11 ms·
"For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing.
by weinzierl 8mo ago
"For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text."
Well, except that this did not prevent it from having embarrassing bugs. Google "Bush hid the facts" for an example. I'm serious, you won't be disappointed.
I think complexity is relative. At the time of the "Bush hid the facts" bug, nailing down Unicode and text encodings was still considered rocket science. Now this is a solved problem and we have other battles we fight.
- jama211 8mo agoFascinating reading about that bug, thanks for sharing
- direwolf20 8mo agoIt's not solved, we just don't have to guess the encoding any more because it's always UTF-8.
- Vinnl 8mo agohttps://en.wikipedia.org/wiki/Bush_hid_the_facts https://en.wikipedia.org/wiki/Bush_hid_the_facts
- deleted 8mo ago[deleted]
- g947o 8mo agoI am pretty sure it's possible to fix that entire category of bugs without introducing RCE vulnerabilities.
- deleted 8mo ago[deleted]
- reyqn 8mo agoEmbarrassing bugs are not RCEs. Also the industry should be more mature now, not less. But move fast and break things, I guess...
- sph 8mo agoWe have reached peak software stability, it's all gonna be downhill from here.
- fwgijcqywqeo 8mo agoWe are living in the future!
- cookiengineer 8mo agoPeak software stability was Windows 7, that's why it's still used in industrial environments.
- trinix912 8mo agoFunny how back then people claimed peak stability was Windows 2000. 10 years from now people will look at Windows 10 and claim that was peak stability.
- croes 8mo ago> Now this is a solved problem Is that so? I ran pretty often in problems with programs having trouble with non-ANSI characters
- nuancebydefault 8mo agoTo be honest, the 'bush hid the facts' bug was funny and was not really a vulnerability that could be exploited, unless... you understood Chinese and the alternative text would manage to pursuade you to do something harmful. In fact, those were the good days, when a mere affair with your secretary would be enough to jeopardize your career. The pendulum couldn't have swung more since.
- egeozcan 8mo ago> unless... you understood Chinese and the alternative text would manage to persuade you to do something harmful Oh, here is the file I just saved... I see that it now tells me to rob a bank and donate the money to some random cult I'm just learning about. Let me make a web search to understand how to contact the cult leader and proceed with my plan! (luckily LLMs were not a thing back then :) )
- dspillett 8mo ago> nailing down Unicode and text encodings was still considered rocket science. Now this is a solved problem I wish… Detecting text encoding is only easy if all you need to contend with is UTF16-with-BOM, UTF8-with-BOM, UTF8-without-BOM, and plain ASCII (which is effectively also UTF8). As soon as you might see UTF16 or UCS without a BOM, or 8-bit codepages other than plain ASCII (many apps/libs assume that these are always CP1252, a superset of the printable characters of ISO-8859-1, which may not be the case), things are not fully deterministic. Thankfully UTF8 has largely won out over the many 8-bit encodings, but that leaves the interesting case of UTF8-with-BOM. The standard recommends against using it, that plain UTF8 is the way to go, but to get Excel to correctly load a UTF8 encoded CSV or similar you must include the BOM (otherwise it assumes CP 1252 and characters above 127 are corrupted). But… some apps/libs are completely unaware that UTF8-with-BOM is a thing at all so they load such files with the first column header corrupted. Source: we have clients pushing & pulling (or having us push/pull) data back & forth in various CSV formats, and we see some oddities in what we receive and what we are expected to send more regularly than you might think. The real fun comes when something at the client's end processes text badly (multiple steps with more than one of them incorrectly reading UTF8 as CP1252, for example) before we get hold of it, and we have to convince them that what they have sent is non-deterministically corrupt and we can't reliably fix it on the receiving end…
- josephg 8mo ago> to get Excel to correctly load a UTF8 encoded CSV or similar you must include the BOM Ah so that’s the trick! I’ve run into this problem a bunch of times in the wild, where some script emits csv which works on the developers machine but fails strangely with real world data. Good to know there’s a simple solution. I hope I remember your comment next time I see this!
- silon42 8mo agoExcel CSV is broken anyway, since in some (EU, ...) countries it needs ; as separator.
- 8mo ago
- bsza 8mo agoThere is a difference between a bug you laugh at and walk away and a bug a scammer laughs at as he walks away with your money. When I open something in Notepad, I don't expect it to be a possible attack vector for installing ransomware on my machine. I expect it to be text. It being displayed incorrectly is supposed to be the worst thing that could happen. There should be no reason to make Notepad capable of recognizing links, let alone opening them. Save that crap for VS Code or some other app I already know not to trust.
- usrbinbash 8mo agoAs funny as the "Bush hid the facts" bug may be, there is a world of difference between an embarassing mistake by a function that guesses the text encoding wrong, and a goddamn remote code execution with an 8.8 score > and we have other battles we fight. Except no, we don't. notepad.exe was DONE SOFTWARE. It was feature complete. It didn't have to change. This is not a battle that needed fighting, this was hitting a brick wall with ones fist for no good reason, and then complaining about the resulting pain.
- MarleTangible 8mo agoThey also wanted to use the popularity of Notepad, so they replaced it with an AI bloatware version instead of creating a new app with extra features.
- delecti 8mo agoThey didn't need to create a new app. At the same time that they started adding LLM garbage to Notepad, they discontinued WordPad. https://en.wikipedia.org/wiki/Windows_Notepad#Change_in_development_model https://en.wikipedia.org/wiki/Windows_Notepad#Change_in_deve... https://en.wikipedia.org/wiki/WordPad#Discontinuation https://en.wikipedia.org/wiki/WordPad#Discontinuation They likely knew nobody would be drawn to WordPad by the additions, so they had to scavenge their rapidly diminishing list of actually useful software for sacrifices on the altar to their outrageous AI investments.
- Ntrails 8mo agoHow long were they threatening to kill snipping tool despite it being a perfectly serviceable piece of kit so we could switch to some shitty alternative?
- d3Xt3r 8mo agoThey did ultimately kill it though - and then they re-created it as a bloated UWP version that is an insane 449 MEGABYTES in size! The old win32 Snipping Tool used to be only a few kilobytes...