagged]
- johnsillings 9mo agowhy does this read like it was written by a state-sponsored actor
- opan 9mo agoThe thought crossed my mind as well. Lots of typos, plus "old version compromised, use new version ASAP" could also be said to get people on a newly compromised version, right? Though it's probably just that the post author is stressed and rushed the post out. I do wonder if there's a way to verify the post was written by the real dev and that he still has control. Old known GPG sig?
- Dylan16807 9mo agoPosted with the new version not even out yet?
- _zagj 9mo agoIIRC, the author, Don Ho, is French and was born in Taiwan, and accordingly, perhaps his English is somewhat idiosyncratic?
- OsrsNeedsf2P 9mo agoSo the hosting provider was hacked? Who was their hosting provider? This is also why update signatures should be validated against a different server; it would require hackers to control bother servers to go undetected
- gruez 9mo ago>This is also why update signatures should be validated against a different server; it would require hackers to control bother servers to go undetected No, it should be a hardcoded key held by the developer, preferably using a HSM, and maybe with some sort of notification capability in case the key was lost. Adding a second server adds marginal security. For instance if the developer's mail was hacked, an attacker would likely be able to reset passwords for both hosting providers.
- dontdoxxme 9mo agoPrevious NS records were pointing at dns-parking.com, which is Hostinger. Although hard to be certain without more details whether a reseller or other supplier is involved.
- technion 9mo agoYou can see this in their DNS history: notepad-plus-plus.org currently has an A record of 95.128.42.184, owned by "Aqua Ray SAS". It switched up from 191.101.104.10 and 212.1.212.49 on 17/1, which is are Hostinger IP addresses.
- kwar13 9mo agoWould've been good if it named the hosting provider. That's the most informative part.
- Larrikin 9mo agoMaybe the hosting provider is currently undergoing an audit or implementing the changes? I expect to know it one day, but it may be too early to provide the name now.
- nickorlow 9mo agoLawsuits are expensive and I'd think that name and shaming would open npp up to one
- r1ch 9mo agoEvery shared hosting provider has this risk. Critical projects should be using dedicated or VPS hosting, preferably with encrypted filesystems too as even datacenter techs can fall victim to social engineering. I'm pretty surprised that they got away with unsigned updates and shared hosting as long as they did. I wonder how many similar popular projects are out there on dodgy infrastructure.
- nosrepa 9mo agoHow scintilla-ating!
- egl2020 9mo agoThis all fascinating, but in the end: I have notepad++; what should I do?
- Marsymars 9mo agoYou’d be protected from this particular exploit if you used a package manager rather than the updater, though of course you’d still be vulnerable to the installer binary itself getting compromised.
- nickorlow 9mo agoWonder how many packages in community package repos are compromised. Surely "Hubbleexplorer" can be trusted to provide arch users with a honest, clean version of npp.
- snvzz 9mo agoKDE's own kate is a good alternative, and available for install via chocolatey.
- jimbob45 9mo agoGedit is an underrated alternative imo.
- bakugo 9mo agoI don't know why that comment is being interpreted as a request for alternatives. They are clearly asking if their machine is compromised.
- egl2020 9mo agoyes, that's my question: am I compromised? What should I do?
- davorak 9mo agoStandard answer to a potentially compromised machine is to start with a factory reset machine and add the software and data you need to do your work/use the machine. Do not take executables from the compromised machine and use them any where since they too could be compromised. There are more steps you can take to ensure greater safety. The above is the minimum a I do for myself and what the minimum IT department and my company executes.
- getcrunk 9mo agoSo they say at the provider level update traffic was redirected . Does this also mean their update endpoints didn’t do encryption?
- getcrunk 9mo agoYea, should have finished reading. Remediation was to “ verify both the certificate and the signature of the downloaded installer. “ I mean for such a dev focused and extremely performant app, that’s disappointing. Glad I’m off windows as of late
- gruez 9mo agoIt's also possible the update manifest contained an url that the updater blindly trusted, and by modifying that file you could change what got downloaded.
