234 pointsby riffraff4 hours ago28 comments
  • Fiveplus2 hours ago
    We have officially reached the logical conclusion of the feature-bloat-to-vulnerability pipeline.

    For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text. An 8.8 CVSS on a utility meant for viewing data is a fundamental failure of the principle of least privilege.

    At some point, they need to stop asking "can we add this feature?" and start asking "does this text editor need a network-aware rendering stack?"

    • weinzierlan hour ago
      "For nearly thirty years, notepad.exe was the gold standard for a "dumb" utility which was a simple, win32-backed buffer for strings that did exactly one thing...display text."

      Well, except that this did not prevent it from having embarrassing bugs. Google "Bush hid the facts" for an example. I'm serious, you won't be disappointed.

      I think complexity is relative. At the time of the "Bush hid the facts" bug, nailing down Unicode and text encodings was still considered rocket science. Now this is a solved problem and we have other battles we fight.

      • nuancebydefault4 minutes ago
        To be honest, the 'bush hid the facts' bug was funny and was not really a vulnerability that could be exploited, unless... you understood Chinese and the alternative text would manage to pursuade you to do something harmful.

        In fact, those were the good days, when a mere affair with your secretary would be enough to jeopardize your career. The pendulum couldn't have swung more since.

      • reyqn35 minutes ago
        Embarrassing bugs are not RCEs. Also the industry should be more mature now, not less. But move fast and break things, I guess...
        • sph24 minutes ago
          We have reached peak software stability, it's all gonna be downhill from here.
      • g947o44 minutes ago
        I am pretty sure it's possible to fix that entire category of bugs without introducing RCE vulnerabilities.
        • LiamPowell15 minutes ago
          The bug here is that links are clickable and the user may have a protocol handler registered which may include a RCE vulnerability. It has nothing to do with anyone remotely accessing notepad or notepad remotely accessing any resources.
      • jama211an hour ago
        Fascinating reading about that bug, thanks for sharing
      • croes30 minutes ago
        > Now this is a solved problem

        Is that so? I ran pretty often in problems with programs having trouble with non-ANSI characters

      • direwolf20an hour ago
        It's not solved, we just don't have to guess the encoding any more because it's always UTF-8.
    • keepamovinan hour ago
      I couldn't agree more. A text editor exposing an attack surface via a network stack is precisely the kind of bloat that makes modern computing ultra-fragile.

      I actually built a "dumb" alternative in Rust last week specifically to escape this. It’s a local-only binary—no network permissions, encrypted at rest, and uses FIPS-compliant bindings (OpenSSL) just to keep the crypto boring and standard.

      It’s inspectable if you want to check the crate: https://github.com/BrowserBox/FIPSPad

      • Muromec38 minutes ago
        What does notepad need openssl for?
        • keepamovin18 minutes ago
          Oh it's an encrypted at rest notepad. The idea was to apply NIST 800-53 and FIPS 140-3 to the smallest possible app where a selection of controls could make sense.

          It only uses OpenSSL-FIPS variant on Linux for the crypt. On Macos and Windows, it uses OS FIPS primitives for it.

        • absynth32 minutes ago
          For the built-in web-browser instance it likely contains by now.
          • daemoncoder11 minutes ago
            Ability to handle email coming soon.
        • nicoburns26 minutes ago
          Looks like it's using it for encryption.
        • w4yai33 minutes ago
          Cryptography I guess
    • cafebabbe2 hours ago
      Question is, did they even realize they added a network-aware rendering stack...
    • TZubiria minute ago
      This has hurt me specifically. Since I work without IDEs, no VIM, no vs code. On linux I use nano, on windows I use Notepad. I like the minimalism and the fact that I have absolute control, and that I can work on any machine without needing to introduce an external install.

      Last couple of years notepad started getting more features, but I'm very practical so I just ignored them, logged out of my account when necessary, opted out of features in settings, whatever.

      But now this moment feels like I must change something, we need a traditional notepad.exe or just copy it from a previous version, I'll try adding NOTEPAD.exe to a thumb drive and having that. But it's a shame that it breaks the purity of "working with what's installed".

