Remix.run Logo
mjmas 10 hours ago

It is to do with link handling:

https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...

> An attacker could trick a user into clicking a malicious link inside a Markdown file opened in Notepad, causing the application to launch unverified protocols that load and execute remote files.

BLKNSLVR 9 hours ago | parent | next [-]

> It is to do with link handling:

Notepad? Link handling?

That's like my pencil having a CVE that's to do with how it loads the ink. That old saying about 'if Microsoft built a car' is more true now than it was then: https://www.snopes.com/fact-check/car-balk/

DavidPeiffer 4 hours ago | parent | next [-]

I was really hoping this CVE would have been caused by the Copilot integration into Notepad.

Calculator hasn't been infiltrated by Copilot yet, but I'm sure the day is coming.

danudey an hour ago | parent [-]

Hey Calculator, how many R's are there in strawberry?

samspot 3 hours ago | parent | prev | next [-]

It's hard for me to imagine anyone balking at this feature. My core note taking workflow frequently involves:

1. Note about blah 2. Paste link to blah 3. Open that link later when reviewing my notes.

Blah is sometimes a web link, sometimes a link to a doc on my system, and sometimes a link to an item in my todo tracker. The better analogy is this is like a pencil having an eraser built in.

I use Drafts instead of Notepad, but if I used Notepad I would want to be able to easily open links in my notes. When I do find myself in Notepad, it's because I double clicked on a readme file that often contains links to resources I need.

delusional 2 hours ago | parent [-]

But then notepad wouldn't be fetching the content. While I would still prefer notepad to be simple, and just making you copy paste the link, I would expect it to forward a link a browser, or something. I would not expect notepad to go out and fetch random content from the internet.

iso1631 6 hours ago | parent | prev | next [-]

> Oil, water temperature and alternator warning lights would be replaced by a single 'general car default' warning light.

> Occasionally, for no reason, your car would lock you out and refuse to let you in until you simultaneously lifted the door handle, turned the key, and grabbed the radio antenna.

> Every time GM introduced a new model, car buyers would have to learn how to drive all over again because none of the controls would operate in the same manner as the old car.

> You would press the 'start' button to shut off the engine.

If you live long enough, satire eventually becomes reality.

Hackbraten 9 hours ago | parent | prev [-]

Unpopular opinion: rudimentary Markdown support is not entirely far-fetched even for a dumb text editor.

Even though I’m all against feature bloat, I think that making Markdown hyperlinks clickable is still within the Overton window of what a simple editor should be doing.

Someone1234 8 hours ago | parent | next [-]

You cannot claim you're "against feature bloat" while then in the same breath say that it is acceptable that a basic text editor have an entire additional render pipeline.

If you want Markdown use VSCode, it is a first class citizen. Don't take an intentionally stripped down text editor and bolt on VSCode-like features.

titzer 6 hours ago | parent | next [-]

As I posted in a sibling, I thought the whole point of markdown was that it was simplified to the point that rendering it was easy to do from scratch. But we fumbled that because we (collectively) have no idea what we are doing.

thwarted 4 hours ago | parent | next [-]

The whole point of markdown is that it is easily readable and editable and the structure is evident without being rendered. That it doesn't strictly need to be rendered in all or any context is its utility.

wang_li 3 hours ago | parent | prev [-]

>But we fumbled that because we (collectively) have no idea what we are doing.

Because, almost entirely, the software development industry has disclaimed all responsibility. It's super common for people to try to do shit they have no experience or skill at, push their effort to be adopted by others, then when it crashes and burns they have no accountability. If software "engineers" adopted the rigors and accountability and dignity of traditional engineering, the industry would be very different.

joquarky an hour ago | parent [-]

Even traditional engineering is now being coerced by "move fast and break things" management.