- prodigycorp 9mo agoI'm extremely wary about any application pushing politics. I subscribe to MacPaw, who makes excellent apps like Setapp, Gemini, and CleanMyMac, all of which I use. At some point, CleanMyMac started putting the Ukranian flag on the app icon and flagging utilities by any Russian developer as untrustworthy (because they are russian), and recommended that I uninstall them. I am not pro russia/anti-ukraine independence by any means, but CleanMyMac is one of those apps that require elevated system permissions. Seeing them engage in software maccarythism makes me very, very hesitant to provide them.
- _alternator_ 9mo agoSorry, what does this have to do with notepad++?
- stackghost 9mo agoThe notepad++ author has publicly come out in favor of Taiwanese independence.
- permo-w 9mo agoTaiwan is already independent. Surely the normal way to refer to it would be as coming out against assimilation with mainland China?
- stackghost 9mo ago>Surely the normal way to refer to it would be as coming out against assimilation with mainland China? I suppose, though that's not really how I tend to see it phrased on socials or in the media.
- litbear2022 9mo agoBefore Trump set his sights on Greenland, Denmark also considered Kosovo to be independent.
- sb057 9mo ago
- tech234a 9mo agoNotably Notepad++ was recently shipping unsigned/self-signed updates, apparently overlapping with the time of this incident, see releases 8.8.2-8.8.6: https://notepad-plus-plus.org/news/ https://notepad-plus-plus.org/news/
- bakugo 9mo agoSo they just conveniently decided not to sign their releases right around the time they were supposedly "hacked"? Something doesn't seem right here.
- adzm 9mo agoCode signing certs are unfortunately expensive
- firesteelrain 9mo ago$700+ at Sectigo for two years Something of Notepad++ size might think about it now
- abeyer 9mo ago"of Notepad++ size" is basically one guy in his free time, no?
- eviks 9mo ago"But look at those downloads, they magically print money"
- firesteelrain 9mo agoNotepad++ is Windows-based and could use the Windows store instead of the built in updater. Microsoft charges a one time fee. It would pass SmartScreen checks. His website has a bunch of ads integrated which I assume are there to help pay for hosting. Mr. Ho already has hosting charges and he uses GitHub. For those who use GitHub, he could continue his GnuPG method for signing. Additionally, GitHub integrates with Sigstore. Windows wouldn’t trust his signature but at least there would be better traceability. Version 8.8.7 labeled “authenticity guaranteed” is a step in that direction. The real “issue” here was his outside hosting platform for updates from my reading of the article.
- bakugo 9mo agoSo uhh... what exactly did the "state-sponsored actors" do? They go on about how their server was compromised, and how the big bad Chinese were definitely behind it, and then claim the "situation has been fully resolved", but there is zero mention of any investigation into what was actually done by the attackers. Why? If I downloaded an installer during the time they were hacked, do I have malware now? The utter lack of any such information feels bizarre.
- mimasama 9mo ago> Even after losing server access, attackers maintained credentials to internal services until December 2, 2025, which allowed them to continue redirecting Notepad++ update traffic to malicious servers. The attackers specifically targeted Notepad++ domain with the goal of exploiting insufficient update verification controls that existed in older versions of Notepad++.
- mikeweiss 9mo agoExactly... Were they exflitrating files open in notepad++ , or was notepad++ installing additional malware for system wide access? What was the end goal?
- NedF 9mo ago[dead]
- starkeeper 9mo agoWhat was the impact of being compromised? Were they able to inject code into releases of Notepad++?
- davorak 9mo agoThey were able to replace the downloaded executable with their own version. From the article: > 2. Even though the bad actors have lost access to the server from the 2nd of September, 2025, they maintained the credentials of our internal services existing on that server until the 2nd of December, which could have allowed the malicious actors to redirect some of the traffic going to https://notepad-plus-plus.org/getDownloadUrl.php https://notepad-plus-plus.org/getDownloadUrl.php to their own servers and return the updates download URL with compromised updates.
- daemonhunter 9mo agoSo what mitigations should the end user be doing? How do we know if anything compromised?
