1008
A remote code execution vulnerability has been found in Microslop Notepad (msrc.microsoft.com)
submitted 8 months ago by to c/technology@lemmy.world
127 comments fedilink hide all child comments
 

They finally did it. Microsoft has successfully over-engineered a text editor into a threat vector.

This CVE is an 8.8 severity RCE in Notepad of all things.

Apparently, the "innovation" of adding markdown support came with the ability of launching unverified protocols that load and execute remote files.

We have reached a point where the simple act of opening a .md file in a native utility can compromise your system.

you are viewing a single comment's thread
view the rest of the comments
[–] 131 points 8 months ago (8 children)

Windows used to come with notepad (raw text) and wordpad (basic markup). It would have made more sense to keep wordpad and add markdown to it instead so there would still be something that is just raw text.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 8 child comments
    •
  • [–] 70 points 8 months ago (7 children)

    I thought the Notepad > Wordpad > MS Word progression was pretty much perfect. A zero complication plaintext editor, something with a bit more formatting, and outright typesetting for print.

    Granted I use a combination of Notepad++, Obsidian, and haphazard LaTeX venvs now so who am I to talk. I don’t represent most Windows users and especially not the Linux daily drivers. I’d like to think there’s still a lot of people in my situation.

    It says a lot that none of the reasons I like Notepad++ were brought into Notepad when they changed it. A copilot button in the place where I write immediate notes and edit batch files? What could possibly be the use case? I just need it to be able to open massive text files and have a decent search UI and that’s it

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 7 child comments
    •
  • [–] 6 points 8 months ago (1 child)

    I’m a huge proponent of LaTeX also, but I feel like it’s not that widely used outside of specific professional niches. The biggest issue I have with Word (and similar software) is the content generation and typesetting being forced into the same interface. It just breaks everything all the time. I’d much happier using word if it only allowed you to type in an Edit mode, and only allowed you to change fonts and layout and stuff in a View mode, and the View mode changes weren’t reflected live in the Edit mode.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 4 points 8 months ago

    I’ve had to use Office a lot professionally and I have to say you do get to learn its quirks over time if you’re stubborn enough to figure out what triggers each unexpected behavior. Ironically learning LaTeX really helped me figure out what’s happening internally in Word in some of those situations, just understanding how the breaks and spaces might be stored gives you a little extra insight.

    AFAIK you can do something similar to what you’re describing in outline mode but I could be completely misremembering.

    All the Office suite is bloated but LibreOffice still feels a long way off.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 8 months ago

    WordPad writes fairly clean rtf. Word writes incredibly bloated messy rtf. No, I don't want to use a .docx or .pdf generating library, I just wanna slap some strings together and have it come out ready to print yet editable by non techy users. I use wordpad to write my templates.

  • permalink
  • fedilink
  • source
  • parent