7 ms·
We have officially reached the logical conclusion of the feature-bloat-to-vulnerability pipeline. For nearly thirty years, notepad.exe was the gold standard fo
by Fiveplus 7mo ago
We have officially reached the logical conclusion of the feature-bloat-to-vulnerability pipeline.
For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text. An 8.8 CVSS on a utility meant for viewing data is a fundamental failure of the principle of least privilege.
At some point, they need to stop asking "can we add this feature?" and start asking "does this text editor need a network-aware rendering stack?"
- consp 7mo ago> viewing data is a fundamental failure of the principle of least privilege. I read the cwe not cve, was wrong. It's still early in the morning...
- seritools 7mo agoYou are mistaken: > The malicious code would execute in the security context of the user who opened the Markdown file, giving the attacker the same permissions as that user.
- mwalser 7mo ago> If I read it correctly (but could be mistaken), it runs with setuid root I am certain you are mistaken. I couldn't find anything that hints at notepad running with elevated privileges.
- dijit 7mo agoPeople very often run notepad as administrator (anything launched from administrative powershell instances will run like this). In fact, if you enabled developer mode on your computer there's a registry key that gets set to run notepad as admin, it's: `runas /savecred /user:PC-NAME\Administrator “notepad %1”` in HKEY_CLASSES_ROOT-> * -> shell -> runas (new folder) -> (Default) And, if I'm not totally mistaken, notepad also has the ability to reopen files as administrator, but I don't remember how to invoke it. Regardless, notepad is a very trusted application and is often run as Administrator. Often it's more trusted than any other utility to modify system files.
- patates 7mo ago> And, if I'm not totally mistaken, notepad also has the ability to reopen files as administrator, but I don't remember how to invoke it. I think that's a notepad plus plus feature. I had it offer to reopen itself as administrator when editing system files like HOSTS.
- MarleTangible 7mo ago> Regardless, notepad is a very trusted application and is often run as Administrator. Sorry to say this, but Notepad was a very trusted application now. I cannot believe that such a core utility has a 8.8 CVE, it sounds like a joke tbh.
- dijit 7mo agoA totally valid modification to the statement I made. These are sad times.
- deleted 7mo ago[deleted]
- cafebabbe 7mo agoQuestion is, did they even realize they added a network-aware rendering stack...
- autoexec 7mo agoIs it giving MS too much credit to suggest that they probably didn't just vibe code their new notepad?
- hennell 7mo agoA utility meant for viewing data? I don't think you understand what a text editor is. I'd agree that recent features feel a bit unnecessary, but it does need to edit and write files - including system ones (going through however that is authorised). You could sandbox a lot of apps with limited impact, but it would make a text editor really useless. Least privilege principles work best when you don't need many privileges.
- ntoskrnl_exe 7mo agoI’m not sure I understand what you’re trying to say. You could always edit system files with notepad, that was something that the program always excelled at thanks to its simplicity in both how it looked and behaved. And i fail to see the new features as anything but useless bloat.
- AnonymousPlanet 7mo agoI'm not sure if we should use "gold standard" together with the little piece of garbage that notepad.exe was for most of its existence. It has been the bane for anyone who had to do work on locked down Windows servers and had to, e.g., edit files with modern encodings. They fixed some of it in the meantime, but the bitter taste remains.
- iugtmkbdfil834 7mo agoYou do have a point, because it shows an unfortunate inflation in words. That said, on a fresh windows install, notepad was usually an island of stability in a sea of sorrow. The day I saw AI introduced to it, I knew the end is nigh.
- AnonymousPlanet 7mo agoWhen you have to edit text files on a locked down Windows server that are UTF-8 like everything else in the world and your only tool is notepad.exe, it's the island of pain.
- ceving 7mo agoThey should have called it Emacs. Then everybody would have known.
- weinzierl 7mo ago"For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text." Well, except that this did not prevent it from having embarrassing bugs. Google "Bush hid the facts" for an example. I'm serious, you won't be disappointed. I think complexity is relative. At the time of the "Bush hid the facts" bug, nailing down Unicode and text encodings was still considered rocket science. Now this is a solved problem and we have other battles we fight.
- jama211 7mo agoFascinating reading about that bug, thanks for sharing
- direwolf20 7mo agoIt's not solved, we just don't have to guess the encoding any more because it's always UTF-8.