- avereveard 9mo agoRight the writeup doesn't mention when it started and what versions are affected
- hug 9mo ago> Based on both assessment, I estimate the overall compromise period spanned from June through December 2, 2025, when all attacker access was definitively terminated. FTA.
- freitasm 9mo agoThe writeup says it right there: "The security exper’s analysis indicates the attack ceased on November 10, 2025, while the hosting provider’s statement shows potential attacker access until December 2, 2025. Based on both assessment, I estimate the overall compromise period spanned from June through December 2, 2025, when all attacker access was definitively terminated."
- avazhi 9mo agoYeah, that refers to the MITM attack on the update server. We have no fucking clue what they actually did while they were in the middle - whatever exploit code was running may very well be running right now on compromised machines. Nobody knows what the compromised exes actually did. Thanks for your nonanswer, though. It was about as unhelpful and unspecific as the original blogpost for this.
- kijin 9mo agoDownload the latest version and install that, instead of using the auto update feature of an old version that might not properly check signatures. As for whether anything else has been compromised, it depends on whether you were targeted. And the payload might have been tailored to each target, so there's no way to know unless you have access to the exact binary. Unfortunately, binaries downloaded through the auto update feature tend not to linger in your Downloads folder.
- gradus_ad 9mo ago[flagged]
- tragiclos 9mo ago> Traffic from certain targeted users was selectively redirected to attacker-controlled served malicious update manifests. I'd be curious to know if there was any pattern as to which users were targeted, but the post doesn't go into any further detail except to say it was likely a Chinese state-sponsored group.
- x_may 9mo agoIt might have been explicitly targeted, but they did say that there were older versions of Notepad ++ with ""insufficient update verification controls" so it might have just been there was only one subset of users actually susceptible to this.
- pavon 9mo agoNo, the additional update verification was added after this attack was discovered. All Notepad++ installations were vulnerable during the time of the hijacking campaign.
- buggymaaan 9mo agoI dont know who hacked the servers nor I do know how to find out. Let's blame state actors, who's going to come verify these claims.
- NedF 9mo ago[dead]
- IhateAI 9mo agoMy guess would be certain IPs associated with universities, corporations and government institutions.
- tragiclos 9mo agoThis article going into more detail on those targeted was posted later: https://securelist.com/notepad-supply-chain-attack/118708/ https://securelist.com/notepad-supply-chain-attack/118708/
- cookiengineer 9mo ago[flagged]
- Jordan-117 9mo agoHave you written about this experience elsewhere? That sounds absolutely nuts.
- suprstarrd 9mo agoI vaguely remember this happening with somebody on an Audacity project, so jumping in! I believe this was on a GitHub issue for that project, but the project has since disabled issues for the repository since they moved source locations. It also definitely hit some press.
- cookiengineer 9mo agoIf you are curious, some /pol/ and 4chan archives still have some stuff about the sneedacity incident available. There's still someone (a bot?) trying to recruit them to post shit about me from time to time.
- idiotsecant 9mo agoSomeone tried to kill you?! People actually killed your friends? Not sure if schizophrenia or actual story ... I desperately need to hear more of this story.
- deleted 9mo ago[deleted]
- cookiengineer 9mo ago[flagged]
- kaashif 9mo agoI don't think they're being malicious. It is definitely a normal reaction to respond with incredulity at something incredible. As in, someone was actually killed because their friend forked an open source project? There is clearly more to the story, it's not like if I forked Audacity tomorrow people would be after me immediately. The explanation, if any, involves the whole thing being very public and 4chan harassment, etc.
- manapause 9mo agoNot notepad++! (Opens WhatsApp) OpenClawd express my discontent across all my channels and draft an email to send to IT tomorrow morning. Also turn off the lights off and go to bed. (Somewhere in china, all the lights go out)
- thomasjudge 9mo agoWill malware/virus scanners detect any bad software?
