12 ms·
We have officially reached the logical conclusion of the feature-bloat-to-vulnerability pipeline. For nearly thirty years, notepad.exe was the gold standard fo
by Fiveplus 8mo ago
We have officially reached the logical conclusion of the feature-bloat-to-vulnerability pipeline.
For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text. An 8.8 CVSS on a utility meant for viewing data is a fundamental failure of the principle of least privilege.
At some point, they need to stop asking "can we add this feature?" and start asking "does this text editor need a network-aware rendering stack?"
- consp 8mo ago> viewing data is a fundamental failure of the principle of least privilege. I read the cwe not cve, was wrong. It's still early in the morning...
- seritools 8mo agoYou are mistaken: > The malicious code would execute in the security context of the user who opened the Markdown file, giving the attacker the same permissions as that user.
- mwalser 8mo ago> If I read it correctly (but could be mistaken), it runs with setuid root I am certain you are mistaken. I couldn't find anything that hints at notepad running with elevated privileges.
- dijit 8mo agoPeople very often run notepad as administrator (anything launched from administrative powershell instances will run like this). In fact, if you enabled developer mode on your computer there's a registry key that gets set to run notepad as admin, it's: `runas /savecred /user:PC-NAME\Administrator “notepad %1”` in HKEY_CLASSES_ROOT-> * -> shell -> runas (new folder) -> (Default) And, if I'm not totally mistaken, notepad also has the ability to reopen files as administrator, but I don't remember how to invoke it. Regardless, notepad is a very trusted application and is often run as Administrator. Often it's more trusted than any other utility to modify system files.
- patates 8mo ago> And, if I'm not totally mistaken, notepad also has the ability to reopen files as administrator, but I don't remember how to invoke it. I think that's a notepad plus plus feature. I had it offer to reopen itself as administrator when editing system files like HOSTS.
- MarleTangible 8mo ago> Regardless, notepad is a very trusted application and is often run as Administrator. Sorry to say this, but Notepad was a very trusted application now. I cannot believe that such a core utility has a 8.8 CVE, it sounds like a joke tbh.
- dijit 8mo agoA totally valid modification to the statement I made. These are sad times.
- deleted 8mo ago[deleted]
- cafebabbe 8mo agoQuestion is, did they even realize they added a network-aware rendering stack...
- autoexec 8mo agoIs it giving MS too much credit to suggest that they probably didn't just vibe code their new notepad?
- hennell 8mo agoA utility meant for viewing data? I don't think you understand what a text editor is. I'd agree that recent features feel a bit unnecessary, but it does need to edit and write files - including system ones (going through however that is authorised). You could sandbox a lot of apps with limited impact, but it would make a text editor really useless. Least privilege principles work best when you don't need many privileges.
- ntoskrnl_exe 8mo agoI’m not sure I understand what you’re trying to say. You could always edit system files with notepad, that was something that the program always excelled at thanks to its simplicity in both how it looked and behaved. And i fail to see the new features as anything but useless bloat.
- AnonymousPlanet 8mo agoI'm not sure if we should use "gold standard" together with the little piece of garbage that notepad.exe was for most of its existence. It has been the bane for anyone who had to do work on locked down Windows servers and had to, e.g., edit files with modern encodings. They fixed some of it in the meantime, but the bitter taste remains.
- iugtmkbdfil834 8mo agoYou do have a point, because it shows an unfortunate inflation in words. That said, on a fresh windows install, notepad was usually an island of stability in a sea of sorrow. The day I saw AI introduced to it, I knew the end is nigh.
- AnonymousPlanet 8mo agoWhen you have to edit text files on a locked down Windows server that are UTF-8 like everything else in the world and your only tool is notepad.exe, it's the island of pain.
- ceving 8mo agoThey should have called it Emacs. Then everybody would have known.
- weinzierl 8mo ago"For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text." Well, except that this did not prevent it from having embarrassing bugs. Google "Bush hid the facts" for an example. I'm serious, you won't be disappointed. I think complexity is relative. At the time of the "Bush hid the facts" bug, nailing down Unicode and text encodings was still considered rocket science. Now this is a solved problem and we have other battles we fight.
- jama211 8mo agoFascinating reading about that bug, thanks for sharing
- direwolf20 8mo agoIt's not solved, we just don't have to guess the encoding any more because it's always UTF-8.