- Vinnl 7mo agohttps://en.wikipedia.org/wiki/Bush_hid_the_facts https://en.wikipedia.org/wiki/Bush_hid_the_facts
- deleted 7mo ago[deleted]
- g947o 7mo agoI am pretty sure it's possible to fix that entire category of bugs without introducing RCE vulnerabilities.
- deleted 7mo ago[deleted]
- reyqn 7mo agoEmbarrassing bugs are not RCEs. Also the industry should be more mature now, not less. But move fast and break things, I guess...
- keepamovin 7mo agoI couldn't agree more. A text editor exposing an attack surface via a network stack is precisely the kind of bloat that makes modern computing ultra-fragile. I actually built a "dumb" alternative in Rust last week specifically to escape this. It’s a local-only binary—no network permissions, encrypted at rest, and uses FIPS-compliant bindings (OpenSSL) just to keep the crypto boring and standard. It’s inspectable if you want to check the crate: https://github.com/BrowserBox/FIPSPad https://github.com/BrowserBox/FIPSPad
- Muromec 7mo agoWhat does notepad need openssl for?
- w4yai 7mo agoCryptography I guess
- absynth 7mo agoFor the built-in web-browser instance it likely contains by now.
- daemoncoder 7mo agoAbility to handle email coming soon.
- autoexec 7mo agoBut can it play MP3s?
- MonkeyClub 7mo agoI'm sure eventually it will, it's law: Every text editor, if it survives long enough, will end up implementing a partial, bug-ridden version of Emacs.
- mr_mitm 7mo agoUnfortunately, code execution in text editors aren't a new thing. Vim had one published in 2019: https://github.com/numirias/security/blob/master/doc/2019-06-04_ace-vim-neovim.md https://github.com/numirias/security/blob/master/doc/2019-06... Another in 2004: https://www.cve.org/CVERecord?id=CVE-2002-1377 https://www.cve.org/CVERecord?id=CVE-2002-1377 Neither vim nor Notepad are purely for displaying text though.
- iso1631 7mo agovim is a far larger program than a text editor. notepad was always a plain text editor. It had enough problems with unicode and what that means to be "plain text".
- Someone1234 7mo ago> Neither vim nor Notepad are purely for displaying text though. Up until fairly recently, that's exactly all Notepad did. Vim has those bugs because of bloat, and now Notepad does too. AI, Markdown, Spellchecker, etc, nobody asked for this bloat.
- artemonster 7mo agotell this to level N-1 managers that want to get promoted by the only way of "launching features"
- TZubiri 7mo agoEDIT: THE OLD NOTEPAD IS STILL IN WINDOWS AND WE CAN USE IT! https://learn.microsoft.com/en-us/answers/questions/3845356/getting-the-old-version-of-notepad-on-windows-11?utm_source=chatgpt.com https://learn.microsoft.com/en-us/answers/questions/3845356/... You basically have to find the "execution alias" setting and disable notepad and you get the ole reliable :D OLD POST: This has hurt me specifically. Since I work without IDEs, no VIM, no vs code. On linux I use nano, on windows I use Notepad. I like the minimalism and the fact that I have absolute control, and that I can work on any machine without needing to introduce an external install. Last couple of years notepad started getting more features, but I'm very practical so I just ignored them, logged out of my account when necessary, opted out of features in settings, whatever. But now this moment feels like I must change something, we need a traditional notepad.exe or just copy it from a previous version, I'll try adding NOTEPAD.exe to a thumb drive and having that. But it's a shame that it breaks the purity of "working with what's installed".
- kgwxd 7mo agoThe day calculator brought me to an MS Store login was the day I became a radical.
- cube00 7mo agoMine was when they asked me to rate the calculator on the store.
- encom 7mo agoThe calculator on my Pixel phone has a privacy policy. I want to get off this ride.
- chasil 7mo agoIs it as good as Android's calculator? https://chadnauseam.com/coding/random/calculator-app https://chadnauseam.com/coding/random/calculator-app https://dl.acm.org/doi/10.1145/2911981 https://dl.acm.org/doi/10.1145/2911981 https://dl.acm.org/doi/pdf/10.1145/2911981 https://dl.acm.org/doi/pdf/10.1145/2911981 https://github.com/LineageOS/android_packages_apps_ExactCalculator https://github.com/LineageOS/android_packages_apps_ExactCalc... https://medium.com/@jnebos/the-humble-android-calculator-4f139e8b1699 https://medium.com/@jnebos/the-humble-android-calculator-4f1...