- burnt-resistor 9mo agoThe whole approach of virus scanning is reactive and incomplete. This is because, except for some uncertain guesswork using "heuristics", it depends upon vendor analysis of submitted malware infection samples after it's already happened to determine specific malware file/process signatures. This doesn't and cannot catch all possible malware that has ever happened, especially if it's new, not widespread, or evaded analysis from ever being noticed. Thus, a fraction of malware will always slip and will always remain undetectable. After a machine is compromised by malware, there's rarely-to-never a trustworthy way to ever fix it with 100% certainty. And especially worrisome is "repair" from the host itself which maybe infected with a rootkit that hides and repairs the malware. Thus, the only correct solution is to completely reimage/reinstall from trusted sources. Deviate from this path at one's own extreme cost/risk. There also exist a tiny amount of even worse, specialized malware, usually deployed by state actors, that infect hardware in such a way that makes them difficult and sometimes uneconomical to repair. PSA: Never run untrustworthy shit on any machine that matters. This also includes FOSS projects that don't have their shit together.
- eviks 9mo agoPSA?: How to establish trust?
- burnt-resistor 9mo agoThat's somewhat of a social problem beyond the scope of technological solutions.
- conception 9mo agoMost edr has a “this program is doing something bad” detector. But the number of folks running security on their build process is still not ubiquitous.
- nickorlow 9mo agoI wonder who the targets were/what the malicious binaries did. Assuming some gov related shop + sent the contents of files on the host to attackers.
- dehrmann 9mo agoAnother popular project I can think of to look out for is PuTTY. I'm fond of 2006 vibe, but Github probably has stronger security protections.
- ivankabiden 9mo agoJob well done!
- wglass 9mo agoCan someone help clarify this for me? Is it correct to say that users would only get the compromised version if they downloaded from the website? Notepad++ has auto-update feature, is there any indication that updates from the AutoUpdate were compromised?
- jszymborski 9mo agoNo, it's specifically the updates that were targetted. I'm unsure about the downloads but those too are presumably at risk. > The attackers specifically targeted Notepad++ domain with the goal of exploiting insufficient update verification controls that existed in older versions of Notepad++.
- Lammy 9mo agoVindicated once again for turning off any update checks the moment I install any new piece of software. Even if this sort of (obviously rare) attack is not a concern, it baffles me how few otherwise-intelligent people fail to see the way these updaters provide the network (which itself is always listening, see Room 641A and friends) with a fingerprint of your specific computer and a way to track its physical location based on the set of software you have installed, all of which want to check for updates every goddamn day.
- arcfour 9mo agoIf the people with access to Room 641A want you, you're toast unless you're ready to make some REALLY big digital lifestyle changes that most people would not be amenable to, because you would have to be extremely paranoid on multiple fronts all the time. That kind of heightened vigilance is exhausting and really not worth it. Threat modeling: it keeps things realistic.
- Lammy 9mo agoSorry for assuming you'd be able to extrapolate from one example. It could be at any level of the funnel from your local machine to the wider Internet. Closer to home: this sort of fingerprinting could defeat things like MAC randomization in a PSK-authed business/university setting if those IT departments had some reason to want to track you. I once worked at a company where the Security team were very proud of this and all the other tricks they used to catch leakers by figuring out who was on campus, where, at what time, usually via fingerprinting personal devices carried alongside corporate devices.
- arcfour 9mo agoAh, so, in addition to turning off automatic updates (everyone knows patches are for wimps! The real threat is supply chain compromise, not 1-days!), you also have taken all of the other necessary steps to protect yourself from the NSA? What if they just compel Microsoft to backdoor Windows/WinGet against you? And these updaters almost universally use HTTPS, which network-based adversaries can't see except for SNI, and even that's going away...?
- edb_123 9mo agoSo, let me get this straight. If I've been lazy, postponed updates and I'm still on 8.5.8 (Oct 2023) - it turns out I'm actually...safer? Anyway, I hope the author can be a bit more specific about what actually has happened to those unlucky enough to have received these malicious updates. And perhaps a tool to e.g. do a checksum of all Notepad++ files, and compare them to the ones of a verified clean install of the user's installed version, would be a start? Though I would assume these malicious updates would be clever enough to rather have dropped and executed additional files, rather than doing something with the Notepad++ binaries themselves. And I agree with another comment here. With all those spelling mistakes that notification kind of reads like it could have been written by a state-sponsored actor. Not to be (too) paranoid here, but can we be sure that this is the actual author, and that the new version isn't the malicious one?
