5 ms·

I guess my habit of running a firewall and not allowing programs to access the internet unless they actually need it is helpful for stuff like this. Absolutely

by Saris 8mo ago

I guess my habit of running a firewall and not allowing programs to access the internet unless they actually need it is helpful for stuff like this. Absolutely no reason a text editor needs internet access. I only update stuff through winget, which fetches the installer from github in a lot of cases, and changing a package requires a PR to the winget repo AFAIK. Not foolproof of course though.

Pet_Ant 8mo ago
Checking for updates and pulling in plug-ins. Both are valid.
- Bender 8mo ago
  A browser can download updates and plugins to be installed locally. I too do not want all my apps making internet connections. Sandboxes / namespaces can help a little.
- MisterTea 8mo ago
  It's because of issues like these that I do not agree with your statement of validity. It's also cheaper code wise to not have these contraptions.
- Saris 8mo ago
  I think these days updates through the OS package manager is a better option, windows has had winget for 5+ years now, and obviously linux and macos both have their own established systems.
- thegrim000 8mo ago
  As for updates - my OS has a built-in package management system, which is responsible for installing and updating packages. Why should notepad++ bypass that and do its own independent update process?
  - maronato 8mo ago
    Because other OSs do not and the notepad++ team wants all users to have a similar experience. If you don’t need auto updates, just disable them. More importantly, notepad++ being able to update itself is not the exploit here. Your OS’ package manager would download the same compromised binary as notepad++’s built in updater.
    - Saris 8mo ago
      What OS doesn't have a package manager now? Windows, Linux, and MacOS all have their own systems. On windows, the package manager downloads the release of notepad++ directly from github, so it would not have been compromised. The hijack was done on the notepad++ website at the webhost level as I understand it, and the built in updater pulled from there.
- hulitu 8mo ago
  > Checking for updates Why ? CADT ?
just_testing 8mo ago
Which firewall software do you use? I should probably start using firewalls in my computers as well...
- Saris 8mo ago
  I've been using Fort: https://github.com/tnodir/fort https://github.com/tnodir/fort It's the best one I found after trying a few, because it's pretty easy to use, and lets me disable notification popups which is a part that always frustrates me about other options.
  - valbu 8mo ago
    Why am I hearing about that specific FW in year 2026, this seems really good, at least the features written if it really supports rules based on parent processes, wildcards, SvcHost granularity without gotchas. Been wrangling with Windows FW for ages, trying to get some badly behaved programs to update like Discord, Teams and others that change install paths or updater executable names or hiddenly use msedgewebview2. PolicyAppId and tagging based rules have given some success but Windows FW is still really broken. Definitely giving Fort a try.
    - Saris 8mo ago
      It's quite good! It definitely deserves to be more popular, I hope it gets some more recognition. Wildcards are great, like you said for those apps that change the directory name every single update.
    - batat 8mo ago
      > A "Core Isolation: Memory Integrity" feature of Windows 10+ prevents creating such memory area (leading to BSOD). > We tried to attestation sign the driver via new EV certificate by MS to fix the driver's limitation, but failed (see #108). > So for now users have to disable the "Core Isolation: Memory Integrity" feature Disabling HVCI doesn't sound like a good idea honestly. I mean they abuse kernel memory protection to bypass EV Certificate restrictions leaving the system in a state where another driver can mess with FW's internal structures using the same trick.
sciencejerk 8mo ago
LittleSnitch is great for MacOS; it is easily configured to alert you every time your machine makes ip/domain connections, which can then be accepted, denied, or rules made
- np1810 8mo ago
  > LittleSnitch is great for MacOS; it is easily configured to alert you every time your machine makes ip/domain connections, which can then be accepted, denied, or rules made For an open-source alternative, consider checking out - Lulu [0]. It's not as feature rich nor has impressive UI like the former but gets the main work done. [0] https://github.com/objective-see/LuLu https://github.com/objective-see/LuLu
  - nonamenoslogan 8mo ago
    I use LuLu, it works great. Its kept my older versions of Photoshop and Acrobat from complaining and showing me ads for newer versions for the last couple years!
    - djkoolaide 8mo ago
      Tossing in a suggestion for Vallum[0] here. It's not FOSS but very polished and a fraction of the cost of Little Snitch. [0]: https://vallumfirewall.com/ https://vallumfirewall.com/
  - addandsubtract 8mo ago
    It's not open source, but I can also recommend Vallum[0] as a cheaper alternative to LittleSnitch. [0] https://www.vallumfirewall.com/ https://www.vallumfirewall.com/
  - XdekHckr 8mo ago
    Are you for realy using apple products? Yuh...
- Saris 8mo ago
  Yeah I've been using Fort on windows, it's easy to use and not closed source and full of bloat like the commonly suggested windows firewalls from various security companies.
drumttocs8 8mo ago
Malwarebytes Windows Firewall Control may annoy me sometimes, but this is exactly why I run it.
- Saris 8mo ago
  It shouldn't! Fort just flashes the tray icon if there's a new connection request and you can click it whenever you want, instead of a popup in your face in the middle of something.

by Saris 8mo ago

Pet_Ant 8mo ago

Checking for updates and pulling in plug-ins. Both are valid.