    • mr_mitman hour ago
      Unfortunately, code execution in text editors aren't a new thing. Vim had one published in 2019: https://github.com/numirias/security/blob/master/doc/2019-06...

      Another in 2004: https://www.cve.org/CVERecord?id=CVE-2002-1377

      Neither vim nor Notepad are purely for displaying text though.

      • iso163124 minutes ago
        vim is a far larger program than a text editor.

        notepad was always a plain text editor. It had enough problems with unicode and what that means to be "plain text".

    • AnonymousPlanetan hour ago
      I'm not sure if we should use "gold standard" together with the little piece of garbage that notepad.exe was for most of its existence. It has been the bane for anyone who had to do work on locked down Windows servers and had to, e.g., edit files with modern encodings. They fixed some of it in the meantime, but the bitter taste remains.
    • cevingan hour ago
      They should have called it Emacs. Then everybody would have known.
    • consp2 hours ago
      > viewing data is a fundamental failure of the principle of least privilege.

      I read the cwe not cve, was wrong. It's still early in the morning...

      • seritools2 hours ago
        You are mistaken:

        > The malicious code would execute in the security context of the user who opened the Markdown file, giving the attacker the same permissions as that user.

      • mwalser2 hours ago
        > If I read it correctly (but could be mistaken), it runs with setuid root

        I am certain you are mistaken. I couldn't find anything that hints at notepad running with elevated privileges.

        • dijit2 hours ago
          People very often run notepad as administrator (anything launched from administrative powershell instances will run like this).

          In fact, if you enabled developer mode on your computer there's a registry key that gets set to run notepad as admin, it's: `runas /savecred /user:PC-NAME\Administrator “notepad %1”` in HKEY_CLASSES_ROOT-> * -> shell -> runas (new folder) -> (Default)

          And, if I'm not totally mistaken, notepad also has the ability to reopen files as administrator, but I don't remember how to invoke it.

          Regardless, notepad is a very trusted application and is often run as Administrator. Often it's more trusted than any other utility to modify system files.

          • patates2 hours ago
            > And, if I'm not totally mistaken, notepad also has the ability to reopen files as administrator, but I don't remember how to invoke it.

            I think that's a notepad plus plus feature. I had it offer to reopen itself as administrator when editing system files like HOSTS.

    • artemonsteran hour ago
      tell this to level N-1 managers that want to get promoted by the only way of "launching features"
    • hennellan hour ago
      A utility meant for viewing data? I don't think you understand what a text editor is.

      I'd agree that recent features feel a bit unnecessary, but it does need to edit and write files - including system ones (going through however that is authorised). You could sandbox a lot of apps with limited impact, but it would make a text editor really useless. Least privilege principles work best when you don't need many privileges.

      • ntoskrnl_exe40 minutes ago
        I’m not sure I understand what you’re trying to say. You could always edit system files with notepad, that was something that the program always excelled at thanks to its simplicity in both how it looked and behaved. And i fail to see the new features as anything but useless bloat.
    • 2 hours ago
      undefined
  • voidUpdate2 hours ago
    I found a copy of the win98 (I believe) notepad.exe a while back, and it works perfectly on windows 11 (though the "about notepad" dialog shows the windows 11 version for some reason??). I can write text into it, save it, and load text again. What more does notepad need? And it has a very nostalgic font too
    • TonyTrapp2 hours ago
      Win9x Notepad in particular can only load files up to 64KB in size (edit: and supports only ANSI encoding, no Unicode). There were some actually useful additions to it up until Windows 10 or so - for example being able to handle LF (in addition to CRLF) line endings. But yeah, everything added in Windows 11 is just pure bloat.
      • SomeUserName432an hour ago
        I find notepad useful for sanitising clipboard content.

        No bold text, italics, bullet points, invisible html.. Just get the text and can copy it to paste again somewhere else.

