8 ms·

A few days ago, Notepad++ got compromised—apparently by a state actor (or a proxy). And now, today, Windows’ built-in Notepad has a fresh CVE. What a life. At

• dgxyz 7mo ago
  Well technically Unixes like Linux are a mountain of legacy and they are fine. Windows is just a mountain of shit.
  • direwolf20 7mo ago
    Unixes like Linux are not immune.
    • dgxyz 7mo ago
      True, as systemd and wayland point out elegantly. But at least there is a modicum of choice there.
      • jamespo 7mo ago
        Ironic in a post about a CVE, as systemd offers more security options for starting services than anything else.
  • nananana9 7mo ago
    "Fine" Why does every Linux distro under the sun try so hard to protect the garbage under /usr/bin/ and /etc/ when literally the only files that matter to me are in /home, which is a free-for-all?
    • dgxyz 7mo ago
      The first point is fairly obvious and the latter point is not true (AppArmor etc)
      • oblio 7mo ago
        Phew, I'm so relieved that now we have the One True Security Solution To Rule Them All, AppArmor. Oh, what do you mean there's also SELinux, Snap, Flatpack, Docker, Podman, ...?
        • StilesCrisis 7mo ago
          He did say "etc"...
          • oblio 7mo ago
            Fairly sure the "etc" came after my comment, in an edit.
            • dgxyz 7mo ago
              No, it didn't. I've only just come back to review it after I posted it and there wasn't a reply.
    • TZubiri 7mo ago
      >Why does every Linux distro under the sun try so hard to protect the garbage under /usr/bin/ and /etc Because a compromised user could infect shared executables and spread the infection. A bit harder to do with etc but for sure possible. The main target would be infecting bash and you are done from the get go. >when literally the only files that matter to me are in /home, which is a free-for-all? The home folder's read write is usually restricted to the user. The only scenario where this isn't the case to my knowledge is Ubuntu where others can read it, but this is just a huge flaw in Ubuntu that almost no other distro has.
      • oblio 7mo ago
        > when literally the only files that matter to me are in /home, which is a free-for-all? > The home folder's read write is usually restricted to the user. Yeah, and that is the point. All user's programs including curl, wget, the web browser, anything else that connects to the network run as the user, and all the user's programs, by default, have access to everything inside ${HOME}. Most people don't really care if /bin gets obliterated, but they do care dearly when /home/joe/photos/annies-2nd-birthday gets wiped.
        • skydhash 7mo ago
          Protecting a user from himself is hard. Protecting user from others is easy. Linux is influenced by unix and a lot of installations are servers. Where most programs run under their own accounts. You can always have two user accounts: oblio and unsafe-oblio anf have a shared folder between the two for transferring files. Or invest into some backup software.
        • dgxyz 7mo ago
          Backups FTW.
        • TZubiri 7mo ago
          Just make another user bro. If you can't even create a user to run a program you distrust, the issue is not that windows doesn't provide sandboxes, it's that you don't use them And no, it's not "a lot of work" it's the bare minimum
    • razighter777 7mo ago
      Linux /home is far from a free for all. flatpak, landlock, selinux, podman, firejail, apparmor, and systemd sandboxing all exist and can and do apply additional restrictions under /home
    • thewebguyd 7mo ago
      Because Linux (and other nixes) have their root in multiuser/time-share systems/servers. Protecting the system* from the users was important, and protecting users from other users equally as important. Protecting the user's $HOME from themselves/user-level programs wasn't as much of a concern, the user was assumed to be responsible enough to manage it themselves.
    • lunar_rover 7mo ago
      Canonical and Red Hat have been modernising things for a long time, albeit slowly. Most funds went into server components. As for the desktop community… Well, it has a severe lack of professionals.
  • est 7mo ago
    > a mountain of legacy and they are fine. telnetd CVE-2026-24061. It's embarrassingly simple exploit but took years to be discovered. > When telnetd invokes /usr/bin/login, it passes the USER value directly. If an attacker sets USER=-f root and connects using telnet -a or --login, the login process interprets -f root as a flag to bypass authentication, granting immediate root shell access.
    • Sohcahtoa82 7mo ago
      Well yeah, but nobody sane still uses telnetd.
• agumonkey 7mo ago
  we still need a mouse icon rce until we reach peak
• TZubiri 7mo ago
  >No real sandboxing, a mountain of legacy… You have: - Windows Sandbox (consumer-level sandbox) - Creating a separate User (User folders are permission locked to their user by default, system binaries cannot be modified without admin access) - HyperV (VM hypervisor) - Edge Browsers Don't get me wrong MSFT quality is dropping steeply, but this is still a strong point. For comparision, on Ubuntu, user folder by default can be read by all users.
  • michaelsshaw 7mo ago
    >Creating a separate User (User folders are permission locked to their user by default, system binaries cannot be modified without admin access) Common practice, and even encouraged by Windows itself, is having the administrator account be the only account. This misuse is a very common thread in Windows systems, and security breaches alike.
    • thewebguyd 7mo ago
      Windows has garbage defaults, but if you read through their documentation on enterprise architecture they definitely do not recommend having admin be the only account. They do in fact encourage separate accounts, multiple level of privileges with login restrictions across different types of machines, etc. Many Linux distros are also guilty of this, disabling the root account by default and having the only user have sudo privileges, just like Windows.
      • michaelsshaw 7mo ago
        Yes, however much more can be done in the user's own directory on Unix systems. Needing sudo raises some eyebrows, whereas most Windows users don't necessarily understand UAC, and almost never think twice about pressing "Yes" on the popups, which are seen more as an annoyance than something critical for safety. Some even completely disable UAC.
    • vel0city 7mo ago
      > Common practice, and even encouraged by Windows itself, is having the administrator account be the only account. This hasn't been true since Vista. Kind of even before that with XP, it really showcased using multiple accounts to home users with a much more stylized user selection screen.
• cookiengineer 7mo ago
  I still use VIM in the terminal. So far, I'm fine, but I assume there's gonna be some inevitable CI/CD compromises sooner or later.
• karel-3d 7mo ago
  Visual Studio Code was not compromised.
  • guidopallemans 7mo ago
    Visual Studio Code is the compromise
  • michaelsshaw 7mo ago
    Neither is Neovim, Sublime Text, Visual Studio, ed, etc... So what? This is still unacceptable
• tristor 7mo ago
  > At this point, what am I supposed to do other than uninstall Windows completely? Uninstall Windows completely 4 years ago when Windows 11 was released heralding in a new era of absolutely insane, self-destructive, unnecessary and unwanted shit? There is no valid excuse for this vulnerability. It's existence is a category error that's only possible because Microsoft has completely jumped the shark. Continuing to use /any/ of their products is a choice to accept pure insanity as a default.
• yoyohello13 7mo ago
  Install vim for Windows. I just use gvim as a notepad replacement. No plugins or anything required.
  • tracker1 7mo ago
    There's also good old edit... ;-) https://github.com/microsoft/edit https://github.com/microsoft/edit Yeah, it's a re-creation of edit, but it's pretty great... also runs outside windows.
• Zenul_Abidin 7mo ago
  It was not compromised a few days ago, that's just when the attack was disclosed. The actual compromise and exploitation happened months ago for several weeks.
• gradientsrneat 7mo ago
  That was a CCP group compromising the Notepad++'s underlying hosting provider; not really much to be done there aside from switching hosting providers. The update validation was also improved, and there's also scoop if you don't trust the built-in updater. Fortunately the attack was narrowly targeted and the IOCs are known.