It feels like a plague of ignorance and enshittification has silently taken over everything.

apitman an hour ago | parent | prev [-]

How do you know they said it in the same breath?

jerf 6 hours ago | parent | prev | next [-]

The main problem with "Markdown support" in Notepad is that "Markdown support" is an ill-defined phrase. The closest thing to a well-defined definition is to support CommonMark but that is far, far from universal. Microsoft being Microsoft they'd probably still half-ass the job then just declare their new half-ass support a newly embraced-and-extended standard and leave it that way for the next 20 years, so asking Notepad to support Markdown is in practice asking for yet another effing Markdown dialect to come into existence and join the shambling hoard of other dialects.

Markdown is more properly understood as a family of related-but-mutually-incompatible standards, like CSV, and like "supporting CSV" is a lot more complicated than meets the eye. And supporting Markdown is already clearly non-trivial compared to the baseline of Notepad we've come to expect over the past few decades.

titzer 6 hours ago | parent [-]

I might be dumb, but I thought the whole point of markdown was to get rid of all the bells and whistles of styling, having a really simplified and dumb format that only outlines structure. The follow-on being that many tools could parse, transform and render said markdown files in a way that makes sense for them. That way there's lots of tools that don't share code, but a shared definition of the format. I.e. markdown is a format (!?).

The problem is that overall we seem to have fumbled both the concept and the implementation. There a bunch of vaguely similar but incompatible markdowns and apparently rendering them is too hard and people immediately reach for an enormous pile of software (usually a web stack) to render it for them.

It should have been entirely possible for a person to write a markdown parser in a couple hours and e.g. render paragraphs, bulleted lists and tables into a terminal.

jerf 4 hours ago | parent [-]

Goals aren't results. It was a goal for Markdown to be simple and universal. It is not a result.

You may be struggling a bit because you are reading some sort of moralization into the statement, some sort of emotional judgment, but there isn't any. It is clear that there does not exist a function that takes a span of "Markdown text" in and emits an abstract syntax tree that everyone agrees upon [1]. That's a fairly mathematical way of putting it, but even from an engineering point of view, the differences matter. Very quickly. It's not like you need to reach deep into crazy syntax to get to real, concrete disagreements between systems, you can hit problems with something as simple as

    "_hello world _"
between the systems where they will do substantially different things.

There are literally dozens of markdown formats now.

How we got there, why such a thing exists, as interesting as those questions may be none of them change the reality on the ground. There is no universal markdown to be appealed to. The closest is CommonMark, and that explicitly exists precisely because there was no consensus in the first place. If markdown was a format, CommonMark would never have been created.

[1]: Nor does its inverse, which at times is more frustrating to me than this. I have in mind what I want to do and either can't figure out how to do it or it simply can't be done.

titzer an hour ago | parent [-]

The answer, of course, is to design a new, universal markdown format :)

But seriously though, all those weird markdown formats could easily just have their own custom parsers than then translate into the common format--supposing the common format is the union of all their features.

tracker1 4 hours ago | parent | prev | next [-]

Just... no... not notepad.. Notepad should be the single-simplest of text editors, always has been, always should be... it should be "safe" much like "task manager" it should be as simple and bulletproof as any application in Windows are... these are essential tools that should never, ever, ever break.

MS has WordPad... fck around with that to make it support markdown or whatever else beyond rtf you want it to support. For that matter, it's probably that much more appropriate to do so.

Do I typically use Notepad, no.. not really... I actually use the new rust based edit terminal app more than Notepad. That said, I expect notepad to do one thing... edit text files, and to not break doing so. The ONLY* addition that might be acceptable would be a HEX Editor mode, so you can edit any file.

There are maybe 5-7 applications in Windows I expect to never break... task manager, notepad, registry editor, file explorer, command prompt are at the top of that list... these are the golden tools that should never fail, even if everything else does.

Zenul_Abidin 2 hours ago | parent | next [-]

Old notepad is still there, it's just in System32 and you have to disable app execution alias for notepad.exe (apps > advanced app settings > app execution aliases)

alternatex 2 hours ago | parent | prev [-]

WordPad was discontinued.

nottorp 9 hours ago | parent | prev | next [-]

Except notepad was the safe option for editing files and making sure what you see is what gets saved. Not any more?

hulitu 2 hours ago | parent [-]

Not. They want it to be Notepad + Wordpad and, in the future, Wordstar.