- hinkley 9mo agoThis reminds me of college, when some of my professors were still sorting out their curriculum and would give us homework assignments with bugs in it. I complained many times that they were enabling my innate procrastination by proving over and over again that starting the homework early meant you would get screwed. Every time I'd wait until the people in the forum started sounding optimistic before even looking at the problem statement. I still think I'd like to have a web of trust system where I let my friends try out software updates first before I do, and my relatives let me try them out before they do.
- dabinat 9mo ago> With these changes and reinforcements, I believe the situation has been fully resolved. Fingers crossed. I get that this is a difficult situation for a small developer, but ending with this line did not fill me with confidence that the problem is actually resolved and make me trust their software on my system.
- the_fall 9mo agoThat's the most honest assessment you can expect from any small-scale developer. What do you expect them to say or do? Their adversary is presumably a national intelligence agency of a superpower. The odds may be better if you operate the way OpenSSH does: move slow, security first, architect everything to be very difficult to attack. But if you're building a text editor, it's not your mindset, and probably never will be.
- xeromal 9mo agoYup, the only way to combat this as a smalltime dev would be to turn off auto updates and make people build from source.
- tjwebbnorfolk 9mo agoyea `curl <url> | gcc` is much safer...
- trympet 9mo agoSecurity through ..rarity? Maybe not for nation state actors though.
- m-schuetz 9mo agoWhy woul building from source be safer? Are you veting every single line of third-party source code you compile and use?
- g-b-r 9mo ago
- shellcromancer 9mo ago> Additionally, the XML returned by the update server is now singed (XMLDSig) The latest and greatest cryptography powering everyone’s favorite SAML-based single-sign on.
- Helmut10001 9mo agoIt looks like using Chocolatey [1] saved me from this attack vector because maintainers hardcode SHA256 checksums (and choco doesn't use WinGuP at all). [1]: https://chocolatey.org/ https://chocolatey.org/
- Melatonic 9mo agoSolid idea
- locusofself 9mo agoI don't think "we" would have been impacted since this specifically targets the updates, but recently Microsoft pulled Notepad++ from the list of apps we can use on our production management laptops. Some people were annoyed and whining about this. That predated this announcement by a few weeks. Probably the right move by the security folks.
- hjoutfbkfd 9mo agoit was pulled because the binaries were self-signed for a short period, not because they knew something who signed the binaries was irrelevant for this attack, because the issue was not checking any signature
- zeroq 9mo agoI've been thinking a lot lately about open source. It seems to be a lot like the communism - sounds great on paper but we are yet to see a proper implementation. Between GIT, Linux and SQLite there are a few projects that has been led by weirdos that have time, resources and conviction to drive these through time. Unless you create some sort of a an auxiliary business and get an acquihire deal most things will fizzle out. Years ago when I started working for BigCo I was amazed by their denial of FOSS. At one point in the project I pointed out a problem, which was heard and recognized, to which I followed up with a solution using an open source package. I thought I was clever - we needed an extra package in our system, but I was able to find a suitable open source solution that would not add to the overall cost of the project. My proposal was immediately pushed back. Initially I thought it was due to responsibility issue - if we'd employ a FOSS solution we'd be responsible for the outcome. Having a 3rd party vendor the management would have the opportunity to shell themselves. But that doesn't have to be the case. The FOSS project could easily fizzle out. And if we don't have enough resources to incorporate it and make it our own, we can potentially risk being left out to dry.