        Ala Cmd+Shift+V on Mac

        • xnorswapan hour ago
          You can Ctrl+shift+v to paste plain text in windows.
          • sheiyei32 minutes ago
            In some cases. In others, the application does whatever it wants.
            • UqWBcuFx6NV4r20 minutes ago
              And funnily enough, Office for Mac doesn’t allow you to do this, or at least it didn’t used to. I think I may’ve just noticed that it’s started working.
        • setoptan hour ago
          I somewhat regularly use the almost embarrassing key sequence Ctrl-C Ctrl-L Ctrl-V Ctrl-A Ctrl-X to sanitize text I’ve copied from a browser, using the address field to remove any formatting.
      • literalAardvark34 minutes ago
        Notepad is so slow at loading large files that it crashing quickly is a feature.

        The windows 7-10 versions that could open anything would just get stuck for half an hour when you opened the wrong thing in them, which was rather annoying.

      • pjmlpan hour ago
        The reason being it is a plain text edit component, with a window around it, hence the limitation.
        • zabzonk13 minutes ago
          Yep. Back when I used to teach Windows programming in C commercially, the course exercise was to replicate notepad. It was surprising how many of its features you could implement in a week-long course, especially as many of our clients were no great shakes at C.
    • leduyquang7532 hours ago
      > (though the "about notepad" dialog shows the windows 11 version for some reason??)

      It's because the program just calls a Windows API to display the version dialog of Windows itself.

    • duskdozer2 hours ago
      How do you edit notes using Microsoft Copilot 365 for Notepad Copilot using that version?
      • sheiyei31 minutes ago
        How do you write without being able to read with that version?
    • mdavid6262 hours ago
      I extracted out notepad.exe, calc.exe and mspaint.exe from Windows 7. I use them on Windows 11. They work perfectly.
      • jakub_gan hour ago
        For those of you on macOS who still want to benefit from arguably the best drawing application ever conceived, https://jspaint.app/ is THE way. Use it all the time when editing screenshots.

        Bonus point: that Windows 95 style "error" beep when pasting too large image. Always sends the shiver down the spine and confuses the coworkers around (we're an all-Mac shop).

        • Lex-2008an hour ago
          my favorite "easter egg" hidden behind File -> Exit menu item of jspaint.app... I still remember how it blew my mind the first time I saw it!
          • sheiyei29 minutes ago
            This wet my eyes. The times...
      • dgxyzan hour ago
        Might as well just use Windows 7 if the security surface is this bad on later windows.
      • voidUpdatean hour ago
        I have the mspaint.exe from the same version too :P. It complains about registry stuff on launch but other than that it works fine. There's no spray can in the modern paint!
    • seritools2 hours ago
      you can also just uninstall the "new" notepad, at which point Windows will let you run the old one again (which is still shipped!).

      By using a version that is _that_ old you do lose out on some of the actually useful updates legacy nodepad received, such as LF line ending support.

    • szatkus37 minutes ago
      > What more does notepad need?

      Most of the features that were added in later versions: unicode, tabs, auto-reload, support for large files. CTRL+S is also nice.

    • throwaway198846an hour ago
      I feel vindicated by reverting to the old windows 10 notepad.exe
    • IshKebaban hour ago
      Support for Unix line endings at the very least.
    • cubefox2 hours ago
      It needs far more features apparently. Tons more. That's why Notepad++ is popular. Which also had a severe security vulnerability recently. Which was actively exploited by some state actor like China.
      • leduyquang7532 hours ago
        That recent Notepad++ incident was a supply chain attack, not a vulnerability in the original program.
        • SPICLK22 hours ago
          Strictly, no. But it was a vulnerability in the design of Notepad++, key elements here being the featureset that requires frequent updates and the lack of integrity checks during the upgrade process.

          This has prompted me to move on from Notepad++ - it's sad, because I've used it for many years, but this is too much.

          • IsToman hour ago
            > in the design of Notepad++

            One could argue it's an issue with windows where you can't just pull updates using a package manager/app store.

