3 ms·
Checking for updates and pulling in plug-ins. Both are valid.
by Pet_Ant 8mo ago
Checking for updates and pulling in plug-ins. Both are valid.
- Bender 8mo agoA browser can download updates and plugins to be installed locally. I too do not want all my apps making internet connections. Sandboxes / namespaces can help a little.
- MisterTea 8mo agoIt's because of issues like these that I do not agree with your statement of validity. It's also cheaper code wise to not have these contraptions.
- Saris 8mo agoI think these days updates through the OS package manager is a better option, windows has had winget for 5+ years now, and obviously linux and macos both have their own established systems.
- thegrim000 8mo agoAs for updates - my OS has a built-in package management system, which is responsible for installing and updating packages. Why should notepad++ bypass that and do its own independent update process?
- maronato 8mo agoBecause other OSs do not and the notepad++ team wants all users to have a similar experience. If you don’t need auto updates, just disable them. More importantly, notepad++ being able to update itself is not the exploit here. Your OS’ package manager would download the same compromised binary as notepad++’s built in updater.
- Saris 8mo agoWhat OS doesn't have a package manager now? Windows, Linux, and MacOS all have their own systems. On windows, the package manager downloads the release of notepad++ directly from github, so it would not have been compromised. The hijack was done on the notepad++ website at the webhost level as I understand it, and the built in updater pulled from there.
- hulitu 8mo ago> Checking for updates Why ? CADT ?