- autoexec 9mo ago> Unless you create some sort of a an auxiliary business and get an acquihire deal most things will fizzle out. This is acceptable. Why shouldn't most things started by people not willing to put in the work to keep them going not fizzle out? The important thing is that anyone who actually cares to can jump in and pick up right where the open source software fizzled out and get it going again. Anyone can learn from the code and use it for anything they want, even things that have nothing to do with the goals of the original project. It's not as if there aren't countless examples of corporate vendors dying off and leaving their customers on the hook with nothing, or just changing the product drastically after the sale. At least in the open source case you have the option to fork the project and continue using it as you always have.
- colonCapitalDee 9mo agoOh interesting, we had an internal mandate not to use Notepad++ come down from on high that was never explained. The timing matches up
- hathym 9mo ago[flagged]
- tempestn 9mo agoIf you find yourself 99.999% sure of almost anything it should be a bit of a red flag to you. If it's based on a hunch without any actual evidence, more so.
- sharyphil 9mo agoI love Notepad++ but for some reason it always had some kind of political BS going on and I don't appreciate that.
- paul_h 9mo agoFor a while, I've been thinking that open source package portals will at some point take over making of binaries that get released. Dev teams will run their own CI with whatever automated test pipelines they think is appropriate. For a tests-pass situation and will pass the git hash to the portal system for release, which just runs compile and making the binary. Well, not all CI runs would result in a release, of course. Then the package portal's own software kicks in to calculate an independent since-last-release report that's attached alongside the maintainer release notes. All such portals upgrade their hash/sig noting of binaries, and keep those in a history retaining merkle tree of sorts. Of nothing, else a git repo. Something like this https://github.com/hboutemy/mcmm-yaml/blob/master/aws/sdk/kotlin/alexaforbusiness-jvm.yaml https://github.com/hboutemy/mcmm-yaml/blob/master/aws/sdk/ko... but with SHA256s, and maybe not the entire world on one repo.
- shevy-java 9mo agoThat's sad. China should be more helpful with regards to open source. Notepad++ is a great editor. I don't use it on Linux, because I have an older editor I am very used to, but on Windows I like notepad++ a lot (though lately I have been using geany on Windows, mostly for convenience - I think notepad++ is better but I sort of like the github-based development of geany; either way notepad++ is really excellent as well).
- _zagj 9mo ago> That's sad. China should be more helpful with regards to open source. They should also be more helpful with not plundering the oceans, even including the territorial waters of far-flung nations, of fish.
- _zagj 9mo agoWhy the downvotes? I guess I should hope the CCP doesn't hijack this account the way they did Notepad++.
- Ayesh 9mo agoIf you update via Winget, you are probably safe. Winget downloads the installer from GitHub: https://github.com/microsoft/winget-pkgs/blob/master/manifests/n/Notepad%2B%2B/Notepad%2B%2B/8.8.8/Notepad%2B%2B.Notepad%2B%2B.installer.yaml#L11 https://github.com/microsoft/winget-pkgs/blob/master/manifes...
- maremmano 9mo agoI’m on version 8.8.8, which says a lot. This time I unfortunately have to move on from Notepad++. Vibes have been negative for a while but out of inertia (and because there weren't obvious alternatives) I never pulled the trigger. Now it's time. The trust is gone. Thanks NP++ for being free and useful for so many years. Can anyone suggest a solid alternative on Windows? I'm fine with Linux and macOS but I have to keep a Windows machine around for some legacy, win only, software. Maybe Sublime Text could be an option? At this point I'd rather pay for something lightweight, fast, and probably better. I don't like tooling that increases my exposure to bad state actors (whatever state they're from).
- nzd 9mo agoSublime Text. It's art.
- maremmano 9mo agoThanks. I'm on it right now. Testing.
- hansifer 9mo agoIt was great 10 years ago before VS Code, but Sublime has been abandonware for years now.
- maremmano 9mo agoI got both Sublime and VSCode. Sublime is a work of love. You can probably do more things with vscode, but I'm not sure you can do many of these things better or faster than sublime. I don't think so.
- nhinck3 9mo ago> I don't like tooling that increases my exposure to bad state actors > Can anyone suggest a solid alternative on Windows What a weird reason to switch. I don't know why you'd believe any other piece of software is somehow more secure against state actors.