PlatoIsADisease 8 hours ago | parent | prev [-]

Maybe I don't understand what markdown support will imply, but doesn't this hide text?

Like, if I have a h2 or url, its going to show as special text rather than the h2 tag?

contextfree 6 hours ago | parent [-]

There's a toggle in the status bar and the View menu that switches between displaying Markdown as formatted vs. plain text

PlatoIsADisease 6 hours ago | parent [-]

Oh that's not so bad.

I mean... other than it creating vulnerability... and maybe is the beginning of the end of notepad as a plain text editor...

graemep 7 hours ago | parent | prev | next [-]

Is this a big deal? is it also not a problem with anything that renders clickable links? Browsers, email clients, whatever.

Is this not a problem with anything that offers a preview of markdown (or HTML, or anything with embedded links)?

laserbeam 6 hours ago | parent [-]

The problem is notepad itself would download and execute bad stuff if you click the evil link. If you would paste that same link in a browser you'd be ok.

And the problem is a notepad app is expected to be dead simple, have few features, and be hard to get wrong while implementing.

graemep 5 hours ago | parent [-]

So Notepad will download and execute itself rather than launch an appropriate application to handle the URL? That was not clear to me.

gcr 7 hours ago | parent | prev | next [-]

What does “unverified protocols” mean? Does Windows have an exe:// url scheme that fetches and runs executable binaries or something?

gruez 7 hours ago | parent [-]

Yes? ShellExecute opens a url if you pass in a url, opens a file if you pass in a path, and runs an .exe if that file is an .exe. Windows also supports SMB paths, so combine that together and you have a RCE

eugenekolo 6 hours ago | parent [-]

But is it running ShellExecute on URIs?

electroly 6 hours ago | parent [-]

I believe it is. Just tested it. You can make the link "C:\windows\system32\cmd.exe" and clicking it will launch the Command Prompt. I noticed you can't make it "C:\windows\system32\cmd.exe /c some-nefarious-thing"; it doesn't like the space. Exploiting may require you to ship both the malicious EXE and the MD, then trick the user into clicking the link inside the MD. But then you could have just tricked them into directly clicking the EXE.

gruez 6 hours ago | parent | next [-]

>Exploiting may require you to ship both the malicious EXE and the MD, then trick the user into clicking the link inside the MD. But then you could have just tricked them into directly clicking the EXE.

1. You can use UNC paths to access remote servers via SMB

2. Even if it's local, it's still more useful than you make it out to be. For instance, suppose you downloaded a .zip file of some github project. The .zip file contains virus.exe buried in some subfolder, and there's a README.md at the root. You open the README.md and see a link (eg. "this project requires [some-other-project](subfolder\virus.exe)". You click on that and virus.exe gets executed.

jkrejcha 3 hours ago | parent | next [-]

> 1. You can use UNC paths to access remote servers via SMB

Relevant article from The Old New Thing: https://devblogs.microsoft.com/oldnewthing/20060509-30/?p=31...

Programs (this is true for most mainstream operating systems) can become network facing without realizing it. I've sometimes found a bunch of Windows programs sometimes tends to assume that I/O completes "instantly" (even if async I/O has been common on Windows for a very long time) and don't have a good UX for cancelling long running I/O operations

electroly 3 hours ago | parent | prev [-]

Definitely; I didn't mean to underplay it. Here's a fun one:

    [Free AI credits](C:\windows\system32\logoff.exe)
It works. This is a real exploit that you could do things with.
thwarted 4 hours ago | parent | prev [-]

What if the space is url encoded %20 ?

Zenul_Abidin 2 hours ago | parent [-]

That wouldn't work because Windows doesn't understand url-encoded sequences.

4 hours ago | parent | prev [-]
[deleted]