This is a most excellent place for technology news and articles.
An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad, causing the application to launch unverified protocols that load and execute remote files.
"launching unverified protocols" - does that mean the network fetching is done by the Notepad app, and Notepad doesn't open the browser for this..? If so, bloody hell, Microsoft...
As I understood it, there can be specifically crafted links in Markdown documents, which, when clicked, will download a file and then execute it.
RCE means exactly this, the ability to run any code on a remote device (the one running notepad).
It's a parsing issue. I've encountered the same writing an MD parser for a website, not as trivial to solve as it seems. For a multi billion dollar company this is hilariously stupid. Why do I get the feeling someone vibecoded this entire implementation.
'cause they did, mate.
They admitted, IIRC, that they fired a bunch of devs and then used gen-AI to write code. I think I have a comment from last year around this time that this was gonna happen, including data breaches on a massive scale, when companies were openly touting this tactic. It's only getting started.
paint still good, right?
I miss oldskool Notepad being present on the system. Win11 Notepad is a worthless piece of shit.
But ... any computer or vm that I use for more than a few hours gets a copy of Metapad.
I've been using Metapad for ... umm ... decades.
Metapad is a simple, extremely lightweight editor, intended to just barely be better than Notepad, fixes a lot of shit that MS never did and stays simple.
https://liquidninja.com/metapad/
I've been a long time user of Notepad++ after Notepad started inserting random whitespace characters in files, which messed up some jankety scripting I was doing at the time. Do you happen to know if Metapad is good about not adding unintended characters like that?
Yes. Metapad is too dumb for that shit. By design.
It's only barely smart enough to be better than Notepad.
It's not smart enough to do anything dumb.
Its free, extremely mature, and you already know how to use it.
Metapad is a feature-for-feature drop-in replacement for Notepad.
It's not smart enough to do anything dumb.
I love this. Amazing quote
cat index.txt hello world^M
/cr/n seems safe
This is the way now...