- bravetraveler 9mo agoShared hosting for this, really? Fascinating.
- _cs2017_ 9mo agoMany large companies allow employees to install software from the internet on their work laptops. How do they avoid being regularly hacked this way (presumably NPP is far from being the only one at risk, and presumably the money from theft of corporate secrets attracts skilled and motivated hackers).
- benterix 9mo agoWell, the update in Notepad++ was the single annoying thing and I made sure I turned it off as the first thing after the install. It was terribly annoying, interrupting my workflow every often so I have no idea how others managed. Why should it decide when to upgrade anyway? It's a notepad! Why should I even bother to upgrade? Everything I need is already there! A piece of software like this one shouldn't be allowed to send out traffic by default anyway, it should be opt-in.
- Jnr 9mo agoYou should see the apps on MacOS. Almost every single app that is not installed from Appstore has that shitty update popup, it is driving me nuts. I think Linux has the best solution for this - good package managers for bases system and Flatpak with Flathub repo for other apps. So you never get stupid popups, and update managers use signed packages and check those signatures before installation.
- throwa356262 9mo agoThe article is not very clear. Which versions where affected and how can people check if they have the infected version?
- antiloper 9mo ago> Additionally, the XML returned by the update server is now singed (XMLDSig) XMLDSig is notoriously difficult to implement correctly and securely, I hope this doesn't backfire.
- Aqua0 9mo agoIt's ridiculous that any software developed by any developer on Earth can now claim to have been attacked by hackers supported by a certain country.
- charlieyu1 9mo agoSupply chain attacks. What can an average developer do?
- hulitu 9mo agoWhy ? It works so well for other, big companies.
- charlieyu1 9mo agoJust downloaded NP++ for my new PC.
- Saris 9mo agoI guess my habit of running a firewall and not allowing programs to access the internet unless they actually need it is helpful for stuff like this. Absolutely no reason a text editor needs internet access. I only update stuff through winget, which fetches the installer from github in a lot of cases, and changing a package requires a PR to the winget repo AFAIK. Not foolproof of course though.
- Pet_Ant 9mo agoChecking for updates and pulling in plug-ins. Both are valid.
- Bender 9mo agoA browser can download updates and plugins to be installed locally. I too do not want all my apps making internet connections. Sandboxes / namespaces can help a little.
- MisterTea 9mo agoIt's because of issues like these that I do not agree with your statement of validity. It's also cheaper code wise to not have these contraptions.
- Saris 9mo agoI think these days updates through the OS package manager is a better option, windows has had winget for 5+ years now, and obviously linux and macos both have their own established systems.
- thegrim000 9mo agoAs for updates - my OS has a built-in package management system, which is responsible for installing and updating packages. Why should notepad++ bypass that and do its own independent update process?
- maronato 9mo agoBecause other OSs do not and the notepad++ team wants all users to have a similar experience. If you don’t need auto updates, just disable them. More importantly, notepad++ being able to update itself is not the exploit here. Your OS’ package manager would download the same compromised binary as notepad++’s built in updater.
- 1970-01-01 9mo agoThis is where package managers shine. You never know if there are vulns in the update servers, and you don't know if they even bother with checksums. I never trust apps that self-update for exactly this reason. Turn that shit off and do choco update notepadplusplus or winget upgrade Notepad++.Notepad++ Of course, this does nothing for bugs in the code.
- torpid 9mo agoLong ago, Canonical did some shady stuff with the now-deprecated apt-key "net-update" signing validation for updating of GnuPG keys over the network, an exclusive Ubuntu "feature" Debian didn't even adopt that in theory allowed the same thing. First I thought CVE-2012-3587 was incompetence... but then seeing CVE-2012-0954 after it, I couldn't help think something more was at bay as something connected to a nation state. It does not surprise me in the least to see nation state attackers exploiting N++. Because I've also on very sensitive enterprise PAM systems in F500/research/academia, and about 10% of the time it felt like I'd see Notepad++ on internet-connected systems used for security tooling because vanilla notepad is indeed garbage. It does not surprise me at all this has been used as an attack vector.