            • ampersandwhich30 minutes ago
              Recently, I was pleasantly surprised to discover that the Microsoft Store has a built-in CLI with that exact functionality. You just run `store updates` to check for updates to store-managed apps, and you can target specific items with `store update <update-id>`. Of course, there's also winget for non-store applications (`winget upgrade`). I find them pretty handy as I have become quite used to managing my Linux installations with pacman over the past year or so. I discovered the store CLI completely by accident. It's not widely advertised.
            • SPICLK2an hour ago
              I'm not sure who I trust less to handle package integrity, the 3rd party hosting provider that Notepad++ used, or Microsoft.
              • IsToman hour ago
                A little tongue-in-cheek, but it's also an issue with windows, that it's owned by an untrustworthy company.
            • voidUpdatean hour ago
              You can if you use the windows store. It's just that you usually install things outside of that, unlike in linuxes where you generally use the package manager that can handle updates for you
            • RobotToasteran hour ago
              Pretty sure winget does let you do that.
      • conductr2 hours ago
        The OS provided option can be bare bones, stable, secure and just utilitarian. This promotes having people choose their own tools for the features they want and not really expecting much other than reliability from the OS version. They didn’t need to mess with a good thing.

        Ok, tabs, I do like the tabs.

  • mjmas5 minutes ago
    It is to do with link handling:

    https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...

    > An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad, causing the application to launch unverified protocols that load and execute remote files.

  • core102429 minutes ago
    It looks like, after Microsoft discontinued WordPad, they want to implement more features into Notepad. If you want simple plain text editor you have to use msedit[1].

    [1]https://github.com/microsoft/edit

    • phatfish13 minutes ago
      You can still open the real notepad, you just have to turn off a "feature" that makes running notepad.exe open the new notepad. Its called "execution alias" or something like that.
  • reddalo2 hours ago
    I miss when the Notepad was doing what the Notepad is supposed to do: show a text file, plain and simple.
    • Borg32 hours ago
      Haha, yeah.. Im using Notepad2 actually, because for LOOONG time, notepad.exe could not display LF files correctly... and Notepad2 has a bit more features, but still.. clean and lean.
    • tosti2 hours ago
      This was already better when the latest from MS was still called "* XP":

      https://liquidninja.com/metapad/

      • xnorswapan hour ago
        Wow that's a hit of nostalgia, I'd completely forgotten about metapad, but I loved it back in the day.

        And it's hard to believe now, but yes, support for Ctrl+S to save file was a notable feature because notepad itself didn't support that back then.

        • barosl15 minutes ago
          Oh wow, yes I remember now, I used to type `Alt+F` and then `S` immediately because Notepad didn't support `Ctrl+S` back then. Thanks for giving me nostalgia!
      • crummy2 hours ago
        I used to overwrite c:\windows\notepad.exe with Metapad. At some point Windows security made this a pain though!
  • r2vcap2 hours ago
    A few days ago, Notepad++ got compromised—apparently by a state actor (or a proxy). And now, today, Windows’ built-in Notepad has a fresh CVE. What a life.

    At this point, what am I supposed to do other than uninstall Windows completely? No real sandboxing, a mountain of legacy…

    • dgxyzan hour ago
      Well technically Unixes like Linux are a mountain of legacy and they are fine.

      Windows is just a mountain of shit.

      • nananana942 minutes ago
        "Fine"

        Why does every Linux distro under the sun try so hard to protect the garbage under /usr/bin/ and /etc/ when literally the only files that matter to me are in /home, which is a free-for-all?

        • dgxyz35 minutes ago
          The first point is fairly obvious and the latter point is not true (AppArmor etc)
      • direwolf20an hour ago
        Unixes like Linux are not immune.
        • dgxyz37 minutes ago
          True, as systemd and wayland point out elegantly. But at least there is a modicum of choice there.
    • agumonkeyan hour ago
      we still need a mouse icon rce until we reach peak
  • rmunn2 hours ago
    "An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad, causing the application to launch unverified protocols that load and execute remote files."

    I didn't even know Notepad would render Markdown.

    • ddtaylor41 minutes ago
      Torture will continue until morale improves
  • bstsb2 hours ago
    i imagine it’s probably something to do with the massive scope creep recently, especially with AI and the Markdown features - they’ve tried to fit some of WordPad’s rich text features following its removal
  • kuboble2 hours ago
    I used notepad as my default, simple text editor for ages.

