Comment by mjmas
2 days ago
It is to do with link handling:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...
> An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad, causing the application to launch unverified protocols that load and execute remote files.
> It is to do with link handling:
Notepad? Link handling?
That's like my pencil having a CVE that's to do with how it loads the ink. That old saying about 'if Microsoft built a car' is more true now than it was then: https://www.snopes.com/fact-check/car-balk/
I was really hoping this CVE would have been caused by the Copilot integration into Notepad.
Calculator hasn't been infiltrated by Copilot yet, but I'm sure the day is coming.
Calculator asks you to rate it in the app store...
You're the preinstalled calculator!! You don't have to compete with other apps!!
3 replies →
Hey Calculator, how many R's are there in strawberry?
It's hard for me to imagine anyone balking at this feature. My core note taking workflow frequently involves:
1. Note about blah 2. Paste link to blah 3. Open that link later when reviewing my notes.
Blah is sometimes a web link, sometimes a link to a doc on my system, and sometimes a link to an item in my todo tracker. The better analogy is this is like a pencil having an eraser built in.
I use Drafts instead of Notepad, but if I used Notepad I would want to be able to easily open links in my notes. When I do find myself in Notepad, it's because I double clicked on a readme file that often contains links to resources I need.
Notepad stuck around in Windows for so long, despite Wordpad also being built-in, because Notepad was supposed to be for e.g. editing C:\AUTOEXEC.BAT or C:\Windows\System32\hosts.txt in Safe Mode. It was basically supposed to be the /bin/sh to Wordpad's /bin/bash — the thing that'll save you in maintenance mode when the system is so hosed that nothing more complex will launch.
If your computer was working, there was never really supposed to be a reason to invoke Notepad. Programmers were expected to install IDEs or third-party text-editor software. Microsoft's own READMEs have always been .rtfs ever since Windows 95. And so on. For a little while, you might use it to view system log files? But the Windows NT lineage gave Windows an Event subsystem with its own MMC-based console, so even that didn't require Notepad any more.
It's therefore bizarre that Microsoft have decided to "enhance" Notepad into this pseudo-rich-text thing, while also sunsetting Wordpad; when it seems like what they really wanted was to "enhance" Wordpad to also do what Notepad does, while sunsetting Notepad. (Even with full back-compat, they could have done this by making Notepad.exe a stub that launched Wordpad.exe with flags.)
But then notepad wouldn't be fetching the content. While I would still prefer notepad to be simple, and just making you copy paste the link, I would expect it to forward a link a browser, or something. I would not expect notepad to go out and fetch random content from the internet.
1 reply →
> Oil, water temperature and alternator warning lights would be replaced by a single 'general car default' warning light.
> Occasionally, for no reason, your car would lock you out and refuse to let you in until you simultaneously lifted the door handle, turned the key, and grabbed the radio antenna.
> Every time GM introduced a new model, car buyers would have to learn how to drive all over again because none of the controls would operate in the same manner as the old car.
> You would press the 'start' button to shut off the engine.
If you live long enough, satire eventually becomes reality.
Unpopular opinion: rudimentary Markdown support is not entirely far-fetched even for a dumb text editor.
Even though I’m all against feature bloat, I think that making Markdown hyperlinks clickable is still within the Overton window of what a simple editor should be doing.
You cannot claim you're "against feature bloat" while then in the same breath say that it is acceptable that a basic text editor have an entire additional render pipeline.
If you want Markdown use VSCode, it is a first class citizen. Don't take an intentionally stripped down text editor and bolt on VSCode-like features.
6 replies →
The main problem with "Markdown support" in Notepad is that "Markdown support" is an ill-defined phrase. The closest thing to a well-defined definition is to support CommonMark but that is far, far from universal. Microsoft being Microsoft they'd probably still half-ass the job then just declare their new half-ass support a newly embraced-and-extended standard and leave it that way for the next 20 years, so asking Notepad to support Markdown is in practice asking for yet another effing Markdown dialect to come into existence and join the shambling hoard of other dialects.
Markdown is more properly understood as a family of related-but-mutually-incompatible standards, like CSV, and like "supporting CSV" is a lot more complicated than meets the eye. And supporting Markdown is already clearly non-trivial compared to the baseline of Notepad we've come to expect over the past few decades.
3 replies →
Markdown is readable as plain text, that's kind of the point of it
There's also a pretty large jump between "I can ask the system to open this link in the default browser" and "I have built my own link handling in a memory-unsafe language to support some really fringe features, and oops it's exploitable"
4 replies →
Just... no... not notepad.. Notepad should be the single-simplest of text editors, always has been, always should be... it should be "safe" much like "task manager" it should be as simple and bulletproof as any application in Windows are... these are essential tools that should never, ever, ever break.
MS has WordPad... fck around with that to make it support markdown or whatever else beyond rtf you want it to support. For that matter, it's probably that much more appropriate to do so.
Do I typically use Notepad, no.. not really... I actually use the new rust based edit terminal app more than Notepad. That said, I expect notepad to do one thing... edit text files, and to not break doing so. The ONLY* addition that might be acceptable would be a HEX Editor mode, so you can edit any file.
There are maybe 5-7 applications in Windows I expect to never break... task manager, notepad, registry editor, file explorer, command prompt are at the top of that list... these are the golden tools that should never fail, even if everything else does.
5 replies →
Except notepad was the safe option for editing files and making sure what you see is what gets saved. Not any more?
1 reply →
Maybe I don't understand what markdown support will imply, but doesn't this hide text?
Like, if I have a h2 or url, its going to show as special text rather than the h2 tag?
2 replies →
Is this a big deal? is it also not a problem with anything that renders clickable links? Browsers, email clients, whatever.
Is this not a problem with anything that offers a preview of markdown (or HTML, or anything with embedded links)?
The problem is notepad itself would download and execute bad stuff if you click the evil link. If you would paste that same link in a browser you'd be ok.
And the problem is a notepad app is expected to be dead simple, have few features, and be hard to get wrong while implementing.
So Notepad will download and execute itself rather than launch an appropriate application to handle the URL? That was not clear to me.
It could be. But why is notepad doing anything other than rendering text? I don't expect it to make links clickable, or render markdown.
That was old Notepad. This is new Notepad.
1 reply →
Just imagine all the problems that wouldn't have occurred of email remained text only!
What does “unverified protocols” mean? Does Windows have an exe:// url scheme that fetches and runs executable binaries or something?
Yes? ShellExecute opens a url if you pass in a url, opens a file if you pass in a path, and runs an .exe if that file is an .exe. Windows also supports SMB paths, so combine that together and you have a RCE
But is it running ShellExecute on URIs?
6 replies →