- Vinnl 8mo agohttps://en.wikipedia.org/wiki/Bush_hid_the_facts https://en.wikipedia.org/wiki/Bush_hid_the_facts
- deleted 8mo ago[deleted]
- g947o 8mo agoI am pretty sure it's possible to fix that entire category of bugs without introducing RCE vulnerabilities.
- deleted 8mo ago[deleted]
- reyqn 8mo agoEmbarrassing bugs are not RCEs. Also the industry should be more mature now, not less. But move fast and break things, I guess...
- keepamovin 8mo agoI couldn't agree more. A text editor exposing an attack surface via a network stack is precisely the kind of bloat that makes modern computing ultra-fragile. I actually built a "dumb" alternative in Rust last week specifically to escape this. It’s a local-only binary—no network permissions, encrypted at rest, and uses FIPS-compliant bindings (OpenSSL) just to keep the crypto boring and standard. It’s inspectable if you want to check the crate: https://github.com/BrowserBox/FIPSPad https://github.com/BrowserBox/FIPSPad
- Muromec 8mo agoWhat does notepad need openssl for?
- w4yai 8mo agoCryptography I guess
- absynth 8mo agoFor the built-in web-browser instance it likely contains by now.
- daemoncoder 8mo agoAbility to handle email coming soon.
- autoexec 8mo agoBut can it play MP3s?
- MonkeyClub 8mo agoI'm sure eventually it will, it's law: Every text editor, if it survives long enough, will end up implementing a partial, bug-ridden version of Emacs.
- mr_mitm 8mo agoUnfortunately, code execution in text editors aren't a new thing. Vim had one published in 2019: https://github.com/numirias/security/blob/master/doc/2019-06-04_ace-vim-neovim.md https://github.com/numirias/security/blob/master/doc/2019-06... Another in 2004: https://www.cve.org/CVERecord?id=CVE-2002-1377 https://www.cve.org/CVERecord?id=CVE-2002-1377 Neither vim nor Notepad are purely for displaying text though.
- iso1631 8mo agovim is a far larger program than a text editor. notepad was always a plain text editor. It had enough problems with unicode and what that means to be "plain text".
- Someone1234 8mo ago> Neither vim nor Notepad are purely for displaying text though. Up until fairly recently, that's exactly all Notepad did. Vim has those bugs because of bloat, and now Notepad does too. AI, Markdown, Spellchecker, etc, nobody asked for this bloat.
- artemonster 8mo agotell this to level N-1 managers that want to get promoted by the only way of "launching features"
- TZubiri 8mo agoEDIT: THE OLD NOTEPAD IS STILL IN WINDOWS AND WE CAN USE IT! https://learn.microsoft.com/en-us/answers/questions/3845356/getting-the-old-version-of-notepad-on-windows-11?utm_source=chatgpt.com https://learn.microsoft.com/en-us/answers/questions/3845356/... You basically have to find the "execution alias" setting and disable notepad and you get the ole reliable :D OLD POST: This has hurt me specifically. Since I work without IDEs, no VIM, no vs code. On linux I use nano, on windows I use Notepad. I like the minimalism and the fact that I have absolute control, and that I can work on any machine without needing to introduce an external install. Last couple of years notepad started getting more features, but I'm very practical so I just ignored them, logged out of my account when necessary, opted out of features in settings, whatever. But now this moment feels like I must change something, we need a traditional notepad.exe or just copy it from a previous version, I'll try adding NOTEPAD.exe to a thumb drive and having that. But it's a shame that it breaks the purity of "working with what's installed".
- kgwxd 8mo agoThe day calculator brought me to an MS Store login was the day I became a radical.
- cube00 8mo agoMine was when they asked me to rate the calculator on the store.
- encom 8mo agoThe calculator on my Pixel phone has a privacy policy. I want to get off this ride.
- chasil 8mo agoIs it as good as Android's calculator? https://chadnauseam.com/coding/random/calculator-app https://chadnauseam.com/coding/random/calculator-app https://dl.acm.org/doi/10.1145/2911981 https://dl.acm.org/doi/10.1145/2911981 https://dl.acm.org/doi/pdf/10.1145/2911981 https://dl.acm.org/doi/pdf/10.1145/2911981 https://github.com/LineageOS/android_packages_apps_ExactCalculator https://github.com/LineageOS/android_packages_apps_ExactCalc... https://medium.com/@jnebos/the-humble-android-calculator-4f139e8b1699 https://medium.com/@jnebos/the-humble-android-calculator-4f1...