Bender 8mo ago
A browser can download updates and plugins to be installed locally. I too do not want all my apps making internet connections. Sandboxes / namespaces can help a little.
MisterTea 8mo ago
It's because of issues like these that I do not agree with your statement of validity. It's also cheaper code wise to not have these contraptions.
Saris 8mo ago
I think these days updates through the OS package manager is a better option, windows has had winget for 5+ years now, and obviously linux and macos both have their own established systems.
thegrim000 8mo ago
As for updates - my OS has a built-in package management system, which is responsible for installing and updating packages. Why should notepad++ bypass that and do its own independent update process?
- maronato 8mo ago
  Because other OSs do not and the notepad++ team wants all users to have a similar experience. If you don’t need auto updates, just disable them. More importantly, notepad++ being able to update itself is not the exploit here. Your OS’ package manager would download the same compromised binary as notepad++’s built in updater.
  - Saris 8mo ago
    What OS doesn't have a package manager now? Windows, Linux, and MacOS all have their own systems. On windows, the package manager downloads the release of notepad++ directly from github, so it would not have been compromised. The hijack was done on the notepad++ website at the webhost level as I understand it, and the built in updater pulled from there.
hulitu 8mo ago
> Checking for updates Why ? CADT ?

just_testing 8mo ago

Which firewall software do you use? I should probably start using firewalls in my computers as well...

Saris 8mo ago
I've been using Fort: https://github.com/tnodir/fort https://github.com/tnodir/fort It's the best one I found after trying a few, because it's pretty easy to use, and lets me disable notification popups which is a part that always frustrates me about other options.
- valbu 8mo ago
  Why am I hearing about that specific FW in year 2026, this seems really good, at least the features written if it really supports rules based on parent processes, wildcards, SvcHost granularity without gotchas. Been wrangling with Windows FW for ages, trying to get some badly behaved programs to update like Discord, Teams and others that change install paths or updater executable names or hiddenly use msedgewebview2. PolicyAppId and tagging based rules have given some success but Windows FW is still really broken. Definitely giving Fort a try.
  - Saris 8mo ago
    It's quite good! It definitely deserves to be more popular, I hope it gets some more recognition. Wildcards are great, like you said for those apps that change the directory name every single update.
  - batat 8mo ago
    > A "Core Isolation: Memory Integrity" feature of Windows 10+ prevents creating such memory area (leading to BSOD). > We tried to attestation sign the driver via new EV certificate by MS to fix the driver's limitation, but failed (see #108). > So for now users have to disable the "Core Isolation: Memory Integrity" feature Disabling HVCI doesn't sound like a good idea honestly. I mean they abuse kernel memory protection to bypass EV Certificate restrictions leaving the system in a state where another driver can mess with FW's internal structures using the same trick.

sciencejerk 8mo ago

LittleSnitch is great for MacOS; it is easily configured to alert you every time your machine makes ip/domain connections, which can then be accepted, denied, or rules made

np1810 8mo ago
> LittleSnitch is great for MacOS; it is easily configured to alert you every time your machine makes ip/domain connections, which can then be accepted, denied, or rules made For an open-source alternative, consider checking out - Lulu [0]. It's not as feature rich nor has impressive UI like the former but gets the main work done. [0] https://github.com/objective-see/LuLu https://github.com/objective-see/LuLu
- nonamenoslogan 8mo ago
  I use LuLu, it works great. Its kept my older versions of Photoshop and Acrobat from complaining and showing me ads for newer versions for the last couple years!
  - djkoolaide 8mo ago
    Tossing in a suggestion for Vallum[0] here. It's not FOSS but very polished and a fraction of the cost of Little Snitch. [0]: https://vallumfirewall.com/ https://vallumfirewall.com/
- addandsubtract 8mo ago
  It's not open source, but I can also recommend Vallum[0] as a cheaper alternative to LittleSnitch. [0] https://www.vallumfirewall.com/ https://www.vallumfirewall.com/
- XdekHckr 8mo ago
  Are you for realy using apple products? Yuh...
Saris 8mo ago
Yeah I've been using Fort on windows, it's easy to use and not closed source and full of bloat like the commonly suggested windows firewalls from various security companies.

drumttocs8 8mo ago

Malwarebytes Windows Firewall Control may annoy me sometimes, but this is exactly why I run it.

Saris 8mo ago
It shouldn't! Fort just flashes the tray icon if there's a new connection request and you can click it whenever you want, instead of a popup in your face in the middle of something.