    After they added copilot I finally gave up and uninstalled it and switched to a one of the minimalistic clones of the good old notepad.exe

  • feverzsj11 minutes ago
    They could've just implemented it in webview2 with all the AI features they want.
  • netsharc2 hours ago
    > An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad, causing the application to launch unverified protocols that load and execute remote files.

    From https://msrc.microsoft.com/update-guide/vulnerability/CVE-20... (there are many collapsible elements on this page, and they're also just for term definitions, sigh)

    What a fucking terrible page for someone unfamiliar with the site. the "Learn More" links will allow you to learn what the terms "CWE", "CVSS", "Product Status" mean, but not to learn more about this vulnerability...

    Anyway, it's not related to CoPilot, but because Notepad makes links clickable now...

    • fhd225 minutes ago
      > Anyway, it's not related to CoPilot, but because Notepad makes links clickable now...

      True, not related to CoPilot, but if I understand your conclusion right (which I'm not sure about), it's not _just_ that links are clickable now, it's because Notepad actually does something with the links. Otherwise it'd be a browser vulnerability, and Notepad couldn't seriously be blamed.

      • LiamPowell12 minutes ago
        It's in fact the opposite. Browsers show a popup that asks if you really intended to click a link with a non http/https handler, notepad does not.

        The actual RCE here would be in some other application that registers a URL handler. Java used to ship one that was literally designed to run arbitrary code.

  • chrisjj12 minutes ago
    > Product

    > Windows Notepad

    Disambiguation urgently needed.

  • consp2 hours ago
    So what this means is every Windows program is now a cve nightmare (or goldmine, depending on view)?
    • veltas2 hours ago
      Yeah the other day in calc.exe I pressed F7 in programmer mode to change to octal (F5 to F8 select Hex, Dec, Oct, Bin), and instead it asked if I was sure I wanted to enable caret browsing.
      • balazspappan hour ago
        I've found calc's currency converter feature frightening.
      • ddtaylor35 minutes ago
        Oof. That's a special kind of stupid. I get how it happened, but like, they found a way to make calc bad while also bringing an obscure feature in modern browsers I hate with a passion.

        It reminds me of King of the Hill where Hank says "Can't you see you're not making Christianity better and you're only making rock music worse?"

    • a962 hours ago
      Always has been.
  • jfaganel992 hours ago
    Notepad had one job... Seems like bringing markdown features killed it :)
  • idoxer2 hours ago
    We got notepad.exe RCE before GTA 6
  • lpcvoidan hour ago
    8.8 RCE CVE in notepad.exe. Well done microslop
  • repelsteeltje42 minutes ago
    I'm frankly amazed that the majority of new laptops still come with Microsoft Windows.

    To be fair, over the years there have been sincere efforts to re-architect the OS with a security, privacy, reliability for peristent storage, graphics, multi-tasking, multi-user, networking etc. But those efforts never caught up with the speed at which bloat was added.

    At the heart, its design still has remnants that have the naivety of a stand-alone, stateless microcomputer that boots straight off a floppy after BIOS POST.

  • larodian hour ago
    use SublimeText, it is perhaps faster now than the stock Notepad
    • xnorswapan hour ago
      As much as I used to love Sublime, the version switching caught me out which burned me a bit, even if admittedly my v2 key lasted an unreasonable time through the version 3 beta, but I don't want to risk buying a v4 key without a clear roadmap of when they might switch to version 5.
    • outimean hour ago
      I can definitely vouch for this! I've been using it for many years and it's been essentially the same the whole time: fast, lean and working on all operating systems.
    • Krssstan hour ago
      Combined with LSP I find it to be quite a good IDE too. Handles extremely large source trees quite well.
  • dgxyz2 hours ago
    Seems whatever they do they step in shit. They should stop doing stuff.

    They spent the last few years entirely compromising their products rather than improving them.

    • muragekibichoan hour ago
      Exactly my predicament. My laptop reached EOL but I'm struggling to purchase a new one.