- kgwxd 8mo agoThat's exactly what it was, I misremembered. But a few months ago, I gave 11 a shot on my gaming PC Windows partition, because 10 had reached end of life, and Minecraft refused to work on it at all, Minecraft then required the store login, without any recourse. So I wiped out the Windows partition and decided Java Edition on Linux was good enough. My kids stopped playing Bedrock anyway. All the other games I cared about worked on Linux too. For me, that's really just Rocket League, but that might die when EAC is added, so another toxic company might be out of my life soon. It'll be sad after 4k hours, but I expected the day to come the day Epic took over. Sober for Roblox is good enough for occasional play with the kids. And just 1 person at work is keeping Windows alive, hopefully they're going to retire soon.
- bigfatkitten 8mo ago> At some point, they need to stop asking "can we add this feature?" and start asking "does this text editor need a network-aware rendering stack?" They didn’t stop there. They also asked “does this need AI?” and came up with the wrong answer.
- sneak 8mo agoIt’s just resumé driven development. Corporate droids gotta justify their salaries somehow. It doesn’t pay to call software “done”.
- cyanydeez 8mo agoMicrosoft is driving AI adoption. Why blame tge workers for this?
- throwpoaster 8mo agoMicrosoft is comprised of its workers.
- jdsampayo 8mo agoAll workers are equal, but some workers are more equal than others
- stalfosknight 8mo agoI have been thinking about this Animal Farm quote a lot recently.
- wormpilled 8mo agoWhy can't Indian software developers stand up for themselves and say no?
- vachina 8mo ago
- addhochohoc 8mo agoYou goto go with the times man, goto write yourself a fulltime job with a legacy.
- gruez 8mo ago>At some point, they need to stop asking "can we add this feature?" and start asking "does this text editor need a network-aware rendering stack?" But so far as I can tell the bug isn't related to "network-aware rendering stack" or AI (as other people are blindly speculating)? From MSRC: >How could an attacker exploit this vulnerability? >An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad, causing the application to launch unverified protocols that load and execute remote files. Sounds like a bug where you could put an url like \\evil.example\virus.exe into a link, and if a user clicks it executes virus.exe
- optymizer 8mo agoThat's why we have text editors, markdown viewers, image viewers, etc. You were never able to "click a link" in Notepad in the past. Mixing responsibilities brings with it lots of baggage, security vulnerabilities being one of them.
- Rohansi 8mo agoI think there are more text editors around that render clickable links than there are that don't. Even your terminal probably renders clickable links. Despite the scary words and score this wouldn't even be a vulnerability if people weren't so hard wired to click every link they see. It's not some URL parsing gone wrong triggering an RCE. Most likely they allowed something like file:// links which of course opens that file. Totally valid link, but the feature must be neutered to only http(s):// because people.
- hulitu 8mo agoEd doesn't.
- deleted 7mo ago[deleted]
- hulitu 8mo ago> That's why we have text editors, markdown viewers, image viewers, etc. This is so 80s. Now we have systemd (svchost.exe), wayland (explorer) and a webbrowser (chrome). You don't need more.
- titzer 8mo agoIt'd be more hilarious if it weren't so sad. In just 10 years a disturbingly large number of huge development teams decided that making a GUI application using the old ways [1] was too hard and decided to ship an entire web engine (electron) to render 10 buttons. [1] (native GUI widgets? agggh)
- Rohansi 8mo agoWhich 10 buttons?
- FridgeSeal 8mo agoLarge swathes of this industry have an obsession with investing 10x more resources into the wrong thing, than simply fixing the underlying issue.
- JCattheATM 8mo agoThings started going downhill when they added a Bing option to one of the menus, which was only very recently after they added support for *nix newlines. A very mishandled product, but then the whole OS has been mishandled since 10. Some would say 7.
- numpad0 8mo ago> At some point, they need to stop asking "can we add this feature?" and start asking "does this text editor need a network-aware rendering stack?" Everyone has to prove their worth by involving more people in ever embiggening trainwrecks every quarters in this day and age just to maintain employment, and without tangibly threatening anyone else's while at it. That's where the features are coming from. That's what needs to be fixed. Which also goes way beyond engineering.
- lofaszvanitt 8mo agoNow imagine that there are people who want to embed video players and image viewing in the terminal :D.