What about nano? Is it OK to choose a safe middle ground? I mean with ed I could just as well use butterflies.
BTW, notepad++ is popular on Windows. That's the sort of software what gets hijacked.
What about nano? Is it OK to choose a safe middle ground? I mean with ed I could just as well use butterflies.
BTW, notepad++ is popular on Windows. That's the sort of software what gets hijacked.
the only book i own on text editing
eMacs wasn’t compromised!
I f'ing love emacs, but don't get cocky. It's a security disaster.
Well, if you use any packages fetched from the net anyway.
All of our modern infrastructure is.
I was being like 99% facetious and the 1% serious has more to do with how eMacs updates are distributed as compared to Notepad++. To your point, any non-vetted packages would be a huge source of risk, and even vetted packages should be monitored.
vim is all i need and is all i’ll ever need.
Emacs* is bloatware
Vims just bloat on ed
ed is the only answer.
Our true salvation
*being an acronym for "Eight Megabytes And Currently Swapping"
But what if you don't get it?
Ed. /s
(Except actually I guess that could happen)
Upstream infrastructure was compromised. Implying it’s a fault with Notepad++ fault is disingenuous. What OSS maintainer is going to think, “I need to pick a hosting provider that’s not going to get hacked by the Chinese government”? Unless your favorite editor is being hosted on infrastructure hardened against state level hackers, it’s not any better.
Did you not read the part about n++ not changing/rotating credentials? I think there's enough blame to go around.
They also weren’t doing any kind of SSL verification for the download request, nor were they doing any kind of hash verification or signing. The former would have prevented a redirect attack in the first place, and the latter would have prevented downloaded files from being modified or swapped out.
I did not because the only part I actually cared about was the bullshit clickbait title.
editors are bloat, manually flip the bits you want with your HANDS like a REAL programmer
Correct me if I'm wrong, but initial news about it serving malicious updates were false. You never got anything malicious thru updates, neither was the exe file/installer tampered with. The worst they actually did was redirect you to a fake site when pressing download, where the malicious file was distributed. GitHub and signed versions were never affected. What's also interesting is that the attacker selectively redirected people, not all of them. I always installed n++ using Ninite, so I'm in the clear.
The whole thing seems blown out of proportions. The amount of affected people is likely very small.
Visual editor?
all 54 comments