      They're all bundled with AI features (I absolutely don't need) and never in my life will I buy a mac for coding. My current laptop is HODL'ing and idk if this enshittification will end soon.

      • dgxyz42 minutes ago
        Yeah it sucks. Got an MBP here which was my refuge from Windows. That's gone to hell too.

        I am moving off onto an old desktop running Debian stable slowly as I don't really need a laptop. This also isolates me from a number of geopolitical and technology creep and lock-in related risks I have identified.

      • ddtaylor39 minutes ago
        Do you have a moment to talk about Linux?
        • w4yai27 minutes ago
          Half of my software don't work on Linux. My job also depends on running PE in a legitimate (read not Wine) environment - and I don't want to spend half of my RAM running VMs.

          What should I do ?

          • dgxyz12 minutes ago
            I had that problem about 20 years ago. I changed the job. I know that's an extreme position but to be tied to a steaming pile of crap is a career risk. I've seen people go down with ships in that way before and it scared me.
      • direwolf20an hour ago
        Install Linux
  • yellow_leadan hour ago
    I'd now like to see a RCE in MS Paint or Calculator, if the exploit finder is reading this.
  • eur0paan hour ago
    Good job!
  • hdgvhicvan hour ago
    So notepad now renders links, then when clicks execute the code on those links (not just loading a website in a browser for example)?
    • ankurdhamaan hour ago
      My assumption here is that if the link is web link it will open that link in web browser but Windows (and other OSes) have custom URL handlers that open whatever app is registered for that URL and that app may have issues that causes it to download and run arbitrary code.
  • __bax2 hours ago
    Just now Notepad integrates very useful copilot assistant... What can go wrong
    • g947o32 minutes ago
      To be fair this has more to do with Markdown than anything else.

      Although I approve of neither feature. notepad should stick with what it does well.

  • DobarDabar2 hours ago
    [dead]
  • j1000an hour ago
    use linux
  • eviks2 hours ago
    What AI great job!
  • dark-star2 hours ago
    Yeah, clicking unverified links in a markdown document to launch an executable....

    Clicking unknown links is always a bad idea, but a CVE for that? I dunno....

    • muvlon2 hours ago
      What other markdown viewers or editors support URL schemes that just execute code? And not in a browser sandbox but in the same security context notepad itself is running in.
    • tosti2 hours ago
      Clicking an unknown link shouldn't result in compromise. Fortunately, MS-Windows disallows running anything not vetted by MS unless you figure out how to bypass the "SmartScreen" filter. This filter is super annoying to many a techie or gamer, but for MS-Windows refusing to run "unknown" programs is a feature, not a bug.

      So yes, MS will likely denounce this as not their problem and move on.

      • yrro2 hours ago
        This is the same company that, back in the day, warned users to not click links in Internet Explorer. A web browser.
        • tostian hour ago
          Funny that since the IE engine was plastered all over the place. Only 98lite could avoid it.
    • bayindirh2 hours ago
      Notepad was the epitome of a single, well functioning app in Windows for the last eternity of two.

      Rewriting it to integrate AI and some bells and whistles recklessly and having a CVE is tragicomic if you ask me.

    • mrweaselan hour ago
      Even if you want to Notepad have clickable links, maybe not allow it to blindly allow every URL scheme known to man. It seems reasonable to limit it to do http/https and MAYBE mailto.
    • xxs2 hours ago
      clicking links should not be a security issue and yes the CVE is totally deserved: that's remote code execution.
  • avaeran hour ago
    You can literally one-shot Opus 4.6 to make a better, faster, safer, more secure notepad.exe than the one that comes with Windows.

    This isn't an AI slop problem.

    • g947o33 minutes ago
      Well, it might be "more secure" in the sense of "no hacker will use it as an attack vector", not necessarily "it is free of security of security bugs".
    • egorfinean hour ago
      Tools are almost never the problem.

      The application of tools is.

      • avaeran hour ago
        I 100% agree. I'm just trying to point out the problem isn't Microsoft AI slopping their software. Even if you slopped it, the software could turn out better than what they're putting out.

        There must be something much worse than slop going on to get to this point.