- kgwxd 7mo agoThat's exactly what it was, I misremembered. But a few months ago, I gave 11 a shot on my gaming PC Windows partition, because 10 had reached end of life, and Minecraft refused to work on it at all, Minecraft then required the store login, without any recourse. So I wiped out the Windows partition and decided Java Edition on Linux was good enough. My kids stopped playing Bedrock anyway. All the other games I cared about worked on Linux too. For me, that's really just Rocket League, but that might die when EAC is added, so another toxic company might be out of my life soon. It'll be sad after 4k hours, but I expected the day to come the day Epic took over. Sober for Roblox is good enough for occasional play with the kids. And just 1 person at work is keeping Windows alive, hopefully they're going to retire soon.
- bigfatkitten 7mo ago> At some point, they need to stop asking "can we add this feature?" and start asking "does this text editor need a network-aware rendering stack?" They didn’t stop there. They also asked “does this need AI?” and came up with the wrong answer.
- sneak 7mo agoIt’s just resumé driven development. Corporate droids gotta justify their salaries somehow. It doesn’t pay to call software “done”.
- cyanydeez 7mo agoMicrosoft is driving AI adoption. Why blame tge workers for this?
- throwpoaster 7mo agoMicrosoft is comprised of its workers.
- jdsampayo 7mo agoAll workers are equal, but some workers are more equal than others
- stalfosknight 7mo agoI have been thinking about this Animal Farm quote a lot recently.
- wormpilled 7mo agoWhy can't Indian software developers stand up for themselves and say no?
- onion2k 7mo ago
- addhochohoc 7mo agoYou goto go with the times man, goto write yourself a fulltime job with a legacy.
- gruez 7mo ago>At some point, they need to stop asking "can we add this feature?" and start asking "does this text editor need a network-aware rendering stack?" But so far as I can tell the bug isn't related to "network-aware rendering stack" or AI (as other people are blindly speculating)? From MSRC: >How could an attacker exploit this vulnerability? >An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad, causing the application to launch unverified protocols that load and execute remote files. Sounds like a bug where you could put an url like \\evil.example\virus.exe into a link, and if a user clicks it executes virus.exe
- optymizer 7mo agoThat's why we have text editors, markdown viewers, image viewers, etc. You were never able to "click a link" in Notepad in the past. Mixing responsibilities brings with it lots of baggage, security vulnerabilities being one of them.
- Rohansi 7mo agoI think there are more text editors around that render clickable links than there are that don't. Even your terminal probably renders clickable links. Despite the scary words and score this wouldn't even be a vulnerability if people weren't so hard wired to click every link they see. It's not some URL parsing gone wrong triggering an RCE. Most likely they allowed something like file:// links which of course opens that file. Totally valid link, but the feature must be neutered to only http(s):// because people.
- hulitu 7mo agoEd doesn't.
- deleted 7mo ago[deleted]
- hulitu 7mo ago> That's why we have text editors, markdown viewers, image viewers, etc. This is so 80s. Now we have systemd (svchost.exe), wayland (explorer) and a webbrowser (chrome). You don't need more.
- titzer 7mo agoIt'd be more hilarious if it weren't so sad. In just 10 years a disturbingly large number of huge development teams decided that making a GUI application using the old ways [1] was too hard and decided to ship an entire web engine (electron) to render 10 buttons. [1] (native GUI widgets? agggh)
- Rohansi 7mo agoWhich 10 buttons?
- FridgeSeal 7mo agoLarge swathes of this industry have an obsession with investing 10x more resources into the wrong thing, than simply fixing the underlying issue.
- JCattheATM 7mo agoThings started going downhill when they added a Bing option to one of the menus, which was only very recently after they added support for *nix newlines. A very mishandled product, but then the whole OS has been mishandled since 10. Some would say 7.
- numpad0 7mo ago> At some point, they need to stop asking "can we add this feature?" and start asking "does this text editor need a network-aware rendering stack?" Everyone has to prove their worth by involving more people in ever embiggening trainwrecks every quarters in this day and age just to maintain employment, and without tangibly threatening anyone else's while at it. That's where the features are coming from. That's what needs to be fixed. Which also goes way beyond engineering.
- lofaszvanitt 7mo agoNow imagine that there are people who want to embed video players and image viewing in the terminal :D.